Privacy

Club Atletismo Benidorm handles personal data belonging to people who join it, train with it or write to it. This page says which data, what for, who it is shared with and what you can demand at any time.

Who is answerable for your data

• Controller: Club Atletismo Benidorm, tax number G03894631
• Address: Ciudad Deportiva Guillermo Amor, calle Foietes s/n, 03502 Benidorm (Alicante).
• Email: info@clubatletismobenidorm.com
• Phone: 610 374 255

The club is not required to have a data protection officer. The board answers for this, and that email address is where requests arrive.

What we handle

What the sign-up form asks for

It is one of the two forms this site collects by itself. It asks for:

• First name and surname.
• Email address, which also identifies your account.
• A password, stored encrypted, which nobody at the club can read.
• Phone number.
• Date of birth, needed for the sporting category: under-10, under-16, under-18, senior or masters.
• Whether you live in Benidorm, because residents get a reduction.
• How you heard about the club. Optional, and only there to tell us what works.
• Proof of payment of the fee, if you would rather attach it. Also optional: plenty of people pay in person at a training session.

What the contact form asks for

The other one. It asks for your name, your email address, a subject — optional — and the message. You write the subject and the message, so what goes in them is up to you: we do not need you to tell us anything you would rather not in order to reply.

That message is not stored on this site. It becomes an email in the club's inbox and lives there, among the rest of the post. Whoever reads it replies to your address, which is the only reason we ask for it.

What the club asks for to handle your membership and your licence

This is collected away from the site, on the licence form or in person: ID document, postal address, passport-style photograph, discipline and level, previous club if you come from one, kit size, bank account for the fee, and an emergency contact with their name, phone number and relationship to you.

Health data

The declaration of fitness or the medical certificate, allergies and conditions that matter under effort, medication that needs attention and, if you want to give it, blood group. These are specially protected data: they are asked for with your explicit consent, seen only by whoever would have to help you — coaches and whoever is running the activity — and used for nothing else.

Images

Photographs and video of training sessions, races and club events, to show what it does: its site, its blog, its social networks, and magazines, leaflets and exhibitions too. They are asked for separately, with their own authorisation, which you can withdraw whenever you like, and the club undertakes to use them for nothing else and in no way that harms your good name or your privacy. Below the age of fourteen it is the mother, father or legal guardian who signs.

If the member is under 18

On top of the above: the name, surname and ID number of the mother, father or legal guardian, and their signed authorisation to register and to take part in training and competition.

What your visit to the site leaves behind

If you accept the measurement cookies, Google Analytics notes which pages you look at, for how long, from what kind of device and from roughly where, tied to an identifier for your browser and not to your name. If you refuse them, none of that is collected. It is set out in detail in the cookie policy.

What we use it for, and on what grounds

• Handling your sign-up request and checking the email address is yours: your consent, given when you tick the box on the form.
• Answering what you ask us through the contact form: your consent, given when you tick the box before sending it.
• Managing your membership, the annual fee and your access to the members' area: the membership relationship that begins when the club admits you.
• Arranging the federation licence and entries to competitions: that same relationship and the sporting rules that govern them.
• Looking after you while you train or compete, which is the only thing health data is for: your explicit consent and, in an emergency, the protection of your life.
• Telling you about the club — meetings, assemblies, changes to training, the WhatsApp group for your discipline: the membership relationship again.
• Showing what the club does on its site and its social networks: your image authorisation, and only for as long as you keep it in place.
• Writing to you by email, WhatsApp or SMS about what does not come out of membership — activities open to anybody, courses, anything to do with the sponsors: your consent, the one on the communications authorisation signed separately and withdrawn with an email.
• Keeping the association's accounts and meeting our obligations to the tax authorities: a legal duty.
• Knowing how this site is used, so as to write it better: your consent, given in the cookie notice and withdrawable whenever you like.

There is no advertising, no remarketing and no automated decision-making about anyone. The site's statistics are read in aggregate: they are there to decide which pages to rewrite, not to treat one visitor differently from another.

How long we keep it

For as long as you are a member, and after you leave for as long as claims can still be made. Financial data, for at least five years, and for as long as accounting and tax rules require it; licence data, for as long as the federation requires it. A sign-up request is kept even if it is refused, so that the refusal can be explained. Health data is reviewed each season and replaced by the new declaration. Images, until you withdraw your authorisation. What you write through the contact form never reaches storage on this site: it is an email in the club's inbox and lasts as long as that conversation does — if you want it deleted sooner, say so and it will be. Browsing statistics, fourteen months at the most.

Who we give it to

• The athletics federation, regional and national, to arrange the licence and competition entries.
• The club's bank, to collect the fee.
• Public authorities, where the law requires it.
• The suppliers this cannot work without: site hosting, email and maintenance of the members' tool. They work on the club's behalf, under a data processing contract, bound to confidentiality and unable to use the data for anything of their own.
• Google Ireland Limited, if you accept the measurement cookies, for the site's statistics; and Usercentrics A/S (Cookiebot), which is what stores your answer to the cookie notice.

Nothing is sold or handed to anyone for advertising. Members' data does not leave the European Economic Area. The site's statistics may end up on Google servers in the United States, under the adequacy decision for the EU–US Data Privacy Framework; if any other supplier ever involved a transfer, it would be with the safeguards the Regulation requires.

Under-18s

From the age of fourteen a person can consent to their own data being handled. Below that age the consent of the mother, father or legal guardian is needed, and the club may ask for the ID of whoever signs in order to check it. The authorisation to train and compete is signed by the legal guardian in every case, up to the age of eighteen.

How we protect it

The connection is encrypted, passwords are stored as digests that cannot be reversed, each person sees only their own part of the panel, and backups are taken. Proof of payment deserves a line of its own, because it carries bank details and sometimes an identity document: it is never published at any address reachable from outside, it is kept on private storage, and it is only ever shown to somebody logged in with permission to see it.

Anybody working with the club who comes to see members' data signs a confidentiality undertaking: they may not repeat what they see or use it outside what they are there to do, and that duty of secrecy outlives their relationship with the club.

Your rights

You can ask us for access to your data, to correct it if it is wrong, to erase it, to restrict its use, to object to a particular use, and to take it elsewhere (portability). Where something rests on your consent — images, health data — you can withdraw that whenever you like, without affecting what was done beforehand.

Erasure has a limit: we cannot delete what a legal obligation requires us to keep, such as the accounting entries for a fee already collected. In that case the data is blocked, available only to whoever the law says, and deleted when the period runs out.

Write to info@clubatletismobenidorm.com or to the club's address quoting RGPD/LOPDGDD, say which right you want to exercise and enclose a copy of something proving who you are. We answer within the following month.

If you think we have got it wrong you can complain to the Spanish Data Protection Agency. We would rather you told us first.

Changes

If what the club does with data changes, this page changes. The version that counts is the one published here.