PRIVACY POLICY AND DECLARATION OF CONSENT FOR THE PROCESSING OF PERSONAL DATA PURSUANT TO ART. 13 OF REGULATION (EU) 679/2016 OF 27 APRIL 2016

The current information notice is issued in accordance with Article 13 of EU Regulation 679/2016 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and in compliance with the law on the processing of personal data and the free movement of such data.

More specifically, this report relates to the PolimiRun Kids 2026, organised as part of the PolimiRun Milano 2026.

Data controller
Politecnico di Milano in the person of the Director General delegated by the pro-tempore Rector – contact: dirgen@polimi.it.

Internal data processor
Dr. Chiara Bianca Pesenti, Campus Life Division Manager, Piazza Leonardo da Vinci 32, Milan (MI), tel. +39 02.2399.2428, e-mail: chiara.pesenti@polimi.it 
The data shall be processed by other persons authorised and instructed for this purpose in accordance with current legislation.

Data Protection Officer and contact details
E-mail: privacy@polimi.it- telephone: +39 0223999378.

Purpose of the processing, legal basis, categories of data and retention period
In accordance with European and national legislation (Regulation (EU) 679/2016 of 27 April, henceforth Regulation), we hereby inform you that personal data provided directly by you shall be used for the following purposes:

Table 1

Please note that photographs and videos may be taken of participants during the event. In the case of minors, explicit consent is required from at least one parent or from the person exercising parental responsibility over the minor.

The images and videos produced, including those that are partial and/or modified or adapted, will be processed in full compliance with EU Regulations.

The data may also be processed with the aid of electronic means by specifically authorized persons for the purposes of promoting and communicating the initiative. The images and videos collected will be stored, including in electronic form and on any technological medium, for the purposes and within the limits defined above, and may be published in accordance with Italian Law No. 150/2000 on institutional websites as well as through social network channels (including, but not limited to, Facebook).

The use of images and videos does not entitle participants to any compensation.

This authorization implies the granting of a non-exclusive, worldwide, transferable license with no time limitations for the use of the Materials and includes the rights set out in Articles 12 to 19 of Italian Law No. 633 of April 22, 1941, including, by way of example and not limitation: the right of publication; the right of reproduction in any manner or form; the right of transcription, editing, adaptation, processing, and reduction; the right of communication and distribution to the public, including the rights of projection, transmission, and dissemination, also in summarized and/or reduced form, through any technical means; as well as the right to store copies of the Materials, including in electronic form and on any technological medium currently known or to be developed in the future, for the purposes and within the limits defined above.

In any case, pursuant to the aforementioned law and Article 10 of the Italian Civil Code, any use of images and videos that may prejudice the honor, reputation, or dignity of the person portrayed, filmed, or recorded is strictly prohibited.

Those who do not consent to photo/video recording will be given a symbol, in the form of a sticker, to be applied to the child's shirt on the day of the event.

Nature of the data
The provision of data is optional.
Refusal to provide the data corresponding to Purpose no. 1 in Table 1 will lead to exclusion in registering and participating in the PolimiRun Kids 2026 event.

Processing methods
For the purposes indicated in Table 1, personal data may be processed on paper or on digital media, manually and/or using electronic or in any case automated instruments on the hard drive of the data centre at Politecnico di Milano. Data may also be stored in paper archives for the duration foreseen for the conservation of documents relating to administrative procedures and indefinitely in digital format in view of the obligations of transparency and the correct operation of public administration.

The data acquired for the purposes indicated in Table 1 shall be accessed by duly authorised staff who have received adequate operational instructions, relevant departments and the support staff organising the event.

Categories of recipients
With regard to Purpose 1, the data may be disclosed to service providers, including external providers, engaged by the Data Controller to organise and hold the event.
In particular, the data collected may be disclosed to the following third party recipients, insofar as they are engaged in various capacities in the event for their own purposes within the context of the initiative or similar events:

• Unione Sportiva ACLI;
• Avaibook Sports, for the collection of registrations for the sporting event;
• A&C Consulting S.a.s. as Data Processor ex Art. 28.

Finally, your personal data may also be disclosed to other public administrations, including in anonymous form in the event that such administrations are obliged to process this data for any proceedings within their institutional competence, as well as to all public entities to which, under the relevant conditions, disclosure is legally required under the provisions of European system, laws or regulations, as well as insurance bodies for any accident reports.

Transfer of data to non-EU countries or international organisations
Personal data will be processed by the Data Controller within the European Union.
Should it become necessary for technical and/or operational reasons to use entities located outside the European Union, or should it become necessary to transfer some of the collected data to technical systems and services managed in the Cloud and located outside the European Union, the processing shall be regulated in accordance with Chapter 5 of the Regulation and authorised on the basis of specific decisions by the European Union.
All of the necessary precautions shall therefore be taken to ensure the maximum protection of personal data, basing the transfer on:

1. adequacy decisions of recipient third countries expressed by the European Commission;
2. appropriate safeguards expressed by the receiving third party under Art. 46 of the EU Regulation;
3. the adoption of Binding Corporate Rules (BCRs).

Rights of data subjects
As a data subject, you can ask the Data Controller for the following at any time:

• confirmation of any personal data held concerning you;
• access to your personal data and related information; the rectification of inaccurate data or the completion of incomplete data; the erasure of personal data concerning you (where one of the grounds indicated in Art. 17, paragraph 1 of the Regulation applies and in accordance with paragraph 3 of the same article); the restriction of processing of your personal data (where one of the grounds indicated in Art. 18, paragraph 1 of the Regulation applies); the transformation of data into anonymous form or the objection to the unlawful processing of data, including data for which storage is not necessary with regard to the purposes for which it was collected or subsequently processed.

As a data subject, you also have the right to object in whole or in part:

• for legitimate reasons, to the processing of personal data concerning you, even if pertinent to the purpose of the collection;
• to the processing of personal data concerning you for the purpose of sending advertisements on courses and cultural events at Politecnico di Milano.

These rights can be exercised by contacting privacy@polimi.it.

If you believe that your rights have been violated by the Data Controller and/or a third party, you have the right to lodge a complaint with the Personal Data Protection Authority and/or other supervisory authority pursuant to the Regulation.

By ticking the appropriate boxes on the online registration form for the PolimiRun Kids 2026 event, the data subject expressly gives his/her free and full consent to the processing of his/her data for each of the purposes indicated in the information notice and within the limits to which his/her consent is required by law, as well as to the communication of his/her data to the persons indicated in the information notice.
In the case of minors, the consent shall be expressed by their parents or by their guardian.

The data subject has the right to withdraw consent at any time. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. Consent can be withdrawn as easily as it is granted.