Privacy Policy for Participants in Events Organised by SCARPA
Calzaturificio S.C.A.R.P.A. S. P.A. (hereinafter also referred to as “SCARPA” or the “Data Controller”), with registered office at Via Enrico Fermi, 1 – 31011 – Asolo (TV), Italy, and contactable at the email info@scarpa.net, certified email (PEC) calzaturificioscarpaspa@legalmail.it or phone number +39 0423 5284.
Categories of data and their sources
SCARPA processes personal data of a general nature (identification and contact details; information relating to participation in the Event, such as the assigned activity group and the products provided for participants to try, including their sizes; and details of the identity document provided as security when borrowing those products) and special categories of personal data (health-related data, limited to the Participant's self-declaration that they are physically and mentally fit to take part in the activities). This information is collected directly from the person to whom it relates or, where a ticket is purchased on behalf of another person, from the purchaser, who provides the name of the ticket holder.
Purpose and Legal Basis
A. Event organisation and management: personal data is processed to identify Participants, manage registrations, organise activity groups with guides and leaders, and send service communications strictly necessary for the Event.
B. Management of the contractual relationship: personal data is processed for all purposes relating to the acceptance of the Event General Terms and Conditions and for managing the relationship at all stages (e.g. cancellations, refunds, insurance cover).
C. Self-declaration of physical and mental fitness: the Data Controller retains this declaration, which contains health-related information, as evidence that the Participant has declared themselves physically and mentally fit to take part in the activities.
D. Administrative and accounting obligations: the ticket purchaser’s personal data is processed to manage payments and fulfil the civil-law, accounting and tax obligations incumbent on the Data Controller.
E. Loan of products to try: Participants may borrow SCARPA products, such as boots, to try during the Event. To ensure each item is returned, the Organiser asks the Participant to present an identity document (without making a copy), and records the Participant’s name and the product loaned.
F. Establishment, exercise or defence of rights: the Data Controller may need to process personal data for the purposes of managing disputes and litigation, whether in or out of court.
| Purpose | Legal basis (standard data) | Legal basis (special data) |
|---|---|---|
| A. | Performance of the contract. | / |
| B. | Performance of the contract. | / |
| C. | Performance of the contract. | Explicit consent of the data subject. |
| D. | Compliance with legal obligations. | / |
| E. | Data Controller’s legitimate interest in ensuring the return of products loaned to Participants to try during the Event. | / |
| F. | Data Controller’s legitimate interest in establishing, exercising or defending a right. | Establishing, exercising or defending a right. |
Retention period
| Purpose | Retention period |
|---|---|
| A. | Until the end of the Event. |
| B. | 10 years from the acceptance of the General Terms and Conditions. |
| C. | 10 years from the acceptance of the General Terms and Conditions. |
| D. | 10 years from the purchase. |
| E. | Entries relating to the loan are deleted once the Event has ended. |
| F. | 10 years from the final resolution of the dispute. |
Nature of Data Provision and Consequences in Case of Refusal to Provide Data
| Purpose | Nature | Consequences |
|---|---|---|
| A. | Necessary | Inability to attend the Event. |
| B. | Necessary | Inability to comply with the General Terms and Conditions and, consequently, to take part in the Event. |
| C. | Necessary | Inability to take part in the activities planned as part of the Event. |
| D. | Necessary | Inability to attend the Event. |
| E. | Optional | Inability to receive products to try during the Event. |
| F. | Necessary | Inability to manage the dispute. |
Scope of Communication
Data are processed by internal staff authorised to carry out specific tasks and are disclosed externally in accordance with the following rules
| Purpose | Categories of external recipients |
|---|---|
| A. | Guides, athletes and external staff responsible for leading groups (limited to the names of Participants); companies providing hosting and management services for the e-commerce platform and for sending service communications. |
| B. | External consultants; insurance companies; companies offering hosting and e-commerce platform management services. |
| C. | Companies offering hosting and e-commerce platform management services. |
| D. | Credit institutions and payment service providers; accounting and tax advisers; parties to whom disclosure is required by law. |
| E. | No external recipients. |
| F. | Law firms; insurance companies; judicial authorities. |
Since data may be processed using computers and IT-enabled systems, they may also be visible to third parties providing technical support and maintenance services on these systems.
Transfer of Data to a Third Country or International Organisation
The Data Controller does not transfer personal data outside the European Economic Area (EEA).
Rights of Data Subjects
Data subjects have the following rights:
Access: they can obtain confirmation as to whether or not personal data concerning them is being processed, and where this is the case, to obtain a copy thereof.
Rectification: they can request updates to their personal data, rectify inaccuracies and supplement incomplete data.
Erasure: they can request the erasure or deletion of personal data if certain conditions are met (contact the Data Controller for more details).
Restriction: they can request data to be flagged so that in the future it may only be processed if certain conditions are met (contact the Data Controller for more details).
Objection: they can object to the processing of personal data on grounds relating to their particular situation, where the processing is based on legitimate interest or where the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller.
Portability: they can receive the personal data provided to the Data Controller in a structured format and transfer said data to another Controller if the processing is based on consent or on a contract and is carried out by automated means.
Withdrawal of consent: they can withdraw consent previously given for specific purposes at any time, without affecting the lawfulness of processing carried out up to that point.
The rights effectively exercisable for the processing activities performed are:
| Purpose | Exercisable right | ||||||
|---|---|---|---|---|---|---|---|
| Access | Rectification | Erasure | Restriction | Objection | Portability | Consent withdrawal | |
| A. | X | X | X | X | X | ||
| B. | X | X | X | X | X | ||
| C. | X | X | X | X | X | X | |
| D. | X | X | X | X | |||
| E. | X | X | X | X | X | ||
| F. | X | X | X | X | X | ||
Data subjects can exercise the above rights by using the form available at https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/1089924 and sending it to privacy@scarpa.net. They can also use this email address to request additional information, such as a copy of the balancing test for legitimate interest or the list of data processors.
A complaint can be lodged with the competent supervisory authority: in Italy, the Garante per la Protezione dei Dati Personali (www.garanteprivacy.it).
