1. DATA CONTROLLER

In accordance with current legislation, including the General Data Protection Regulation 2016/679 (hereinafter, “GDPR”) and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights (“LOPDGDD”), the data subject is informed that the data provided will be processed by RPM Racing S.L.U. (hereinafter, “RPM”) as the Data Controller, whose contact details are as follows:

• VAT Nº: B61514360
• Registered office: Avenida de la Granvia de L’hospitalet, 8 -10 7ª PLANTA, L’hospitalet de Llobregat, 08902 , Barcelona
• E-mail: dpo@rpmsports.es

2. PURPOSE AND DURATION OF THE DATA PROCESSING

When users provide personal data through the registration forms for RPM events/activities on the RPM websites or contact forms, their personal data will be processed for the following purposes:

1. When personal data is provided through the contact form, the purpose is to respond to users’ requests. To this end, your personal data will be kept for the duration of the management of your query, and even afterwards, until the lapse of any liabilities arising from it.
2. When personal data is provided through the subscription to the commercial newsletter of the Website, the purpose is the subscription to the commercial newsletter to keep the User informed about the latest news and events of RPM. Data will be kept until users withdraw their consent.

III. When users provide personal data through registration forms for events/activities organized by RPM, the purpose is to manage and process their participation. To this end, your data will be kept for the duration of the event/activity in which you register and, once the event/activity ends, for the period of limitation of the legal actions that may arise from it.

1. The data provided through surveys issued by RPM will be used to make aggregate data reports, for statistical and analytical purposes in order to improve our services.
2. When users provide their consent and want to participate in a sweepstakes or contest organized by RPM, the purpose is to manage their participation and perform the accounting, tax and administrative management. To this end, your data will be kept for the duration of the sweepstakes or contest in which you enter and, once it is over, for the period of limitation of the legal actions that may arise from it.
3. When the data subject provides personal data through the Covid19 Self Declaration of Responsibility form, the purpose is to manage and process the user’s participation in a secure manner, reducing the risk of contagion and transmission of Covid-19, also complying with the health measures established in the Autonomous Regions in which the events are held. Your data will be kept for the duration of the event/activity in which you register and, once the event/activity is over, for the period of limitation of the legal actions that may arise from it.

VII. Additionally, your data will be used to provide you with personalised information on projects, services, campaigns, and events in which RPM participates or organises, unless otherwise indicated or unless the data subject exercises their right to oppose the sending of such information to the address dpo@rpmsports.es, as well as the preparation of personalised reports on your activity with RPM.

VIII. We also process photographs/pictures for the dissemination of group pictures celebrating sporting events organised by RPM for informative, commercial and advertising purposes. Your image and/or video, with or without sound, will be kept for a maximum period of 20 years until you revoke your consent.

1. IV. If required by the event rules and as long as you do not exercise your right of deletion, we will process your data (your first name, surname, year of birth and gender) in order to show your position in the ranking of participants,according to the event categories.

Unless you indicate otherwise, the above storage periods for personal data will apply and it is your responsibility to keep your personal data up to date.

3. LEGITIMACY OF DATA PROCESSING

The legitimate bases for the processing of your data are as follows:

I.- The execution of the contractual relationship, to manage and process your participation, the payment for the participation in the event if applicable, as well as the fulfilment of legal obligations in some cases.

II.- We process your data to comply with our legal obligations, where required by law, or where necessary to protect our rights.

III.- The RPM’s legitimate interest, in sending surveys and aggregate reports for statistical purposes, as well as personalised information based on the user’s profile, on projects, services, campaigns, events in which RPM participates or organises and on the basis of the exception provided for in Article 21.2 of Law 34/2002 of 11 July, on information society services and electronic commerce (“LSSI”).

Likewise, the use of your data to respond to your requests and provide customer service to users of our services, as well as the capture of images, advertising and promotion of the event through the dissemination of images recorded during the event, constitutes a legitimate interest of RPM.

IV.- Users’ express consent to provide them with information about products and services of our partners and to carry out other activities that require their consent.

V.- In the case of the processing of data provided in the Covid-19 self-declaration of responsibility, the legitimate basis is the public interest as set out in Articles 6. e) and 9. g) of the RGPD.

VI.- In the case of images or your position in the ranking (and data associated with such publication), by registering for the event, you are authorising the use of images as expressly indicated in the event rules, without prejudice to the possibility of revocation of such consent.

4. CATEGORIES OF PERSONAL DATA TO BE PROCESSED

With your consent, RPM may process the following categories of personal data:

• Identification details: name, surname, ID card number
• Contact details: telephone, postal address, e-mail address
• Personal and social characteristics details: date of birth, gender, nationality, hobbies, affiliations.
• Financial and bank details: credit or debit card,
• Data resulting from customised reports on your activity with RPM.
• Health data: Covid-10 symptomatology data, close contact and body temperature,
• Images recorded at the event

Any other personal data that users provide to RPM through the forms established on our website and its subdomains.

5. PERSONAL DATA OF MINORS

RPM informs users that, in order to proceed with the processing of personal data of minors under 14 years of age, the consent of parents, guardians or those who hold parental authority over the minors shall be required.

Therefore, when a minor participates in any race, or in general in any event organised by RPM or its partners, identification details of parents, guardians or those persons holding parental authority will be required for the sole purpose of obtaining the necessary consent. RPM reserves the right to require the official family register or any other document that determines parentage, guardianship or in general parental authority over the minor.

6. PERSONAL DATA OF THIRD PARTIES

When users provide personal data of family members, friends, partners or any other third parties related to the users, they must undertake to inform them of the privacy policy of RPM and in general of the terms set out herein and obtain the consent of those third parties for the processing of their personal data.

7. DATA SECURITY

RPM-MKTG has implemented the necessary technical and organisational measures to guarantee the security of your data and prevent its alteration, loss, processing or unauthorised access, taking into account the current technology available, the nature of the data stored and the risks to which they are exposed.

8. RECIPIENTS OF THE DATA SUBJECT’S DATA

Your personal data may be disclosed to the following entities:

• Partners or organisers of races or any other events in which you participate, solely for the purpose of managing your participation. By way of example, this refers to service providers who provide postal or electronic mailing services, tax and accounting services, services related to the registration and organisation of the event, emergency and medical care services, data enhancement services, timing, filming, photography, fraud prevention or analytical services.
• Professionals who collaborate with the RPM to ensure the proper attention of applicants, as well as the correct provision of the required service.
• Suppliers of RPM required for the proper fulfilment of the legal obligations and/or the purposes indicated above.
• Public Administrations, where required by law.
• The payment gateways: Redsys Servicios de Procesamiento, S.L.
• and PayPal (Europe) S.à r.l.
• In addition to the above, we inform you that, if you participate in sporting events organised by RPM, your name, surname, bib number and photograph may be disseminated through the official website of the event, its social networks, collaborating entities, and the media.
• If you choose the option, we will disclose your race bib number, name, email and phone number so that the event photographer can contact you regarding the photos of the event attended.
• We may also disclose your personal data to our sponsors and marketing partners for them to market their products or services and to measure the effectiveness of their marketing campaigns, promotions and sponsorships or for other marketing purposes, provided that you have consented to this.

You are informed that your data will be transferred to the country where the event will take place. RPM undertakes to comply with the guarantees set out in the RPGD.

10. RIGHTS OF THE DATA SUBJECT

Data subjects have the right to:

• Access their personal data.
• Rectify inaccurate or incomplete data.
• Request the deletion of their data when, among other reasons, the data is no longer necessary for the purposes for which it was collected.
• Oppose or limit the processing of their personal data in the cases provided for in current legislation.
• Request the portability of their data
• Revoke the consent given

As regards the images recorded during the event, we inform you that you may revoke your consent at any time, without affecting the lawfulness of the processing based on the consent prior to its withdrawal. As a consequence, you may request not to appear, you or the minor you represent, in photographs or images of groups celebrating sporting events, in which case those photographs or images in which you appear will not be used, or they will be altered so as to prevent your identification.

The data subject may contact the data protection officer of RPM at the addresses indicated in the first paragraph. Likewise, when the data subjects consider that the exercise of their rights has not been effective, they may file a complaint with the Spanish Data Protection Agency.

Updated May 2023