1. Data controller and categories of processed data
Participation in the Event and the provision of associated services entail the processing of participants’ personal data such as: personal details, transit times and times at control and/or timing points.
The data controller is NEXP srl, with registered office in via V. Veneto 72 – 55100 – Lucca.
2. Purposes and assumptions of the processing
The use of the personal data indicated above is inherent in the sporting and public nature of the Event, in its organisational needs and in offering participants the services provided.
NEXP srl uses and processes the data, also through its technical and service partners and associated companies, for the following purposes: verification of participation requirements; timekeeping services; reporting and documentation of the Event; promotion and commercial exploitation of the Event.
The prerequisites for processing are therefore:
i) provision of services related to the registration of participants in the Event and the smooth running of the Event (for example, in the case of management of the participant’s registration, timekeeping and publication of results);
ii) consent of the data subject (for example, for marketing purposes, as specified below);
iii) pursuit of the legitimate interest of NEXP srl and its business partners (for example, in the case of publication of images and results to document the Event);
iv) fulfilment of legal obligations (for example, in the case of communications due to public authorities);
3. Scope of circulation and dissemination of data
In view of the public nature and purpose of the Event, the participants also acknowledge and accept that the data relating to their image, their times and results, or their position in real time, may be made publicly accessible by being published on the websites of NEXP srl, of the Event’s sponsors and service partners and/or communicated to third parties for the purposes of reporting, documenting and promoting the Event itself, for the provision of specific services related to the Event in compliance with specific legal or regulatory obligations.
4. Consent for the advertising exploitation of the participant’s image
With the specific and free consent of the person concerned, NEXP srl may exploit the footage that includes his/her image for the promotion of the Event and other events organised by NEXP srl. The interested party may revoke such consent at any time by writing to NEXP srl.
5. Processing for marketing purposes
If the participant uses his or her email address to register for the Event, NEXP srl may use this address, without the prior consent of the participant, to send him or her, also through its service partners, communications of a commercial nature relating to its products and services connected to the Event or to other initiatives and events similar to the Event. The interested party may object to the sending of such communications at any time by writing to NEXP srl or by following the specific instructions contained in each communication.
Without prejudice to the above, with the specific and free consent of the data subject, revocable at any time, NEXP srl may, directly or through its service partners
a) use the participants’ contact data (email, address and telephone number) for purposes of commercial information, market research, surveys, direct offers of its own products and services and/or products and services of its service and business partners, through traditional methods (i.e. paper mail, telephone calls with operator, etc.) and automated communication tools (i.e. pre-recorded telephone calls, email, fax, sms, mms, app, etc.);
b) transfer to certain categories of third parties (in particular, the companies sponsoring the Event and other companies that provide products and services related to the organisation of the Event and, more generally, to the world of sporting activities) the contact details of participants (email, address and telephone number) for the purposes of commercial information, market research, surveys, direct offers of their products and services carried out through traditional means (i.e. paper mail, telephone calls through an operator, etc.. ) and automated communication tools (i.e. pre-recorded telephone calls, e-mail, fax, sms, mms, app, etc.). These third parties will act from time to time as autonomous Data Controllers, with the consequent burden of providing the interested party with their own privacy information in accordance with the law.
6. Storage of data and Data Processors
The data of the interested parties will be stored in the computer archives of NEXP srl and protected by appropriate security measures in line with the provisions of article 32 of EU Regulation 2016/679. The data will be kept for the time necessary in relation to the purposes for which they were collected and possibly for a further period of time if data retention is necessary for the protection of a right of NEXP srl or a third party (for example, data related to registration for the Event will be kept for ten years, also in consideration of possible claims by the data subject within the ordinary ten-year limitation period; data relating to the results of the Event shall be kept for as long as there is a current interest in the documentation of the Event itself; contact details for sending commercial communications shall be kept until the person concerned exercises his/her right to object or revokes the consent previously granted; data relating to the image of the participants shall be kept for as long as NEXP srl may legitimately have footage of the Event).
For the purposes of storage and, more generally, processing, NEXP srl may use third parties under its own responsibility; such parties, if the legal requirements are met, will be appointed by NEXP srl as its Data Processors pursuant to art. 28 of EU Regulation 679/2016. In order to know the complete list of the Data Processors appointed from time to time by NEXP srl, the data subject may send a request through the addresses indicated in art. 9) below.
7. Data transfer outside the EU
In the case of international data transfers from the European Economic Area (EEA), where the European Commission has recognised that a country outside the EEA is able to guarantee an adequate level of data protection, the data subject’s data may be transferred on that basis.
For transfers to non-EEA countries whose level of protection has not been recognised by the European Commission, NEXP srl will rely on an exemption applicable to the specific situation or will implement one of the following measures to ensure the protection of your data:
- standard contractual clauses approved by the European Commission; or
- binding corporate rules, where applicable.
To obtain a copy of these measures or details of where they are available, you can send a written request as set out in the next article.
8. Rights of the data subject
At any time, the participant may exercise his or her rights regarding the processing of personal data in accordance with Articles 15-22 of the GDPR 2016/679. These rights include:
A. Access: the data subject may obtain information in relation to the processing of their data and a copy of that data.
B. Rectification: where the data subject considers that their data is inaccurate or incomplete, they may request that such data be amended accordingly.
C. Deletion: the data subject may request deletion of the data if he/she revokes his/her prior consent and there is no other legal basis for processing or in other cases provided for by law.
D. Limitation: in the cases provided for by law (for example, if he disputes the lawfulness of the processing or the accuracy of the data), the data subject may obtain the limitation of the processing of the data without the data being erased.
E. Opposition: the data subject may object to the processing of his/her data if the processing is based on a legitimate interest of NEXP srl for reasons relating to his/her particular situation, unless there are compelling grounds for the interest of NEXP srl to override his/her rights (this is the case, for example, where the processing is necessary for the purposes of defending a right of NEXP srl in court).
F. Revocation of consent: the data subject may revoke the consent previously given for the purposes of processing.
The data subject may, at any time, object to the processing of his or her data for marketing purposes and revoke the consent previously given for this purpose, also by following the procedure and instructions given in the text of each commercial communication.
The participant is aware that his or her opposition (see letter e above) or withdrawal of consent (see no. 4 above) to the use of images of him or her will be effective to the extent that it will be possible to stop the publication of such images by reasonable means and at reasonable cost. Opposition and revocation will not, however, affect the lawfulness of the uses that have taken place in the meantime.
The rights in question may be exercised by sending a written communication to NEXP srl at the following address firstname.lastname@example.org
In accordance with current legislation, in addition to the rights mentioned above, the interested party may also lodge a complaint with the Guarantor for the protection of personal data, Piazza di Monte Citorio n. 121 – 00186, Rome, Fax: (+39) 06.69677.3785, email@example.com