MUNICIPALITY OF COMO, MUNICIPALITY OF LECCO AND MUNICIPALITY OF VARESE

PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA PURSUANT TO ARTICLE 13 OF REGULATION (EU) 2016/679

Registration and participation in Open Master Series 2027 – O.M.S. 2027 – Lake Como 2027

Introduction Pursuant to Article 13 of Regulation (EU) 2016/679 (hereinafter also referred to as the “GDPR”), the Municipality of Como, the Municipality of Lecco and the Municipality of Varese, acting as joint controllers (hereinafter also referred to simply as the “joint controllers”), hereby inform data subjects about the use of their personal data in connection with registration for, and related activities concerning, the 2027 edition of Open Master Series 2027 – O.M.S. 2027 – Lake Como 2027 (hereinafter also referred to as the “Open Master Games” or “OMG”).

Data controllers and Data Protection Officers (DPOs)

Pursuant to Article 4(7) of the GDPR, the joint controllers are:
  • The Municipality of Como, with registered office at Via ________________ Tel.: __________ Email: ______________. The Municipality’s Data Protection Officer (DPO) can be contacted at: dpo@trustds.it
  • The Municipality of Lecco, with registered office at Via ________________ Tel.: __________ Email: ______________. The Municipality’s Data Protection Officer (DPO) can be contacted at: _______
  • The Municipality of Varese, with registered office at Via ________________ Tel.: __________ Email: ______________. The Municipality’s Data Protection Officer (DPO) can be contacted at: _______
The joint controllers have designated an email address as a single point of contact, which data subjects may use to facilitate the exercise of the rights referred to in section 5 and, in any event, for requests concerning data protection: ___________ Data subjects retain the right to submit requests to each joint controller individually, in accordance with Article 26 of the GDPR. The text of the joint controllership agreement is available in the “Privacy Policy” section on the homepage of the OMG website.

Purposes of processing, personal data processed, legal basis for processing, data retention period and nature of data provision

Purpose A): management of participant enrolment, registration and accreditation procedures, as well as processing activities necessary to manage the organisational aspects of the event, in compliance with applicable laws.
  • Personal data processed: identification data, contact details, other sports-related information (e.g. discipline and relevant category), medical fitness to practise sport;
  • Legal basis for processing: Personal data are processed on the following grounds:
    • Performance of a task carried out in the public interest pursuant to Article 6(1)(e) of the GDPR, based on Article 13 of Legislative Decree No. 267 of 18 August 2000 (TUEL) and Lombardy Regional Law No. 26 of 1 October 2014, concerning the promotion and development of physical and sporting activities;
    • Compliance with a legal obligation pursuant to Article 6(1)(c) of the GDPR, in relation to additional organisational aspects such as accounting obligations and/or document retention obligations;
    • Performance of a contract pursuant to Article 6(1)(b) of the GDPR, in accordance with the Terms and Conditions of Open Master Series 2027 – O.M.S. 2027 – Lake Como 2027;
    • With regard to data concerning athletes’ health, the legal basis is the performance of tasks carried out for reasons of substantial public interest pursuant to Article 9(2)(g) of the GDPR, read in conjunction with Articles 2-sexies and 2-septies of Legislative Decree No. 196/2003. Specifically, with regard to obtaining and verifying certificates of fitness for competitive sporting activities, the legal basis is the Decree of the Ministry of Health of 18 February 1982 (1715Q063) (Official Gazette, General Series No. 63 of 5 March 1982).
  • Data retention period: until the end of the period established for reporting on the activities of Open Master Series 2027 – O.M.S. 2027 – Lake Como 2027, and in any event no later than 30 June 2028, without prejudice to any additional retention obligations imposed by law.
  • Nature of data provision: provision of the data is mandatory for participation in the OMG.
Purpose B): taking photographs and making video recordings, and subsequently publishing them through the communication channels of Open Master Series 2027 – O.M.S. 2027 – Lake Como 2027 (the website and official social media platforms advertised on the OMG website), in order to promote the event and the activities organised by the controller.
  • Personal data processed: photographs and video recordings of participants in Open Master Series 2027 – O.M.S. 2027 – Lake Como 2027;
  • Legal basis for processing: Personal data are processed on the basis of the legitimate interests of the joint controllers (Article 6(1)(f) of the GDPR), consisting of their interest in promoting the event. To safeguard the rights of data subjects, the controller undertakes to select, from the photographs and videos produced, primarily images and footage depicting the event as a whole rather than individual participants. Participants may also exercise their right to object by using the contact details provided in section 1 of this notice.
  • Data retention period: Processing will continue until the end of the period established for reporting on OMG activities and, in any event, until 30 June 2028. This is without prejudice to any further processing carried out by IMGA as an independent data controller, as indicated under Purpose C) below.
  • Nature of data provision: provision of the data is necessary insofar as the data subject participates in the OMG. However, any objection to the processing of such data will prevent the joint controllers from continuing the processing to the extent that the data subject’s rights prevail.
Purpose C): disclosure of registered participants’ data to IMGA – International Masters Games Association, as the organisation holding proprietary rights relating to certain aspects of the organisation of the OMG (including photographs and videos); disclosure of registered participants’ data (excluding photographs and videos) to sports organisations and other parties involved in organising the event, to ensure the proper conduct of the OMG.
  • Personal data processed: identification data, contact details, other sports-related information (e.g. discipline and relevant category), and the outcome of the fitness verification. In the case of IMGA, photographs/videos are also included.
  • Legal basis for processing: Personal data are processed on the basis of the performance of a contract, pursuant to Article 6(1)(b) of the GDPR, in accordance with the Terms and Conditions of Open Master Series 2027 – O.M.S. 2027 – Lake Como 2027;
  • Data retention period: until the end of the period established for reporting on the activities of Open Master Series 2027 – O.M.S. 2027 – Lake Como 2027, and in any event no later than 30 June 2028. This is without prejudice to any further processing carried out by IMGA as an independent data controller, governed by the privacy policy provided by IMGA to registered participants.

Methods of processing and recipients of data

The personal data collected are processed in connection with the registration, organisation and management of Open Master Series 2027 – O.M.S. 2027 – Lake Como 2027, for the purposes set out above, in accordance with the principles laid down in Article 5 of the GDPR (fairness, lawfulness and transparency of processing). The joint controllers ensure that the information processed is relevant and proportionate to the purposes pursued. Processing is carried out by individuals authorised by the controller for the purposes indicated. Persons authorised to process data are bound by professional confidentiality obligations. Personal data may also be processed with the assistance of other parties appointed as data processors, who process data in accordance with the purposes and means determined by the data controller pursuant to Article 28 of the GDPR, and in compliance with the purposes set out in section 2. In particular, Inrete s.r.l. (VAT No. 06938560965), as the company entrusted with managing the organisational aspects of the OMG on behalf of the joint controllers, acts as a data processor. The list of data processors is available upon request by the data subject. With regard to the processing of personal data carried out by the operators of the social media platforms used by the controller for Purpose B) referred to in section 2, please refer to the privacy notices and terms of service of those platforms.

Transfer of data outside the European Economic Area (EEA)

As a general rule, personal data processed for the aforementioned purposes are not transferred outside the EEA. For certain specific processing activities, some categories of data may be transferred to third countries outside the European Union or the European Economic Area (EEA), in accordance with the conditions laid down in Chapter V of the GDPR, in order to ensure an adequate level of protection for the rights and freedoms of data subjects. In particular, in accordance with section 2, Purpose C) of this notice, the personal data specified therein may be disclosed to IMGA – International Masters Games Association, based in Switzerland, pursuant to Adequacy Decision 2000/518/EC of 26 July 2000, confirmed by the Commission in its review report of 15 January 2024. With regard to the photographs/videos collected (section 2, Purpose B), data may be transferred to the United States insofar as they are published on the OMG Facebook and Instagram pages. The transfer of data is lawful on the basis of the European Commission’s adequacy decision of 10 July 2023 (link https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en), given that Meta Platforms Inc., the owner of the Facebook and Instagram platforms, is registered under the Data Privacy Framework (link https://www.dataprivacyframework.gov/list).

Rights of data subjects

Data subjects – meaning the individuals to whom the processed data relate – may exercise the rights provided for in Article 15 et seq. of the GDPR, within the limits and under the conditions established by the GDPR. These include, in particular, the right to access their personal data, to request their rectification, restriction or erasure where the relevant conditions are met, as well as the right to object to processing and the right to data portability. To exercise their rights, data subjects may contact the joint controllers or the Data Protection Officer using the contact details provided in section 1 of this notice. If data subjects believe that the processing of their personal data by the joint controllers infringes the GDPR, they have the right to lodge a complaint with a supervisory authority in the Member State of their habitual residence, place of work or the place where the alleged GDPR infringement occurred (Article 77 of the GDPR). The Italian supervisory authority is the Garante per la protezione dei dati personali (Italian Data Protection Authority), whose contact details are available on its website (www.garanteprivacy.it). Pursuant to Article 79 of the GDPR, data subjects also have the right to seek a judicial remedy if they believe that their rights have been infringed as a result of the processing.

Changes to this privacy notice

The joint controllers may modify, add or remove any part of this privacy notice on the processing of personal data. To facilitate the identification of any changes, the notice indicates the date on which it was last updated.