DATA CONTROLLER
In accordance with current legislation, including the General Data Protection Regulation 2016/679 (“GDPR”) and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), the user is informed that the data provided will be processed by RPM Racing S.L.U (“RPM”) as the Data Controller, whose contact details are as follows:
- Data controller: RPM Racing S.L.U
- VAT Nº: B61514360
- Registered office: Av. Diagonal, 477, 16th floor, L’Eixample 08036 Barcelona
- E-mail address: dpo@rpmsports.es
- PURPOSE AND DURATION OF DATA PROCESSING
When users provide personal data (directly or through a legal representative or authorised third party) through the contact or registration forms for the event organised by RPM and other activities included on the webpage, their personal data will be processed for the following purposes:
| Queries: | |
| Purpose: | To attend to orders, requests, enquiries, complaints or suggestions or any type of request made by users through the forms available on the website or emails. |
| Duration: | Your personal data will be kept for the entire duration of the processing of your enquiry, request or complaint, and even afterwards, until the statute of limitations on any liability arising from it expires. |
| Legitimate basis: | The consent given, the performance of our contract, the fulfilment of a legal obligation on our part (in the case of service-related or data protection claims) or the defence of our legitimate interests. |
| Newsletter: | |
| Purpose: | Include you in our database to send you the newsletter when you sign up for it through the form on the Web. RPM will send the newsletter, which will contain information about its products and services, or those of its partners or suppliers, with whom it has promotional agreements. In these cases, third parties will never have access to personal data. |
| Duration: | Your data will be kept until you withdraw your consent by writing to dpo@rpmsports.es or through the “Unsubscribe” section included in the emails you receive from us. |
| Legitimate basis: | The consent given. |
| Event registration and loyalty programmes or activities organised by RPM: | |
| Purpose: | Manage the hired services and process the user’s participation in them, including sending information about the organisation, event, programme or activity the user has registered for. |
| Duration: | Your data will be kept for the duration of our contract, i.e. for the duration of the event/programme/activity for which you register and, once the contractual relationship has ended, until the statute of limitations on any legal action arising from it expires. |
| Legitimate basis: | The performance of our contract and the fulfilment of legal obligations. |
| Surveys: | |
| Purpose: | To report aggregated data for statistical and analytical purposes to improve our services. |
| Duration: | Your data will be kept until the study that prompted the survey is completed. |
| Legitimate basis: | RPM’s legitimate interest. |
| Participation in prize draws or competitions: | |
| Purpose: | Manage your participation and conduct the relevant accounting, fiscal and administrative management, and add participants as new subscribers to commercial communications. |
| Duration: | Your data will be kept for the duration of the prize draw or competition in which you enter and, once it ends, until the statute of limitations on any legal action arising from it expires. |
| Legitimate basis: | The performance of our contract and the fulfilment of legal obligations. |
| Sending information and news: | |
| Purpose: | To provide you with personalised information about services, campaigns, events, programmes, or activities in which you participate or that are organised by RPM. |
| Duration: | Your data will be kept unless otherwise indicated or you exercise your right to oppose the sending of information or the preparation of personalised reports on your activity with RPM, by sending an email to dpo@rpmsports.es or through the “unsubscribe” section included in the emails you receive from us. |
| Legitimate basis: | The legitimate interest of RPM, based on the exception provided for in article 21.2 of Law 34/2002 of 11 July, on information society services and electronic commerce (LSSICE). |
| Images | |
| Purpose: | We process photographs/images for the dissemination of images of the participation in the event or activity organised by RPM. The images and content related to the event may be disseminated for informative, informative, commercial, and advertising purposes. This will include publication on social networks, in the media and the press covering the event. |
| Duration: | The images and/or videos, with or without sound, will be kept unless you exercise your rights to that effect, and while the purposes for which they were collected persist. The data is stored on the social network itself in accordance with its privacy policies. |
| Legitimate basis: | The performance of our contract and your consent. |
| Public ranking | |
| Purpose: | Show your name and surname, kilometres travelled, time invested, route, number of editions in which you have participated, as well as the position you occupy in the ranking of participants in the event, based on any criteria that may govern each event under the relevant participation regulations or terms and conditions. |
| Duration: | Your data will be kept until you withdraw your consent. |
| Legitimate basis: | The consent given. |
| Sponsor information | |
| Purpose: | In case you provide your data to sponsors, they may send you commercial communications about their own products and services. |
| Duration: | Your data will be processed in accordance with the privacy policies of those companies. You may withdraw your consent at any time by contacting us at the addresses indicated in those policies. |
| Legitimate basis: | The consent given. |
| Cookies, pixel and tracking | |
| For more detailed information go to Cookies Policy | |
Depending on the case, providing minimum personal data is an essential requirement to fulfil the purpose for which they are requested; otherwise, it may not be possible to provide the product or service requested. If all the required data is not provided, there is no guarantee that the information and services provided will be completely tailored to your needs.
Thus, you must ensure that the personal data provided to RPM is truthful and you are responsible for communicating any changes.
Unless you indicate otherwise, the above-mentioned storage periods for personal data will apply, and it is therefore your responsibility to keep it up to date. Once the storage period expires, and when data processing is no longer necessary based on the purpose for which it was collected, the data will be deleted with the appropriate security measures to ensure its anonymisation or destruction.
- CATEGORIES OF PERSONAL DATA TO BE PROCESSED
Pursuant to the above, RPM may process the following categories of personal data:
- Identification details: name, surname, DNI (National ID card number)
- Contact details: telephone number, postal address, e-mail address.
- Personal and social details: date of birth, gender, nationality, hobbies, affiliations.
- Financial and bank details: credit or debit card.
- Data resulting from your participation in the RPM event or activity.
- Data resulting from customised reports on your activity with RPM.
- Images taken at the event.
- Geolocation data.
- Photograph provided by the data subject
Also, any other personal data that users provide to RPM through the forms included on our website and its subdomains.
- PERSONAL DATA OF MINORS
In the event that a minor participates in an event organized by RPM for which it is expressly established that children under 14 years of age may register, it will be necessary to provide data identifying the parents, guardians or those who hold parental authority over them for the sole purpose of obtaining the necessary consent. RPM reserves the right to request the family record book or any other document that determines parenthood, guardianship or, in general, parental authority over the minor.
- PERSONAL DATA OF THIRD PARTIES
When users provide personal data of family members, friends, partners or any other third parties related to the user, they must undertake to inform of RPM’s privacy policy and in general of the terms set out herein, and obtain the consent of these third parties for the processing of their personal data.
- DATA SECURITY
RPM guarantees that it has implemented the necessary technical and organisational policies to ensure the security of your data and prevent its alteration, loss, processing or unauthorised access, taking into account the state of technology, the nature of the data stored and the risks to which they are exposed. To guarantee the security and protection of personal data, the following measures, among others, are implemented:
- Ensure the confidentiality, integrity, availability, and continuous resilience of data processing systems, restoring access quickly in case of incidents.
- Perform regular checks on the effectiveness of technical and organisational measures to ensure security.
- Apply pseudonymisation and encryption in cases of sensitive data.
- All systems shall comply with current legislation.
- Risks will be minimised to acceptable levels, balancing security controls with the nature of the information.
- Information security awareness and training programmes will be implemented for all users with access to data.
- Security controls shall be applied in a manner proportionate to the risk and the nature of the data processed.
- All members of RPM shall be responsible for ensuring the security of information.
Furthermore, RPM complies with all provisions of the GDPR and LOPDGDD regulations for the processing of personal data under its responsibility, and specifically with the principles described in Article 5 of the GDPR, whereby they are processed lawfully, fairly and in a transparent manner towards the data subject, and the data is adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed.
- RECIPIENTS OF THE DATA SUBJECT’S DATA
No communication of personal data to third parties is expected to take place, except ─if required for processing purposes─ to our communications service providers with whom RPM has confidentiality and/or data processor contracts required by the privacy regulations in force.
The foregoing is without prejudice to those transfers of personal data that are necessary for the execution of our contract, or in compliance with legal obligations, or when the user expressly consents to the transfer of their data such as event sponsors, or the transfers made for the publishing of images on RPM’s social networks.
- INTERNATIONAL DATA TRANSFERS
In the processing of your data carried out by RPM, we need to hire external services that may involve your data being stored and/or processed by organisations that are established or operate from outside the European Union, which would imply that we carry out international transfers of your data. However, these transfers are conducted under guarantees of security and compliance, as stipulated by current legislation on data protection.
- RIGHTS OF THE DATA SUBJECT
Any person has the right to obtain confirmation as to whether personal data concerning them are processed. In addition, any data subject may request the exercise of the following rights by writing to the postal address at the top of this page:
- Right of access: It allows data subjects to know and obtain information about their personal data undergoing processing.
- Right of rectification or deletion: This right allows for the correction of errors, modification of inaccurate or incomplete data, and to guarantee the accuracy of the information that is the subject of the processing.
- Right of erasure: It allows for the deletion of data that proves to be inadequate or excessive.
- Right of objection: The right of data subjects not to have their personal data processed or to have the processing cease.
- Restriction of processing: This entails the marking of the personal data stored, with the aim of limiting their future processing.
- Data portability: Provision of the data undergoing processing to the data subjects, so that they can provide them to another data controller without hindrance.
- Right not to be subject to automated individual decisions (including profiling): The right not to be subject to decisions based on automated processing which produce effects or significantly affect the data subject.
We inform you that you may revoke the consents given at any time, without affecting the lawfulness of the processing based on the consent prior to its withdrawal.
As regards those images taken during the event or activity, you may request not to appear in group images celebrating sporting events, in which case such images in which you appear will be removed, or the image will be modified to prevent your identification.
The data subject may contact the data protection officer of RPM through the addresses indicated in the first paragraph. Likewise, when the data subjects consider that the exercise of their rights has not been effective, they may file a complaint with the Spanish Data Protection Agency.
- ACCEPTANCE
The acceptance and provision of this document indicates that you understand and accept all the clauses of our privacy policy and therefore authorise the collection and processing of your personal data under these terms. This acceptance is given in each case by activating the “Acceptance” checkbox in our Privacy Policy.
- AMENDMENT
RPM reserves the right to amend this Privacy Policy, according to its own criteria, or due to a legislative, case-law or doctrinal change of the Spanish Data Protection Agency, so users are advised to consult it periodically, although any change will be visibly displayed on the web.
For more information about privacy safeguards, you can contact RPM via the contact details provided at the beginning of this Privacy Policy.
RPM Racing S.L.U. All rights reserved.