Privacy

1. Data Controller

The controller within the meaning of the GDPR is:

• Amateursportverein Sport OK Toblach
• Seeweg 16, 39034 Dobbiaco/Toblach (BZ), Italy
• Codice Fiscale: 01483970214
• Email (data protection): info@worldcup-dobbiaco.it

2. Registration data

To run the event we process the data collected in the registration form. This processing is purpose-bound and necessary for performance of the contract as well as for the organisation and safety of the race (Art. 6(1)(b) GDPR).

• Full name
• Tax number (Codice Fiscale)
• Place and date of birth
• Phone number
• Emergency contact (name and phone number)
• Sports-medical certificate (health data – see section 3)

Community Run

For registration for the free Community Run we process the data collected in the Community Run form in order to organise the Community Run. The legal basis is your consent, which you give by ticking the box in the form (Art. 6(1)(a) GDPR). The data are stored in our database (Supabase, see section 6); after submitting you receive a confirmation email.

• First name and last name
• Email address
• Interest in the workshop (optional, a non-binding expression of interest only)
• Your consent (ticked box) with the time of registration
• Language of registration (German, Italian or English)
• A technical access key, stored only as a hash

You can withdraw your consent at any time with effect for the future, e.g. by email to info@worldcup-dobbiaco.it. This does not affect the lawfulness of processing carried out before the withdrawal. For the Community Run mailing list see section 5; for retention see section 7.

3. Health data – sports-medical certificate

The sports-medical certificate you upload contains health data and therefore a special category of personal data.

Health data are a special category of personal data within the meaning of Art. 9 GDPR. We process your certificate solely on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you give during registration, and to protect vital interests during the race. The data are treated confidentially, stored in a private, access-restricted storage, and kept only for as long as necessary to run the event safely. You may withdraw your consent at any time with effect for the future.

4. Payment data (Stripe)

Payment of the entry fee is processed via Stripe Payments Europe, Ltd. The data required for payment (e.g. card details) are collected and processed directly by Stripe; we do not receive full payment-instrument data. In this respect Stripe acts as an independent controller.

For more information see Stripe’s privacy policy: https://stripe.com/privacy

5. Newsletter, participant and Community Run communications

We keep three separate mailing lists. They differ in purpose and legal basis:

• Newsletter (optional): If you sign up for our newsletter, we process your email address and name on the basis of your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the unsubscribe link in every email or by contacting us.
• Participant information (no consent required): Once your registration is binding, we add your first name, last name and email address to a separate participant list. We use it exclusively for organisational and safety-related information about the race, such as start times, changes to the course or schedule, and weather and safety notices. This processing is necessary for the performance of the participation contract (Art. 6(1)(b) GDPR); no consent is required for it and none is obtained. These messages contain no advertising.
• Community Run: If you sign up for the Community Run (see section 2), we add your first name, last name and email address to a separate Community Run list. We use it, where needed, to send information about the Community Run, such as the schedule, meeting point or short-notice changes, as part of organising it. The basis is the consent you gave when signing up (Art. 6(1)(a) GDPR), which you can withdraw at any time. These messages contain no advertising, and the list is not a newsletter.

The three lists are independent of each other: unsubscribing from the newsletter does not stop participant information, which is part of running the race and is sent for as long as your registration is active. Conversely, registering for the race does not constitute consent to the newsletter. Likewise, signing up for the Community Run constitutes neither consent to the newsletter nor registration for the race. Retention periods are those set out in point 7.

For all three lists we use Sendinblue SAS (trading as Brevo), 9–17 rue Salneuve, 75017 Paris, France, RCS Paris 498 019 298, as a processor.

6. Technical data and service providers

When you access the website, technically necessary data (e.g. IP address, date/time, requested page) are processed to provide the website securely and reliably (Art. 6(1)(f) GDPR).

• Hosting: Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA – delivery of the website (server location in the EU where available). For any data access from the USA, Vercel relies on the EU-U.S. Data Privacy Framework (DPF).
• Database/storage: Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513 – storage of participant and registration data, including Community Run sign-ups. The database for this project is hosted in a data centre in Paris (EU, AWS eu-west-3); for any data access outside the EU, Supabase relies on the EU standard contractual clauses.
• Email delivery: Plus Five Five, Inc. (trading as Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA – sending of confirmation and ticket emails and of the Community Run sign-up confirmation, and delivery to us of messages sent via the contact form. Transfers to the USA are based on the EU-U.S. Data Privacy Framework (DPF).
• Rate limiting/abuse protection: Upstash Inc., USA – processing of IP addresses to limit the number of requests. Processing takes place in a data centre in Frankfurt am Main (EU); in addition, Upstash relies on the EU-U.S. Data Privacy Framework (DPF) for any data access.
• Audience measurement: Vercel Web Analytics (provider: Vercel Inc., address see above, acting as processor) – data-minimising, aggregated statistics on page views (e.g. page visited, referring page, country/region, device type, browser and operating system). Only the path of the visited page’s address is transmitted; parameters (the part after “?”, e.g. personal access links) and page anchors are removed before sending. No cookies are set and no data is stored in your browser; visits are distinguished only by a hash generated from the request, which is discarded after 24 hours. The audience measurement is only loaded if you consent to “Statistics” in the cookie notice; the legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future via “Cookie settings” at the bottom of the website. Further information: https://vercel.com/docs/analytics/privacy-policy and https://vercel.com/legal/privacy-policy.
• No Google Analytics and no advertising or marketing trackers are used.

Contact form: If you write to us via the contact form, we process your name, your email address and your message. They are delivered by our email service provider Resend (see above) as an email to the organising team’s mailbox; we do not store them in our database. The purpose is to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns a registration or participation, otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We keep your message for as long as is necessary to deal with your enquiry.

Cookies, consent and Google Maps

We only use strictly necessary cookies and storage to the extent required to operate the website – in particular the “dll_consent” cookie, which stores your choice in the cookie notice for 6 months (Art. 6(1)(f) GDPR; proof of consent pursuant to Art. 7(1) GDPR).

On the contact page you can load a map from Google Maps (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The map is only loaded once you consent (Art. 6(1)(a) GDPR). Your IP address and information about your browser, among other data, are then transferred to Google, possibly also to the USA; for such transfers Google relies on the EU-U.S. Data Privacy Framework (DPF). Google may use cookies or similar technologies. You can withdraw your consent at any time with effect for the future via “Cookie settings” at the bottom of the website. Google’s privacy policy: https://policies.google.com/privacy

All cookies and storage technologies in use, with their purpose and retention period, are listed in our cookie policy: https://www.dolomiteslastloop.com/en/cookie-policy

7. Retention period

We store personal data only for as long as necessary for the stated purposes or as required by statutory retention obligations. Participant data are kept until three months after the race (period running from 15 May 2027) and then deleted or anonymised. Health data (sports-medical certificates) are kept until three months after the race (period running from 15 May 2027) and then deleted. Community Run registration data (in our database and in the Community Run list at Brevo) are kept until six months after the Community Run (period running from 24 April 2027) and then deleted. Payment and accounting-related data are retained for ten years in accordance with Art. 2220 of the Italian Civil Code.

8. Your rights

With regard to your personal data you have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to object (Art. 21 GDPR) – in particular to the publication of photos and videos, see section 10
• Right to data portability (Art. 20 GDPR)
• Right to withdraw a given consent with effect for the future (Art. 7(3) GDPR)

To exercise your rights, contact: info@worldcup-dobbiaco.it

9. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority. In Italy the competent authority is the Garante per la protezione dei dati personali (https://www.garanteprivacy.it).

10. Photos and videos (image rights)

During the event, we and the photographers we commission take photos and videos of the race. We publish these images to document the event and to report on it: on this website (including the gallery and the results), on our social media channels and in our press work. This covers images from the start, the course, the base camp and the award ceremony.

The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). Our interest is to document a publicly accessible sporting event, to report on it and to make it known; obtaining individual consent from every participant, crew member and spectator is not practicable at a race of this size. Set against this is your interest in controlling your own image. We have weighed the two against each other: the images are taken at a public competition in which you take part deliberately, they show you in that sporting context and not in a private or demeaning situation, and they are not linked to your health data, contact details or other sensitive information. On that basis our documentation interest prevails. It expressly does not suffice for prominent promotional use of individual identifiable people – for example as the face of an advertising campaign or a sponsor appearance; for that we ask you for separate consent beforehand.

Right to object (Art. 21 GDPR): You can object at any time to the publication of images in which you are identifiable – without giving reasons and without any disadvantage to your participation. Write to info@worldcup-dobbiaco.it. It helps to include your bib number and, if you have it, the link to the image; you can also object in general terms. Following your objection, we remove the images concerned from our own channels (website, social media) or make you unrecognisable in them, and we record your objection internally so that future publications no longer show you either. We handle your objection without undue delay and at the latest within one month of receipt (Art. 12(3) GDPR); as a rule we implement it within 14 days. For images already passed on to third parties (press, sponsors) or shared by third parties, we request removal but cannot guarantee it.