Protection Policy

DATA CONTROLLER

Data Controller: KLASSMARK NO NATURE NO FUTURE, S.L.
Trade name: KLASSMARK
Tax Identification Number: B75391060
Registered office: [CONFIRM: C. Can Pau Birol, 25, local B / C. Can Pau Birol, 35], 17005 Girona, Spain
Contact and privacy email: info@klassmark.com
Company registration details: Girona Commercial Registry, file GI-75679, entry 1
Website: www.klassmark.com

Throughout this Privacy Policy, KLASSMARK NO NATURE NO FUTURE, S.L. may also be referred to as “KLASSMARK,” the “Entity,” the “Organizer,” or the “Data Controller.”

This policy governs the processing of personal data carried out directly by KLASSMARK.

When an activity, sporting event, registration process, or service is organized by another legal entity, that entity must be specifically identified as the Data Controller in the relevant form, regulations, registration process, or document.

SCOPE OF THIS POLICY

This Privacy Policy applies to personal data processed through:

a) The website klassmark.com.
b) Contact, inquiry, registration, accreditation, employment application, collaboration, sponsorship, and communications subscription forms.
c) Registration and participation processes for sporting events organized or managed by KLASSMARK.
d) External platforms used to manage registrations, payments, insurance, timing, tracking, results, communications, or audiovisual content.
e) Participant control systems, race bibs, accreditations, timing, rankings, and safety systems.
f) The management of customers, participants, employees, candidates, volunteers, suppliers, sponsors, collaborators, and other individuals connected with KLASSMARK’s activities.
g) The capture and publication of photographs, videos, interviews, live broadcasts, and other audiovisual content.
h) KLASSMARK’s official social media profiles.
i) Any other communication channel or service managed directly by KLASSMARK.

Websites, services, or platforms managed by third parties are subject to their own terms and privacy policies.

PERSONAL DATA WE MAY PROCESS

Depending on the data subject’s relationship with KLASSMARK, we may process the following categories of personal data:

3.1 Identification Data

First name, last name, date of birth, nationality, gender or sporting category, identification document, signature, race bib number, membership number, federation license, or other necessary identifiers.

3.2 Contact Data

Email address, telephone number, mailing address, country of residence, and emergency contact information.

3.3 Sporting Participation Data

Event, race, distance, category, team or club, registration history, participation status, checkpoint records, start and finish times, timing data, rankings, withdrawals, penalties, incidents, and sporting claims.

3.4 Financial and Contractual Data

Registration or service fees, products or services purchased, billing details, payments, returns, refunds, and transaction references.

KLASSMARK will not retain complete payment card details when payment is processed directly by a financial institution or external payment platform.

3.5 Technical and Browsing Data

IP address, online identifiers, device used, operating system, browser, access logs, settings, preferences, and information collected through cookies or similar technologies.

3.6 Location Data

Checkpoint information, approximate or precise location, routes, courses, and information generated through timing, tracking, or safety systems, when such systems are used.

3.7 Image and Voice Data

Photographs, videos, audio recordings, interviews, broadcasts, testimonials, and appearances in content related to KLASSMARK or its events.

3.8 Health-Related Data

Information strictly necessary to manage medical assistance, accidents, emergencies, insurance matters, allergies, injuries, or medical conditions relevant to participant safety.

KLASSMARK will not request complete medical histories.

3.9 Minors’ and Legal Representatives’ Data

The minor’s name and age, details of the parent, guardian, or legal representative, relationship with the minor, authorizations, consents, and proof of legal representation where necessary.

3.10 Professional and Employment Data

Resume, education, experience, skills, professional information, availability, information provided during recruitment processes, and documentation necessary to manage an employment or professional relationship.

3.11 Supplier, Sponsor, and Collaborator Data

Name, position, company or organization, professional contact details, tax information, banking information, contractual details, and other information necessary to manage a professional or commercial relationship.

3.12 Marketing Communications Data

Communication preferences, consent records, date and source of subscription, interactions with communications, and unsubscribe requests.

KLASSMARK applies the principle of data minimization and will only process data that is adequate, relevant, and necessary for each purpose.

PURPOSES AND LEGAL BASES FOR PROCESSING

4.1 Website Operation and Security

Technical data may be processed to:

Enable website navigation and operation.
Maintain website security.
Prevent unauthorized access, fraud, misuse, errors, or cyberattacks.
Manage technical logs.
Detect and resolve incidents.

Legal basis: KLASSMARK’s legitimate interest in ensuring the security, stability, and proper operation of the website.

Cookies or similar technologies that are not strictly necessary will only be used with the user’s consent, in accordance with the Cookie Policy.

4.2 Inquiries, Requests, and Contact

Personal data may be processed to:

Respond to inquiries submitted through forms, email, telephone, or other channels.
Provide information about KLASSMARK, its events, or its services.
Prepare quotes or proposals.
Manage requests, incidents, complaints, and claims.

Legal basis: taking pre-contractual measures, performing a contractual relationship, or KLASSMARK’s legitimate interest in responding to communications received.

4.3 Event Registration and Participation

Personal data may be processed to:

Process and confirm registrations.
Manage races, distances, categories, teams, clubs, race bibs, and purchased services.
Verify participation requirements.
Manage accreditations and race bib collection.
Prepare start lists.
Send operational communications.
Provide information about schedules, routes, regulations, mandatory equipment, weather, safety, or incidents.
Manage participant changes, amendments, cancellations, refunds, and claims.
Organize the event operationally and technically.

Legal basis: performance of the registration agreement and implementation of pre-contractual measures.

Data marked as mandatory is necessary to manage registration. Failure to provide such data may prevent registration from being completed or participation from continuing.

When the legal organizer of an event is another entity, this will be specifically stated during the registration process.

4.4 Verification of Identity, Age, and Participation Requirements

Personal data may be processed to:

Verify identity.
Confirm age and sporting category.
Verify licenses, insurance, or authorizations.
Prevent identity fraud.
Prevent improper race bib collection or transfer.
Ensure compliance with event regulations.

Legal basis: performance of the participation agreement and KLASSMARK’s legitimate interest in preserving event safety and integrity.

As a general rule, identity documents will be visually checked without retaining a copy.

A copy will only be retained where necessary, proportionate, and legally justified.

4.5 Payments, Billing, and Administrative Obligations

Personal data may be processed to:

Process payments and refunds.
Confirm transactions.
Issue invoices.
Maintain accounting records.
Comply with tax and administrative obligations.
Prevent fraudulent transactions.

Legal basis: performance of a contract, compliance with legal obligations, and legitimate interest in preventing fraud.

When payment is managed by an external provider, that provider will process banking or card details in accordance with its own privacy policy and security standards. KLASSMARK will only receive the information necessary to confirm and manage the payment.

4.6 Timing, Checkpoints, and Results

Personal data may be processed to:

Record starts, checkpoints, and finishes.
Calculate total and split times.
Prepare rankings.
Manage withdrawals, penalties, and incidents.
Resolve sporting claims.
Publish official results.
Maintain a sporting and historical archive.

Legal basis: performance of the participation agreement and the legitimate interests of KLASSMARK, participants, and the sporting community in ensuring competition transparency and preserving results.

Published results may include:

First and last name.
Race bib number.
Category.
Team or club.
Nationality.
Split times.
Final time.
Position.
Finishing status.

Contact information, identification document numbers, home addresses, medical information, and complete dates of birth will not be published.

Data subjects may request correction of inaccurate results and, where justified circumstances apply, object to processing based on legitimate interests.

4.7 Tracking, Geolocation, and Safety

When an event uses tracking devices or systems, personal data may be processed to:

Monitor participant progress.
Detect deviations from the course.
Locate a person in the event of an accident, loss, or emergency.
Coordinate rescue and assistance.
Manage event safety.
Provide public live tracking where prior notice has been given.

Legal basis: performance of the participation agreement, KLASSMARK’s legitimate interest in protecting participants, and, in emergency situations, protection of vital interests.

When public tracking is optional and not required for participation, it will be based on consent.

KLASSMARK will limit the accuracy, frequency, access, and retention of location data to what is necessary.

Where appropriate, public location data may be displayed with a delay or at an approximate level to protect participant safety.

4.8 Insurance, Accidents, and Emergencies

Personal data may be processed to:

Arrange or verify insurance coverage.
Report accidents to insurers.
Coordinate medical services, ambulances, rescue services, or civil protection.
Contact the person designated for emergencies.
Manage claims and liabilities.

Legal basis: performance of a contract, compliance with legal obligations, legitimate interest in managing liabilities, and protection of vital interests.

Insurers, insurance brokers, healthcare providers, and emergency services may act as independent Data Controllers in relation to processing carried out under their own legal obligations.

When a participant provides the details of an emergency contact, the participant confirms that they have informed that person that their data may be used for this purpose.

4.9 Health-Related Data

Health data will only be processed where necessary to:

Provide medical assistance.
Respond to an emergency.
Manage an accident.
Process an insurance claim.
Implement safety measures related to a medical condition voluntarily disclosed.

In addition to a legal basis under Article 6 of the GDPR, processing will be based, as applicable, on:

Protection of vital interests.
Provision of healthcare by professionals subject to professional confidentiality.
The data subject’s explicit consent.
Establishment, exercise, or defense of legal claims.

Access will be restricted to personnel who need to know the information, and enhanced confidentiality and security measures will be applied.

4.10 Photographs, Videos, and Voice Recordings

During events, photographs, videos, audio recordings, interviews, and broadcasts may be captured for the purpose of:

Documenting the activity.
Reporting on the event.
Producing race reports, summaries, and editorial content.
Sharing the event through official channels.
Preserving the event’s historical archive.
Promoting future editions.

The processing of general, environmental, panoramic, or incidental images is based on KLASSMARK’s legitimate interest in documenting and communicating its activities, while respecting rights to honor, privacy, and one’s own image.

Image capture will be disclosed through this Privacy Policy, event regulations, participation terms, and, where reasonably possible, signage in the main recording areas.

Individual portraits, interviews, testimonials, or images primarily intended for third-party or sponsor advertising campaigns will require separate, specific, and revocable consent, unless another applicable legal basis exists.

Refusal to authorize individualized commercial use of an image will not prevent participation in the event.

Withdrawal of consent will not affect uses lawfully made before withdrawal or materials that cannot technically or legally be removed immediately, without prejudice to the individual assessment of each request.

4.11 Marketing Communications and Newsletters

Personal data may be processed to:

Send newsletters.
Provide information about future editions.
Communicate KLASSMARK activities, events, and services.
Send content related to expressed preferences.
Measure the effectiveness of communications in a proportionate manner.

Legal basis: the data subject’s consent.

Where a prior contractual relationship exists, KLASSMARK may send information about its own similar services or events where permitted by applicable law, always providing a simple and free opt-out method.

The data subject may withdraw consent or unsubscribe using the link included in each communication or by contacting info@klassmark.com.

Unsubscribing from marketing communications will not prevent receipt of operational communications necessary to manage a registration, contract, incident, or safety matter.

4.12 Sponsors and Commercial Partners

The presence of a sponsor, collaborator, or partner on a website or at an event does not mean that it receives participants’ personal data.

KLASSMARK will only disclose personal data to a sponsor for the sponsor’s own marketing purposes when:

The sponsor has been identified.
Information has been provided regarding the data and intended purpose.
Separate and specific consent has been obtained.
Refusal does not prevent participation in the event.

When a campaign is jointly organized with a sponsor, the responsibilities of each entity will be disclosed in advance.

4.13 Recruitment

Candidate data may be processed to:

Manage applications.
Assess education and experience.
Contact candidates.
Conduct interviews and recruitment processes.
Assess suitability for current or future positions.

Legal basis: implementation of pre-contractual measures and, where an application is retained for future opportunities, the candidate’s consent.

Unsuccessful applications will be retained for a maximum of one year unless the candidate requests earlier deletion or a different retention period has been disclosed.

Applicants should not submit resumes containing special categories of personal data that are not necessary for the recruitment process.

4.14 Relationships With Suppliers, Professionals, and Collaborators

Personal data may be processed to:

Manage contracts, orders, and services.
Maintain professional communications.
Coordinate personnel, equipment, and operations.
Manage invoicing and payments.
Comply with tax, employment, or administrative obligations.

Legal basis: performance of a contract, compliance with legal obligations, and legitimate interest in managing professional relationships.

4.15 Volunteers and Support Personnel

When KLASSMARK manages volunteers or support personnel, personal data may be processed to:

Manage applications and assignments.
Coordinate schedules, locations, and duties.
Provide accreditations and equipment.
Manage training and operational communications.
Implement prevention and safety measures.
Arrange insurance where applicable.

Legal basis: the relationship agreed with the individual, compliance with legal obligations, and legitimate interest in safely organizing the activity.

The legal classification of each collaboration must be determined according to its actual nature and applicable law.

4.16 Social Media

KLASSMARK may process data relating to individuals who interact with its official profiles in order to:

Respond to messages and comments.
Provide information.
Manage mentions and interactions.
Moderate content.
Protect channels against misuse.

Legal basis: interaction initiated by the user and KLASSMARK’s legitimate interest in managing its digital presence.

Social media platforms also process personal data under their own privacy policies and terms.

4.17 Legal Compliance and Defense of Claims

Personal data may be retained or processed to:

Comply with legal obligations.
Respond to requests from public authorities.
Investigate violations.
Manage administrative or judicial proceedings.
Establish, exercise, or defend legal claims.

Legal basis: compliance with legal obligations and KLASSMARK’s legitimate interest in protecting its rights and legal responsibilities.

SOURCE OF PERSONAL DATA

Personal data may be obtained:

Directly from the data subject.
From their legal representative.
From a person authorized to complete a group registration or collect a race bib.
From registration, payment, insurance, timing, tracking, or results platforms.
From clubs, federations, or sporting organizations where a legal basis exists.
From insurers, healthcare providers, or public authorities.
From customers, suppliers, sponsors, or collaborators.
From publicly available profiles and interactions on social media.

Where a person provides another individual’s data, that person must ensure that they are authorized to do so and that the other individual has been informed about the processing.

RECIPIENTS OF PERSONAL DATA

Where necessary, personal data may be processed by or disclosed to:

Website hosting, maintenance, cybersecurity, and IT service providers.
Email, newsletter, cloud storage, and document management providers.
Registration and participant management platforms.
Financial institutions and payment service providers.
Timing, tracking, and results companies.
Insurance companies and insurance brokers.
Medical services, ambulance providers, rescue teams, civil protection, and emergency services.
Photographers, production companies, media organizations, and audiovisual archive managers.
Legal, tax, employment, and accounting advisers.
Federations, clubs, and sporting bodies.
Public administrations and competent authorities.
Sponsors, only in cases previously disclosed and authorized.
Other organizers or entities responsible for a specific activity.
The public, media outlets, and search engines in relation to results or content lawfully published.

Service providers acting on behalf of KLASSMARK will be subject to a data processing agreement and may only use personal data in accordance with KLASSMARK’s documented instructions.

EXTERNAL PROVIDERS AND SERVICES

KLASSMARK may use external providers to manage:

Website hosting and maintenance.
Registrations.
Payments.
Timing.
Participant tracking.
Insurance.
Newsletters.
Data storage.
Forms.
Photographs and videos.
Online stores.
Analytics and consent management.

Depending on the event or activity, these services may include:

RockTheSport.
Google Workspace, Google Drive, Google Photos, YouTube, or related services.
Other providers identified in the corresponding form, registration process, or service.

The inclusion of a provider in this list does not necessarily mean that it is used for every event.

When a user accesses an external platform, that platform may process personal data in accordance with its own privacy policy.

INTERNATIONAL DATA TRANSFERS

Some technology providers may be located outside the European Economic Area or may allow access to personal data from third countries.

Where an international transfer occurs, KLASSMARK will apply one of the safeguards provided for under the GDPR, such as:

An adequacy decision adopted by the European Commission.
A recognized international data transfer framework.
The European Commission’s Standard Contractual Clauses.
Binding Corporate Rules.
Other legally valid safeguards.

Where necessary, transfer impact assessments will be carried out and supplementary measures will be implemented.

Information regarding applicable safeguards may be requested by contacting info@klassmark.com.

DATA RETENTION PERIODS

Personal data will be retained according to the following criteria:

Inquiries

For the time necessary to respond and, as a general rule, for up to one year after the last communication, unless a contractual relationship or legal claim arises.

Registrations and Participation

For the duration of event management and subsequently for the applicable statutory limitation periods relating to contractual, administrative, or legal liabilities.

Billing and Accounting

For the periods required under applicable commercial, tax, and accounting legislation.

Acceptance of Regulations and Terms

For as long as liabilities or claims may arise from participation.

Resumes

For the duration of the recruitment process and, where retention for future opportunities has been authorized, for a maximum of one year.

Marketing Communications

Until consent is withdrawn or an unsubscribe request is made.

A minimal record of the unsubscribe request or consent may be retained where necessary to demonstrate compliance.

Timing and Technical Records

For the period necessary to validate results, resolve incidents, and preserve the integrity of the sporting archive.

Published Results

For as long as a legitimate sporting, historical, or informational interest exists, subject to periodic review of necessity and proportionality.

Geolocation Data

For the duration of the event and for any additional period strictly necessary to manage incidents, safety matters, or claims.

Detailed tracking data not linked to an incident will be deleted or anonymized once it is no longer necessary.

Health and Emergency Data

For the period necessary to provide assistance and subsequently for the limitation periods applicable to insurance or legal claims.

Healthcare providers may apply their own statutory retention periods.

Editorial or Historical Photographs and Videos

For as long as they continue to serve a legitimate informational, documentary, or historical purpose, subject to periodic review.

Commercial Campaign Images

For the period disclosed when consent was obtained or for the duration of the campaign, without prejudice to the right to withdraw consent.

Suppliers and Professional Relationships

For the duration of the contractual relationship and subsequently for the applicable statutory periods.

Once the relevant periods expire, personal data will be securely deleted, anonymized, or blocked.

MINORS

Registration of minor participants must be completed or authorized by their parent, guardian, or legal representative where necessary.

Where processing is based on consent and the minor is under 14 years of age, consent must be provided by the person holding parental responsibility or legal guardianship.

KLASSMARK may take proportionate measures to verify:

The minor’s age.
The representative’s identity.
The legal relationship between the representative and the minor.
The authenticity of the authorization.

Authorization for individualized commercial or advertising use of a minor’s image will be obtained separately from the minor’s legal representative.

Enhanced safeguards will be applied to prevent unnecessary publication of minors’ personal data, documents, medical information, or real-time locations.

The best interests of the minor will prevail in all processing activities.

AUTOMATED DECISION-MAKING AND PROFILING

As a general rule, KLASSMARK does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect individuals.

KLASSMARK may carry out limited segmentation of communications based on criteria such as:

Language.
Event.
Race format.
Distance.
Edition.
Expressed preferences.

This segmentation does not produce legal effects or significantly affect users.

If more advanced profiling or automated decision-making systems are implemented in the future, users will be informed in advance.

DATA SUBJECT RIGHTS

Data subjects may exercise the following rights:

Right of access: to confirm whether KLASSMARK processes their data and obtain a copy.
Right to rectification: to correct inaccurate or incomplete data.
Right to erasure: to request deletion where legally applicable.
Right to restriction: to request that processing be limited in the circumstances provided by law.
Right to object: to object to processing based on legitimate interests for reasons relating to their particular situation.
Right to object to marketing: to object at any time to direct marketing communications.
Right to data portability: to receive certain data in a structured, commonly used, machine-readable format.
Right to withdraw consent: to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Right not to be subject to automated decision-making: where the legal requirements are met.

Requests may be submitted to:

Email: info@klassmark.com
Subject line: Data Protection – Exercise of Rights

The request should include:

First and last name.
The right being exercised.
Sufficient information to identify the relevant data.
The event, registration, or relationship concerned, where applicable.
A notification address, where necessary.

KLASSMARK will not routinely require a copy of an identity document.

Additional information will only be requested where there are reasonable doubts regarding the identity or authority of the person making the request.

RIGHT TO LODGE A COMPLAINT

If a person believes that their data has not been processed correctly, they may first contact KLASSMARK at info@klassmark.com.

They also have the right to lodge a complaint with:

Spanish Data Protection Agency
www.aepd.es

This is without prejudice to the jurisdiction of other competent supervisory authorities where applicable.

SECURITY AND CONFIDENTIALITY

KLASSMARK will implement technical and organizational measures appropriate to the level of risk, including, where applicable:

Access controls.
Permission management.
Identification and authentication systems.
Secure data transmission.
Backups.
Incident management.
Confidentiality obligations.
Secure blocking and deletion.
Enhanced protection of health, location, and minors’ data.
Supplier oversight.
Procedures for responding to personal data breaches.

Employees, collaborators, contractors, professionals, and authorized personnel with access to personal data will be subject to confidentiality obligations.

ACCURACY OF PERSONAL DATA

The data subject confirms that the personal data provided is accurate, complete, and up to date.

Any changes must be communicated through the available channels.

KLASSMARK may carry out reasonable verification where necessary to manage a registration, contract, claim, or legal obligation.

THIRD-PARTY LINKS AND SERVICES

Klassmark.com may contain links to websites, forms, registration systems, social media platforms, or services managed by third parties.

As a general rule, KLASSMARK does not control processing carried out directly by those third parties.

Before providing personal data through an external service, users should review the relevant privacy policy and applicable terms.

CHANGES TO THIS POLICY

KLASSMARK may update this Privacy Policy to reflect:

Legal or regulatory changes.
New guidance from supervisory authorities.
Organizational changes.
New services or events.
Changes in service providers.
New technologies.
Changes in personal data processing activities.

The current version will be available at www.klassmark.com.

Where a change materially affects the processing of personal data or its legal basis, KLASSMARK will provide the necessary information and, where required, obtain new consent.

Last updated: July 15, 2026
Version: 1.0