Welcome to our platform for the communication, sharing and enjoyment of information, services and experiences related to the world of endurance and outdoor sports.
This Policy is intended to illustrate the methods and purposes of the personal data processing carried out by Endu S.r.l., as data controller (hereinafter, "ENDU" or the "Controller"), in the provision of services through the website www.endu.net (the "Site") or other websites or mobile applications for which ENDU provides this notice (hereinafter, the ENDU Services). In relation to certain services, ENDU reserves the right to provide a specific notice that may from time to time supplement or amend this notice; in the event of conflict, the terms of the specific notice relating to the particular service shall prevail.
What is set out here shall be deemed applicable to anyone who browses the Site or otherwise interacts with the ENDU Services, accessible electronically also by means of any existing or forthcoming mobile applications, and more generally to the natural persons whose personal data is collected and processed within the scope of the ENDU Services (users of the ENDU Services and, more generally, all persons whose data is processed within the scope of the ENDU Services shall hereinafter also be referred to as the "Data Subjects").
The processing of the personal data of Data Subjects shall take place in compliance with applicable law, with particular reference to EU Regulation 2016/679 (hereinafter also the "Regulation") on the protection of natural persons with regard to the processing of personal data, as well as national implementing provisions and measures of the Italian Data Protection Authority.
1. Scope of application
Every person has the right to the protection of their personal data.
For this reason, ENDU has always been strongly committed to ensuring respect for the privacy of Data Subjects and their right to be adequately informed about the collection and processing of their data.
The ENDU Services have therefore been configured, in compliance with the principles of necessity and proportionality, in such a way as to minimise the collection and use of identifying data of Data Subjects, excluding its processing in all cases where the intended purposes can be achieved through the use of anonymous data or by other means.
For the avoidance of doubt, it is clarified that this Privacy Policy must be considered as referring to and therefore applicable solely to the ENDU Services offered by the Controller, without extending to: (i) products and services provided by third parties through the platform and the ENDU Services; (ii) pages or sites accessible via links from the ENDU Services and managed by third parties.
Each user is therefore invited to carefully read the relevant privacy policies for a more detailed understanding of the processing carried out through such sites and services.
It is further clarified that ENDU makes its platform available to event organisers, sports associations and clubs, and other parties that provide support to organisers as well as to sports bodies, or that sell goods or services related to the sporting activities covered by the Services; through the ENDU platform, therefore, the aforementioned parties may directly provide goods or services to users (for example, they may collect registration for an event or a sports body, or sell goods related to the sporting event). In such cases, for the purposes of personal data protection, the parties in question operate as independent data controllers on the basis of the independent relationship (for example, the relationship arising from registration for the event or sports body) established with the user within the ENDU platform, while ENDU, as provider of the platform used by the controllers, will act as their data processor pursuant to art. 28 of the Regulation and in that capacity may acquire and transmit users' data to the controllers. This notice therefore does not cover the processing that such parties will carry out in their capacity as independent data controllers. Whenever a user establishes an independent relationship with the parties in question through the ENDU platform, they are responsible for reading and checking the notice provided by such parties, in order to understand the purposes and legal basis of the processing and to give informed consent where required.
2. Purposes and legal basis of processing
The personal data of Data Subjects is processed by the Controller for the purposes specified below.
For the performance of the contract or otherwise to provide ENDU Services requested by the user
The data of the user and the persons indicated by them will be processed by ENDU for the performance of the contractual relationship and the provision of the ENDU Services supplied at the user's request.
In particular, ENDU may process the data of the user and the persons indicated by them for the conduct of operational and administrative activities necessary for: (i) managing registration, authentication and access to the platform; (ii) providing geolocation, timing, statistical analysis and other similar services related to participation in sporting events or the conduct of training sessions; (iii) managing requests for the purchase of goods or services offered through the platform directly by ENDU or by third parties, including registrations for sporting events and competitions as well as the purchase of ancillary goods or services in connection with such events; (iv) managing payment transactions at the user's request, to enable banking and credit institutions to proceed with the verification of the chosen payment method, debits and the management of other service procedures; (v) offering a platform of contacts and useful information on the world of endurance and outdoor sports, facilitating communication and information exchange between users through networking and messaging services and their participation in initiatives of various kinds (sporting, recreational, charitable) organised by ENDU or third parties, and providing a thematic Newsletter service dedicated to the world of endurance and outdoor sports and the sporting projects and events organised by ENDU and third-party partners; (vi) managing, at the user's request, the interactions of the ENDU Services with third-party social network platforms, to which users may connect according to their preferences in order to share activities or information concerning them; (vii) providing ENDU Services (for example, ENDUpix or other similar services) through which ENDU enables participants in sporting events (and persons authorised by them) to purchase, upon subscription to its services, the photographic and video footage depicting them during the event; (viii) the issuance of administrative, accounting and tax documents relating to the ENDU Services requested by the user.
For this purpose, ENDU may process the data indicated in points a), b), c), d), e) and f) of the following article 3).
The legal basis for processing is represented by article 6(1)(b) of the Regulation, as the processing is necessary for the performance of a contract to which the user is a party, or otherwise to provide the ENDU Services requested by the Data Subject.
Where, for the purpose of providing the requested ENDU Services, the Controller needs to process special categories of data of the user (i.e. data relating to their state of health), the legal basis for processing will also be represented by the explicit consent of the user pursuant to article 9(2)(a) of the Regulation. Failure to provide consent, as well as its withdrawal, will result in the inability to provide the requested ENDU Services for which such data is necessary.
Where, for the purpose of providing the requested Services, ENDU needs to process special categories of data of the user (i.e. data relating to their state of health), the legal basis for processing will also be represented by the explicit consent of the user pursuant to article 9(2)(a) of the Regulation. Failure to provide consent, as well as its withdrawal, will result in the inability to provide the requested Services.
Similarly, where the ENDU Service requested by the user requires the use of data relating to the location of the electronic device used by the user for the purpose of using the service, ENDU will request the prior consent of the Data Subject for this purpose, which may be withdrawn at any time.
With regard to the publication and distribution, through the Site and the ENDU Services (for example, ENDUpix or other similar services), of photographs and videos relating to sporting events and competitions, individual participants will be asked for specific authorisation at the time of registration, collected by the organiser.
Finally, where at the express indication of the User and always for the purpose of providing the ENDU Services, the Controller finds itself processing personal data of persons with whom it has no direct relationship (for example, the identifying or contact details of a third party registered by a user for a sporting event through the services), the processing will be based, in addition to the need to provide the requested ENDU Service and the authorisation indirectly provided by the Data Subject, also on the legitimate interest of the Controller pursuant to article 6(1)(f) of the Regulation, insofar as the user providing the third party's data through the ENDU Services declares that they do so with prior authorisation from the Data Subject, and the processing of the latter's data by ENDU, in addition to being reasonably foreseeable by the Data Subject in light of what has been declared by the user, does not infringe their fundamental rights and freedoms. In this case, the Data Subject nonetheless has the right to object at any time, on grounds relating to their particular situation, to the processing of their personal data, by writing to privacy@endu.net.
For compliance with legal obligations
The data of the user and the persons indicated by them will be processed by ENDU for compliance with legal obligations, such as, by way of example, tax-related obligations connected to the performance of the contract and the provision of the ENDU Services.
For this purpose, ENDU may process the data indicated in points a), b), c), d), e) and f) of the following article 3).
The legal basis for processing is represented by art. 6(1)(c) of the Regulation, as the processing is aimed at fulfilling a legal obligation to which the controller is subject.
For sending commercial communications relating to products/services similar to those already purchased
ENDU, pursuant to art. 6(1)(f) of the Regulation, may process the user's data on the basis of its own legitimate interest, for the purpose of sending, by email, commercial communications and/or communications relating to promotional initiatives concerning products and services similar to those already purchased by the user.
For this purpose, ENDU may process the data indicated in point b) of article 3).
In any case, the user may object at any time to the processing of their data for this purpose, by writing to privacy@endu.net.
In the event of an objection, ENDU will cease such data processing without delay and in any case no later than 5 days from the objection.
Furthermore, individual communications sent by email will contain a hyperlink allowing the user to object easily and intuitively to receiving further communications.
For sending commercial communications relating to ENDU or third-party services and products
Subject to the user's express and specific consent, ENDU, pursuant to art. 6(1)(a) of the Regulation, may process the user's personal data in order to send commercial communications relating to its own or third-party products and/or services, as well as to invite them to participate in promotional initiatives, loyalty programmes and/or initiatives with third-party partners, and to conduct market research and customer satisfaction surveys. Such consent is optional and is not a condition for entering into a contract with ENDU for the ENDU Services. ENDU may send the communications in question using automated systems (e.g. email, instant messaging systems such as "WhatsApp") and traditional channels (e.g. postal mail and calls with an operator).
For this purpose, ENDU may process identifying and contact data as well as data relating to the ENDU Services requested, as referred to in point b) of article 3; furthermore, where the user has given their consent to the profiling activities referred to in the following point e), ENDU may also process the information indicated in point a) of article 3) for marketing purposes.
The consent given by the user may be withdrawn at any time by writing to privacy@endu.net.
For profiling purposes
Subject to the User's express and specific consent, ENDU, pursuant to art. 6(1)(a) of the Regulation, may process the user's data in order to better understand their habits and interests and, consequently, to offer them products and services that ENDU believes may be of interest, as well as to improve the user experience in using the ENDU services. In particular, ENDU will process for this purpose personal data such as information relating to ENDU products and services purchased (by way of example, the type of events attended by the user, the type of products, frequency of purchase, amount spent), as well as data relating to their browsing on the Site. For this purpose, ENDU may process the data referred to in points a) and b) of article 3) (in any case, excluding data belonging to special categories, such as data relating to state of health). Such consent is optional and is not a condition for entering into a contract with ENDU for the ENDU Services.
The consent given by the user may be withdrawn at any time by writing to privacy@endu.net.
For the transfer of data to third parties for marketing purposes
Subject to the user's express and specific consent, ENDU, pursuant to art. 6(1)(a) of the Regulation, may disclose certain data of the user to event organisers and companies operating in the insurance, publishing, tourism, financial, sporting, automotive, energy, consumer goods, humanitarian and charitable sectors for the purpose of sending marketing communications by such parties. Such organisers and companies may therefore use the user's data for commercial and promotional purposes, using both automated systems (e.g. email, instant messaging systems such as "WhatsApp") and traditional channels (e.g. postal mail and calls with an operator).
The identifying data of the user that may be disclosed includes name, surname, date and place of birth, postcode of residence, their address or registered office and their contact details. Such consent is optional and is not a condition for entering into a contract with ENDU for the ENDU Services.
The consent given by the user may be withdrawn at any time by writing to privacy@endu.net.
On occasion, ENDU may request consent to the transfer of the user's data to third-party partners, for the purpose of sending marketing communications by such parties, including by means of automated systems (for example, email, instant messaging systems such as "WhatsApp"), in exchange for benefits or services offered without monetary payment. The user's data may be disclosed to the partners highlighted from time to time during the purchase flow. In this case too, the consent given may be withdrawn at any time by writing to privacy@endu.net. Where consent is requested in exchange for the provision of an ongoing service, the withdrawal of such consent will result in the interruption of the service offered.
For the making of video and photographic recordings
Where the user decides to register and participate in an event whose rules provide for the making of video or photographic recordings of the event, with the consequent release of a waiver for the use of their image, ENDU, on the basis of its own legitimate interest, may record the image of the Data Subject for the purpose of documenting the event and making the event photographs available to participants through its ENDUpix service.
In any case, the user may object at any time to the processing of their data for this purpose by writing to privacy@endu.net.
In the event of an objection, ENDU will cease such data processing without delay, without prejudice to the lawfulness of the data processing carried out up to the time of the objection.
For the purposes of documenting and evaluating sporting events
As part of its mission to create an information portal for all endurance and outdoor sports enthusiasts, ENDU may collect, publish and process for statistical purposes, through its platform, the personal data of participants in sporting events and competitions, with specific regard to the results (including placement, final time and intermediate times) achieved by such persons in sporting competitions that are already publicly accessible by virtue of the public nature of the event and the related results and/or by virtue of specific agreements between the participant and the event organiser. Also for the purpose of documenting sporting events and competitions, ENDU may further acquire, directly or through its commercial partners, the related photographic recordings.
The legal basis for processing is represented by art. 6(1)(f) of the Regulation insofar as ENDU uses the data for informational purposes without interfering with the rights and freedoms of the Data Subject, and the processing of data relating to results and photographic recordings in the terms described above is reasonably foreseeable by the Data Subject who takes part in a competition or event of a public nature whose results are intended to be disseminated and commented upon outside the circle of participants. In the case of photographic reproductions used by ENDU for the purpose of documenting events, the legal basis for processing may also be represented by the specific consent given by the Data Subject at the time of registration for the sporting event.
In any case, the Data Subject has the right to object at any time, on grounds relating to their particular situation, to the processing of their personal data and to withdraw any previously given consent, by writing to privacy@endu.net.
For purposes connected to corporate transactions or the transfer or lease of the Controller's business
ENDU may transfer the data of Data Subjects to parties resulting from corporate transactions to which ENDU is a party (for example, mergers, demergers, incorporations, etc.) or to companies that acquire or take on lease the Controller's business, or that otherwise, on the basis of a specific agreement, take over from the latter in the activity of providing the Services.
In such cases, the transfer will be aimed at enabling the normal continuation of relationships in connection with the provision of the Services and will be based on the legitimate interest of the Controller (cf. art. 6(1)(f) of the Regulation), without prejudice to the right of the Data Subject to object at any time, on grounds relating to their particular situation, by writing to privacy@endu.net. For this purpose, ENDU may process the data referred to in points a), b), c), d), e) and f) of article 3).
3. Types of data processed
Data voluntarily provided by the user
ENDU will process the personal data that the user provides at the time of registration, when requesting a specific service (for example, registration for a sporting event) or otherwise in the context of the relationship with ENDU.
Such data may include:
identifying and contact data (name, surname, gender, date of birth, company name or registered name, address, registered office, telephone and email contacts);
data relating to the ENDU Services used by the user and the sporting events in which the user has participated;
payment and billing data (data relating to credit cards and other payment systems used by the user);
special categories of data whose processing is necessary in connection with the provision of a Service requested by the user (for example, personal data relating to any disabilities of the Data Subjects, where necessary for registration in special sections or categories and for participation in sporting events and competitions);
personal information published and shared directly by the Data Subject through the Services, including any profile photos.
The provision of personal data is a necessary requirement for the provision and consequent use of the requested Services. Failure to provide certain data (personal details, email address, postal address, payment data and telephone number, etc.) may therefore result in the Controller's inability to provide the requested Services. In this regard, ENDU will indicate from time to time, including through its forms, the data whose provision is strictly necessary for the use of the Services and the additional data whose provision is instead necessary only in order to enrich the user experience within the Services themselves.
Public and/or freely accessible data and photographic recordings of sporting events
The Site and the ENDU Services also function as an aggregator of results from sporting events, both competitive and amateur. To this end, the Controller may process personal data drawn from lists, public registers (for example: rankings and results of sporting events organised by commercial partner and/or affiliated entities) or freely accessible to the general public.
It is also noted that, as provided for in registration forms for sporting events or competitions, participants may be recorded, by means of photographs or video, during the events, and in such cases the organiser may request their specific authorisation for the publication and distribution of the relevant images, including through third-party services, including ENDU.
ENDU processes personal data connected to the image of the participants recorded during the event for: (i) documenting the sporting event within the Site and the Services; (ii) making photos and videos available on the ENDU platform so as to allow the same participants to purchase and share the photos and videos depicting them through the ENDUpix service, as indicated in art. 2, letter g) of this notice.
ENDU may acquire recordings of the event from the organiser, also through its commercial partners, or, depending on the circumstances, carry them out directly in agreement with the organiser.
Each participant is free to authorise a family member or friend to view and purchase through the Services the photos and videos concerning them; the utmost care and responsibility is therefore recommended in choosing the person with whom to share the codes and credentials of the Services that allow the viewing and purchase of the recordings.
Furthermore, it is clarified that:
failure to authorise the photographic and video recordings and their making available for the purposes described above will result in the inability to register for the event, given that in light of the public nature of sporting events it is in practice impossible to exclude from recordings persons who have refused their authorisation;
payment and billing data (data relating to credit cards and other payment systems used by the user);
through the Controller's Services (for example, ENDUpix or other similar Services), the Data Subject (or the persons authorised by them) may purchase only the photographs and videos depicting them, or photographs considered of general interest in relation to the event; however, given the public nature of sporting events, it is not possible to exclude that the photographs and videos in question may also contain the image of Data Subjects other than the participant purchasing the photo or video;
given the characteristics of the events, video and photographic recordings may also be made in locations or in ways that are not signposted or with signage that is not always visible.
Where a person does not agree to the use of their image in the terms described above, they should not take part in events in relation to which the organisers acquire, at the time of registration, the rights for the subsequent publication and distribution of the recordings, including for payment and through third-party services, including ENDU.
Without prejudice to the above, the Data Subject may always send a written request to the Controller to obtain the removal of their image from the Site and the Services, or its obscuring, following identification of the photograph or video depicting them.
Where photographic and video recordings are instead published and distributed directly by the organiser or third parties through the ENDU platform, the Data Subject must contact the organiser and the third party, as independent data controllers, for the purpose of exercising their rights.
User location data and statistics of sporting events and competitions
The ENDU Services also include services connected to the tracking and/or timing of sporting events or sporting activities carried out in an unorganised form; in order to provide such Services, the Controller locates the user's geographical position through the GPS system of the device used or through other technologies, such as RFID. Tracking and timing services also involve the processing of location data for the calculation and display of key performance parameters such as distance, intermediate times and average pace/speed. Location is necessary for the provision of the requested ENDU Services and without access to such data the Controller is unable to provide the ENDU Services in question, which presuppose the identification of the geographical position of the devices used by users. To avoid being located, it is sufficient for the user not to use the location services provided by ENDU, or to prevent location through the settings of their device. Notwithstanding the above, the organiser of an individual sporting event may make participation subject to the location of participants for safety reasons or for other specific reasons. Data Subjects are therefore advised to carefully read the rules of individual events, asking the organiser directly for any clarifications in this regard.
Where the Controller's Services are used to send an emergency message, the user's position will be detected in real time and, upon the occurrence of the conditions specified in the terms of use of the ENDU Services and within the Services themselves, the user's position will be communicated by SMS and/or in-app message and/or email to the recipient chosen by the user.
Where ENDU Services are used for route tracking in the context of races or training sessions, the Controller will retain the data relating to the routes to allow the user to maintain a history of their routes on any device on which the ENDU Services are used, as well as to allow the user to share such data with other users or third parties through the ENDU Services. At any time, the user may ask the Controller to delete the data in question. In the event of a deletion request, ENDU will be unable to provide the Services connected to the storage and sharing of location data relating to the user's training sessions and races. In the event of closure of the user's account, the Controller will proceed to permanently delete or anonymise the data in question. In any case, deletion does not affect any processing of data carried out independently by the organiser of the sporting event.
Third-party data
When the user provides a telephone number or other contact details to which to automatically send an emergency message, or the identifying and contact details of a person to be registered for a sporting event or other initiative through the Services, the use of such data by ENDU occurs under the exclusive responsibility of the user, who must obtain the express authorisation of the Data Subject for this purpose. It is expressly prohibited to use the Services to communicate or disseminate personal data of third parties who have not previously and explicitly authorised the use of their data within the Services.
Data transmitted by the Data Subject's third-party providers
For the purpose of performing the Services requested by the Data Subject, ENDU may acquire and process data transmitted, with the Data Subject's authorisation, by third parties that provide the latter with specific services (for example, data certifying the physical fitness of the Data Subject with regard to participation in a sporting event, which is processed and transmitted by companies specialising in the provision of fitness certification services and which is used by ENDU to complete registration for a sporting event through its Services; data relating to registration for sporting events or bodies that the Data Subject wishes to share within their ENDU profile).
4. Methods of processing and data retention period
All personal data is processed primarily through electronic means and methods; however, processing by paper means is not excluded a priori.
Data will be retained in a form that allows the identification of Data Subjects only for the time strictly necessary to achieve the purposes for which the data was originally collected and, in any case, within the limits of the law.
In order to ensure that personal data is always accurate, up to date, complete and relevant, we invite users and other interested parties to keep their data updated through the specific functions of the sites and applications connected to the ENDU Services, or to notify any changes to the following email address: privacy@endu.net.
Personal data will be processed only for the time necessary in relation to the purposes described above.
Unless otherwise provided in this notice and in the detailed notices relating to specific Services, the Controller will adhere to the following retention periods:
for purposes connected to the performance of the contract and the provision of the Services requested by users, data will be processed by ENDU for the entire duration of the relationship and for as long as obligations or commitments connected to its performance subsist; beyond this period, in the event of disputes and always with regard to data relating to orders or purchases made through the Services, in light of the ordinary limitation period for rights (10 years under Italian law), the retention period will be extended for a further 11 years for purposes connected to compliance with legal obligations and to allow ENDU to defend its rights against possible disputes within the limitation period;
for compliance with legal obligations, data will be processed and retained by ENDU for as long as the need for processing to fulfil such legal obligations persists;
with regard to processing for marketing purposes, carried out on the basis of ENDU's legitimate interest or with the user's prior consent, data will be processed for the entire duration of the relationship with the user and for as long as obligations or commitments connected to its performance subsist, unless the previously given consent is withdrawn or an objection to processing is raised;
for profiling purposes, ENDU may process – until the end of the relationship or the possible withdrawal of consent – data relating to the last 12 months, after which the data will be retained if necessary to pursue other purposes or will be permanently deleted;
in relation to further data processed on the basis of the Controller's legitimate interest as described above, data will be processed for as long as the legitimate interest persists, without prejudice to the Data Subject's right to object.
5. Communication of personal data to third parties
No data will be disclosed or communicated to third parties without the express and specific consent of the Data Subject, with the exception of the communication of location data pursuant to the preceding point 3, letter d), and data disclosed or otherwise shared by the user through the ENDU Services and the related websites as provided in point 6) of this notice.
Where communication to third-party suppliers, consultants or partners of ENDU is necessary for purposes connected to the provision of the ENDU Services, the Controller will take care to appoint them as data processors pursuant to art. 28 of the Regulation, by virtue of the demonstrated capacity, experience and reliability. In this regard, for the purposes of data storage, ENDU uses the hosting services provided by AWS Amazon Web Services Inc. from servers located within the European Union; for this purpose, AWS has been appointed by ENDU as data processor. Data Subjects may at any time request the complete list of data processors appointed by ENDU from time to time, by sending a request pursuant to the following article 9).
Furthermore, in certain cases, ENDU may communicate users' data to its partners to enable the users themselves to benefit from any agreements, promotions or ancillary services provided by such partners (for example, insurance companies); such partners will act as independent data controllers.
As already indicated in the preceding article 1), where ENDU acts as data processor of a third-party provider using the ENDU platform to provide goods or services to users (including event organisers for whose events the user may register), ENDU may acquire and transmit users' data to the respective data controllers, in its capacity as data processor and on the basis of the notices independently made available by the controllers.
It is understood that users' personal data may be freely communicated to third parties, such as law enforcement or other public authorities, whenever permitted by law or required by an order or measure of a competent authority. Such parties will process the data as independent data controllers.
6. Public sharing of data, social networks and third-party sites
The Site and the ENDU Services constitute a platform for sharing the sporting experiences of each user, both individual and within the context of events and competitions organised by third parties or by the Controller itself, in which a plurality of parties will participate.
By using the ENDU Services in the context of races and sporting events, the user chooses to share and make public their participation in the sporting event, allowing access to their location data (and to data resulting from the related processing in terms of times, speed and distances) to anyone connected to the website of the Controller or the organiser through which the event can be followed. If the user does not wish to share such data publicly, they are invited not to use the relevant ENDU Service.
Each user will be able to freely modify, at any time, their preferences and settings regarding the sharing of data and information through the ENDU Services, including those relating to their training sessions, by creating a public, private or restricted-access profile. In this regard, the user's attention is drawn to the importance of carefully evaluating the data they intend to publish through the ENDU Services and the consequences that the publication of such data may have on their private life and that of third parties, having regard for example to data relating to race or training routes. In the event of doubts about the possible negative consequences arising from publication, the user is invited not to publish the data or to request further information from ENDU by writing to privacy@endu.net.
The Site also offers the possibility of sharing such information with the social networks chosen by each user. The managers of such services will act as independent data controllers. Users who wish to share their data and information on such social networks are invited to read the respective personal data processing policies.
In the case of events and competitions organised by third parties, the organiser may acquire and process the data of the user participating in the event for their own purposes and on the basis of an independent notice; the user is therefore invited to verify with the organiser (and any suppliers used by the organiser) the means and purposes of the processing of their data connected to participation in the event. Where provided for in the notice relating to each specific event, ENDU may also take on the role of joint data controller or independent data controller together with the organiser, with consequent exchange of data and information for the purposes described in the notice and on the basis of an adequate legal basis.
7. Transfer of personal data outside the European Economic Area
In pursuit of the purposes described above, ENDU may also transfer data to third countries or international organisations outside the European Economic Area ("EEA").
In such cases, where the European Commission has recognised that a country outside the EEA is capable of ensuring an adequate level of data protection, the personal data of Data Subjects may be transferred on that basis.
For transfers to countries or international organisations outside the EEA whose level of protection has not been recognised by the European Commission, ENDU will rely on a derogation applicable to the specific situation (for example, a transfer necessary to perform a Service at the Data Subject's request, as in the case of an international payment) or on one of the following adequate safeguards to ensure the protection of the personal data of Data Subjects:
standard contractual clauses, approved by the European Commission, which bind the data importer to process the data in compliance with the Regulation and this notice; or
binding corporate rules.
For further information on such measures, a written request may be sent to privacy@endu.net.
8. Security measures
Taking into account the state of the art and the costs of implementation, as well as the nature, scope, context and purposes of processing, and the risks to the rights and freedoms of Data Subjects, ENDU, including through its data processors appointed pursuant to art. 28 of the Regulation, will implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk in accordance with articles 32 et seq. of the Regulation; such measures include, among others:
the pseudonymisation and encryption of personal data;
the ability to ensure on an ongoing basis the confidentiality, integrity, availability and resilience of processing systems and services;
the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;
a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures in order to ensure the security of processing.
To this end, ENDU uses as sub-processor the company AWS – Amazon Web Services Inc., whose services are certified to the ISO 27001 standard, thereby ensuring the confidentiality, integrity, availability and resilience of the IT systems and related services through which data is stored and processed.
The Controller also has in place a procedure for regularly verifying the effectiveness of the technical and organisational measures adopted to ensure the security of processing throughout its entire duration, and allows access to data only to duly trained persons, except in cases where access must take place by virtue of a specific provision of Union or Member State law or an order of an authority.
9. The rights of the Data Subject
Pursuant to the Regulation, Data Subjects may exercise the following rights against ENDU:
to request and obtain information regarding the existence of their data with ENDU as well as regarding the personal data processing carried out by ENDU, and to obtain access to such data;
to request and obtain receipt in a structured, commonly used and machine-readable format of their data provided to the Controller, where the processing is based on consent or a contract and is carried out by automated means, and, where technically feasible, the transfer of such data to another data controller;
to request and obtain the modification and/or correction of data that is inaccurate or incomplete;
to request and obtain the erasure of their data where it concerns data or information that is not necessary – or no longer necessary – for the preceding purposes, or where the other conditions provided for by law are present (cf. art. 17 of the Regulation);
to request and obtain the restriction of the processing of their data where the Data Subject contests its accuracy, or in the further cases provided for by art. 18 of the Regulation;
to object to the further processing of their data in the cases expressly defined in the preceding article 2).
Such requests may be addressed to ENDU through the endu.net website, by accessing the Privacy section of their account, by sending a request to privacy@endu.net or through other channels that ENDU may make available to Data Subjects. Requests submitted by email or other channels that do not allow the identification of the requester must be accompanied by a copy of the latter's identity document for the purpose of verifying their identity.
In accordance with applicable law, in addition to the rights referred to above, the Data Subject also has the right to lodge a complaint with the competent supervisory authority, which in Italy is the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza di Monte Citorio n. 121 00186 ROMA, Fax: (+39) 06.69677.3785, garante@gpdp.it, protocollo@pec.gpdp.it.
10. Links to other websites
The Controller does not control and has no way of supervising either the content or the personal data processing policies of the websites and third-party services accessible through the links contained within the Site and the ENDU Services. ENDU therefore cannot under any circumstances be held responsible for the processing carried out through or in relation to such third-party sites.
Users are therefore invited to pay the utmost attention in this regard, by reading the terms of use and privacy policies published on the portals visited.
ENDU provides links to websites and services managed by third parties solely to facilitate users' browsing, it being understood that the activation of such hyperlinks does not entail, nor should it suggest, any kind of recommendation or endorsement by the Controller for access to and browsing of these websites, nor any guarantee as to their content or the goods and services provided through them.
11. Cookies
Normal browsing within the pages of the Site involves the installation, by the Controller or third parties, of small text strings called cookies, the use of which is aimed both at ensuring the normal functionality of the Site and at allowing the Controller to offer its users a better browsing experience.
For further information in this regard, Data Subjects are invited to read the Cookie Policy.
12. Minors
Use of the ENDU Services is reserved for users who are of legal age. In the case of images of minors recorded during a sporting event, the provisions of the preceding article 3, point c) shall apply. Rights relating to the image of a minor must be exercised directly by the person exercising parental authority.
As already noted in the introduction, for the purpose of providing goods and services through the ENDU platform, some users may process the personal data of minors; in such cases, ENDU does not act as data controller and therefore the processing in question falls outside the scope of this Privacy Policy.
In any case, any abuses relating to the processing of minors' data may be reported to privacy@endu.net in order to allow ENDU to take appropriate measures to protect the minor concerned, including through the immediate blocking of the processing of their data.
13. Data Controller
The Controller of the personal data of users and other Data Subjects whose data is processed through the Services is Endu S.r.l., with registered office at Via Falcone 30/A, 43121 Parma (PR), Italy; the Controller may be freely contacted by Data Subjects for any questions or requests relating to this Privacy Policy by writing to the email address dpo@endu.net.
14. Amendments and updates
The Controller may freely amend or update, in whole or in part, this document, including in consideration of amendments to laws or regulations governing the protection of personal data.
It is understood that any amendment or update will be notified to users and other Data Subjects on the homepage of the Site and through the other channels available from time to time within the Services (for example, in-app communications or email communications for registered users). Upon a new access to the Site and the Services by the Data Subject, ENDU will ask them to confirm that they have read the new version of the Privacy Policy applicable to the processing of their data.