Updated : November 26 , 2024
- Introduction
This policy (” Privacy Policy “) describes how Gotland360 Bike Event AB, org.nr 559137-0456 (” Gotland360 “, ” We “, ” us “, ” our “) processes your personal data when you register for one of our races, buys a product from us, comes into contact with us as a representative of a supplier or partner, or in other situations when we may process your personal data. Your privacy is important to us, which is why we are keen that the personal data we process about you is handled in a way that protects and respects your privacy, and which is in accordance with the EU’s data protection regulation ( “Data Protection Regulation” ) and other applicable data protection legislation.
Gotland360 is the personal data controller for the processing of personal data described in this Privacy Policy, which means that we determine the purposes and means of the processing of personal data described.
- Where does Gotland360 get your personal data from?
Gotland360 primarily collects personal data directly from you, such as when you register for a race via our website, or from the organization you represent when you interact with Gotland360. Exceptionally, we may receive your personal data from third parties, such as from our suppliers and partners or from references during a recruitment process. We may also collect data from publicly available sources, such as public registers of natural persons and the Internet.
- Categories of personal data that Gotland360 processes
Gotland360 processes the following categories of personal data about you:
- Name, address, telephone number and e-mail address (” Contact details “),
- Date of birth, nationality, gender, team name, clothing size, and other participant-specific data (“ Participant Data ”),
- Starting number, starting group, final result and participation history (” Race details “),
- Information on association affiliation (“ Association Information ”),
- Order number, information about goods and services, and delivery tracking number (” Order Information “),
- Credit and debit card details, incl. card number, validity date and CVC/CVV code, bank account number and name of the bank (” Payment details “),
- Information about use of the app , website and Gotland360 services in general, such as IP address and other statistics, as well as other usage information (” Usage Information “),
- Photos and video (“ Photo Data ”),
- Social security number or coordination number (” Social security number “).
Gotland360 exceptionally also processes special categories of personal data about you:
- Information about special diets and allergies, functional impairment and health (” Sensitive personal data”).
- Legal basis for Gotland360 processing of personal data
Gotland360 may process personal data based on any of the following legal grounds:
Agreement : In some cases, Gotland360 processes your personal data because it is necessary to fulfill an agreement in which you, as a registered party, are a party to the agreement, or to take measures before such an agreement is entered into. This includes processing to enable entries, participation in and execution of our races, our provision of a participant profile and the sale of products and services via our webshop.
Legitimate interest : Gotland360 also processes your personal data because it is necessary in relation to our legitimate interest in conducting our business, sending out newsletters to registered users and communicating via letter, e-mail and telephone with various stakeholders. In cases where we base our processing of your personal data on a legitimate interest, we carry out an assessment in advance where we ensure that the processing is necessary in relation to the purpose, as well as a balancing of interests where we weigh our legitimate interest against your interest in not receiving your personal data processed.
Legal obligation : In some cases, we process your personal data to fulfill legal obligations incumbent on us, for example to fulfill rules in the Accounting Act (1999:1078) or the Discrimination Act (2008:57).
Consent : Exceptionally, we may process your personal data based on your consent. This includes processing for direct marketing and when we collect sensitive personal data about you.
Protect fundamental interests : In connection with accidents that occur during races, Gotland360 can process personal data to enable treatment.
- Which personal data is processed for which purposes and which legal grounds?
Here below, which personal data is processed for which purposes, based on which legal basis according to the data protection regulation and how long we keep your personal data.
Purpose: Registration for and participation in our races
To make it possible for you to sign up for, or participate in, our races, to administer incoming entries, enable and administer payments, and send out necessary content before races, such as start certificates.
Category of personal data
- Contact details
- Participant details
- Race details
- Association information
- Payment information
- Social security number
- Sensitive personal data
Legal basic
Agreement (Art. 6(1)(b)): the processing is necessary for Gotland360 to be able to fulfill a contractual obligation.
Legitimate interest (Art. 6(1)(f)): the processing is necessary for Gotland360’s legitimate interest in fulfilling the purpose.
Express consent (Art. 9(2)(a)): in relation to the processing of sensitive personal data.
Storage time
For personal data saved on the participant profile, see more under the purpose Providing a participant profile.
For accounting documents, see more under the purpose Legal obligations.
Other personal data is stored for 3 years from the end of the calendar year in which the race for which the notification refers was carried out, in order to be able to meet our obligations according to consumer legislation.
Purpose: Care during races
To enable care and concern during races in connection with accidents.
Category of personal data
- Contact details
- Race details
- Sensitive personal data
Legal basis
Protect fundamental interest (Art. 6(1)(d)): the processing is necessary for Gotland360 to be able to protect interests that are of fundamental importance to the data subject.
Legitimate interest (Art. 6(1)(f)): the processing is necessary for Gotland360’s legitimate interest in enabling care in connection with accidents.
Express consent / protection of fundamental interest when consent cannot be given (Art. 9(2)(a) / Art. 9(2)(c)): in relation to possible processing of sensitive personal data.
Storage time
No personal data is stored specifically for the purpose of care and social care.
Purpose: Administration of races
To enable races by coordinating and administering officials and the officials’ work, landowners and neighbors affected by races, as well as partners and other suppliers who contribute with race-specific deliveries.
Category of personal data
- Contact details
- Association information
- Property details
- Social security number
Legal basic
Legitimate interest (Art. 6(1)(f)): the processing is necessary for Gotland360’s legitimate interest in administering and enabling races.
Storage time
Agreements are stored for 10 years from the end of the agreement period, unless circumstances dictate otherwise.
Other personal data is deleted no later than 3 years after the relationship with Gotland360 ended.
Purpose: Administration of t-shirts and medals
To enable the delivery of t-shirts and medals from the race, as well as associated administration.
Category of personal data
- Contact details
- Participant details
- Association information
- Payment information
- Social security number
Legal basic
Agreement (Art. 6(1)(b)): the processing is necessary for Gotland360 to be able to fulfill a contractual obligation.
Storage time
Personal data is stored for a maximum of 3 years from the end of the calendar year in which the relevant race was carried out.
For accounting documents, see under the purpose Legal obligations.
Purpose: To provide a participant profile
To provide a participant profile to simplify the registration process and improve the participant experience in accordance with Gotland360 contractual obligations, as well as enable internal analysis and follow-up of participation and participants.
Category of personal data
- Contact details
- Participant details
- Race details
- Association information
- Order information
- Social security number
Legal basic
Agreement (Art. 6(1)(b)): the processing is necessary for Gotland360 to be able to fulfill a contractual obligation.
Legitimate interest (Art. 6(1)(f)): the processing is necessary for Gotland360’s legitimate interest in providing a participant profile.
Storage time
Personal data is stored for 5 years from the end of the calendar year in which the race for which your last registration was carried out.
Purpose: To provide a business portal
To provide a corporate portal to simplify the participant registration process for corporate customers, improve the customer experience, enable companies to initiate their own registration procedures, and enable internal analysis and tracking of participation and participants.
Category of personal data
- Contact details
- Participant details
- Race details
- Order information
- Social security number
- Sensitive personal data (Data on dietary preferences)
Legal basis
Legitimate interest (Art. 6(1)(f)): the processing is necessary for Gotland360’s legitimate interest in providing a business portal.
Express consent (Art. 9(2)(a)): in relation to the processing of sensitive personal data.
Storage time
Personal data is stored for 3 years from the end of the calendar year in which the race for which the latest registration was intended was carried out.
Purpose: Provide a web shop
To enable the purchase of additional services for races, gift cards and other products in Gotland360’s store, including enabling and administration of payments, as well as other order administration and order handling, including order delivery.
Category of personal data
- Contact details
- Order information
- Payment information
- Photo details
- Social security number
Legal basic
Agreement (Art. 6(1)(b)): the processing is necessary for Gotland360 to be able to fulfill a contractual obligation.
Legitimate interest (Art. 6(1)(f)): the processing is necessary for Gotland360’s legitimate interest in providing a webshop for sale.
Storage time
Personal data is stored for 3 years from the end of the calendar year in which your purchase was made in order to meet our obligations under consumer legislation.
In the case of gift cards, personal data is stored for 1 year from the end of the calendar year in which the gift card’s validity period has expired.
Other personal data is deleted no later than 1 year after the end of the calendar year in which the contractual relationship with Gotland360 was terminated.
For accounting documents, see under the purpose Legal obligations.
Purpose: Film, image and documentation
To film and broadcast Gotland360 for the public, enable and carry out photography during arrangements to document, as well as administer and store film and images to enable historical preservation.
Category of personal data
- Contact details
- Race details
- Photo details
Legal basic
Agreement (Art. 6(1)(b)): the processing is necessary for Gotland360 to be able to fulfill a contractual obligation.
Legitimate interest (Art. 6(1)(f)): the processing is necessary for Gotland360’s legitimate interest in providing/enabling film and image services, as well as film and image storage.
Storage time
The parts of film and images that are not needed for documentation and historical preservation are continuously thinned out and otherwise preserved forever.
Purpose: Marketing, events and other mailings
To provide participants and other stakeholders with information, such as via newsletters, inspirational letters or invitations to events, conduct participant surveys, create and store contact lists, enable marketing from collaboration partners, administer and implement campaigns and events, such as sponsor meetings and analyze and evaluate activities for improvement purposes.
Category of personal data
- Contact details
- Participant details
- Race details
- Association information
- Photo details
Legal basic
Consent (Art. 6(1)(a)): offers, benefits, tips and inspiration from our partners are sent out based on your consent.
Legitimate interest (Art. 6(1)(f)): the processing is necessary for Gotland360’s legitimate interest in fulfilling the purposes.
Express consent (Art. 9(2)(a)): in relation to the processing of sensitive personal data.
Storage time
Personal data is stored for a maximum of 3 years from the end of the calendar year of your last registration, alternatively your last contact with Gotland360.
Purpose: General communication
To enable internal communication, including communication via e-mail, telephone and intranet, as well as external communication, such as press releases, or communication with stakeholders via e-mail, telephone, contact form, social media, etc.
Category of personal data
- Contact details
- Order information
- Photo details
Legal basic
Legitimate interest (Art. 6(1)(f)): the processing is necessary for Gotland360’s legitimate interest in being able to communicate internally and externally.
Storage time
Personal data is stored for a maximum of 2 years from the end of the calendar year in which collection took place, provided that the personal data is not processed for any other purpose.
Purpose : Press and media
To provide a press room, enable press/media coverage, enable the media to follow and report on races after accreditation, and share statistics, start list and results with the media.
Category of personal data
- Contact details
- Participant details
- Race details
- Association information
- Photo details
Legal basic
Legitimate interest (Art. 6(1)(f)): the processing is necessary for Gotland360’s legitimate interest in fulfilling the purposes.
Storage time
Personal data is stored for 1 year from the end of the calendar year in which the race for which the activity referred was carried out.
In the case of press rooms, personal data is stored for 3 years from the end of the calendar year in which publication took place.
Purpose: Customer service
To provide support and customer service in relation to Gotland360’s services and products, including administration of complaint cases.
Category of personal data
- Contact details
- Participant details
- Race details
- Order information
- Association information
Legal basic
Agreement (Art. 6(1)(b)): the processing is necessary for Gotland360 to be able to fulfill a contractual obligation.
Legitimate interest (Art. 6(1)(f)): the processing is necessary for Gotland360’s legitimate interest in providing a customer service.
Storage time
Personal data is stored for 2 years from the end of a customer service matter.
Purpose: Website, app and social media
To provide meeting places for Gotland360 with various stakeholders, present and market Gotland360’s activities, facilitate interactions with participants, and track and analyze usage to improve the user experience on Gotland360’s social channels.
Category of personal data
- Contact details
- Participant details
- Race details
- Association information
- Usage information
- Photo details
Legal basic
Consent (Art. 6(1)(a)): for the use of cookies other than necessary, we collect your consent. You can read more about our use of cookies in our Cookie Information.
Legitimate interest (Art. 6(1)(f)): the processing is necessary for Gotland360’s legitimate interest in providing a website, app and social media.
Storage time
Personal data processed via Gotland360’s website and app are deleted when they are no longer necessary for its purpose, taking into account the storage time for Gotland360’s other processing that takes effect on these platforms.
No personal data is stored specifically for the purpose of providing meeting places via social media.
Purpose : Business related purpose
To enable Gotland360 to be able to carry out activities within the scope of our business area, such as creating, managing and storing documents and records, carrying out sales activities and evaluating collaboration partners, administering supplier invoices, accounting and agreements, as well as fulfilling our corporate or association law obligations, such as establishing minutes, annual report/accounts and other necessary documents.
Category of personal data
- Contact details
- Association information
- Social security number
Legal basic
Legal obligation (Art. 6(1)(c)): the processing is necessary to fulfill a legal obligation.
Legitimate interest (Art. 6(1)(f)): the processing is necessary for Gotland360’s legitimate interest in fulfilling the purposes.
Storage time
Company and association documents are stored as long as they are relevant in relation to Gotland360’s operations.
Agreements are stored for 10 years from the end of the agreement period, unless circumstances dictate otherwise.
Otherwise, personal data is only stored for as long as stated under applicable purpose in this table.
For accounting documents, see under the purpose Legal obligations.
Purpose : Legal obligations
To ensure compliance with legislation, such as the Accounting Act (1999:1078), respond and follow requests and demands from authorities and courts, etc. , as well as follow requirements for external audits.
Category of personal data
- Contact details
- Social security number
Legal basic
Legal obligation (Art. 6(1)(c)): the processing is necessary to fulfill a legal obligation.
Storage time
Accounting documents are stored for 7 years after the calendar year in which the accounting year ended in accordance with Gotland360’s obligations under the Accounting Act.
Application documents for advertised positions are stored for 2 years after the advertised position has been filled in accordance with the Discrimination Act.
Other personal data is processed as long as it is necessary to fulfill the purpose.
- Who can we share your personal data with?
In order to run Gotland360’s business, we may share your personal data with third parties under certain conditions. We may share your personal data with the following categories of recipients:
Suppliers : In cases where it is necessary for the purposes described under section 5 above, we may share your personal data with suppliers to Gotland360, who process your personal data on our behalf and in accordance with our instructions, so-called personal data processors. It may be a supplier of IT services for timing, race registration, payment solutions or security systems, and which contributes to Gotland360 being able to provide its services. Gotland360 only shares personal data with trusted suppliers who, by agreement with us, have committed to take technical and organizational security measures regarding your personal data, and to only process these on our instructions. Some suppliers are independent data controllers for the processing of your personal data, for example banks and insurers. This Privacy Policy does not apply to suppliers who are independent personal data controllers.
Collaboration partners : We may also share your personal data with our collaboration partners under certain conditions. We always carry out a suitability assessment before we share your personal data with partners to ensure your privacy.
Public organisations: We may share necessary information with public organisations, such as the Police, the Tax Agency, courts and healthcare, when we are obliged to do so, we are protecting your interests, or at your request.
External advisors : When necessary to safeguard Gotland360’s interests, we may share personal data with external advisors, such as accountants or lawyers.
- Transfer of personal data to countries outside the EU/EEA
We always strive to only process your personal data within the EU/EEA. In exceptional cases, however, we may share your personal data with suppliers, including subcontractors, and collaboration partners outside the EU/EEA. We always ensure that the necessary organizational and technical security measures are taken before a transfer to a third country takes place, to ensure an adequate level of protection for your personal data in accordance with the Data Protection Regulation and other applicable data protection legislation. We or our suppliers only transfer personal data to third countries in the following cases:
- The transfer takes place to a country covered by a decision on an adequate level of protection from the European Commission (Art. 45 Data Protection Regulation). If such a decision exists, the country to which personal data is transferred is considered to have a sufficiently high level of protection for a transfer to be permitted without special permission. Which countries are covered can be found at any time on the European Commission’s website.
- Appropriate protective measures have been taken, including that the personal data exporter and personal data importer have entered into the European Commission’s standard contractual clauses for third country transfer, and, where applicable, additional security measures have been taken (Art. 46 of the Data Protection Regulation).
- Your rights in relation to your personal data
Gotland360 protects your rights in relation to your personal data and that you can exercise these in relation to Gotland360. Below follows an account of the rights attributed to you according to the Data Protection Regulation. If you wish to exercise any of your rights, you can contact us via the contact details set out in section 11 below.
Right to information : You have the right to receive information about how we process your personal data. We primarily provide this information via this Privacy Policy.
Right of access : You have the right to be informed on request whether we process your personal data, and if this is done, access to the personal data in the form of a free register extract, as well as information about how we process your personal data, such as information about purposes and categories of personal data. If a record extract request is sent repeatedly, we may charge a reasonable fee to administer such a request.
Right to rectification : You have the right to have incorrect personal data that we process about you corrected without delay, as well as the right to have incomplete personal data that we process about you supplemented.
Right to deletion ( the right to be forgotten ): You have the right, under certain conditions, to have the personal data we process about you deleted. This applies, among other things, if personal data is no longer necessary in relation to the purposes for which it was collected, you withdraw your consent and there is no longer a legal basis for processing the personal data, the personal data has been processed in an illegal manner, you have objected to our processing of your personal data and there are no legitimate reasons for the processing, or if you have objected to processing for direct marketing purposes. To the extent that our processing of your personal data is necessary for a specific reason, for example to defend a legal claim, we are not obliged to delete your personal data and can then refuse your request.
Right to restriction of processing : You have the right, under certain conditions, to demand that our processing of your personal data be restricted. This applies if you dispute the correctness of the personal data, our processing of your personal data is illegal or that we no longer need the personal data for the purposes of the processing. You can also request restriction while we evaluate whether our legitimate reasons for the processing of your personal data are after you object to the processing.
Right to data portability : You have the right to obtain your personal data that you have provided to us in a structured, commonly used and machine-readable format. You also have the right to transfer this personal data to others without hindrance from us. If it is technically possible, you have the right to request that we carry out such a transfer directly to another. Your right to data portability requires that the processing is based on your consent or on an agreement, and takes place automatically.
Right to object : You have the right under certain conditions to object to our processing of your personal data. This applies when we process personal data after a balance of interests. We may then only continue to process your personal data if we have compelling legitimate reasons that outweigh your interests. You always have the right to object to processing of your personal data that involves direct marketing. After such an objection, we are obliged to cease processing for such purposes.
Right to revoke consent : If Gotland360 processes your personal data based on consent, you have the right to revoke such consent at any time. We will then stop processing your personal data.
Right to submit a complaint : If you have a complaint about our processing of personal data, you have the right to submit a complaint to IMY, which is the Swedish supervisory authority.
- Cookies and Other tracking technology
Please see our Cookie Information for more information on how Gotland360 uses cookies and other tracking technologies.
- The occurrence of automated decision making
Gotland360 may use automated decision-making, including profiling , based on your personal data. Your personal data may be used for automated decision-making, including profiling , in the following cases:
- Purchase behaviors and targeted offers: Gotland360 may, based on your previous purchase behaviors regarding our races, target offers for the purchase of starting places to certain such previous participants.
- Analysis of purchasing behaviour: We may also analyze and draw conclusions about purchasing behavior in general, with the aim of developing our business and our services and products.
- Contact details and updates
If you want additional information about how we process your personal data, you can contact us by letter, e-mail, phone or via our contact form which you can find on our website.
Gotland360 Bike Event AB
Northland Bringes 233, 622 50 Romakloster
info@gotland360.se
This Privacy Policy may be updated.