Spain Rush-SPF Privacy Policy  

SPF SPORT MANAGEMENT S.L. (the “Company”) is an organization that engages in personal data processing activities, which brings a significant responsibility in designing and organizing procedures to ensure compliance with legal regulations in this area.

In fulfilling these responsibilities and with the objective of establishing the general principles governing the processing of personal data within the Company, it approves this Personal Data Protection Policy, which it communicates to its Employees and makes available to all its stakeholders.

1. Purpose

The Personal Data Protection Policy is a proactive responsibility measure aimed at ensuring compliance with applicable legislation in this matter and, in relation to it, respecting the right to honor and privacy in the processing of personal data of all individuals associated with the Company.

To develop the provisions of this Personal Data Protection Policy, the principles governing data processing within the organization are established, along with the procedures and organizational and security measures that those affected by this Policy are committed to implementing within their area of responsibility.

To achieve this, the Management will assign responsibilities to the staff involved in data processing operations.

2. Scope of Application

This Personal Data Protection Policy will apply to the Company, its administrators, directors, and employees, as well as to all individuals associated with it, expressly including service providers with data access (“Data Processors”).

3. Principles of Personal Data Processing

As a general principle, the Company will strictly comply with personal data protection legislation and must be able to demonstrate this compliance (“Proactive Responsibility Principle”), paying special attention to data processing that may pose a higher risk to the rights of the data subjects (“Risk-Based Approach Principle”).

In relation to the above, SPF SPORT MANAGEMENT S.L. will ensure compliance with the following principles:

• Lawfulness, Fairness, Transparency, and Purpose Limitation: Data processing must always be informed to the data subject, through clauses and other procedures, and will only be considered legitimate if consent for data processing is given (with special attention to minors), or if there is other valid legal authorization, and the purpose aligns with the regulations.
• Data Minimization: Data processed must be adequate, relevant, and limited to what is necessary for the purposes of processing.
• Accuracy: Data must be accurate and, where necessary, updated. Measures will be adopted to promptly delete or rectify inaccurate personal data related to the purposes of processing.
• Storage Limitation: Data will be stored in a manner that allows the identification of data subjects for no longer than necessary for processing purposes.
• Integrity and Confidentiality: Data will be processed in a manner that ensures adequate security, including protection against unauthorized or unlawful processing, loss, destruction, or accidental damage, by implementing appropriate technical and organizational measures.
• Data Transfers: It is prohibited to purchase or obtain personal data from illegitimate sources or in cases where data has been collected or transferred in violation of the law, or if its legitimate origin cannot be sufficiently guaranteed.
• Contracting with Data-Access Providers: Only providers offering sufficient guarantees to apply appropriate technical and security measures in data processing will be contracted. An appropriate agreement will be documented with these third parties.
• International Data Transfers: Any personal data processing subject to EU regulations that involves data transfer outside the European Economic Area must be carried out in strict compliance with the requirements established by applicable law.
• Rights of the Data Subjects: The Company will facilitate the exercise of access, rectification, erasure, restriction of processing, opposition, and portability rights to the data subjects, establishing internal procedures, particularly models for their exercise, which must satisfy at least the applicable legal requirements in each case.

The Company will promote the consideration of the principles outlined in this Personal Data Protection Policy (i) in the design and implementation of all work procedures, (ii) in the products and services offered, (iii) in all contracts and obligations formalized or assumed, and (iv) in the implementation of all systems and platforms allowing employee or third-party access and/or the collection or processing of personal data.

4. Employee Commitment

Employees are informed of this Policy and acknowledge that personal data is a Company asset. In this regard, they adhere to it, committing to:

Completing the data protection awareness training provided by the Company.

Applying user-level security measures applicable to their position, without prejudice to responsibilities in the design and implementation that may be attributed based on their role within SPF SPORT MANAGEMENT S.L..

Using established formats for exercising rights by data subjects and promptly informing the Company to ensure an effective response.

Reporting to the Company, as soon as they become aware of it, any deviations from this Policy, particularly concerning “Personal Data Breaches,” using the established format.

5. Control and Evaluation

Verification, evaluation, and assessment of the effectiveness of technical and organizational measures will be carried out annually or whenever significant changes occur in data processing, to ensure data processing security.