Privacy

1. Data Controller

The controller within the meaning of the GDPR is:

• Amateursportverein Sport OK Toblach
• Seeweg 16, 39034 Dobbiaco/Toblach (BZ), Italy
• Codice Fiscale: 01483970214
• Email (data protection): info@worldcup-dobbiaco.it

2. Registration data

To run the event we process the data collected in the registration form. This processing is purpose-bound and necessary for performance of the contract as well as for the organisation and safety of the race (Art. 6(1)(b) GDPR).

• Full name
• Tax number (Codice Fiscale)
• Place and date of birth
• Phone number
• Emergency contact (name and phone number)
• Sports-medical certificate (health data – see section 3)

3. Health data – sports-medical certificate

The sports-medical certificate you upload contains health data and therefore a special category of personal data.

Health data are a special category of personal data within the meaning of Art. 9 GDPR. We process your certificate solely on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you give during registration, and to protect vital interests during the race. The data are treated confidentially, stored in a private, access-restricted storage, and kept only for as long as necessary to run the event safely. You may withdraw your consent at any time with effect for the future.

4. Payment data (Stripe)

Payment of the entry fee is processed via Stripe Payments Europe, Ltd. The data required for payment (e.g. card details) are collected and processed directly by Stripe; we do not receive full payment-instrument data. In this respect Stripe acts as an independent controller.

For more information see Stripe’s privacy policy: https://stripe.com/privacy

5. Newsletter and participant communications

We keep two separate mailing lists. They differ in purpose and legal basis:

• Newsletter (optional): If you sign up for our newsletter, we process your email address and name on the basis of your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the unsubscribe link in every email or by contacting us.
• Participant information (no consent required): Once your registration is binding, we add your first name, last name and email address to a separate participant list. We use it exclusively for organisational and safety-related information about the race, such as start times, changes to the course or schedule, and weather and safety notices. This processing is necessary for the performance of the participation contract (Art. 6(1)(b) GDPR); no consent is required for it and none is obtained. These messages contain no advertising.

The two lists are independent of each other: unsubscribing from the newsletter does not stop participant information, which is part of running the race and is sent for as long as your registration is active. Conversely, registering for the race does not constitute consent to the newsletter. Retention periods are those set out in point 7.

For both lists we use Sendinblue SAS (trading as Brevo), 9–17 rue Salneuve, 75017 Paris, France, RCS Paris 498 019 298, as a processor.

6. Technical data and service providers

When you access the website, technically necessary data (e.g. IP address, date/time, requested page) are processed to provide the website securely and reliably (Art. 6(1)(f) GDPR).

• Hosting: Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA – delivery of the website (server location in the EU where available). For any data access from the USA, Vercel relies on the EU-U.S. Data Privacy Framework (DPF).
• Database/storage: Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513 – storage of participant and registration data. The database for this project is hosted in a data centre in Paris (EU, AWS eu-west-3); for any data access outside the EU, Supabase relies on the EU standard contractual clauses.
• Email delivery: Plus Five Five, Inc. (trading as Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA – sending of confirmation and ticket emails. Transfers to the USA are based on the EU-U.S. Data Privacy Framework (DPF).
• Rate limiting/abuse protection: Upstash Inc., USA – processing of IP addresses to limit the number of requests. Processing takes place in a data centre in Frankfurt am Main (EU); in addition, Upstash relies on the EU-U.S. Data Privacy Framework (DPF) for any data access.
• No Google Analytics or comparable tracking tools are used.

7. Retention period

We store personal data only for as long as necessary for the stated purposes or as required by statutory retention obligations. Participant data are kept until three months after the race (period running from 15 May 2027) and then deleted or anonymised. Health data (sports-medical certificates) are kept until three months after the race (period running from 15 May 2027) and then deleted. Payment and accounting-related data are retained for ten years in accordance with Art. 2220 of the Italian Civil Code.

8. Your rights

With regard to your personal data you have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to object (Art. 21 GDPR) – in particular to the publication of photos and videos, see section 10
• Right to data portability (Art. 20 GDPR)
• Right to withdraw a given consent with effect for the future (Art. 7(3) GDPR)

To exercise your rights, contact: info@worldcup-dobbiaco.it

9. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority. In Italy the competent authority is the Garante per la protezione dei dati personali (https://www.garanteprivacy.it).

10. Photos and videos (image rights)

During the event, we and the photographers we commission take photos and videos of the race. We publish these images to document the event and to report on it: on this website (including the gallery and the results), on our social media channels and in our press work. This covers images from the start, the course, the base camp and the award ceremony.

The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). Our interest is to document a publicly accessible sporting event, to report on it and to make it known; obtaining individual consent from every participant, crew member and spectator is not practicable at a race of this size. Set against this is your interest in controlling your own image. We have weighed the two against each other: the images are taken at a public competition in which you take part deliberately, they show you in that sporting context and not in a private or demeaning situation, and they are not linked to your health data, contact details or other sensitive information. On that basis our documentation interest prevails. It expressly does not suffice for prominent promotional use of individual identifiable people – for example as the face of an advertising campaign or a sponsor appearance; for that we ask you for separate consent beforehand.

Right to object (Art. 21 GDPR): You can object at any time to the publication of images in which you are identifiable – without giving reasons and without any disadvantage to your participation. Write to info@worldcup-dobbiaco.it. It helps to include your bib number and, if you have it, the link to the image; you can also object in general terms. Following your objection, we remove the images concerned from our own channels (website, social media) or make you unrecognisable in them, and we record your objection internally so that future publications no longer show you either. We handle your objection without undue delay and at the latest within one month of receipt (Art. 12(3) GDPR); as a rule we implement it within 14 days. For images already passed on to third parties (press, sponsors) or shared by third parties, we request removal but cannot guarantee it.