I. Data Controller

ŠK RUN FOR FUN, with its registered office at Tupolevova 1020/20, 851 01 Bratislava-Petržalka, Identification Number (IČO): 31 805 159, registered in the registry maintained by the Ministry of Interior of the Slovak Republic under No. VVS/1-900/90-16300, e-mail: info@runforfun.sk (hereinafter referred to as the “Controller” or “we”).

The Controller implements a project titled “Aging is a Myth” (hereinafter the “Project”), which supports active and healthy aging of seniors, primarily through sports activities.

II. Categories of Personal Data Processed

We process the Personal Data of the Project participant (hereinafter referred to as the “Participant”) to the following extent: name, surname, year of birth, telephone contact, and photographs of the Participant.

We also process the personal data of a third party provided to the Controller by the Participant for the purpose of contacting them in the event of a collapse or sudden deterioration of the Participant’s health status during activities related to the Project (hereinafter referred to as the “Contact Person”), to the following extent: name, surname, and telephone contact. The Participant confirms that they have informed the Contact Person about providing their data to the Controller and the purpose of its processing.

III. Sources of Personal Data

We obtain personal data directly from Participants through communication channels, in particular via direct written, telephone, personal, or electronic communication.

IV. Purposes and Legal Bases for Processing Personal Data

a) Registration and Participation in Project Activities
Personal data for this purpose is processed to enable the Participant to actively participate in the Project’s activities. For this purpose, we process the Participant’s: name, surname, year of birth, and telephone contact. These data are processed on the legal basis of the performance of a contract—to enable the Controller to provide the contractual performance related to the Participant’s participation in the Project activities. If this personal data is not provided, it will not be possible to register the Participant or ensure their participation in the Project activities.

b) Promotion
We process personal data for the purpose of positive promotion of the Controller’s activities within the Project for documentation and presentation purposes, specifically by publishing photographs capturing the Participant during Project activities on the Controller’s social networks (e.g., Facebook, Instagram). For this purpose, we process the Participant’s: name and photograph. These data are processed on the basis of the Participant’s consent. Failure to grant consent or its subsequent withdrawal does not affect the possibility of participating in the Project’s activities.

c) Vital Interests of the Participant
We process personal data for the purpose of protecting the vital interests and health of the Participant, e.g., in the event of a collapse or sudden deterioration of the Participant’s health status, where it is necessary to contact emergency medical services and/or the Contact Person. For this purpose, we process the Participant’s: name, surname, telephone contact, year of birth, and the Contact Person’s: name, surname, and telephone contact. This personal data is processed on the legal basis of protecting the vital interests of the Participant.

Providing the Contact Person’s data for the purpose of protecting the Participant’s vital interests is voluntary. Failure to provide this data does not affect the possibility of participating in the Project, but it may make it difficult or impossible to contact a close person in the event of a sudden health deterioration or other emergency situation during Project activities.

V. Retention Period of Personal Data

Personal data processed under Section IV(a) and (c) are processed for the duration of the Participant’s participation in the Project and for the period necessary to settle rights and obligations arising from their participation.

Personal data processed for the purpose under Section IV(b) are processed for the duration of the Project and for 5 years after its completion, or until the consent to the processing of personal data is withdrawn, whichever occurs earlier. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

The granted consent can be withdrawn at any time by sending an e-mail to info@runforfun.sk or by a letter sent by post to the Controller’s address: ŠK RUN FOR FUN, registered office: Tupolevova 1020/20, 851 01 Bratislava.

VI. Disclosure of Personal Data

The Participant’s personal data may be disclosed to the extent of their name and photographs capturing the Participant during activities within the Project on the Controller’s social networks (e.g., Facebook, Instagram).

VII. Recipients of Personal Data

Depending on the purpose of processing personal data and specific circumstances, recipients of personal data may include other entities (acting as processors or independent controllers), in particular: the Data Protection Officer, and the company providing external support and management of the Controller’s social networks. In relation to published/disclosed photographs, the recipients of the personal data are the visitors to the Controller’s social networks.

In cases where we process your personal data through processors, we ensure that they act in accordance with applicable legal regulations and terms agreed upon in the personal data processing agreement, particularly ensuring that personal data is protected in accordance with the requirements of the General Data Protection Regulation (GDPR) No. 2016/679.

VIII. Security

The Controller has adopted appropriate technical, organizational, and legal measures to ensure the security and integrity of personal data for maximum protection. In the event of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, we will notify the Participant of the personal data breach without undue delay.

IX. Transfer of Personal Data to Third Countries

In the case of publishing photographs and related personal data on social networks (specifically Facebook and Instagram), this personal data may be accessed and processed by the operators of these social networks. In connection with the operation of social networks, transfers of personal data to countries outside the European Economic Area (EEA), including the United States of America, may occur.

Such transfers are carried out on the basis of an adequacy decision by the European Commission or on the basis of other appropriate safeguards in accordance with Articles 45 to 49 of the General Data Protection Regulation (“GDPR”). More detailed information on the processing of personal data by social network operators is available in the privacy policies of the respective social networks.

X. Rights of the Data Subject

The data subject has the following rights in connection with the processing of their personal data:

Right of access by the data subject: The data subject has the right to obtain confirmation from the Controller as to whether or not personal data concerning them are being processed, and, where that is the case, access to the personal data and specifically the following information: purposes of the processing; categories of personal data concerned; recipients or categories of recipients to whom the personal data have been or will be disclosed.

Right to rectification and completion: The right to have inaccurate personal data rectified and incomplete personal data completed.

Right to withdraw consent: The data subject has the right to withdraw their consent to the processing of personal data at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Right to erasure (“right to be forgotten”): The data subject has the right to obtain from the Controller the erasure of personal data concerning them without undue delay, particularly where the data are no longer necessary in relation to the purposes for which they were collected or otherwise processed, or where the data subject withdraws consent on which the processing is based.

Right to restriction of processing: The data subject has the right to obtain from the Controller restriction of processing, particularly if the accuracy of the personal data is contested by the data subject, or for other reasons under Article 18 of the GDPR.

Right to data portability: The data subject has the right to receive the personal data concerning them, which they have provided to a Controller, in a structured, commonly used and machine-readable format and has the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, if the processing is based on consent or a contract and the processing is carried out by automated means.

Right to object: Where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to processing of personal data concerning them for such marketing, which includes profiling to the extent that it is related to such direct marketing.

Right to lodge a complaint with a supervisory authority: Without prejudice to any other administrative or judicial remedy, every data subject has the right to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR).