INFORMATION ON THE COLLECTION AND PROCESSING OF PERSONAL DATA (PRIVACY POLICY)
These information are provided in accordance with the provisions of the Law on Personal Data Protection (Official Gazette of the Republic of Serbia No. 87/2018) (‘Law’).
HANDLER
We are BELGRADE MARATHON PRODUCTION, MARKETING AND ORGANIZATION OF SPORTS EVENTS LLC, BELGRADE, with registered office at Dr. Iva Popovića Đanija 3a, Belgrade (Savski venac), Republic of Serbia, registration number 06303773 (hereinafter: ” Belgrade Marathon ” or ” Rukovalac ” or ” We “).
The Belgrade Marathon is aware and understands that privacy is of great importance to you, so we take the protection of personal data very seriously. Therefore, as the Controller, and by creating this Privacy Policy, we make the processing of your personal data transparent and understandable. The controller is the person who determines the purpose and method of data processing, and in the event that two or more controllers jointly determine the purpose and method of processing, then they are considered joint controllers.
In this Privacy Policy, we explain how, as a Controller, we collect, process and use your personal data, as well as how you can exercise your rights as a data subject. This Privacy Policy applies to all natural persons who access our website www.bgdmarathon.org (hereinafter: Website ), register a profile or register for races organized by the Belgrade Marathon, etc.
This Privacy Policy, together with our Terms and Conditions and Cookie Policy, contains information that relates or may relate to you. Therefore, we suggest that you read them carefully in order to find out all the necessary information regarding the processing and protection of your personal data.
PERSONAL DATA PROTECTION OFFICER
The Data Protection Officer of the Controller is Sanja Kovačević, +381 11 3690709, [sanja.kovacevic@bgdmarathon.org](mailto:sanja.kovacevic@bgdmarathon.org).
PERSONAL INFORMATION WE COLLECT
Personal data is any data relating to a natural person whose identity is determined or determinable, directly or indirectly, in particular on the basis of an identity marker, such as name and identification number, location data, identifiers in electronic communication networks or one, i.e. more features of his physical, physiological, genetic, mental, economic, cultural and social identity.
The Belgrade Marathon collects, processes, stores, and transfers various types of your personal data, which we have grouped as follows:
“Identity Data” includes first and last name, username or similar identifier, gender, date of birth, city, nationality, photos, videos.
“Contact Information” includes email address and telephone numbers.
“Transaction Data” includes details of payments you have made to us (eg when registering for our events and races).
“Profile Data” includes registrations you have made for participation in our events and races, the race distance you are registering for, T-shirt size, your expected race time, competition number, position on the map, intermediate and final times during live race tracking, performance achieved, results, and race time in our events.
“Marketing Data” includes your preferences in terms of accepting marketing from us and third parties.
“Technical Data” includes Internet Protocol (IP) address, browser type and version and other data / technologies on the devices you use to access our Website.
HOW WE COLLECT YOUR PERSONAL DATA
We use a variety of methods to collect data from and about you, including:
Direct interaction . You provide identity data, contact data and other data listed in the previous section when creating / registering a profile on our website, i.e. when registering for events or races that we organize, when giving consent for newsletters and other promotional activities.
Automated Technologies or Interactions . As you interact with the Website, we may automatically collect technical data about your equipment, browsing actions and behavioral patterns. We collect this personal data using cookies, server logs and other similar technologies. Please see our Cookie Policy for more details.
Realization of events and races of the Belgrade Marathon . We collect and process your personal data, independently or through engaged partners and processors, as part of your participation in events and races that we organize (e.g. assignment of race numbers, photos and video recordings during the race, live race tracking (map position and split and finish times), timekeeping, achieved results, and rankings).
Third parties . We may receive your personal data from various third parties. In that case, we will provide you with information about the processing of your personal data within a reasonable time and in accordance with the Law, except when such an obligation is excluded by the Law.
HOW WE USE YOUR PERSONAL DATA
We will use your personal data only when and in the manner permitted by law. We will most commonly use your personal data in accordance with the following legal bases: a) when we need to perform a contract that we are about to conclude or have already concluded with you, b) when it is necessary for our legitimate interests (or the interests of a third party) and your interests and fundamental rights do not prevail over those interests, c) when we have received your valid consent to process personal data, d) when we need to fulfill a legal or other legal obligation.
Contact us to learn more about the legal basis we will apply to process your personal data.
PURPOSES FOR WHICH WE USE YOUR PERSONAL DATA
Your consent
| Purpose / Activity | Type of Personal Data | Legal Basis | Retention Period |
|---|---|---|---|
| Profile creation (registration) on the website | Identity data | Your consent | For as long as the profile is active (i.e. not deleted by the user) |
| Contact details | Your consent | ||
| Contact details | Your consent | ||
| Marketing data | Your consent | ||
| Registration for races organised by the Controller | Identity data | Performance of a contract or taking steps, at your request, before entering into a contract | Until the purpose is fulfilled, and no longer than one year |
| Contact details | Performance of a contract or taking steps, at your request, before entering into a contract | ||
| Transaction data | Performance of a contract or taking steps, at your request, prior to entering into a contract | ||
| Profile data | Performance of a contract or taking steps, at your request, prior to entering into a contract | ||
| Organisation of races and publication of results | Identity data | Performance of a contract; Legitimate interest of the Controller (we must be able to publish and retain results, rank race participants, etc.) | Permanent |
| Profile information | |||
| Contact Information | |||
| Recording (video and photo) and publication of materials from races organised by the Controller and/or its partners, for the purposes of organising and promoting the races and related activities | Full name, video recordings, photographs | Legitimate interest of the Controller and its partners (we and our partners must be able to publish and present our races through print and electronic media, on the website and social networks, as well as in other current or future media) | Permanent |
| Live race tracking (participants’ positions on the map and their split and finish times) via a dedicated application, as well as publishing and making such data available to application users (e.g. participants and spectators) | Identity data | Your consent | Until consent is withdrawn |
| Profile information | |||
| Transfer of your data to the organisation Abbott World Marathon Majors (United States) for your selection and qualification for leading world marathons (Tokyo, Boston, London, Berlin, Chicago, New York) in master competition categories | Identity data | Your consent | Until consent is withdrawn |
| Contact Information | |||
| Profile information | |||
| Inclusion in our newsletter lists and other promotional activities | Identity data | Your consent | Until consent is withdrawn |
| Profile information | |||
| Marketing data | |||
| Sale of photographs and video recordings from races in which you appear, through our partners | Identity data | Your consent | Until consent is withdrawn |
| Contact Information | |||
| Photographs and Video Recordings in which you are captured as a participant in our events | |||
| Transfer of your data to third parties for marketing purposes | Identity data | Your consent | Until consent is withdrawn |
| Contact Information | |||
| Marketing data | |||
| Use of cookies (see Cookie Policy) | Technical data | Your consent | Until consent is withdrawn |
If we intend to process your personal data for purposes other than those listed above, then we will provide you with all the necessary information in accordance with the Law before starting such processing.
HOW LONG DO WE KEEP YOUR PERSONAL INFORMATION?
We will only keep your personal data for as long as is necessary to fulfill the purposes for which we collected it, including the purposes of complying with legal obligations or other legal requirements. When determining the appropriate retention period for personal data, we take into account the amount, nature and sensitivity of personal data, the potential risk of harm from unauthorized use or disclosure of personal data, the purposes for which we process personal data and whether we can achieve those purposes by other means and in accordance with the applicable regulation. Details on the retention periods for different purposes of processing your personal data are provided in the table within the section “Purposes for which we use your personal data.”
MARKETING
We strive to provide you with choice regarding the use of your personal data, particularly in relation to marketing and advertising.
We will use your identity data, contact data and marketing data to send our newsletters and other promotional content, if you have given us your consent (opt-in) for these purposes. At the same time, we require your consent before sharing your personal data with third parties (companies) for marketing purposes. The controller does not oversee these third parties and is not responsible for their collection and processing of personal data.
You can ask us or third parties to stop sending you marketing messages at any time (revocation of consent). Withdrawal of consent can be done by logging into the Website and revoking the relevant fields for setting marketing preferences within your profile (opt-out) or by following the opt-out links on any marketing message sent to you or by contacting us or third party at any time.
RECIPIENTS, CATEGORIES OF RECIPIENTS
The Belgrade Marathon can deliver your personal data to processors with whom it has concluded data processing contracts and who process your data on behalf of the Belgrade Marathon as Controller, and for the purposes of achieving the above-mentioned processing purposes. The engagement of a data processor is conditional upon compliance with the legal basis we apply and the specific purpose of processing, as well as the implementation of appropriate procedures and protection mechanisms to ensure the security of your personal data and the exercise of your rights granted by law.
For example, the processors that Belgrade Marathon has hired (or can hire) are: 1) Companies (service providers) related to the provision and maintenance of our IT and communication infrastructure,
2) Companies (service providers) related to the maintenance of the website and/or applications used on the website,
3) Companies (service providers) that provide race recording services (video recordings, photographs) or timing services for participants,
4) Companies (service providers) that provide services through applications enabling live race tracking (participants’ positions on the map, split and finish times), including publishing and making such data available to application users (e.g. participants and spectators),
marketing agencies for the purposes of marketing and advertising activities, etc.
We share video recordings and photographs (collectively, “recordings”) from our races with our partners with whom we cooperate in organizing and promoting the races. This allows our partners to further use such recordings for the purposes of organizing and promoting the races, as well as promoting their own activities related to the races. In particular, this includes publishing and displaying the recordings through print and electronic media, on their websites and social networks, as well as in other current or future media.
Additionally, with your explicit consent, your personal data may be shared with the Abbott World Marathon Majors organization (United States) for the purpose of your selection and qualification for the world’s leading marathons (Tokyo, Boston, London, Berlin, Chicago, New York) within the masters categories of these prestigious competitions. The controller does not oversee this organization and is not responsible for their collection and processing of personal data.
Finally, we may disclose your personal data to third parties whenever necessary or appropriate and in accordance with applicable regulations, including:
- or to comply with our legal obligations, including where necessary to comply with applicable laws, regulations, or contracts, or to respond to a court order or judicial or administrative proceedings,
- in response to legitimate requests from government authorities;
- or when necessary for the establishment, exercise, or defense of potential, pending, or actual legal claims or proceedings,
- or where it is necessary to protect your vital interests or the vital interests of another person,
- or in connection with the reorganization of our company or group, the sale, assignment, or other transfer of all or part of our business, for example to potential buyers or investors of the company or any part of its business, or
- with your consent.
STATEMENT OF PERSONAL DATA OUTSIDE THE TERRITORY OF THE REPUBLIC OF SERBIA
Your personal data is stored on the premises of the Belgrade Marathon as well as on servers in the Republic of Germany.
Your personal data may be made available to certain categories of recipients outside the Republic of Serbia, as explained in the section “Recipients, categories of recipients.” In this regard, the Belgrade Marathon will continuously ensure that any transfer of your personal data outside the Republic of Serbia is carried out exclusively in accordance with the Law and with an adequate level of protection equivalent to that guaranteed by the Law. This includes, among other things, transferring data to countries that have been recognized as providing an adequate level of protection (such as signatories to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data), or to other countries by implementing appropriate safeguards (e.g. the use of standard contractual clauses, approval from the Commissioner for Data Protection, etc.) in accordance with the Law.
If you wish to learn more about these safeguards, you may contact us via email or send a written request to the address provided in the section “Controller.”
Furthermore, based on your explicit consent, your personal data will be transferred to the organization Abbott World Marathon Majors (United States) for the purpose of your selection and qualification for leading world marathons (Tokyo, Boston, London, Berlin, Chicago, New York) within the masters competition categories of these prestigious events.
This means that your personal data will be transferred to and processed in the United States (USA). Please note that the Republic of Serbia has not adopted an adequacy decision in relation to the USA, which means that the level of data protection in the USA may not necessarily meet the standards set by the Law. Appropriate safeguards for such transfers to the USA have not been established.
Possible risks arising from the lack of data protection standards in the recipient country (such as the USA) include the following:
- Inadequate legal protection – the recipient country may not have comprehensive data protection regulations comparable to the Law, which may result in weaker privacy rights or insufficient legal remedies for individuals;
- Limited ability to exercise data subject rights – data subjects may not be able to exercise their rights (e.g. access, rectification, erasure, objection to processing) due to the absence of an independent supervisory authority or an adequate enforcement framework in the recipient country;
- Government surveillance and access – authorities in the recipient country may have broader powers of surveillance without adequate oversight or proportionality requirements, which may lead to unauthorized access to or misuse of personal data by public authorities;
- Unlawful or unauthorized data processing – without adequate safeguards, there is a risk of unlawful or unauthorized processing of personal data, including unauthorized sharing or sale of personal data to third parties, resulting in a loss of control over how personal data is used;
- Increased risk of data breaches – the recipient country may not have adequate technical and organizational security measures to protect personal data from unauthorized access, breaches, or cyberattacks, which may expose data subjects to risks such as identity theft or fraud;
- Difficulty in seeking legal remedies – in the event of a data breach or misuse of personal data, data subjects may face significant challenges in obtaining legal remedies or compensation in jurisdictions with inadequate or unclear legal procedures.
- Cross-border data sharing without consent – personal data may be shared across borders in ways that the data subject has not consented to or been informed about, undermining transparency and trust in data processing;
- Lack of data minimization and purpose limitation – in jurisdictions without adequate safeguards, personal data may be processed beyond the original purpose for which it was collected, potentially exposing data subjects to new or unexpected uses of their data.
You accept the potential risks that may arise due to the absence of an adequacy decision and appropriate protective measures, as outlined in this section.
COOKIES
The Belgrade Marathon integrates and uses cookies to enable certain website functions and integrate external web services and thereby improve the user experience. So-called “cookies” are small text files that your browser can store on your access device.
You can set your browser to reject all or some cookies, or to warn you when websites place or access cookies. If you disable or refuse cookies, please note that some parts of the Website may become unavailable or may not function properly. For more information about the cookies we use, see our Cookie Policy .
AUTOMATIC DECISION MAKING
The Belgrade Marathon uses your personal data to make the following automated decisions:
Allocation of competition numbers : Each applicant for participation in the race organized by the Belgrade Marathon is automatically assigned a competition number when submitting or processing his application.
Determining the starting position/group : The starting positions of competitors in our races depend on the expected time at the finish line, in this regard, personal data of registered competitors from our databases is used to determine the starting position/group in an automated way.
Timekeeping and ranking of participants in current and overall standings: Time measurement and participant ranking are carried out automatically, based on the results achieved during the race.
THIRD PARTIES
Third parties (including our partners) may independently record and photograph our races and use such recordings or photographs, which may contain participants’ personal data, for purposes they determine themselves and which are not related to the purposes set out in this Privacy Policy. We do not control these third parties in such activities and are not responsible for their collection and processing of personal data.
YOUR RIGHTS
As a data subject, you have the rights listed below as prescribed by the Law regarding the protection of your personal data. If you wish to exercise any of these rights, please contact us via email or send a written request to the address provided in the section “Controller.”
Right of access: You have the right to obtain information about the personal data we process about you.
Right to rectification and erasure: You may request that we correct inaccurate data and—where legal conditions are met—delete your personal data.
Restriction of processing: You may request—provided that the legal conditions are met—that we restrict the processing of your personal data.
Data portability: If you have provided data to us based on a contract or consent, you may, subject to the applicable legal conditions, request to receive the data you provided in a structured, commonly used, and machine-readable format, or request that we transfer it to another controller.
Right to object: Where you consider it justified, you have the right at any time to object to the Controller regarding the processing of your personal data, where such processing is carried out for the performance of tasks in the public interest or in the exercise of official authority vested in the Controller (Article 12(1)(5) of the Law), or for the purposes of the legitimate interests of the Controller or a third party (Article 12(1)(6) of the Law), including profiling based on these grounds.
The Controller is obliged to cease processing your personal data upon your objection, unless it demonstrates that there are compelling legal grounds for processing which override your interests, rights, or freedoms, or are related to the establishment, exercise, or defense of legal claims.
Right to object to direct marketing: You have the right to object at any time to the processing of your personal data if it is being processed for direct marketing purposes, including profiling to the extent that it is related to direct marketing. Once you submit an objection to processing for direct marketing purposes, your personal data can no longer be processed for such purposes.
Consent: Where your personal data is processed based on your prior consent, you have the right to withdraw your consent at any time. In this regard, you may contact us via the email address provided above or send a written request to the address указан in the section “Controller.” Data processing is prohibited after the withdrawal of consent, with the fact that the withdrawal of consent does not affect the legality of data processing based on the consent given before its withdrawal.
If you believe that the processing of your personal data has been carried out in violation of the Law, you may file a complaint with the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11120 Belgrade (“Commissioner”).
CHANGES AND AMENDMENTS TO THE PRIVACY POLICY
This Privacy Policy may be amended or updated from time to time to reflect changes in our data processing practices, legal obligations, or other relevant circumstances. The current and valid version of the Privacy Policy is always available on our website www.bgdmarathon.org
. We recommend that you periodically check the website to stay informed about any updates.
If we make significant changes that may affect your rights or the way we process your personal data, we will clearly inform you via the website and, where required by law, directly—for example, via email or other appropriate means of communication.
*************************************************************************************
[ ] I confirm that I have read and fully understood this Privacy Policy.
[ ] I consent to the collection and processing of my personal data during and in connection with the creation and registration of my profile on the Website, in accordance with the information contained in this Privacy Policy.
[ ] I consent to the collection and processing of my personal data during and in connection with live race tracking (tracking participants’ positions on the map and their split and finish times) via a dedicated application that publishes and makes such data available to application users (e.g. participants and spectators), in accordance with the information contained in this Privacy Policy.
[ ] I give my explicit consent for the collection, processing, and transfer of my personal data to the organization Abbott World Marathon Majors for the purpose of selection and qualification for leading world marathons (Tokyo, Boston, London, Berlin, Chicago, New York) in the masters competition categories, in accordance with the information contained in this Privacy Policy.
[ ] I consent to the collection and processing of my personal data in connection with inclusion in newsletter lists and other promotional activities of the Belgrade Marathon as the Controller, in accordance with the information contained in this Privacy Policy.
[ ] I consent to the collection and processing of my personal data in connection with the transfer of my data to Witisi Sport GmbH for the purchase of photographs and video recordings in which I appear during the race, in accordance with the information contained in this Privacy Policy.
[ ] I consent to the collection and processing of my personal data in connection with the transfer of my data to third parties for marketing purposes, in accordance with the information contained in this Privacy Policy.
IMPORTANT NOTICE FOR MINORS AND THEIR PARENTS / LEGAL GUARDIANS:
In the event that profile creation, race registration, or other processing purposes in accordance with this Privacy Policy are carried out for a minor, their parent exercising parental rights (or other legal guardian) is required to:
(i) Pruži izričit pristanak za prikupljanje i obradu podataka o ličnosti maloletnog lica u skladu sa Politikom privatnosti.
(ii) izabere (opt-in gore) svrhe obrade podataka maloletnog deteta za koje daje pristanak (videti gore),
(iii) navede (upiše) svoje podatke u okviru donje tabele:
| Full name | Contact phone number | Email address |
|---|---|---|
| parent exercising parental rights, i.e. | parent exercising parental rights, i.e. | parent exercising parental rights, i.e. |
| other legal guardian | other legal guardian | other legal guardian |