1. Data Controller and Categories of Personal Data Processed

Participation in the Event and the provision of related services involve the processing of participants' personal data, including: personal identification details and membership of sports clubs/organisations; images captured through video recordings and photographs; times and timestamps recorded at checkpoints and/or timing points; geographical location data relating to participants who use a device to track their geographical position and the services associated with it; and data and copies of certificates of medical fitness for sports activities.

Data relating to the participant's health may also be processed (i.e. information about medical conditions disclosed in medical certificates or directly by the participant), where strictly necessary for registration and participation in the Event (for example, for registration in a special race category reserved for athletes with disabilities and/or for requesting specific assistance), and only with the participant's explicit consent. In such cases, the participant's consent is required for participation in the Event, and failure to provide such consent will prevent completion of the registration.

The Organiser acts as the Data Controller.

2. Purposes and Legal Bases for Processing

The use of the personal data listed above is inherent to the sporting and public nature of the Event, its organisational requirements and the provision of the services offered to participants.

The Organiser uses and processes personal data, including through its technical and service partners and affiliated companies, for the following purposes: verifying participation requirements; providing timing and tracking services; providing medical assistance services; supplying photographic and video services for the media and participants (including paid services); communicating information to sports and public authorities; reporting on and documenting the Event; and promoting and commercially exploiting the Event.

The legal bases for processing are therefore as follows:

(i) The provision of services connected with participants' registration for the Event and its proper organisation and running (for example, managing participant registrations, recording times and publishing results, or making photographs and videos of the Event available to participants);

(ii) The participant's consent (for example, when processing health-related data or for marketing purposes, as specified below);

(iii) The pursuit of the legitimate interests of the Organiser and its commercial partners (for example, publishing images and results to document the Event);

(iv) Compliance with legal obligations (for example, communications required by public authorities);

(v) Protection of the vital interests of the participant or another person (for example, where medical assistance services become necessary during the Event).

The Organiser draws all participants' attention to the fact that video recordings and photographs of participants will be taken during the Event, both while they are moving and in posed situations.

On the basis of the legal grounds described above (in particular, points (i) and (iii)), the Organiser may use these images or allow the Event's sponsors and technical and service partners to use them for the following purposes:

a) Reporting on and documenting the Event;

b) Commercialising photographic and video services relating to the Event, including offering photographs and videos, free of charge or for a fee, to all participants and persons authorised by them, for exclusively private use.

Authorisation for images of participants to be captured in the context of the Event is a necessary requirement for participation, insofar as the organisation and running of the Event, as described in the Regulations, include video and photographic coverage for documentation purposes and the subsequent offer of services enabling all participants to purchase photographs and videos of the Event.

Therefore, failure to authorise the use of one's image for the above-mentioned purposes, as required in the Image Release Form, will make registration for the Event impossible.

3. Scope of Data Sharing and Disclosure

The Organiser informs participants that the Event is also organised and managed through the services of technical and commercial partners, with the support of sponsors.

The services provided by these partners may include registration services, tracking services, timing services, photographic and video recording services, verification and validation of participation requirements, and other services as necessary.

Some of these services may require or involve the participant registering on the partner's platform or, in any case, the partner processing personal data in its capacity as an independent Data Controller. In such cases, participants are invited to carefully read the privacy policy provided by the relevant partner.

Participants may request the current list of partners and sponsors at any time by contacting the Organiser.

Given the public nature and purpose of the Event, participants also acknowledge and accept that data relating to their image, times and results, or their real-time location, where specific tracking services are active, may be made publicly accessible through publication on the websites of the Organiser, the Event's sponsors and service partners, and/or communicated to third parties for the purposes of reporting on, documenting and promoting the Event itself, providing specific services connected with the Event, such as the sale of video and photographic services, complying with specific legal or regulatory obligations, and protecting participants' vital interests (for example, by communicating information to the competent authorities and emergency personnel for rescue operations and/or the provision of medical assistance services during the Event).

4. Consent for the Advertising Use of Participants' Images

With the specific and freely given consent of the participant, the Organiser may use recordings featuring their image to promote the Event and other events organised by the Organiser.

Participants may withdraw this consent at any time by contacting the Organiser.

5. Processing for Marketing Purposes

Where participants provide their email address for registration for the Event, the Organiser may use that address, without obtaining the participant's prior consent, to send them, including through its service partners, commercial communications relating to its own products and services connected with the Event or otherwise relating to other initiatives and events similar to the Event.

Participants may object to receiving such communications at any time by contacting the Organiser or by following the specific instructions included in each communication.

Without prejudice to the above, with the participant's specific and freely given consent, which may be withdrawn at any time, the Organiser may, either directly or through its service partners:

a) Use participants' contact details (email address, postal address and telephone number) for commercial information, market research, surveys and direct offers relating to its own products and services and/or those of its service and commercial partners. Such communications may be sent through traditional methods (i.e. postal mail, telephone calls with an operator, etc.) and automated communication tools (i.e. pre-recorded telephone calls, emails, faxes, SMS, MMS, apps, etc.);

b) Transfer participants' contact details (email address, postal address and telephone number) to specific categories of third parties (in particular, companies sponsoring the Event and other companies providing products and services related to the organisation of the Event and, more generally, the world of sporting activities) for commercial information, market research, surveys and direct offers of their own products and services. Such communications may be sent through traditional methods (i.e. postal mail, telephone calls with an operator, etc.) and automated communication tools (i.e. pre-recorded telephone calls, emails, faxes, SMS, MMS, apps, etc.).

These third parties will act as independent Data Controllers on a case-by-case basis and will therefore be responsible for providing participants with their own privacy policies in accordance with applicable law.

6. Data Retention and Data Processors

Participants' personal data will be stored in the Organiser's electronic records and protected through appropriate security measures in accordance with Article 32 of EU Regulation 2016/679.

Data will be retained for as long as necessary in relation to the purposes for which it was collected and, where applicable, for an additional period if retention is necessary to protect a legal right of the Organiser or a third party.

For example:

• Data relating to registration for the Event will be retained for ten years, also taking into account potential claims by participants within the ordinary ten-year limitation period.
• Data relating to the Event's results will be retained for as long as there remains a current interest in documenting the Event.
• Contact details used to send commercial communications will be retained until the participant exercises their right to object or withdraws their previously granted consent.
• Participants' image data will be retained for as long as the Organiser is legally entitled to use the recordings of the Event.

For storage and, more generally, for the processing of personal data, the Organiser may engage third parties under its responsibility. Where the legal requirements are met, these parties will be appointed by the Organiser as Data Processors pursuant to Article 28 of EU Regulation 2016/679.

Participants may request the complete list of Data Processors appointed by the Organiser at any given time using the contact details provided in Article 9 below.

7. Transfer of Data Outside the EU

In the event of international transfers of personal data from the European Economic Area (EEA), where the European Commission has recognised that a country outside the EEA provides an adequate level of data protection, participants' personal data may be transferred on that basis.

For transfers to countries outside the EEA whose level of data protection has not been recognised as adequate by the European Commission, the Organiser will rely on an applicable derogation for the specific situation or implement one of the following safeguards to ensure the protection of participants' data:

• Standard Contractual Clauses approved by the European Commission; or
• Binding Corporate Rules, where applicable.

To obtain a copy of these safeguards or further information on where they are available, participants may submit a written request as indicated in the following article.

8. Minors

Registration of minors for Events is permitted only by persons exercising parental or legal responsibility over the minor, or by persons who have obtained the necessary prior authorisation from them.

When registering a minor, the persons exercising parental or legal responsibility – or another person expressly authorised by them for this purpose – must, on behalf of the minor, authorise the photographic and video recording of the minor during the Event for the purposes described in this Privacy Policy and in the Image Release Form, and provide consent, where necessary, for the processing of the minor's health-related data.

Persons exercising parental or legal responsibility over the minor may exercise the rights specified in Article 9 below with regard to the minor's personal data.

The Organiser does not process minors' personal data for marketing purposes or for the direct offering of products and services.

However, the Organiser may process the personal data of the person exercising parental or legal responsibility over the minor for marketing purposes or the direct offering of products and services, subject to the conditions set out in the preceding Article 5.

9. Data Subject Rights

Participants may exercise their rights regarding the processing of their personal data at any time pursuant to Articles 15–22 of GDPR 2016/679. These rights include:

a) Right of Access: Participants may obtain information about the processing of their personal data and request a copy of such data.

b) Right to Rectification: Where participants consider their personal data to be inaccurate or incomplete, they may request that such data be amended accordingly.

c) Right to Erasure: Participants may request the deletion of their personal data if they withdraw their previous consent and there is no other legal basis for processing, or in other cases provided for by law.

d) Right to Restriction of Processing: In the cases provided for by law (for example, where the participant disputes the lawfulness of the processing or the accuracy of the data), participants may obtain restriction of the processing of their personal data without the data being deleted.

e) Right to Object: Participants may object to the processing of their personal data where the processing is based on the Organiser's legitimate interests, on grounds relating to their particular situation, unless there are compelling legitimate grounds for the Organiser's interests to override their rights (for example, where processing is necessary for the Organiser to defend a legal claim).

f) Right to Withdraw Consent: Participants may withdraw any consent previously given for the processing of their personal data.

Participants may object to the processing of their personal data for marketing purposes and withdraw any consent previously given for such purposes at any time, including by following the procedures and instructions provided in each commercial communication.

Participants acknowledge that their objection (as referred to in point e) above), or the withdrawal of consent (as referred to in the previous Article 4) or of authorisation (as referred to in the Image Release Form) for the use of images featuring them, will take effect only to the extent that the publication of such images can be stopped using reasonable means and at reasonable cost.

In any event, such objection or withdrawal will not affect the lawfulness of any use of the images that has already taken place.

These rights may be exercised by sending a written communication to the Organiser.

In accordance with applicable legislation, in addition to the rights listed above, participants also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali):

Piazza di Monte Citorio n. 121
00186 Rome, Italy
Fax: (+39) 06.69677.3785
Email: [email protected]