INFORMATION ON THE COLLECTION AND PROCESSING OF PERSONAL DATA (PRIVACY POLICY)

This information is provided in accordance with the provisions of the Law on Personal Data Protection (Official Gazette of the RS No. 87/2018) (‘Law’).

CONTROLLER

We are BEOGRADSKI MARATON PROIZVODNJA, MARKETING I ORGANIZACIJA SPORTSKIH PRIREDBI DOO, BEOGRAD, with a registered office at Dr Ive Popovića Đanija 3a, Belgrade (Savski Venac), Republic of Serbia, company registration number 06303773 (hereinafter referred to as “Beogradski Maraton”, “Controller”, or “We”).

Beogradski Maraton is aware and understands that privacy is of great importance to you, which is why we take the protection of personal data very seriously. Therefore, as the Controller, and by creating this Privacy Policy, we ensure that the processing of your personal data is transparent and understandable. The Controller is the entity that determines the purpose and manner of data processing. In cases where two or more controllers jointly determine the purpose and manner of processing, they are considered joint controllers.

In this Privacy Policy, we explain how, in our capacity as the Controller, we collect, process, and use your personal data, as well as how you can exercise your rights as a data subject. This Privacy Policy applies to all individuals who access our website www.bgdmarathon.org (hereinafter referred to as the Website), register a profile, or sign up for races organized by Beogradski Maraton, etc.

This Privacy Policy, together with our General Terms and Conditions and Cookie Policy, contains information that relates or may relate to you. Therefore, we recommend that you read them carefully to obtain all necessary information regarding the processing and protection of your personal data.

If you have any questions regarding this Privacy Policy, please contact us at [011/3690709].

DATA PROTECTION OFFICER

The Data Protection Officer at the Controller is Sanja Kovačević, reachable at 011/3690709 or sanja.kovacevic@bgdmarathon.org

PERSONAL DATA WE COLLECT

Personal data is any information relating to a natural person whose identity is determined or identifiable, directly or indirectly, particularly based on an identity marker such as a name and identification number, location data, identifiers in electronic communication networks, or one or more characteristics of their physical, physiological, genetic, mental, economic, cultural, or social identity.

The Belgrade Marathon collects, processes, stores, and transfers various types of your personal data, which we have categorized as follows:

“Identity Data” includes first and last name, username or similar identifier, gender, date of birth, city, nationality, photos, and videos.
“Contact Data” includes email addresses and phone numbers.
“Transaction Data” includes details of payments you have made to us (e.g., when registering for our events and races).
“Profile Data” includes the registrations you have made for participation in our events and races, the race distance you have registered for, T-shirt size, your expected race time, race number, position on the map, intermediate and final times during live race tracking, achieved performance, results, and race times.
“Marketing Data” includes your preferences regarding acceptance of marketing from us and third parties.
“Technical Data” includes your internet protocol (IP) address, browser type and version, and other data/technologies related to the devices you use to access our website.

HOW WE COLLECT YOUR PERSONAL DATA

We use various methods to collect data from and about you, including:

Direct Interaction – You provide identity data, contact details, and other personal information when:
- Creating/registering a profile on our website.
- Signing up for events or races we organize.
- Giving consent for newsletters and other promotional activities.
Automated Technologies or Interactions – When you interact with our website, we may automatically collect technical data about your device, browsing actions, and behavior patterns. This personal data is collected using cookies, server logs, and other similar technologies. Please refer to our Cookie Policy for more details.
Event and Race Organization – We collect and process your personal data, either independently or through engaged processors, as part of your participation in Beograd Marathon events and races (e.g., assigning race numbers, capturing photos and videos during the race, live race tracking including position on the map and recorded passing and final times, time measurement, achieved results, and ranking).
Third Parties – We may receive your personal data from various third parties. In such cases, we will provide you with information about the processing of your personal data within a reasonable period, in compliance with the law, unless the law excludes such an obligation.

HOW WE USE YOUR PERSONAL DATA

We will use your personal data only when and as permitted by law. Most commonly, we will process your personal data based on the following legal grounds:

a) When it is necessary to perform a contract that we are about to enter into or have already concluded with you.
b) When it is necessary for our legitimate interests (or the interests of a third party), provided that your interests and fundamental rights do not override those interests.
c) When we have obtained your valid consent for the processing of personal data.
d) When we need to comply with a legal or other statutory obligation.

Please contact us if you would like more information on the legal grounds we apply when processing your personal data.

PURPOSES FOR WHICH WE USE YOUR PERSONAL DATA

Your Consent

Purpose / Activity	Type of Personal Data	Legal Basis	Retention Period
Profile Creation (Registration) on the Website	Identity Data	Your consent	As long as the profile is active (not deleted by the user)
	Contact Data	Your consent
	Profile Data	Your consent
	Marketing Data	Your consent
Race Registration Organized by the Controller	Identity Data	Performance of a contract or taking steps, at your request, before entering into a contract	Until the purpose is fulfilled, and no longer than one year
	Contact Data	Performance of a contract or taking steps, at your request, before entering into a contract
	Transaction Data	Performance of a contract or taking steps, at your request, before entering into a contract
	Profile Data	Performance of a contract or taking steps, at your request, before entering into a contract
Race Implementation and Result Publication	Identity Data	Performance of a contract, Legitimate interest of the Controller (we must have the ability to publish and store results, rank race participants, etc.)	Permanent
	Profile Data
	Contact Data
Recording (video and photo) and publishing materials from races organized by the Controller and/or its partners, for the purpose of implementing and promoting races or their activities related to the races	Full Name, Video Recordings, Photographs	Legitimate interest of the Controller and its partners (We and our partners must have the ability to publish and display our races through print and electronic media, on the website and social media, as well as other media, present or future)	Permanent
Live Race Tracking (competitor positions on the map and their intermediate and final times) via a dedicated application, as well as publishing and making such data available to the application’s users (e.g., competitors and spectators)	Identity Data	Your consent	Until consent is withdrawn
	Profile Data
	Submission of your data to the Abbott World Marathon Majors organization (United States) for your selection and qualification for the world’s leading marathons (Tokyo, Boston, London, Berlin, Chicago, New York) in the master competition categories			Identity Data	Your consent	Until consent is withdrawn
Contact Data
Profile Data
Inclusion on lists for our newsletters and other promotional activities	Identity Data	Your consent	Until consent is withdrawn
	Profile Data
	Marketing Data
Submission of your data to Pica Group S.p.A. (Italy) for purposes further specified in the “PICA” section below	Identity Data	Your consent	Until consent is withdrawn
	Contact Data
	Photographs and video recordings in which you are captured as a participant in our events
Submission of your data to third parties for marketing purposes	Identity Data	Your consent	Until consent is withdrawn
	Contact Data
	Marketing Data
	Use of cookies (see Cookie Policy) (see Cookie Policy)			Technical Data	Your consent	Until consent is withdrawn

If we intend to process your personal data for purposes other than those mentioned above, we will provide you with all the necessary information in accordance with the Law before initiating such processing.

HOW LONG DO WE KEEP YOUR PERSONAL DATA?

Vaše podatke o ličnosti ćemo čuvati samo onoliko dugo koliko je potrebno da ispunimo svrhe za koje smo ih prikupili, uključujući i svrhe ispunjavanja zakonskih obaveza ili drugih pravnih zahteva. Prilikom određivanja odgovarajućeg perioda čuvanja podataka o ličnosti, uzimamo u obzir količinu, prirodu i osetljivost podataka o ličnosti, potencijalni rizik od štete od neovlašćene upotrebe ili otkrivanja podataka o ličnosti, svrhe u koje obrađujemo podatke o ličnosti i da li te svrhe možemo postići drugim sredstvima i u skladu sa važećim propisom. Detalje o periodima čuvanja za različite svrhe Vaših podataka o ličnosti navedeni su u tabeli u okviru odeljka ’’Svrhe u koje koristimo Vaše podatke o ličnosti’’.

PICA

PICA Group S.p.A is a company established in accordance with the laws of Italy, with its registered office in Cervia, Via XXII Ottobre no.15/B (hereinafter referred to as PICA). PICA is a company that designs and develops applications, websites, and software, as well as a company that sells digital products, operating both in Italy and internationally. PICA has designed and developed a technological solution based on an advanced artificial intelligence system that enables “automatic” identification and delivery of photographs and video recordings and operates through ad hoc packages (hereinafter referred to as PICA SUITE) consisting of: (a) software for identifying and storing images displayed in photographs and/or videos; (b) IOS and Android applications (hereinafter referred to as the App PICA) for online consultation and purchasing of photographs and video recordings; (c) a website called “getpica.com” for online consultation and purchasing of photographs and video recordings; and (d) a dashboard for control available at dashboard.getpica.com.

PICA offers its clients B2B services related to the use of PICA SUITE, as well as, if required, providing photographic or video services, using photographers capable of utilizing PICA SUITE.

PICA also directly sells to individuals participating in (public or private) events of various types (such as, but not limited to, sports, cultural, or music events) photographs and/or video recordings depicting them, which were taken by photographers engaged by the organizers of the events or by PICA itself at the request of the organizers, and which are uploaded to PICA SUITE.

In accordance with the above, Beogradski maraton has established a business cooperation with PICA, under which PICA will have access to your data (as listed in the table above) and process it for the following purposes:

Sorting and delivering photographs and/or video recordings to event participants,
Cloud storage (cloud) of photographs and/or video recordings of the event,
Access to the PICA SUITE dashboard by us as the event organizers for reporting and insights into the events we organize,
Uploading photographs and/or video recordings of the event to the iOS and Android application and the website getpica.com for consultation, customization, and sharing of photographs and/or video recordings by event participants,
Multilingual support services for event participants,
Providing a digital Media-Kit for communication regarding the services provided by PICA to event participants,
Options for uploading a gallery of photographs or generic video of the event visible to all relevant participants,
Options for uploading customized graphics that will be applied to all photographs,
Selling, via PICA SUITE, photographs and/or video recordings depicting participants in the events, directly to such participants, delivering them directly to their smartphones through the PICA app or on the web via the getpica.com portal.

MARKETING

We strive to provide you with choices regarding the use of your personal data, especially concerning marketing and advertising.

We will use your identity data, contact details, and marketing data to send our newsletters and other promotional content, if you have given us your consent (opt-in) for these purposes. At the same time, we need your consent before sharing your personal data with third parties (companies) for marketing purposes. The controller does not control these third parties and is not responsible for their collection and processing of personal data.

You can request that we or third parties stop sending you marketing messages at any time (withdrawal of consent). You can withdraw consent by logging into the website and unchecking the relevant marketing settings in your profile (opt-out) or by following the unsubscribe links in any marketing message sent to you or by contacting us or the third party at any time.

RECIPIENTS, CATEGORIES OF RECIPIENTS

Belgrade Marathon may share your personal data with processors with whom it has concluded data processing agreements, and who process your data on behalf of Belgrade Marathon as the Data Controller, for the purposes of achieving the aforementioned processing purposes. Engaging processors is contingent upon compliance with the legal basis we apply and the specific purpose of processing, as well as the implementation of appropriate procedures and protective mechanisms to ensure the security of your personal data and the exercise of your rights as provided by law.

For example, processors engaged (or to be engaged) by Belgrade Marathon include: 1) companies (service providers) related to the provision and maintenance of our IT and communication infrastructure, 2) companies (service providers) related to the maintenance of the website or applications used on the website, 3) companies (service providers) providing timing services for participants in the races, 4) companies (service providers) providing services via applications that allow live tracking of races (participant positions on the map, split and final times), including publishing and making such data available to users of the applications (e.g., participants and spectators), 5) marketing agencies for marketing and advertising purposes, etc.

We share video recordings and photographs (collectively “footage”) from our races with our partners who we collaborate with for the execution and promotion of races, so that our partners can further use these recordings for the purposes of executing and promoting races and their activities related to the races, which particularly includes the possibility for them to publish and display the footage via print and electronic media, on their websites and social media platforms, as well as in other current or future media.

Additionally, your personal data may, with your explicit consent, be provided to the Abbott World Marathon Majors organization (United States) for the purpose of your selection and qualification for the leading world marathons (Tokyo, Boston, London, Berlin, Chicago, New York) in the master categories of participants in these prestigious competitions (marathons). The Data Controller does not control this organization and is not responsible for their collection and processing of personal data.

Finally, your personal data may be disclosed to third parties whenever necessary or appropriate and in accordance with applicable laws, including:

To fulfil our legal obligations, or when necessary to comply with the law, another regulation, or a contract, or to respond to a court order, judicial or administrative procedure,
as a response to lawful requests from government authorities,
when necessary to establish, exercise, or defend potential, impending, or actual legal claims or proceedings,
where it is necessary to protect your vital interests or the vital interests of another person,
in connection with the reorganization of our company or group, sale, transfer, or other transfer of all or part of our business, e.g., to potential buyers or investors of the company or any part of the company’s business or
with your consent.

Disclosure of Personal Data Outside the Territory of the Republic of Serbia

Your personal data is stored in the premises of the Belgrade Marathon as well as on servers in the Federal Republic of Germany.

Your personal data may be made available to certain categories of recipients outside the Republic of Serbia, as explained in the section “Recipients, categories of recipients.” In this regard, the Belgrade Marathon will continuously ensure that any transfer of your personal data outside the Republic of Serbia is carried out exclusively in accordance with the law and with the provision of an adequate level of protection equivalent to the level guaranteed by the Law, which includes, among other things, transferring data to those countries that have been determined to provide an adequate level of protection (Council of Europe Convention on the Protection of Individuals with regard to Automatic Processing of Personal Data member states) or to other countries by providing appropriate protective measures (e.g., application of standard contractual clauses, approval from the Commissioner for data transfer, etc.) in accordance with the Law. If you wish to familiarize yourself with the relevant measures, you can contact us via email or send us a letter at the address provided in the “Controller” section.

Furthermore, based on your explicit consent, your personal data will be provided to the organization Abbott World Marathon Majors (United States) for the purpose of your selection and qualification for the leading world marathons (Tokyo, Boston, London, Berlin, Chicago, New York) within the master categories of participants in these prestigious marathon competitions. This means that your personal data will be transferred and processed in the United States (USA). Please note that the Republic of Serbia has not made a decision regarding the adequacy of protection with respect to the United States, meaning that the level of data protection in the USA may not necessarily meet the standards set by the Law. Appropriate protective measures have not been established for transfers to the USA.

Possible risks that may arise due to the lack of data protection standards in the recipient country (such as the USA) are as follows:

Inadequate legal protection – The recipient country may not have comprehensive data protection regulations comparable to the Law, which can lead to weaker privacy rights or insufficient legal remedies for individuals.
Limited enforcement of the rights of data subjects – Data subjects may not be able to exercise their rights (e.g., access, correction, deletion, objection to processing) due to the lack of an independent supervisory body or legal framework for enforcement in the recipient country.
Government surveillance and access – Authorities in the recipient country may have broader powers for surveillance without appropriate oversight or proportionality requirements, leading to unauthorized access or misuse of personal data by public authorities.
Illegal or unauthorized processing of data – Without adequate protective measures, there is a risk of illegal or unauthorized processing of data, including the unlawful sharing or selling of personal data to third parties, resulting in a loss of control over the way personal data is used.
Increased risk of data breaches – The recipient country may not have adequate technical and organizational security measures to protect personal data from unauthorized access, breaches, or cyber-attacks, which could put data subjects at risk of identity theft or fraud.
Difficulty in seeking legal redress – In the event of a data breach or misuse of data, data subjects may face significant difficulties in seeking legal redress or compensation in jurisdictions with inadequate or unclear legal procedures.
Cross-border data sharing without consent – Personal data may be shared across borders in a manner that the data subject has not consented to or been informed about, undermining transparency and trust in data processing.
Lack of data minimization and purpose limitation – In jurisdictions without appropriate protection measures, personal data may be processed beyond the original purpose for which it was collected, potentially exposing data subjects to new or unexpected uses of their data.

You accept the potential risks that may arise due to the absence of a decision on an adequate level of protection and the absence of appropriate protection measures, as stated in this section.

COOKIES

The Belgrade Marathon integrates and uses cookies to enable certain functions of the website and integrate external web services, thereby improving the user experience. The so-called “cookies” are small text files that your browser can store on your access device.

You can set your browser to reject all or some cookies, or to alert you when websites set or access cookies. If you disable or reject cookies, please note that some parts of the website may become unavailable or may not function properly. For more information about the cookies we use, please refer to our Cookie Policy.

AUTOMATED DECISION-MAKING

The Belgrade Marathon uses your personal data for the following automated decision-making processes:

Assignment of race numbers: Each participant applying for a race organized by the Belgrade Marathon is automatically assigned a race number upon submission and processing of their application.
Determination of starting position/group: The starting positions of participants in our races depend on their expected finish time. Accordingly, personal data from our databases is used to determine the starting position/group in an automated manner.
Time measurement and ranking of participants in current and overall standings: Time measurement and ranking of participants are carried out automatically based on their results during the race.

THIRD PARTIES

Third parties (including our partners) may independently record and photograph our races and use such recordings or photographs, which may contain participants’ personal data, for purposes they determine themselves and that are not related to the purposes stated in this Notice. We do not control these third parties in such activities and are not responsible for their collection and processing of personal data.

YOUR RIGHTS

As a data subject, you have the rights outlined below, as prescribed by the Law on the Protection of Personal Data. If you wish to exercise any of these rights, please contact us via email or send us a letter to the address provided in the “Data Controller” section.

Right of Access: You have the right to obtain information about the data we process about you.

Right to Rectification and Erasure: You may request the correction of inaccurate data and, if the legal conditions are met, the deletion of your data.

Restriction of Further Processing: You may request that we restrict the processing of your data, provided that the legal conditions for such restriction are met.

Data Portability: If you have provided us with data based on a contract or consent, you may, under legal conditions, request to receive the data you provided in a structured, commonly used, and machine-readable format or request that we transfer it to another responsible party.

Right to Object: If you believe it is justified, you have the right to object at any time to the processing of your personal data if the processing is carried out for public interest purposes, legal obligations of the Data Controller (Article 12, Paragraph 1, Item 5 of the Law), or for the legitimate interests of the Data Controller or a third party (Article 12, Paragraph 1, Item 6 of the Law), including profiling based on these grounds. The Data Controller must cease processing your personal data upon receiving your objection unless they demonstrate compelling legal grounds for processing that override your interests, rights, or freedoms, or if processing is necessary for legal claims.

You also have the right to object at any time to the processing of your personal data for direct marketing purposes, including profiling related to direct marketing. Once you object to processing for direct marketing, your personal data can no longer be processed for such purposes.

Consent: If your personal data is processed based on your prior consent, you have the right to withdraw your consent at any time. To do so, you may contact us via the provided email or send us a letter to the address listed in the “Data Controller” section. Data processing is no longer permitted after consent is withdrawn, but the withdrawal does not affect the lawfulness of processing based on consent given before its withdrawal.

If you believe that your data has been processed in violation of the provisions of the Law, you may file a complaint with the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar Kralja Aleksandra 15, 11120 Belgrade (“Commissioner”).

*************************************************************************************

[ ] I confirm that I have read and fully understood this Privacy Policy.

[ ] I consent to the collection and processing of my personal data during and in connection with the creation and registration of my profile on the Website, in accordance with the information contained in this Privacy Policy.

[ ] I consent to the collection and processing of my personal data during and in connection with live race tracking (tracking the position of competitors on the map and their intermediate and final times) within a dedicated application that publishes and makes such data available to the application’s users (e.g., competitors and spectators), in accordance with the information contained in this Privacy Policy.

[ ] I give my explicit consent for the collection, processing, and submission of my personal data to the Abbott World Marathon Majors organization for the purpose of selection and qualification for the world’s leading marathons (Tokyo, Boston, London, Berlin, Chicago, New York) in the master competition categories, in accordance with the information contained in this Privacy Policy.

[ ] I consent to the collection and processing of my personal data in connection with being added to mailing lists for newsletters and other promotional activities of the Belgrade Marathon as the Controller, in accordance with the information contained in this Privacy Policy.

[ ] I consent to the collection and processing of my personal data in connection with the submission of my data to third parties for marketing purposes, in accordance with the information contained in this Privacy Policy.

[ ] I consent to the collection and processing of my personal data in connection with the submission of my data to PICA Group S.p.A. for the purposes and in accordance with the information contained in this Privacy Policy.

IMPORTANT NOTICE FOR MINORS AND THEIR PARENTS/LEGAL REPRESENTATIVES:

In the event that the creation of a profile, race registration, or other processing purposes in accordance with this Privacy Policy are carried out for a minor, their parent exercising parental rights (or another legal representative) is required to:

(i) Confirm (opt-in) that they have read and fully understood this Privacy Policy (see above),

(ii) Select (opt-in above) the processing purposes for the minor child’s data for which they give consent (see above),

(iii) Provide (enter) their information in the table below:

Name and surname	Contact number	Email Address
Parent exercising parental rights, or	Parent exercising parental rights, or	Parent exercising parental rights, or
another legal representative	another legal representative	another legal representative