Privacy policy
Data controller
Camino de Dragones, S.L., tax ID (NIF) B-23904261, registered office at Calle Sant Feliu 30, Esc. B, P. 2, Pta. 2, 08390 Montgat (Barcelona), Spain. Data protection contact email: info@caminodedragones.es.
What data we process, why and on what legal basis
Processing | Data | Legal basis | Retention |
Registration and organisation of the race | Captain and team members: first name, surname, ID card or passport number, date of birth, email, phone, 10 km time and running order; vehicles and drivers' phone numbers | Performance of the registration contract (Art. 6(1)(b) GDPR) | Until the end of the edition and then blocked for the statutory limitation periods |
Payments and invoicing | Payer details and amount | Legal obligation (Art. 6(1)(c) GDPR) | 6 years (Spanish Commercial Code) |
Accident and civil liability insurance | Runners' identification data and, in the event of a claim, the data needed to handle it | Performance of the contract and legal obligation to insure the race | As long as needed to handle the claim and until it becomes time-barred |
Health and minors | Declaration of physical fitness; for runners aged 16 and 17, the signed consent form (the medical certificate and the copy of the signer's ID are checked at start-pack collection and handed back, with no copy kept; the date and the person who checked them are recorded); medical assistance during the race | Explicit consent (Art. 9(2)(a) GDPR); in an emergency, vital interests (Art. 9(2)(c) GDPR) | Up to 1 year after the race, unless a claim is pending |
Results | Team name, number, times and penalties | Legitimate interest in publishing the results (Art. 6(1)(f) GDPR) | Kept published as a record of the race |
Photos and videos | Participants' image | General coverage of the race: legitimate interest. Promotional use in which a participant appears prominently: consent, requested through a separate, optional box in the assumption-of-risk document | For as long as the material is used or until consent is withdrawn |
Newsletter (website form) | Consent (Art. 6(1)(a) GDPR) | Until the user unsubscribes | |
Information about new editions for captains of previous editions | Captain's name and email | Legitimate interest (Art. 6(1)(f) GDPR) and Art. 21(2) LSSI, as these are services similar to those already purchased, only if, when registering the team, they did not tick the box to opt out. Every email includes an unsubscribe link | Until the captain unsubscribes |
Volunteers | Name, date of birth, phone, T-shirt size, driving licence and vehicle, availability and, if given, allergies or diet (used only for meals) | Consent (Art. 6(1)(a) GDPR; for allergies, Art. 9(2)(a) GDPR) | Until the end of the edition |
Team members' data
The captain provides the data of the other team members. In doing so, the captain declares that they have informed them of this policy and of the Rules and that they agree. Each runner confirms their data when signing the assumption-of-risk form before the start.
Minors
Only minors aged 16 and 17 may take part, with the consent of their parent or legal guardian, who must run on the same team. Their data are processed with the same safeguards and only to manage their participation.
Recipients
We do not sell data. We only share them with:
The race insurer, for the mandatory insurance policies.
Emergency services and authorities (112, Mossos d'Esquadra, Servei Català de Trànsit, local councils), when necessary for safety or required by law.
Providers working on behalf of the organisation under a data processing agreement: Vltava Run s.r.o. (Czech Republic), which manages the website, the registration platform and email, and relies on Breezy s.r.o. (SolidPixels, Czech Republic) for the website platform and hosting, on an external developer for the registration platform, on Ecomail for sending emails and on Google (Google Workspace) for email and documents; the official timing company; and the race photographers and videographers.
International transfers
The providers of the website, registration and email sending are in the European Union. Google (Google Workspace) may process data in the United States. Google LLC is certified under the EU-US Data Privacy Framework, which the European Commission considers to provide an adequate level of protection.
Your rights
You may at any time exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw any consent you have given, by writing to info@caminodedragones.es. If we have reasonable doubts about your identity, we may ask you for the additional information needed to confirm it. Withdrawing consent does not affect processing carried out before. If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
Security and automated decisions
We apply appropriate technical and organisational measures to protect the data. We do not make automated decisions or create profiles.
Last updated: 7 November 2026.