Privacy Policy

PRIVACY POLICY

Last updated: 15 July 2026

DATA CONTROLLER

Data Controller: KLASSMARK NO NATURE NO FUTURE, S.L.
Trade Name: SANTA VALL
Tax Identification Number (NIF): B75391060
Registered Office: C. Can Pau Birol, 35, 17005 Girona, Spain
Privacy Contact: info@klassmark.com
Commercial Registry: Girona Commercial Registry, Sheet GI-75679, Entry 1
Website: www.santavall.com

Throughout this Privacy Policy, KLASSMARK NO NATURE NO FUTURE, S.L. may also be referred to as “Klassmark,” “Santa Vall,” “the Data Controller,” “the Organizer,” or “the Entity.”

SCOPE

This Privacy Policy governs the processing of personal data carried out by Santa Vall through:

a) The website santavall.com.
b) Contact, newsletter, registration, and participation forms.
c) External platforms used to manage registrations, payments, activities, or communications.
d) The organisation and operation of sporting events.
e) Accreditation systems, race bibs, timing, results, safety, and participant tracking.
f) The collection and publication of photographs, videos, live broadcasts, and other audiovisual content.
g) Social media channels and any other communications related to Santa Vall.

PERSONAL DATA WE MAY PROCESS

Depending on your relationship with Santa Vall and the services you use, we may process the following categories of personal data:

Identification data: first name, surname, date of birth, nationality, gender or competition category, identity document, signature, race bib number, and federation licence where required.

Contact details: email address, telephone number, postal address, country of residence, and emergency contact information.

Sporting participation data: event, distance, category, team or club, registration history, participation status, start and finish records, checkpoint information, timings, rankings, classifications, withdrawals, penalties, and race incidents.

Financial and contractual data: registration fees, selected services, invoicing details, payments, refunds, and transaction references.

Technical and browsing data: IP address, online identifiers, device information, browser type, access logs, preferences, and information collected through cookies or similar technologies.

Location data: checkpoints, approximate location, or route information where timing, tracking, or safety systems are used.

Image and voice data: photographs, videos, live broadcasts, interviews, recordings, and appearances in event-related content.

Health-related data: information strictly necessary to provide medical assistance, manage accidents or emergencies, insurance claims, allergies, injuries, or relevant medical conditions where applicable.

Legal representative data: name, contact details, relationship to the minor, authorisations, and proof of legal representation.

Marketing data: communication preferences, consent records, subscription date and source, email interactions, and unsubscribe requests.

Any information voluntarily provided through stories, applications, comments, surveys, or free-text fields.

Santa Vall applies the principle of data minimisation and will only collect personal data that is adequate, relevant, and necessary for the purposes for which it is processed.

PURPOSES OF PROCESSING AND LEGAL BASIS

4.1 Website operation and security

Purposes

To enable the proper operation and navigation of the website.
To maintain website security and prevent unauthorised access, fraud, abuse, technical failures, or cyberattacks.
To manage technical logs and resolve incidents.

Legal basis

Our legitimate interest in ensuring the security, stability, and proper functioning of the website (Article 6(1)(f) GDPR).

Cookies and similar technologies that are not strictly necessary will only be used with your consent.

4.2 Enquiries and information requests

Purposes

To respond to enquiries submitted via email or contact forms.
To provide information about events, registrations, services, or activities.
To manage complaints and support requests.

Legal basis

The processing is necessary to take pre-contractual steps requested by the data subject (Article 6(1)(b) GDPR) or, where applicable, is based on our legitimate interest in responding to communications (Article 6(1)(f) GDPR).

4.3 Participant registration and event management

Purposes

To process and confirm registrations.
To manage the selected distance, category, team, race bib, and contracted services.
To verify compliance with participation requirements.
To manage start lists, accreditation, race bib collection, and participant support.
To send operational communications regarding schedules, route changes, safety, regulations, checkpoints, mandatory equipment, or race incidents.
To manage cancellations, amendments, refunds, and claims.

Legal basis

Processing is necessary for the performance of the registration contract and the implementation of pre-contractual measures (Article 6(1)(b) GDPR).

Personal data marked as mandatory is required to complete and manage your registration. Failure to provide such information may prevent Santa Vall from processing or maintaining your participation.

4.4 Identity, Age and Eligibility Verification

Purposes

To verify the identity of participants.
To confirm age, competition category, licence, authorisations, and any eligibility requirements.
To prevent identity fraud and the improper collection of race bibs.

Legal basis

The performance of the registration contract and Santa Vall’s legitimate interest in ensuring the safety, integrity, and proper organisation of the event.

As a general rule, Santa Vall will visually verify identity documents without retaining a copy. Documentation will only be requested or retained where necessary, proportionate, and duly justified.

Where a race bib is collected by an authorised third party, only the personal data strictly necessary for that purpose will be processed.

4.5 Payments, Invoicing and Administrative Obligations

Purposes

To process payments, refunds, and transaction records.
To issue invoices and payment confirmations.
To comply with accounting, tax, and legal obligations.
To prevent fraud and unauthorised transactions.

Legal basis

Performance of the registration contract, compliance with legal obligations, and our legitimate interest in preventing fraud.

Where payments are processed directly by an external payment provider, full payment card details will be processed exclusively by that provider in accordance with its own privacy policy and security standards. Santa Vall will only receive the information necessary to confirm and manage the transaction.

4.6 Timing, Race Bibs and Results

Purposes

To record starts, checkpoints, and finish times.
To calculate overall times, split times, rankings, and classifications.
To manage withdrawals, penalties, sporting incidents, and appeals.
To publish official results and maintain the historical sporting archive.

Legal basis

Performance of the participation contract and Santa Vall’s legitimate interest, together with that of participants and the wider sporting community, in ensuring transparency, preserving sporting records, and maintaining historical results.

Published results may include, where appropriate:

Name and surname
Race bib number
Category
Team or club
Nationality
Split times
Finish time
Overall position
Finishing status

Contact details, identity document numbers, postal addresses, medical information, and full dates of birth will never be published.

Participants may request the correction of inaccurate results and, where justified by their particular circumstances, object to certain processing activities based on legitimate interest. Each request will be assessed in light of the integrity of the sporting record and the rights involved.

4.7 Participant Tracking, Location and Safety

Purposes

To manage timing checkpoints.
To locate participants in the event of an emergency, accident, or if they become lost.
To coordinate rescue, medical assistance, and event safety.
Where expressly indicated, to provide live tracking services for spectators or accompanying persons.

Legal basis

Where tracking is necessary for the safe organisation of the event, processing is based on the performance of the participation contract, Santa Vall’s legitimate interest in protecting participants and, where applicable, the protection of vital interests.

Where public live tracking is optional and not necessary to participate, it will only be carried out with the participant’s consent.

Santa Vall will limit the accuracy, frequency, recipients, and retention period of location data to what is strictly necessary. Where appropriate, publicly displayed locations may be delayed or shown approximately to reduce security risks.

4.8 Insurance, Accidents and Emergencies

Purposes

To arrange mandatory or optional event insurance.
To report accidents or incidents to the relevant insurer.
To coordinate medical services, rescue operations, and emergency response.
To contact the participant’s designated emergency contact.
To establish, exercise, or defend legal claims.

Legal basis

Performance of the participation contract, compliance with legal obligations, Santa Vall’s legitimate interest in managing liabilities and, in urgent situations, the protection of vital interests.

Insurance companies, healthcare providers, and emergency services may act as independent data controllers for the personal data they process under their own legal obligations.

Participants providing the details of an emergency contact confirm that they have informed that person that their information may be used solely for emergency contact purposes.

4.9 Health Data

Santa Vall does not require access to participants’ complete medical history.

Health information will only be processed where strictly necessary to:

Provide emergency medical assistance.
Deliver healthcare during the event.
Manage insurance claims.
Take into account a medical condition relevant to participant safety where a dedicated disclosure mechanism has been provided.

In addition to the legal bases set out in Article 6 GDPR, the processing of health data will rely, where applicable, on:

The protection of vital interests where the participant is unable to give consent.
The provision of healthcare by professionals subject to professional confidentiality.
The participant’s explicit consent where the information is voluntarily provided.

Access to health information will be restricted to personnel who require it and will be protected through enhanced security and confidentiality measures.

4.10 Anti-Doping Controls

Where an event is subject to anti-doping regulations, Santa Vall may cooperate with the relevant anti-doping authorities and organisations.

The purpose of such processing is to facilitate anti-doping procedures and comply with applicable sporting and legal obligations.

The legal basis for this processing is compliance with legal obligations and the public interest established by applicable anti-doping legislation.

Anti-doping authorities and organisations will generally act as independent data controllers regarding the samples and personal data they process.

Santa Vall will never use anti-doping information or results for commercial, advertising, or unrelated purposes.

4.11 Photography, Video Recordings and Participants’ Image

During the event, photographs, video recordings, audio recordings, interviews, and live broadcasts may be captured in order to:

Document the event.
Produce race reports, highlights, and editorial content.
Promote Santa Vall through its website, social media channels, official communications, and the media.
Preserve the historical archive of the event.

The legal basis for processing general, panoramic, environmental, or incidental images is Santa Vall’s legitimate interest in documenting and promoting the event, without prejudice to the limits established by applicable image rights legislation.

Participants will be informed of image recording through the Event Regulations, this Privacy Policy and, where reasonably possible, signage in the main filming areas.

Close-up portraits, individual interviews, testimonials, or images primarily intended for commercial campaigns, sponsor promotions, advertising, or marketing activities unrelated to editorial coverage will only be used with the participant’s separate, specific, and revocable consent, unless another legal basis applies.

Refusing consent for commercial use of one’s image will never prevent participation in the event.

Where reasonably feasible, participants may request in advance to avoid close-up or individualised recordings. However, this does not guarantee that they will not appear incidentally in general images of a public sporting event.

4.12 Marketing Communications and Newsletter

Purposes

To send the Santa Vall newsletter.
To provide information about future editions of Santa Vall and other sporting events organised by Klassmark.
To measure, in a proportionate manner, the performance and effectiveness of our communications.

Legal basis

Your consent, in accordance with Article 6(1)(a) GDPR and applicable legislation governing electronic marketing communications.

Where there is an existing contractual relationship, Santa Vall may send information about its own similar events or services where permitted by law, always providing a simple and free mechanism to opt out.

You may withdraw your consent or unsubscribe at any time by using the unsubscribe link included in every communication or by contacting info@klassmark.com.

Unsubscribing from marketing communications will not affect the delivery of operational communications necessary to manage your registration or to inform you about safety matters, schedules, event updates, or incidents.

4.13 Sponsors and Partners

The presence of sponsors or partners at an event or on this website does not mean that they receive participants’ personal data.

Santa Vall will only share personal data with a sponsor for the sponsor’s own marketing purposes where:

the sponsor has been clearly identified;
participants have been informed about the data to be shared and the intended purpose;
the participant has provided specific, freely given, and separate consent; and
refusing consent does not prevent participation in the event.

Where a promotional campaign is jointly organised by Santa Vall and a sponsor, participants will be informed of the responsibilities of each organisation before any personal data is collected.

4.14 Social Media

Santa Vall maintains official profiles on various social media platforms and may process personal data relating to users who interact with those profiles in order to:

respond to messages, comments, mentions, and other interactions;
provide information about events and activities;
moderate content and protect our channels against misuse.

Legal basis

Processing is based on the user’s interaction with our profiles, our legitimate interest in managing our social media presence and, where applicable, our contractual relationship with the participant.

Please note that social media platforms also process personal data under their own privacy policies, over which Santa Vall has no control.

4.15 Legal Compliance and Defence of Legal Claims

Santa Vall may retain and process personal data where necessary to:

comply with legal obligations;
respond to requests from public authorities;
investigate breaches of applicable rules or regulations;
establish, exercise, or defend legal claims.

Legal basis

Compliance with legal obligations and Santa Vall’s legitimate interest in protecting its legal rights and responsibilities.

SOURCE OF PERSONAL DATA

Personal data may be obtained:

directly from the data subject;
from their legal representative;
from a person authorised to complete a team registration or collect a race bib on their behalf;
through registration, payment, timing, tracking, or results platforms used to provide our services;
from sports federations, insurance companies, medical services, or public authorities where there is a lawful basis for doing so;
through publicly available interactions with Santa Vall’s official social media profiles.

Where a person provides personal data relating to another individual, they must ensure that they are authorised to do so and that the relevant person has been informed about the processing of their data.

RECIPIENTS OF PERSONAL DATA

Where necessary, personal data may be processed or disclosed to:

website hosting, maintenance, cybersecurity, email, cloud storage, newsletter, and IT service providers;
registration and participant management platforms;
banks and payment service providers;
timing, tracking, and results providers used for each edition of the event;
insurance companies and insurance brokers;
medical services, ambulances, rescue teams, civil protection services, and public emergency authorities;
photographers, audiovisual production companies, media organisations, and photographic archive providers acting on behalf of Santa Vall or, where appropriate, as independent controllers;
legal, tax, accounting, and other professional advisers;
sports federations, governing bodies, and competent public authorities where required by law;
anti-doping organisations and authorities, where applicable;
identified sponsors, only where participants have given their explicit consent or where a jointly managed campaign has been clearly communicated;
members of the public, search engines, and media outlets in relation to lawfully published results, photographs, videos, or other public event information.

Service providers acting on behalf of Santa Vall are contractually bound to process personal data only in accordance with our documented instructions and applicable data protection legislation.

EXTERNAL SERVICES

Santa Vall may use third-party providers to manage registrations, payments, timing services, participant tracking, newsletters, online stores, photographs, videos and other services necessary for the organisation of the event.

Depending on the edition of the event or the service provided, these suppliers may include registration platforms, payment providers, timing and tracking systems, newsletter platforms, cloud storage services, photo galleries, audiovisual platforms, online stores and other technology providers identified at the time of registration or within the relevant service.

Where users access an external website through a link, the external provider will process personal data under its own privacy policy.

Where a provider processes personal data on behalf of Santa Vall, the appropriate data processing agreements will be in place and the relevant information will be provided to participants.

INTERNATIONAL DATA TRANSFERS

Some of our technology providers may be located outside the European Economic Area (EEA) or may allow access to personal data from third countries.

Where an international transfer takes place, Santa Vall will ensure that one of the safeguards provided by the GDPR applies, including:

an adequacy decision adopted by the European Commission;
participation in an approved international transfer framework where applicable;
the European Commission’s Standard Contractual Clauses (SCCs);
Binding Corporate Rules or any other legally recognised safeguard.

Where appropriate, transfer impact assessments will be carried out and supplementary protective measures implemented.

You may request further information about international transfers affecting your personal data, including a copy of the applicable safeguards, by contacting:

info@klassmark.com

DATA RETENTION

Personal data will be retained for the following periods or in accordance with the following criteria:

Enquiries: for the time necessary to respond and, in general, for up to one year after the last communication, unless they give rise to a contractual relationship or legal claim.
Participant registrations: for the duration of the event and thereafter for the applicable statutory limitation periods relating to legal or contractual obligations.
Accounting and invoicing records: for the periods required under applicable accounting and tax legislation.
Acceptance of the Event Regulations and Terms & Conditions: for as long as legal or contractual claims may arise.
Marketing communications and newsletters: until consent is withdrawn or the individual unsubscribes. A minimum record of consent may be retained where necessary to demonstrate compliance with legal obligations.
Timing records and technical logs: for the period necessary to validate results, resolve disputes, and preserve the integrity of the sporting record.
Published results: for as long as there is a legitimate sporting, historical, or informational interest, subject to periodic review of their continued necessity and proportionality.
Location and tracking data: only for the duration of the event and any additional period strictly necessary to manage safety, incidents, or claims. Detailed tracking information not related to an incident will be deleted or anonymised as soon as it is no longer required.
Health and emergency data: only for the period strictly necessary to provide assistance and subsequently for the applicable limitation periods relating to insurance or legal claims. Healthcare providers may retain such information in accordance with their own legal obligations.
Photographs and videos used for editorial or historical purposes: for as long as they continue to serve an informational, documentary, or historical purpose, subject to periodic review.
Images used with consent for commercial campaigns: for the duration of the consent and the relevant campaign or period communicated to the participant, without prejudice to the right to withdraw consent at any time.
Blocked data: where required by law, certain information may be retained exclusively for judges, courts, public authorities, or the defence of legal claims.

Once the applicable retention periods have expired, personal data will be securely deleted or anonymised.

MINORS

The registration of participants under the applicable legal age must be completed or authorised by their parent, legal guardian, or authorised representative where required.

Where processing is based on consent and the participant is under the age established by applicable legislation, consent must be provided by the person exercising parental responsibility or legal guardianship.

Santa Vall may adopt reasonable measures to verify both the participant’s age and the authority of the person providing consent.

Any authorisation for the commercial or promotional use of a minor’s image shall always be obtained separately and through their legal representative.

Additional safeguards will be applied to minimise the publication of unnecessary personal information, real-time location data, or any processing incompatible with the best interests of the child.

AUTOMATED DECISION-MAKING AND PROFILING

Unless expressly stated otherwise for a specific service, Santa Vall does not make decisions based solely on automated processing that produce legal or similarly significant effects on individuals.

Santa Vall may carry out limited segmentation of communications, for example based on the event, distance, language, or edition in which a participant has expressed an interest. Such segmentation does not produce legal effects or significantly affect participants.

Should more advanced profiling or fully automated decision-making processes be implemented in the future, participants will be informed in advance in accordance with the GDPR.

YOUR RIGHTS

Under the GDPR, you may exercise the following rights:

Right of access – to know whether we process your personal data and obtain a copy of it.
Right to rectification – to request the correction of inaccurate or incomplete data.
Right to erasure – to request the deletion of your personal data where legally applicable.
Right to restriction of processing – to request that processing be limited in the circumstances provided by law.
Right to object – to object to processing based on legitimate interests for reasons relating to your particular situation and, at any time, to direct marketing communications.
Right to data portability – where applicable, to receive the personal data you have provided in a structured, commonly used, and machine-readable format.
Right to withdraw consent – at any time, without affecting the lawfulness of processing carried out before withdrawal.
Right not to be subject to decisions based solely on automated processing, where the legal requirements are met.

To exercise any of these rights, please contact:

info@klassmark.com

Subject: Data Protection – Exercise of Rights

Your request should include your name, the right you wish to exercise, sufficient information to identify your data and, where relevant, the event or registration concerned.

As a general rule, Santa Vall will not require a copy of your identity document. Additional information will only be requested where there are reasonable doubts regarding the identity or authority of the person making the request.

RIGHT TO LODGE A COMPLAINT

If you believe that your personal data has not been processed in accordance with applicable data protection legislation, you are encouraged to contact Santa Vall first at:

info@klassmark.com

You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD) or with any other competent supervisory authority in accordance with applicable law.

SECURITY AND CONFIDENTIALITY

Santa Vall implements appropriate technical and organisational measures to ensure a level of security appropriate to the nature, scope, context and risks associated with the processing of personal data.

These measures may include:

access controls and user permissions;
encryption and secure data transmission where appropriate;
backup procedures;
incident detection and management;
confidentiality obligations for staff and collaborators;
secure deletion and data blocking procedures;
enhanced safeguards for health data, location data, minors’ data and identity documents;
careful selection and ongoing supervision of service providers.

Employees, volunteers, contractors and collaborators with access to personal data are subject to strict confidentiality obligations.

CHANGES TO THIS PRIVACY POLICY

Santa Vall may update this Privacy Policy from time to time to reflect legal, technical, organisational or operational changes affecting the processing of personal data.

The latest version will always be available on this website.

Where changes materially affect the way personal data is processed or the legal basis on which processing relies, Santa Vall will provide appropriate notice and, where required by law, obtain renewed consent before continuing the relevant processing.