EN
Srpski English

INFORMATION ON THE COLLECTION AND PROCESSING OF PERSONAL DATA (PRIVACY POLICY)

INTRODUCTORY PROVISIONS

As part of the European Running Championships, to be held in Belgrade on 17–18 April 2027, we will organize a Marathon, Half Marathon, and 10K Race, open to all interested runners (“mass participants”), including members of relay teams (“Teams”), as well as participants registering as part of companies and other organizations (“Groups”) (hereinafter referred to as the “Event”).

The Belgrade Marathon recognizes and understands that your privacy is of great importance to you. Therefore, we take the protection of your personal data very seriously. By creating this Privacy Policy, we aim to ensure that the processing of your personal data is transparent and easy to understand. Accordingly, this Privacy Policy, together with our Terms and Conditions and Cookie Policy, contains information relating to, or that may relate to, you.

In this Privacy Policy, we explain how, in our capacity as Joint Controllers, we collect, process, and use your personal data both during the registration process for the Event through the registration platform available on the European Running Championships njuko, and in connection with your participation in the Event, including the organization and management of the Event. We also explain how you may exercise your rights as a data subject.

The Website may contain links to third-party websites. For more information about how your personal data is processed on those websites, please refer to their respective privacy policies.

This Privacy Policy has been prepared in accordance with the provisions of the Law on Personal Data Protection.Official Gazette of the Republic of Serbia, No. 87/2018. (“Law”).

HANDLER

The personal data collected in connection with the Event are jointly processed by the following two entities (hereinafter collectively referred to as the “Joint Controllers” or “we”):

(1) BEOGRADSKI MARATON PROIZVODNJA, MARKETING I ORGANIZACIJA SPORTSKIH PRIREDBI DOO BEOGRAD, with its registered office at Dr Ive Popovića Đanija 3a, Belgrade (Savski Venac), Republic of Serbia, company registration number 06303773 (hereinafter: the “Belgrade Marathon”); and

(2) European Athletics (EA), Avenue Louis-Ruchonnet 16, CH-1003 Lausanne, Switzerland (hereinafter referred to as “EA”), the rights holder of the European Running Championships 2027.

A controller is a natural or legal person who determines the purposes and means of the processing of personal data. Where two or more controllers jointly determine the purposes and means of processing, they are regarded as Joint Controllers. The Belgrade Marathon and EA jointly determine the purposes and means of processing your personal data in connection with the Event and, accordingly, act as Joint Controllers within the meaning of the applicable personal data protection laws.

The Belgrade Marathon and EA have entered into a Data Sharing Agreement governing the allocation of responsibilities between them with respect to the protection of personal data. A summary of the essential provisions of this Agreement is available upon request by contacting the Data Protection Officer identified below. You may exercise your rights, as described in the section “Your Rights”, directly against either of the Joint Controllers.

PERSONAL DATA PROTECTION OFFICER

The Data Protection Officer of the Controller is:
Sanja Kovačević
Telephone: +381 11 369 0709
Email: sanja.kovacevic@bgdmarathon.org

PROCESSOR

The registration platform, njuko.com, used for the Event is operated by Njuko SAS, 65 Avenue de Bayonne, Espace Agoretta, 64210 Bidart, France (hereinafter referred to as “Njuko”), acting as a data processor on behalf of the Belgrade Marathon pursuant to a Data Processing Agreement concluded between the Belgrade Marathon and Njuko. Njuko processes participants’ registration data solely in accordance with the instructions of the Belgrade Marathon and only for the purposes set out in this Privacy Policy. Njuko does not use the personal data it processes on behalf of the Belgrade Marathon for its own purposes.

PERSONAL INFORMATION WE COLLECT

Personal data is any data relating to a natural person whose identity is determined or determinable, directly or indirectly, in particular on the basis of an identity marker, such as name and identification number, location data, identifiers in electronic communication networks or one, i.e. more features of his physical, physiological, genetic, mental, economic, cultural and social identity.

The Belgrade Marathon collects, processes, stores, and transfers various types of your personal data, which we have grouped as follows:

“Identity Data” includes first name, last name, username or similar identifier, gender, date of birth, address, nationality, photographs, and video recordings.

“Contact Data” includes your email address, telephone number(s), and emergency contact information.

“Transaction Data” includes details of payments you have made to us.

“Profile Data” includes your registration for participation in the Race, T-shirt size, expected finish time, bib number, map location, split times and official finish time during live race tracking, performance, results, and finish time at the Event.

“Marketing Data” includes your choices and preferences regarding receiving marketing communications from us and from third parties.

“Technical Data” includes your Internet Protocol (IP) address, browser type and version, and other information and technologies relating to the devices you use to access the Website.

HOW WE COLLECT YOUR PERSONAL DATA

We use a variety of methods to collect data from and about you, including:

Direct interaction . You provide Identity Data, Contact Data, and other data specified in the previous section when registering for the Event through the Website.

Automated Technologies or Interactions . As you interact with the Website, we may automatically collect technical data about your equipment, browsing actions and behavioral patterns. We collect this personal data using cookies, server logs and other similar technologies. Please see our Cookie Policy for more details.

Organization and Management of the Event. We collect and process your personal data, either directly or through our partners and data processors, in connection with your participation in the Event (e.g. allocation of a race bib number, photographs and video recordings taken during the race, live race tracking (map position and split and finish times), timekeeping, recording of results and rankings, and publication of results).

Third Parties. We may receive your personal data from various third parties. In such cases, information regarding the processing of your personal data is provided in this Privacy Policy or, where required by law, the relevant information concerning the processing of your personal data will be provided to you within a reasonable period of time.

HOW WE USE YOUR PERSONAL DATA (LEGAL BASES AND PURPOSES OF PROCESSING)

We will use your personal data only when and in the manner permitted by law. We will most commonly use your personal data in accordance with the following legal bases: a) when we need to perform a contract that we are about to conclude or have already concluded with you, b) where it is necessary for our legitimate interests (or those of a third party), provided that your interests and fundamental rights and freedoms do not override those interests; c) when we have received your valid consent to process personal data, d) when we need to fulfill a legal or other legal obligation.

We collect and use your personal data for the performance of a contract with you (Article 12(1)(2) of the Law), in particular in connection with:

In addition, we collect and use your personal data for the purposes of pursuing our legitimate interests or the legitimate interests of our partners (Article 12(1)(6) of the Law), in particular in connection with:

We also collect and use your personal data on the basis of your consent (Article 12(1)(1) of the Law), in particular for the following purposes:

To register for the Event through the Website (i.e. to enter into a contractual relationship with us), you are required to provide the data requested for this purpose, as well as any other data that must be collected in accordance with applicable laws and regulations. If you do not provide such personal data, you will not be able to successfully complete your registration for the Event.
You are not required to provide consent for the processing of data that is not necessary for the establishment and performance of the contractual relationship with us, nor required by applicable law, but is instead collected on the basis of your consent (where applicable).
In any event, if you have any questions, including whether the collection of certain personal data constitutes a legal or contractual requirement or is necessary for entering into a contractual relationship with us, we remain at your disposal and will be happy to provide any necessary clarification.

If we intend to process your personal data for purposes other than those set out above, we will provide you with all information required under the Law before commencing such further processing.

WITH WHOM WE SHARE YOUR PERSONAL DATA

We ensure that access to personal data is granted only to those employees who require such access in order to perform their duties and responsibilities. We take all reasonable measures to ensure that our employees keep your personal data confidential, including by imposing confidentiality obligations and providing appropriate data protection training.

Access to personal data may also be granted to third parties where they have a lawful or legitimate reason for such access. Whenever we allow a third party to access personal data, we will take appropriate measures to ensure that the data is used in a manner consistent with this Privacy Policy.

In this regard, we may share your personal data with service providers, sponsors and partners of the Event, partner sports organizations involved in the Event, providers of IT and communications infrastructure services (including the provider of the registration platform), providers of event photography and filming services, live event tracking services through dedicated applications, security service providers, as well as advisers, legal counsel, insurance companies, marketing agencies, newsletter service providers, and social media platforms, all of whom act on our behalf or jointly with us pursuant to cooperation agreements, data sharing agreements, and/or data processing agreements.

As described in the section “Controller”, personal data collected in connection with the Event are processed under the joint control of the Belgrade Marathon and European Athletics (EA). European Athletics (EA), in its capacity as a Joint Controller, receives and uses participants’ registration and accreditation data for the purposes of organizing and managing the Event, preparing post-event reports and statistics, and, where consent has been provided, informing participants about future events and similar activities. The legal basis for the transfer of personal data to European Athletics (EA) is the Data Sharing Agreement concluded between the Belgrade Marathon and European Athletics (EA).
In addition, the Serbian Athletic Federation, Bulevar oslobođenja 54, 11000 Belgrade, which, together with the Belgrade Marathon, is responsible at the local level for all aspects of the organization and delivery of the Event, may receive participants’ personal data for the same purposes.

Subject to your explicit consent, your personal data may be transferred to Abbott World Marathon Majors (United States of America) for the purpose of your selection and qualification for the world’s leading marathons (Tokyo, Boston, London, Berlin, Chicago, and New York) within the masters categories of these prestigious marathon events. The Data Controller does not control this organization and is not responsible for its collection or processing of personal data.

We have also established a business cooperation with Witisi Sport GmbH, Germany (Hohler Weg 21, 53343 Wachtberg), which has been engaged to provide photography and video recording services for our Events. Such photographs and video recordings may be offered to you for purchase by Witisi Sport GmbH, provided that you have previously given your consent for your personal data to be shared with that company for this purpose.
In this regard, the Controller and Witisi Sport GmbH act as Joint Controllers pursuant to a separate agreement that transparently allocates their respective responsibilities for compliance with the obligations set out in the Law. A summary of the essential provisions of this agreement is available upon request by contacting our Data Protection Officer. Please note that you may exercise your rights, as described in the section “Your Rights”, directly against either of the Joint Controllers, regardless of the internal allocation of responsibilities under the aforementioned agreement.

Finally, we may disclose your personal data to third parties whenever necessary or appropriate and in accordance with applicable regulations, including:

HOW LONG DO WE KEEP YOUR PERSONAL INFORMATION?

When determining the appropriate retention period for personal data, we take into account the amount, nature and sensitivity of personal data, the potential risk of harm from unauthorized use or disclosure of personal data, the purposes for which we process personal data and whether we can achieve those purposes by other means and in accordance with the applicable regulation.

In this regard, your personal data will be retained by us until the contract has been fulfilled or the purpose for which the data was collected has been achieved, unless applicable laws require longer retention periods.
Generally, and unless another processing purpose requires otherwise, your personal data will be retained for the duration of the Event and for an appropriate period thereafter for the purposes of pursuing legitimate interests, reporting and statistical analysis, complying with legal obligations, or establishing, exercising, or defending legal claims in ongoing or potential judicial or other proceedings.

Personal data may also be retained for a longer period if you have provided your consent or where applicable laws prevent their deletion. Personal data processed for marketing purposes on the basis of your consent will be retained until it is no longer necessary for the purpose for which it was collected or until you withdraw your consent, whichever occurs first.

If you submit a valid request for erasure or withdraw your consent to the processing of your personal data, your personal data will be deleted unless there are other lawful grounds for retaining it (e.g. retention periods required under tax or financial legislation, or ongoing or potential judicial or other legal proceedings). In such cases, your personal data will be deleted once those grounds no longer apply.

European Athletics retains data relating to the organization of the Event and competition results for up to three (3) years after the Event for reporting and statistical purposes. Certain results-related data (e.g. name, nationality, finishing time, and ranking) may be retained for a longer period where necessary for maintaining historical records, rankings, and the integrity of the sport.
Data processed for future communications will be retained only where the data subject has provided consent, and only until such consent is withdrawn. Whenever possible, data will be anonymized for long-term statistical and historical purposes.

MARKETING

We strive to provide you with choices regarding the use of your personal data, particularly in relation to marketing and promotional activities.

We will use your identity data, contact data and marketing data to send our newsletters and other promotional content, if you have given us your consent (opt-in) for these purposes. You may withdraw your consent at any time by logging into the Website and updating the relevant marketing preference settings in your profile (opt-out), by following the unsubscribe links included in any marketing communication sent to you, or by contacting us at any time.

In addition, where you have provided your consent, we may share your personal data with our partners and sponsors, who may subsequently contact you as part of their marketing activities. Please note that such disclosure of data to partners or sponsors is carried out solely on the basis of your consent, which you may withdraw at any time.
Before transferring your data to third parties based on your consent, we require them not to further disclose such data and to provide you with a simple, easy, and effective means of objecting to the further use of your data. However, despite our continuous efforts, we cannot guarantee that such third parties will always comply with these obligations to the extent desired.

SECURITY MEASURES

The Controller implements appropriate technical, organizational, and personnel measures to protect personal data against unauthorized access, loss, destruction, alteration, misuse, or unauthorized disclosure.

These measures include access controls, secure data storage, regular reviews of our security practices, the implementation of backup systems and databases, management of data retention periods, employee training, and other appropriate safeguards. The measures are designed to ensure a level of security appropriate to the risks associated with the processing of personal data.

STATEMENT OF PERSONAL DATA OUTSIDE THE TERRITORY OF THE REPUBLIC OF SERBIA

Your personal data are stored at the premises of the Belgrade Marathon as well as on servers located within the European Union.

Your personal data may be made available to certain categories of recipients outside the Republic of Serbia, as explained in the section “Recipients and Categories of Recipients.” In this regard, Belgrade Marathon will continuously ensure that any transfer of your personal data outside the Republic of Serbia is carried out exclusively in accordance with the Law and subject to an adequate level of protection equivalent to that guaranteed under the Law.
This includes, among other things, transfers to countries that have been recognized as providing an adequate level of protection (such as member states of the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data), or transfers to other countries through the implementation of appropriate safeguards (e.g. standard contractual clauses, approval of the Commissioner for Information of Public Importance and Personal Data Protection, or similar measures), in accordance with the Law.
If you wish to obtain further information about these safeguards, you may contact our Data Protection Officer or send a written request to the address specified in the “Data Controller” section.

In particular, under the joint controllership arrangement described in the section “Controller”, your personal data are transferred to European Athletics (EA), which is established in Switzerland. Switzerland has been recognized as providing an adequate level of protection for personal data in accordance with the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data. In addition, the transfer of personal data is governed by the Standard Contractual Clauses (SCCs) concluded between the Belgrade Marathon and European Athletics (EA), which provide appropriate safeguards in accordance with the Law. A copy of these safeguards is available upon request by contacting our Data Protection Officer.

Furthermore, based on your explicit consent, your personal data will be transferred to Abbott World Marathon Majors (United States of America) for the purpose of your selection and qualification for the world’s leading marathons (Tokyo, Boston, London, Berlin, Chicago, and New York) within the masters categories of these prestigious marathon events.
This means that your personal data will be transferred to and processed in the United States of America (USA). Please note that the Republic of Serbia has not adopted a decision recognizing the United States as providing an adequate level of data protection. Consequently, the level of protection afforded to personal data in the USA may not necessarily meet the standards required under the Law. Furthermore, no appropriate safeguards have been established for this transfer to the United States.

Possible risks arising from the lack of data protection standards in the recipient country (such as the USA) include the following:

  1. Inadequate legal protection – the recipient country may not have comprehensive data protection regulations comparable to the Law, which may result in weaker privacy rights or insufficient legal remedies for individuals;
  2. Limited ability to exercise data subject rights – data subjects may not be able to exercise their rights (e.g. access, rectification, erasure, objection to processing) due to the absence of an independent supervisory authority or an adequate enforcement framework in the recipient country;
  3. Government Access and Supervision – Data subjects may not be able to effectively exercise their rights (e.g. the right of access, rectification, erasure, or objection to processing) due to the absence of an independent supervisory authority or an adequate legal framework for enforcement in the recipient country.
  4. Unlawful or unauthorized data processing – without adequate safeguards, there is a risk of unlawful or unauthorized processing of personal data, including unauthorized sharing or sale of personal data to third parties, resulting in a loss of control over how personal data is used;
  5. Increased risk of data breaches – the recipient country may not have adequate technical and organizational security measures to protect personal data from unauthorized access, breaches, or cyberattacks, which may expose data subjects to risks such as identity theft or fraud;
  6. Difficulty in seeking legal remedies – in the event of a data breach or misuse of personal data, data subjects may face significant challenges in obtaining legal remedies or compensation in jurisdictions with inadequate or unclear legal procedures.
  7. Cross-border data sharing without consent – personal data may be shared across borders in ways that the data subject has not consented to or been informed about, undermining transparency and trust in data processing;
  8. Lack of data minimization and purpose limitation – in jurisdictions without adequate safeguards, personal data may be processed beyond the original purpose for which it was collected, potentially exposing data subjects to new or unexpected uses of their data.

You accept the potential risks that may arise due to the absence of an adequacy decision and appropriate protective measures, as outlined in this section.

COOKIES

The Belgrade Marathon integrates and uses cookies to enable certain website functions and integrate external web services and thereby improve the user experience. So-called “cookies” are small text files that your browser can store on your access device.

You can set your browser to reject all or some cookies, or to warn you when websites place or access cookies. If you disable or refuse cookies, please note that some parts of the Website may become unavailable or may not function properly. For more information about the cookies we use, see our Cookie Policy .

AUTOMATIC DECISION MAKING

The Belgrade Marathon uses your personal data to make the following automated decisions:

Assignment of Race Bib Numbers: Each person who registers for the Event is automatically assigned a race bib number upon submission and processing of their registration.

Assignment of Starting Position/Starting Wave: The starting position of participants in our races is determined based on their expected finish time.

Timekeeping and ranking of participants in current and overall standings: Time measurement and participant ranking are carried out automatically, based on the results achieved during the race.

THIRD PARTIES

We cannot exclude the possibility that sports clubs, companies, or other organizations may register participants through our registration system. When doing so, such organizations act as third parties. If, in your capacity as such a third party, you register other individuals with us, please note that you must have the valid consent of all such individuals at the time of registration.
By registering another person’s data, you confirm that you have obtained their consent and agree to indemnify and hold us harmless from any claims, demands, or liabilities brought by that person. If you do not have such consent, we reserve the right to take appropriate legal action, including seeking compensation for any damages incurred.

Third parties (including our partners and sponsors) may independently photograph and record our events and use such photographs or recordings, which may contain participants’ personal data, for purposes determined by them and which may not necessarily be related to the purposes described in this Privacy Policy. We do not control such third parties in connection with these activities and are not responsible for their collection or processing of personal data.

YOUR RIGHTS

As a data subject, you have the rights set out below under the Law in relation to the protection of your personal data. If you wish to exercise any of these rights, please contact our Data Protection Officer or send a written request to the address specified in the “Data Controller” section.

Right of access: You have the right to obtain information about the personal data we process about you.

Right to rectification and erasure: You may request that we correct inaccurate data and—where legal conditions are met—delete your personal data.

Restriction of processing: You may request—provided that the legal conditions are met—that we restrict the processing of your personal data.

Data portability: If you have provided data to us based on a contract or consent, you may, subject to the applicable legal conditions, request to receive the data you provided in a structured, commonly used, and machine-readable format, or request that we transfer it to another controller.

Right to Object: Where you consider it justified, you have the right to object at any time to the Controller’s processing of your personal data where such processing is carried out for the performance of a task carried out in the public interest or in the exercise of the Controller’s statutory powers (Article 12(1)(5) of the Law), or for the purposes of the legitimate interests pursued by the Controller or a third party (Article 12(1)(6) of the Law), including profiling based on those legal grounds. Upon receiving your objection, the Controller must cease processing your personal data unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or where the processing is necessary for the establishment, exercise or defence of legal claims.

You have the right to object at any time to the processing of your personal data for direct marketing purposes, including profiling to the extent that it is related to such direct marketing.
If you object to the processing of your personal data for direct marketing purposes, your personal data shall no longer be processed for those purposes.

Consent: Where your personal data is processed on the basis of your previously given consent, you have the right to withdraw that consent at any time. To do so, you may contact our Data Protection Officer or send a written request to the address specified in the “Data Controller” section.
The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Data processing is prohibited after the withdrawal of consent, with the fact that the withdrawal of consent does not affect the legality of data processing based on the consent given before its withdrawal.

If you believe that the processing of your personal data has been carried out in violation of the Law, you may file a complaint with the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11120 Belgrade (“Commissioner”).

CHANGES TO THIS PRIVACY POLICY

This Privacy Policy may be amended or updated from time to time to reflect changes in our data processing activities, legal obligations, or other relevant circumstances. The current and applicable version of the Privacy Policy is always available on the Website. We recommend that you periodically review the Website to stay informed of any changes to this Privacy Policy.

*************************************************************************************

[ ] I consent to my personal data being used for inclusion in mailing lists for newsletters and other promotional activities of the Belgrade Marathon, in accordance with the information contained in this Privacy Policy.

[ ] I consent to my personal data being used to receive information about the activities, services, and products of the Belgrade Marathon’s partners and sponsors, in accordance with the information contained in this Privacy Policy.

[ ] I consent to my personal data being shared with the Belgrade Marathon’s partners and sponsors for the purposes of their marketing activities, in accordance with the information contained in this Privacy Policy.

[ ] I consent to my personal data being shared with Witisi Sport GmbH for the purpose of purchasing photographs and video recordings in which I appear during the race, in accordance with the information contained in this Privacy Policy.

[ ] I give my explicit consent for the collection, processing, and transfer of my personal data to the organization Abbott World Marathon Majors for the purpose of selection and qualification for leading world marathons (Tokyo, Boston, London, Berlin, Chicago, New York) in the masters competition categories, in accordance with the information contained in this Privacy Policy.

[ ] I would like to receive European Athletics newsletters, as well as information about events, news, and digital services. I understand that I may withdraw my consent at any time. For more information, please refer to the Privacy Policy.

[ ] I consent to receiving marketing communications and promotional offers from the official partners and sponsors of European Athletics. I understand that I may withdraw my consent at any time. [Link: View the current European Athletics partners here]

NOTICE REGARDING MINORS:

Where the registration for the Event is made on behalf of a minor, the parent exercising parental responsibility (or another legal representative) is required to:

(ii) select (opt in to) the purposes of processing the minor child’s personal data for which consent is given (see above),

(iii) provide (enter) their own details in the table below:

Full name Contact phone number Email address
Parent exercising parental responsibility or other legal representative Parent exercising parental responsibility or other legal representative Parent exercising parental responsibility or other legal representative