Privacy Policy

1. Data controller

For the processing of personal data carried out directly through this website, the data controller is:

GSX PORTUGAL, UNIPESSOAL, LDA
Brand: GlobalSport
NIPC / registration number: 514779012
Registered office: Avenida Polo 3, n.º 72, 4590-052 Carvalhosa, Paços de Ferreira, Portugal
Email: info@globalsport.pt

The Corrida do Dragão (Dragon Race) is organised by GlobalSport. Institutional or promotional support given to the event by other entities does not mean, in itself, that those entities receive the data submitted through the forms on this website.

2. Scope of this Policy

This Policy applies to the website corrida-do-dragao.pt and to the processing of personal data carried out directly through its pages, forms and technical systems.

The website is informational in nature. It does not directly process the purchase or payment of registrations and does not offer a newsletter.

The registration buttons may redirect you to a separate GlobalSport platform. The processing carried out on that platform is governed by the privacy information and the conditions presented on that service.

3. Data we may process on this website

3.1. Contact forms

When you submit a request through a form, we may process:

• name;
• email address;
• telephone number, where provided;
• the content of the message;
• date and time of the request;
• information strictly necessary to manage and respond to the communication.

The telephone number should not be required in the general contact form where an email address is sufficient to respond to the request.

3.2. Volunteering forms or other specific forms

If a volunteering form or another form with a specific purpose is made available, only the data necessary for that purpose will be collected. The form itself must clearly explain what the data will be used for.

Health data, civil identification documents or other more sensitive data should not be requested through a public form, except where there is a concrete need, an adequate legal basis and reinforced protection measures.

3.3. Technical data

Technical data necessary for the operation, security and abuse prevention of the website may be processed, such as:

• IP address, for the technically necessary period;
• date and time of access;
• session identifiers;
• browser and device information;
• security and server logs.

3.4. Cookies, analytics and external content

Analytics, advertising or external content technologies that are not strictly necessary should only be activated where the necessary legal basis exists and, where applicable, after the user's consent.

See the Cookie Policy for more information.

4. Purposes and legal bases

Responding to contacts and requests

Purpose: to receive, forward, analyse and respond to questions, support requests, suggestions or other messages initiated by the user.

Legal basis: GlobalSport's legitimate interest in responding to communications voluntarily addressed to the organisation and, where the contact relates to steps requested by the user before entering into a contract or registering, the performance of pre-contractual steps.

Submitting a contact form does not constitute consent to marketing.

Managing volunteering applications

Purpose: to assess availability, organise contacts and manage the volunteering process when that form is active.

Legal basis: legitimate interest in managing volunteering and steps requested by the applicant, depending on the specific relationship.

Website security

Purpose: to prevent fraud, spam, attacks, abuse and security incidents.

Legal basis: legitimate interest in protecting the website, its users and the organisation's systems.

Cookies and non-essential technologies

Where the storage of, or access to, information on the user's device is not strictly necessary, the processing depends on prior consent, under the applicable legislation.

5. Mandatory and optional data

Each form identifies the mandatory fields. GlobalSport applies the principle of data minimisation and seeks to request only the data necessary to respond to the request.

Where a field is optional, not providing it does not prevent the form from being submitted.

6. Recipients and service providers

Data may be processed, to the extent necessary, by providers that support the operation of the website and its communications, for example:

• hosting and infrastructure;
• website maintenance and development;
• email or SMTP services;
• security, spam prevention and technical monitoring;
• support tools, where actually used.

Providers acting on behalf of GlobalSport must process the data in accordance with adequate instructions and data protection obligations.

Form data must not be passed on to sponsors or partners for marketing purposes merely because a form has been submitted.

If data is communicated to another entity for that entity's own purposes, such communication must have a legal basis, be notified to the data subject in advance and be reflected in this Policy.

7. International transfers

Some technology providers may process data outside the European Economic Area. Where this occurs, GlobalSport uses legally adequate transfer mechanisms, where required, and assesses the safeguards applicable to the provider.

8. Retention

GlobalSport keeps data only for the period necessary for the purposes described.

As an operational rule:

• contact requests may be kept for up to 12 months after the request is closed, unless further retention is necessary for the exercise or defence of legal rights or to comply with a legal obligation;
• volunteering application data should, as a rule, be deleted or anonymised no later than 6 months after the event, unless a subsequent relationship justifies a different retention period;
• technical and security logs should be kept for the period strictly necessary for security and diagnostics, in accordance with the actual configuration of the systems and providers.

Backups may keep copies for an additional limited period, until their normal rotation cycle, without reuse for other purposes.

9. Data subject rights

Under the applicable rules, you may request:

• access to your data;
• rectification of inaccurate data;
• erasure;
• restriction of processing;
• objection to processing based on legitimate interest;
• portability, where legally applicable;
• withdrawal of consent, where processing depends on consent, without affecting the lawfulness of the processing carried out beforehand.

To exercise your rights, contact info@globalsport.pt.

GlobalSport may request additional information strictly necessary to confirm the identity of the requester where there are reasonable doubts.

You may also lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese data protection authority.

10. Automated decisions

The forms on this website must not be used to make solely automated decisions that produce legal effects, or similarly significant effects, on the user.

11. Minors

The general contact form is not specifically intended to collect data from minors. If a volunteering process or another form aimed at minors is created, rules on age, on the need for the legal representative's involvement and on adequate privacy information must be defined in advance.

12. Security

GlobalSport applies technical and organisational measures appropriate to the risk, including access controls, software updates, protected transmission, permission management and measures against spam and abuse.

No form should send personal data through visible URL parameters or to analytics tools.

13. Cookies

Information about cookies, tags, local storage and external content can be found in the Cookie Policy.

14. Changes

This Policy may be updated to reflect legal, technical or functional changes. The date and version in force are indicated at the top of this document.

15. Contact

Questions about privacy or the exercise of rights:

GSX PORTUGAL, UNIPESSOAL, LDA - GlobalSport
Avenida Polo 3, n.º 72
4590-052 Carvalhosa, Paços de Ferreira, Portugal
Email: info@globalsport.pt