PRIVACY NOTICE

Notice provided pursuant to art. 13 of Regulation (EU) 2016/679 (GDPR).

Data controller

VIETTI & LEVORATO S.r.l., Via Vittorio Veneto 101, 28041 Arona (NO), Italy, VAT no. IT00192990034 — info@viettishop.com. No data protection officer has been appointed, as there is no obligation to do so.

Data processed

Identification and contact data (first name, last name, email, phone), city, trail running experience, longest run, weekly volume, preferred date, shoe size and fitting, optional Instagram handle, optional short description, plus consent records with date and time. No health data is collected at the request stage. At the confirmation stage (accepted participants only): final size, dietary profile and any allergies, name and phone number of an emergency contact.

Purposes and legal basis

Management and assessment of participation requests, organisation of the activity and related communications: performance of pre-contractual and contractual measures (art. 6.1.b GDPR). Legal obligations: art. 6.1.c GDPR. Marketing communications: optional and revocable consent (art. 6.1.a GDPR). Information about allergies and intolerances is processed on the basis of consent, for the sole purpose of preparing the lunch box.

Recipients

The data is processed by authorised VIETTI staff and by the guides in charge of the organisation; it is stored on the Klaviyo platform (Klaviyo Inc., USA — transfer safeguarded by the EU-US Data Privacy Framework) and on the Shopify infrastructure hosting the site; the professionals in charge of photo and video process the images as data processors. The data is not disclosed to Arc’teryx or to any other third parties, except where required by law. Participants who provide an emergency contact confirm that they have informed that person: those details are used only in case of need during the event.

Retention

Requests not accepted: 60 days after the event date. Confirmed participants’ data: 12 months after the event, unless the law requires otherwise. Dietary profile, allergies and emergency contact: deleted within 30 days after the event. Marketing consents: until withdrawn. Images and video: as set out in the release.

Provision of data

Providing the data marked as required is necessary to manage the request; failure to provide it prevents the assessment of participation. Optional data may be freely omitted.

Data subject rights

Access, rectification, erasure, restriction, portability, objection and withdrawal of consent at any time, plus the right to lodge a complaint with the Italian Data Protection Authority (Garante). Requests should be sent to info@viettishop.com.