Privacy policy
Effective: until revoked
1. Introduction
The purpose of this privacy notice (hereinafter: Notice) is to enable those who register for the running race (hereinafter: Race) organized by Running Latte Club Kft. (hereinafter: Organizer or Controller), those taking part in the Race, and visitors to the Organizer's website (hereinafter jointly: Data Subjects) to learn what personal data the Organizer processes, for what purpose, on what legal basis, and for how long, as well as what rights they have in this regard.
In preparing this Notice, the Organizer has had regard to Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter: GDPR), as well as Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information (hereinafter: Infotv.).
2. Details of the Controller
- Name: Running Latte Club Kft.
- Registered office: 8096 Sukoró, Oltvány köz 3., Hungary
- Tax number: 32977806-2-07
- Company registration number: 07 09 037260
- Email: support@latterace.com
- Websites: latterace.com, latterace.hu
3. Definitions
Personal data: any information relating to an identified or identifiable natural person.
Data subject: the natural person to whom the personal data relates.
Processing: any operation performed on personal data, including in particular collection, recording, storage, use, disclosure, transfer, restriction, erasure, or destruction.
Controller: the entity that determines the purposes and means of processing personal data – in the context of this Notice, the Organizer.
Processor: an entity that processes personal data on behalf of, and under instruction from, the Organizer.
Registrant: the person who submits an entry for the Race – for themselves or for another person.
Racer: the natural person who actually takes part in the Race.
Personal data breach: an event resulting in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to, personal data.
4. Principles of processing
The Organizer processes personal data in accordance with the following principles:
- lawful, fair, and transparent processing,
- purpose limitation – data is collected only for clear and lawful purposes,
- data minimization – only the data necessary to achieve the purpose is processed,
- accuracy and up-to-dateness,
- storage limitation – data is retained only for as long as necessary,
- integrity and confidentiality – appropriate technical and organizational measures are applied to protect the data,
- accountability – the Organizer takes responsibility for complying with the above principles.
5. Legal bases for processing
The Organizer processes personal data on one of the following legal bases:
- the consent of the Data Subject;
- performance of the contract concluded with the Registrant/Racer (registration, and acceptance of the Competition Rules), or the taking of steps necessary for this at the Data Subject's request prior to entering into the contract;
- compliance with a legal obligation to which the Organizer is subject (e.g. accounting or tax obligations);
- the legitimate interest of the Organizer or a third party, provided that such interest is not overridden by the interests of the Data Subject.
6. Individual processing activities
The following sections describe each processing purpose, the categories of data concerned, the legal basis, and the duration of processing.
6.1. Registration for the Race
Registration can only take place via the Organizer's online platform (latterace.com, latterace.hu), through the Cheers registration and ticketing system, operated by Develops Hungary Kft.
| Categories of data processed | First and last name, email address, phone number, date of birth, home address, chosen race distance, T-shirt size. |
|---|---|
| Legal basis for processing | Performance of the contract formed between the Registrant and the Organizer upon acceptance of the Competition Rules, or the taking of steps necessary for this. |
| Purpose of processing | Recording the registration and organizing the Race, identifying and distinguishing registrants, providing the correct T-shirt size, and maintaining contact with the registrant. |
| Source of the data | Provided by the person submitting the registration. If someone registers another person, it is the registering person's responsibility to have that person's consent for the processing. |
| Duration of processing | Registration data is retained until consent is withdrawn. |
| Consequence of not providing the data | The Registrant will not be able to register for the Race. |
6.2. Verification of discounts (student and disability discounts)
The Registrant is eligible for the student discount upon presentation of a valid ISIC student card, and for the disability discount upon presentation of a currently valid disability card/certificate. The Organizer checks this in person at bib pickup.
| Categories of data processed | The fact of eligibility for the discount (student or disability eligibility category). The disability card/certificate evidences a fact that constitutes health data, i.e. a special category of data; the Organizer records only the fact of eligibility and does not keep any health details on file. |
|---|---|
| Legal basis for processing | For special category data, the explicit consent of the Data Subject (given by voluntarily presenting the document at bib pickup); for the student discount, performance of the contract (registration). |
| Purpose of processing | Identifying those eligible for the discount and applying it. |
| Source of the data | The Data Subject (the card/certificate presented). |
| Duration of processing | Registration data is retained until consent is withdrawn. |
| Consequence of not providing the data | The Organizer may refuse to apply the discount, and the full entry fee becomes payable. |
6.3. Registration for the duo relay
On the 21 km distance, entry is also possible in the form of a duo (2-person) relay; in this case, the details of both team members must be recorded.
| Categories of data processed | The names and contact details of the team members, and the division of the distance between them. |
|---|---|
| Legal basis for processing | Performance of the contract formed by registration. |
| Purpose of processing | Running the duo relay, and correctly recording the handover and results. |
| Source of the data | The team member submitting the registration provides both parties' details; it is the registering member's responsibility to have their teammate's consent. |
| Duration of processing | Same as the retention period for general registration data (see Section 6.1). |
| Consequence of not providing the data | The team will not be able to register as a duo relay. |
6.4. Payment of the entry fee
The entry fee can be paid via the Cheers registration system (operated by Develops Kft.), by bank card and/or another payment method offered by the system.
| Categories of data processed | Name, the amount due/paid, the transaction identifier and date. Card details are entered on the payment provider's own platform; the Organizer has no access to them. |
|---|---|
| Legal basis for processing | Performance of the registration contract. |
| Purpose of processing | Collecting and recording the entry fee. |
| Source of the data | The person initiating the payment, and the payment provider. |
| Duration of processing | Registration data is retained until consent is withdrawn, or for 8 years. |
| Consequence of not providing the data | The registration will not become valid. |
6.5. Invoicing
| Categories of data processed | Name, billing address, email address, the amount of the registration/fee, the method and date of payment. |
|---|---|
| Legal basis for processing | Compliance with a legal obligation (accounting and tax rules). |
| Purpose of processing | Fulfilling the documentation obligation required under accounting and tax law. |
| Source of the data | Provided by the Registrant during registration. |
| Duration of processing | Under Act C of 2000 on Accounting, the Organizer must retain invoicing-related data for 8 years following the relevant order. |
| Consequence of not providing the data | Not applicable, as issuing an invoice is a statutory obligation. |
6.6. Bib number and race pack pickup
| Categories of data processed | Linking the Racer's name with the bib number assigned to them. |
|---|---|
| Legal basis for processing | Performance of the registration contract (Competition Rules). |
| Purpose of processing | Ensuring the professional, verifiable running of the Race. |
| Source of the data | The Organizer assigns the bib number to the Racer. |
| Duration of processing | Generally the same as the retention period for the Race results (see Section 6.8). |
| Consequence of not providing the data | The consequences set out in the Competition Rules (e.g. disqualification) may apply. |
6.7. Timing
If the Organizer uses electronic (e.g. chip-based) timing, the start, any intermediate checkpoints, and the finish time are recorded in connection with the Racer's bib number/chip, based on which the Racer's time and placement are determined. The contact details of the timing service partner will be updated following the official approval of the race.
6.8. Publication of the start and results lists
| Categories of data processed | The exact data appearing on the public start/results list, e.g. name, year of birth, place of residence (town/city), gender, category, club, as well as the time achieved and placement. |
|---|---|
| Legal basis for processing | The Racer's consent, given upon registration. |
| Purpose of processing | Transparent, verifiable publication of the Race results. |
| Source of the data | Data provided at registration, and results recorded during the Race. |
| Duration of processing | Until consent is withdrawn. |
| Consequence of not providing the data | Not applicable, as consent is given by registering. |
6.9. Photographs and video recordings
| Categories of data processed | Photographs and video recordings taken of Racers at the venue and during the time of the Race, on which the Racer's bib number is typically also visible. |
|---|---|
| Legal basis for processing | The Organizer's legitimate interest in promoting the Race, as well as Racers' legitimate interest in gaining access to recordings made of them. |
| Purpose of processing | Documenting and promoting the Race, and informing and serving Racers. |
| Source of the data | The Racer. |
| Duration of processing | If the Racer objects, the Organizer will remove the recording from its own platforms without undue delay. |
| Consequence of not providing the data | Only an objection is possible; prior refusal is not available. |
6.10. Contacting the Organizer
| Categories of data processed | Name, email address, phone number, and the content of the inquiry. |
|---|---|
| Legal basis for processing | The consent of the Data Subject. |
| Purpose of processing | Responding to the inquiry and maintaining contact. |
| Source of the data | The person sending the inquiry. |
| Duration of processing | Inquiries and complaints received are retained until consent is withdrawn. |
| Consequence of not providing the data | The Organizer will not be able to contact the Data Subject. |
6.11. Newsletter and marketing communications
The Organizer sends newsletters / marketing emails or SMS messages; the legal basis is voluntary consent.
6.12. Social media platforms
The Organizer operates social media platforms (e.g. Facebook, Instagram).
6.13. Cookies on the website
The Organizer's website may use cookies to ensure the website functions properly and for statistical purposes.
7. Processors
The Organizer may engage processors for certain personal data processing operations. A processor may process the data entrusted to it only in a technical capacity, in accordance with the Organizer's instructions, and may not carry out processing for its own purposes.
7.1. Registration and ticketing system
Processor: Develops Hungary Kft. (operator of the Cheers registration and ticketing system). Details:
- Develops Hungary Kft — Develops Hungary Korlátolt Felelősségű Társaság
- 1097 Budapest, Drégely utca 2-4. B. lház. 604., Hungary
- Tax number: 27917882-2-43 | EU tax number: HU27917882
7.2. Other processors
The Organizer may engage processors for the following further activities:
- payment service provider
- invoicing system / bookkeeping
- hosting provider
- timing / results-list service provider
The Organizer will provide, on request, a list of processors not detailed above, and will add them when this Notice is next updated.
8. Data transfers
The Organizer transfers personal data to a third party only if:
- the Data Subject has consented to this,
- it is necessary for the performance of the contract concluded with the Registrant/Racer (e.g. engaging a processor),
- a law requires or permits this (e.g. an official or judicial request), or
- the Organizer or a third party has a legitimate interest in doing so that does not disproportionately harm the interests of the Data Subject.
9. Data security
The Organizer takes appropriate technical and organizational measures to ensure the security of personal data, including in particular protection against unauthorized access, alteration, transfer, disclosure, erasure or destruction, as well as against accidental loss or damage.
Personal data may only be accessed by staff members for whom this is necessary to perform their duties, and who are bound by confidentiality obligations.
10. Rights of Data Subjects
The Organizer will fulfil requests received without undue delay, and no later than within one month of receipt, or will inform the Data Subject of the reason for any refusal and of the available remedies. In justified cases, this deadline may be extended by a further two months.
10.1. Right of access
The Data Subject has the right to be informed as to whether the Organizer is processing their personal data, and if so, has the right to learn in particular the purpose of the processing, the categories of data processed, the recipients, the intended storage period, and the further rights listed in this section.
10.2. Right to rectification
The Data Subject may request the rectification of inaccurate personal data concerning them, or the completion of incomplete data.
10.3. Right to erasure
In cases specified by law, the Data Subject may request the erasure of their personal data, in particular if the data is no longer needed for the purpose for which it was collected, if they withdraw their consent and there is no other legal basis for processing, or if the processing is unlawful.
The Organizer draws attention to the fact that requests for the deletion of race results published on the public results list may conflict with the legitimate interest in the transparency and integrity of the Race; such requests are assessed by the Organizer on a case-by-case basis.
10.4. Right to restriction of processing
The Data Subject may request the restriction of processing, among other things, if they contest the accuracy of the data, or if the processing is unlawful but the Data Subject requests restriction instead of erasure.
10.5. Right to data portability
Where processing is based on consent or on a contract and is carried out by automated means, the Data Subject has the right to receive the data concerning them in a structured, machine-readable format, and may request that it be transmitted to another controller.
10.6. Right to object
Where processing is based on the Organizer's legitimate interest, the Data Subject has the right to object to the processing on grounds relating to their particular situation. In such a case, the Organizer may continue processing the data only if compelling legitimate grounds override the interests of the Data Subject, or if the processing relates to the establishment, exercise, or defense of legal claims.
10.7. Right to withdraw consent
Where processing is based on consent, the Data Subject may withdraw their consent at any time, free of charge. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
11. Remedies
If the Data Subject believes that the Organizer has infringed their right to the protection of their personal data, it is primarily recommended to contact the Organizer directly at the contact details given in this Notice.
In addition, the Data Subject may lodge a complaint with the National Authority for Data Protection and Freedom of Information (NAIH):
National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság)
Address: 1055 Budapest, Falk Miksa utca 9-11., Hungary
Postal address: 1363 Budapest, Pf. 9., Hungary
Phone: +36-1-391-1400
Email: ugyfelszolgalat@naih.hu
Website: www.naih.hu
The Data Subject is also entitled to turn to the courts. The action may be brought – at the Data Subject's choice – before the tribunal (törvényszék) competent for the Data Subject's place of residence or stay.
12. Amendment of the Notice
The Organizer reserves the right to amend this Notice. The version of the Notice currently in effect is available on the Organizer's website at https://latterace.com/policies/privacy-policy.