Privacy Policy for Young Talents Applicants
This Privacy Policy refers exclusively to applications made through the entry form on the website www.irondames.ch (hereinafter the “Website“). In accordance with the European Regulation on Data Protection (Regulation (EU) 2016/679, hereinafter also “GDPR“) and the relevant regulations, such as the Switzerland Federal Act on Data Protection (FADP) and its ordinance (hereinafter, collectively, the “Applicable Law“), this Privacy Policy is provided to drivers who apply for the Iron Dames Young Talents event directly on the Website (hereinafter, “Applicants”) and their parents/legal representatives, who make the application on behalf of the Applicants (hereinafter, “Representatives”).
1. Data Controller and contact details
The Data Controller is DC Racing Solutions S.A., with registered office in Baarerstrasse 80, 6300-Zug (Switzerland), VAT n. CHE-296 968 866 (hereinafter, “Data Controller” or just “Controller“).
For any clarification, information, or exercise of the rights listed in this Privacy Policy, the Data Controller can be contacted at the following e-mail: info@irondames.ch
2. Personal data subject to processing
The personal data processed are those provided by the Representatives, also on behalf of the Applicants, while fulfilling the “Entry Form” that is available on the “Iron Dames Young Talents” section of the Website, as well as the personal data contained in the documents that can be uploaded to the above-mentioned “Entry Form”.
In order to send the application, the Data Controller does not require or ask for personal data that belong to special categories, which mean personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and/or genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.
If the Representatives, on behalf of the Applicants, autonomously decide to provide those personal data in the documents, they must insert a formula like the following in order to allow the processing of those data: “I, [Representative’s name, last name, place and date of birth], give the consent on behalf of [Applicant’s name, last name, place and date of birth] to the processing of personal data belonging to special categories present in the application for the Iron Dames Young Talents event”.
The Data Controller shall process personal data in compliance with the Applicable Law, assuming that they refer to the Applicants or to third parties who have expressly authorised the Applicants to provide them or whose personal data the Applicants was entitled to provide. With respect to these assumptions, the Applicants and the Representatives undertake to indemnify and hold harmless the Data Controller from any dispute, claim or request for compensation for damage caused by the processing of personal data that may be received from such third parties.
Please note that the User is not expected or required to register on the Website to access its pages. The User, therefore, will not have a personal account in which data and information referring to the same will be stored and accessible by the User for consultation and/or modification.
The Data Controller shall process personal data in compliance with the Applicable Law, assuming that they refer to the User or to third parties who have expressly authorised the User to provide them or whose personal data that the User was entitled to provide. With respect to these assumptions, the User undertakes to indemnify and hold harmless the Data Controller from any dispute, claim or request for compensation for damage caused by the processing of personal data that may be received from such third parties.
3. Purposes and legal basis of the processing
The personal data of the Applicants shall be processed for the following purposes:
| PURPOSES | LEGAL BASIS |
|---|---|
| Evaluate and select the Applicants that will participate in the Iron Dames Young Talents event. | The implementation of pre-contractual measures at the request of the Applicant and/or the contract to which she is party [Article 6(1)(b) of the GDPR]. If the Applicant autonomously decides to provide in the uploaded documents personal data belonging to special categories, the legal basis is the consent that the Applicant gives to the processing of her personal data [Article 6(1)(a) of the GDPR]. |
| Send the information about how to prepare for the Iron Dames Young Talents event to the Applicants that have been selected to participate. | The implementation of pre-contractual measures at the request of the Applicant and/or the contract to which she is party [Article 6(1)(b) of the GDPR / Article 31(2)(a) of the FADP]. |
| Organize the Iron Dames Young Talents event (i.e. organizing training activities, organizing meet and greet with the Iron Dames, organizing laps, etc.) | The implementation of pre-contractual measures at the request of the Applicant and/or the contract to which she is party [Article 6(1)(b) of the GDPR / Article 31(2)(a) of the FADP]. |
| Evaluate the Applicants that will participate in the Iron Dames Young Talents event, in order to select new Iron Dames team members. | The implementation of pre-contractual measures at the request of the Applicant and/or the contract to which she is party [Article 6(1)(b) of the GDPR / Article 31(2)(a) of the FADP]. |
| Complying with legal obligations to which the Data Controller is bound, included to respond to any requests to exercise the Applicants’ rights as data subjects under current data protection legislation. | The compliance with legal obligations to which the Data Controller is bound [Article 6(1)(c) of the GDPR / Article 31(1) of the FADP]. |
| Ascertaining, exercising, or defending legal claims or whenever courts are acting in their judicial capacity. | The legitimate interest of the Data Controller to ascertain, exercise, or defend legal claims or whenever the courts are acting in their judicial capacity [Article 6(1)(f) of the GDPR / Article 31(1) of the FADP]. |
The personal data of the Representatives shall be processed for the following purposes:
| PURPOSES | LEGAL BASIS |
|---|---|
| Identify the parents or legal representatives that are acting on behalf of the minor Applicants. | The implementation of pre-contractual measures at the request of the Applicant and/or the contract to which she is party [Article 6(1)(b) of the GDPR / Article 31(2)(a) of the FADP]. |
| Complying with legal obligations to which the Data Controller is bound, included to respond to any requests to exercise the Representatives’ rights as data subjects under current data protection legislation. | The compliance with legal obligations to which the Data Controller is bound [Article 6(1)(c) of the GDPR / Article 31(1) of the FADP]. |
| Ascertaining, exercising, or defending legal claims or whenever courts are acting in their judicial capacity. | The legitimate interest of the Data Controller to ascertain, exercise, or defend legal claims or whenever the courts are acting in their judicial capacity [Article 6(1)(f) of the GDPR / Article 31(1) of the FADP]. |
4. Consequences of failure to provide personal data
Failure to provide the personal data, in whole or in part, may determine the impossibility to apply for and, therefore, to participate in the Iron Dames Young Talents event.
5. Methods of personal data processing
Personal data are processed with manual and/or paper-based and/or computer-based and/or telematic instruments and/or supports, in any case in such a way as to guarantee their security and confidentiality. To this end, the Data Controller has adopted and implements security measures, both technical and organisational, appropriate to the level of risk related to the processing of personal data carried out. In particular, the Website functionality is provided on HTTPS encrypted connection and personal data are collected, filed and stored on secure servers, protected by firewalls and physically located within the European Economic Area.
6. Recipients of personal data
The personal data provided by the Applicants and the Representatives may be shared, for the purposes set out in paragraph 3 above, with:
- employees or other types of collaborators of the company authorized by the Data Controller to process those personal data and who have received specific instructions on how to process the personal data in accordance with the Applicable Law;
- Iron Lynx S.r.l., acting as data processor, with registered office in Via Civinelli, 950 – 47522, Cesena (Italy), VAT n. 04345820403, in order to publish the “Entry Form” on the “Iron Dames Young Talents” section of the Website and in order to collect and provide to the Data Controller the Applicants and Representatives’ personal data;
- companies, consultants or professionals who may be entrusted with the maintenance and updating of the Website and, in general, management of the Data Controller’s hardware and software, including the hosting provider and cloud computing services providers who typically act as data processor;
- Public Authorities to whom, in their capacity as independent data controllers, it is obligatory to disclose those personal data by virtue of legal provisions or orders of the authorities;
- law firms, associated firms, consultants or professionals (e.g., legal, administrative and/or tax consultancies) who may be appointed to support the Data Controller in order to ensure the correct fulfilment of the legal obligations with which it is required to comply; the ascertainment, exercise or defence of a right in court or whenever the jurisdictional authorities exercise their jurisdictional functions.
7. Data transfers to countries outside the EEA or international organisations
The Iron Lynx S.r.l.’s hosting provider’s servers are located within the European Economic Area. However, personal data are transferred to Switzerland, where the Data Controller is based: the transfers of personal data between the European Economic Area and Switzerland take place on the basis of the adequacy decision pursuant to article 45 GDPR. In addition, some of the Data Controller’s suppliers or the servers of such suppliers may be located in countries outside the EEA: in these cases, the Data Controller guarantees that the transfers take place ensuring an adequate level of protection of data subjects’ rights and freedoms (i.e. on the basis of a adequacy decision or standard contractual clauses).
For more information, the Applicants and/or the Representatives can contact the Data Controller at the e-mail listed in paragraph 1.
8. Period of retention of personal data
The personal data provided by the Applicants and the Representatives will be retained for a period not exceeding the fulfilment of the above-mentioned purposes for which they are processed.
Regarding the processing of personal data for the purpose of recruiting new Iron Dames team members, these data will be kept for a period of 24 months from the moment the Data Controller concluded the recruiting process.
9. Rights of the data subject
The Applicants and the Representatives, as data subjects, within the limits of their respective roles, are entitled:
- to receive confirmation as to whether or not their personal data are being processed and, if so, to obtain access to them and to a range of relevant information, including, by way of example, information relating to: a) the purposes of the processing; b) the categories of personal data that are subject to processing; c) the entities or categories of entities to whom or which the personal data have been or will be communicated; d) the storage period of the data or, if that is not possible, the criteria used to determine that period; e) the source of the personal data, if they have not been provided by the Applicants and/or the Representatives;
- to request and obtain the updating of personal data, the rectification of inaccurate data or, when needed, the integration of incomplete data;
- • to request and obtain the erasure of personal data if: a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; b) the Applicants and/or the Representatives object to the processing carried out on the basis of a legitimate interest of the Controller and there is no overriding legitimate reason to continue the processing; c) the personal data have been processed unlawfully; d) the personal data must be erased by the Controller in compliance with a legal obligation;
- to request and obtain the restriction of processing in the event of: (a) contestation of the accuracy of their personal data for the time necessary for the Data Controller to carry out the requested verifications; (b) unlawful processing of data by the Data Controller, if the Applicants and/or the Representatives object to the deletion of the data and instead request the restriction of their use; (c) ascertainment, exercise or defence of a right of the data subjects in court, although the Data Controller no longer needs the data for the purposes of processing; (d) awaiting the outcome of the verification as to whether the Data Controller’s legitimate reasons prevail over those of the data subjects;
- in cases where the processing of personal data is based on a contract and is carried out by automated means, to request and receive in a structured, commonly used and machine-readable format their personal data and, if technically feasible, to obtain the direct transmission of them by the Controller to another controller;
- to object, in whole or in part, on legitimate grounds relating to their particular situation, to the processing of personal data concerning the Applicants and/or the Representatives, even though they are relevant to the purpose of collection;
- in cases where the processing of personal data is based on the consent, to withdraw, at any time, the given consent; the withdrawal shall not affect the lawfulness of processing based on consent before its withdrawal;
- to file a complaint with the competent Data Protection Authorities.
The Data Controller shall inform each of the recipients to whom the personal data of the Applicants and/or of the Representatives have been transmitted of any rectification, cancellation and/or restriction of processing carried out, except when this proves impossible or involves a disproportionate effort.
10. Ways of exercising rights of data subjects
As data subjects, the Applicants and/or the Representatives may exercise the above-mentioned rights at any time by contacting the Data Controller at the e-mail listed in paragraph 1.
If the Applicants and/or the Representatives wish to lodge a complaint, they may use, if available, the forms on the website of the competent Data Protection Authorities.
11. Changes to this Privacy Policy
This Privacy Policy may be amended and/or integrated and/or updated periodically, also as a consequence of the updating of the Applicable Law.
In this case, the Data Controller shall inform the Applicants and the Representatives of any amendments and/or additions and/or updates to this Privacy Policy by publishing the updated version of the Privacy Policy on the Website.
Last Update: 27/05/2024
