POLIMIRUN SPRING 2024 - PRIVACY POLICY PURSUANT TO ARTICLES 13 OF REGULATION (EU) 679/2016 OF 27 APRIL 2016

The following is the privacy policy drafted according to Article 13 of the Regulation (EU) No 679 of 2016 (hereinafter EU Regulation).

The Data Controller indicated below shall collect and process the data provided in the registration form for PolimiRun Spring 2024, as well as any images collected for the purposes described below.

The personal data indicated in the online registration form are required for the conclusion and consequent management of the relationship with the Politecnico di Milano for participation in the sports event.

Data controller
Politecnico di Milano in the person of the Director General delegated by the pro-tempore Rector – contact: dirgen@polimi.it.

Internal data processor
Dr Chiara Bianca Pesenti, Campus Life Division Manager.

The data shall be processed by other persons authorised and instructed for this purpose in compliance with current legislation.

Data Protection Officer and contact details
E-mail: privacy@polimi.it.

Purpose of the processing, legal basis, categories of data and retention period
For the purposes of applying the relevant European and national legislation (Reg. EU 679/2016, henceforth Regulation), we inform you that your personal data shall be used for the following purposes:

During the PolimiRun Spring 2024, images will be acquired in the form of photographs or videos that will be used for the purpose of broadcasting the various moments of the event - on promotional material for the event, on social media and in the press - in exercise of the right to inform.

The images, both photographs and videos, shall be stored in the computer archives of the Politecnico di Milano and/or of the partners participating in the event.

To this end, please refer to the audio/video policy of the Politecnico di Milano events, available at this link https://www.polimi.it/fileadmin/user_upload/priva cy/informative-2-livello/2023/2023_03_06_contenuti_multimediali.pdf.

By accepting the event Regulations, you grant a non-exclusive license to use the Materials, with no limit of duration and for the whole world, transferable to third parties. This includes the rights referred to in Articles 12 to 19 of the Italian Law No 633 of 22 April 1941, including but not limited to: right of publication; right of reproduction in any manner or form; right of transcription, editing, adaptation, processing and reduction; right of disclosure and distribution to the public, including the rights of projection, transmission and dissemination even in summarised and/or abridged version, by any technical means; right to keep a copy of the Materials, also in electronic form and on any known technological support or future invention for the purposes and within the limits defined above.

Pursuant to the aforementioned Article 97 and pursuant to Art. 10 of the Italian Civil Code, any use of the images that could prejudice the honour, reputation or dignity of the person portrayed, filmed or recorded.

During the PolimiRun Spring 2024, the service named ENDUpix will be made available in order to allow the participant to identify and purchase photos of the sports event portraying them. In relation to the aforementioned service, Engagigo S.r.l., the company providing the ENDUpix service, is to be considered the data controller of the particular personal data necessary for the provision of the service. To this end, please refer to the information on the processing of personal data with reference to the ENDUpix service, available at the following link: https://ftp-endu-net.s3.amazonaws.com/pdf/informativa_endupix_2022v2_it.pdf.

Nature of the processing
The provision of the data requested for Purpose 1 in the table is mandatory. Refusal to provide the data shall mean you cannot take part in the sports event.

The provision of the data requested for Purpose 2 in the table is mandatory. Refusal to provide the data shall mean you shall be unable to access the newsletter service envisaged.

Processing methods
The data are processed for the formalization and consequent organizational, administrative, legal and fiscal management of the contractual relationship that results from acceptance of your registration by the Politecnico di Milano.  In addition, the data shall be:

• processed for the purpose of sending you any information you may need to participate in the sports event or other activities that take place as part of the event;
• processed for the purpose of sending newsletters promoting sports events at the Politecnico di Milano, as established for Purpose 2 shown in the table;
• processed electronically and on paper by internal staff, authorized collaborators and external data processors duly appointed by the Politecnico di Milano;
• stored in computerised form or on paper and protected from unlawful or unauthorized access, theft, loss and destruction with adequate security measures;
• shared with partners participating in the event, subject to prior consent, as well as for insurance purposes;
• health data are also processed in the form of the medical certificate of suitability for competitive sporting practice and FIDAL card/Runcard/EPS-Runcard card required, for the purpose of the correct carrying out of the event for competitive athletes; the data will be used only and exclusively for the purpose described.

Categories of recipients
In relation to the purposes indicated, the data may be communicated to public and/or private subjects, or they may be communicated to companies and/or persons who provide services, including external ones, also on behalf of the Data Controller.

Furthermore, your personal data may also be communicated to other public administrations, including anonymously if they have to process the same for any proceedings within their institutional competence as well as to all those public entities to which, in the presence of the relevant conditions, the communication it is compulsorily provided for by provisions of the European legal system, laws or regulations, as well as insurance bodies for any accident practices.

They are responsible pursuant to art. 28 of the EU Regulation:

• Avaibook Sports, for the collection of registrations for the non-competitive sporting event;
• Evodata, for the collection of registrations for the competitive sporting event;
• A&C Consulting company, for the purpose of technical management of the sporting event.

Rights of data subjects
As a data subject, you can ask the Data Controller for the following at any time:

• confirmation of any personal data held concerning you;
• access to your personal data and related information; the correction of inaccurate data or the completion of incomplete data; the cancellation of personal data concerning you (where any of the conditions indicated in Art. 17, paragraph 1 of the Regulation applies and in compliance with the exceptions provided for in paragraph 3 of the same article); the restriction of the processing of your personal data (where one of the conditions indicated in Art. 18, paragraph 1 of the Regulation applies), the transformation into anonymous form or the blocking of data processed in violation of the law, including those that do not need to be kept for the purposes for which the data were collected or subsequently processed;

As a data subject, you also have the right to object in whole or in part:

• for legitimate reasons, to the processing of personal data concerning you, even if pertinent to the purpose of the collection;
• to the processing of personal data concerning you for the purpose of sending advertisements on courses and cultural events at the Politecnico di Milano.

These rights can be exercised by contacting privacy@polimi.it.

If you believe that your rights have been violated by the data controller and/or a third party, you have the right to lodge a complaint with the Personal Data Protection Authority and/or other competent supervisory authority pursuant to the Regulation.