Privacy Policy

UNITED RAFTING PRIVACY POLICY
Federal Act on Data Protection (FADP) and, where applicable, Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR)

DEFINITIONS
For the purposes of this Privacy Policy:

“United Rafting” means United Rafting, an international non-profit association having its registered office in Switzerland;
“FADP” means the Swiss Federal Act on Data Protection of 25 September 2020, as amended and in force;
“GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016;
“Personal Data” means any information relating to an identified or identifiable natural person;
“Processing” means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organisation, storage, adaptation, retrieval, consultation, use, disclosure, transmission, combination, restriction, deletion or destruction;
“User” means any person who creates or holds an account on the United Rafting Online Platform or otherwise uses digital services provided by United Rafting;
“Member Federation” means a National Federation or other member organization recognized by United Rafting in accordance with its Statutes.
Where a term is not expressly defined in this Policy, the definitions contained in applicable data protection legislation shall apply.

INTRODUCTION
United Rafting is committed to protecting the privacy and Personal Data of athletes, coaches, river guides, instructors, officials, representatives of Member Federations, volunteers, staff members, event participants, Users and other persons who interact with the Federation.

This Privacy Policy explains how United Rafting collects, uses, stores, discloses and otherwise processes Personal Data in connection with its institutional, sporting, educational and administrative activities.

ART. 1 – SCOPE AND APPLICATION
United Rafting processes Personal Data in accordance with the Swiss Federal Act on Data Protection (FADP), its implementing ordinances and any other applicable Swiss data protection legislation.

Where the processing falls within its territorial scope, United Rafting also complies with Regulation (EU) 2016/679 (“GDPR”), including where United Rafting offers services or activities to individuals located within the European Economic Area or otherwise carries out processing subject to the GDPR.

Other national data protection legislation may apply to specific processing activities depending on the country concerned.

Personal Data shall be processed lawfully, in good faith and proportionately and only for purposes that are specified and recognizable to the data subject or compatible with those purposes.

Within the limits permitted by applicable law, Personal Data may be processed for the pursuit of the institutional purposes set out in the United Rafting Statutes, Rules and Regulations.

ART. 2 – INFORMATION WE COLLECT
United Rafting may collect Personal Data directly from you, automatically through its websites and digital services, or from Member Federations, event organisers, service providers and other legitimate sources.

2.1 Information you provide to us
We may collect information when you:

register for or use the United Rafting Online Platform or other digital services;
apply for or renew a United Rafting licence, membership, qualification or certification;
register for or participate in a United Rafting competition, workshop, training course, examination, Congress or other activity;
act as an athlete, coach, staff member, river guide, instructor, judge, official or member of a United Rafting body, commission, department, panel or working group;
submit an application, candidature, accreditation request or other institutional document;
subscribe to newsletters or other communications;
purchase goods or services, pay fees or make other payments;
contact United Rafting by email, telephone, online form, social media or other means;
report an incident, complaint, safeguarding matter or disciplinary issue.

Depending on the activity concerned, the Personal Data collected may include:

full name;
postal and residential address;
email address and telephone number;
date and place of birth;
nationality;
gender, where relevant to a sporting activity or competition category;
passport or other identification details, where required;
photographs and audiovisual material;
sporting affiliations, licences, rankings, results and competition history;qualifications, certifications, assessments and training records;
roles held within Member Federations or other sporting organisations;
payment and transaction information;
travel and accommodation information where required for an event or institutional activity;
information required for anti-doping, safeguarding, disciplinary, eligibility or health and safety purposes where permitted by applicable law.

Payment card information may be processed directly by third-party payment service providers, including Stripe. United Rafting may receive transaction-related information necessary to administer payments without necessarily receiving or retaining complete payment card details.

United Rafting will not request Personal Data that are not reasonably necessary for the relevant activity or purpose.

2.2 Information collected through the Online Platform
When you create or use an account on the United Rafting Online Platform, United Rafting and its authorised service providers may process information including your:

name and surname;
email address;
account credentials;
address and contact details;
nationality and date of birth;
membership or licence status;
sporting role and qualifications;
competition registrations and results;
GTE qualifications, workshops, examinations and certification history;
officials' or judges' qualifications, assessments and activity records.

2.3 Information collected automatically
When you access United Rafting websites or digital services, certain technical information may be collected automatically, including:

Internet Protocol (IP) address;
browser type and version;
operating system and device information;
time zone and language settings;
pages visited and navigation data;
date and time of access;
referring website;
interaction with website functions;
error and performance information.

This information may be collected through cookies, server logs and comparable technologies in accordance with Article 6 below.

2.4 Information received from other sources
United Rafting may receive Personal Data from:

Member Federations;
Continental Areas;
event Organising Committees;
affiliated or recognised sporting organisations;
anti-doping organisations and competent sporting authorities;
training providers and certified instructors;
payment and technology providers;
public authorities where permitted or required by law.

Where required by applicable law, United Rafting shall inform the data subject of the source and purpose of such processing.

ART. 3 – PURPOSES AND LEGAL GROUNDS FOR PROCESSING
United Rafting processes Personal Data only where this is necessary for legitimate and specified purposes connected with its activities.

Personal Data may in particular be processed:

to manage membership and institutional relationships with Member Federations;
to issue and administer licences, qualifications, certifications and accreditations;
to register athletes, teams, coaches, officials and other participants for competitions and events;
to organise and manage World Championships, Continental Championships, World Cups and other United Rafting competitions and activities;
to manage the Guide Training & Education (GTE) Programme;
to manage judges, technical officials and other sporting qualifications;
to administer Congresses, elections, Boards, Departments, Commissions and other institutional bodies;
to communicate with Members, Users and participants;
to administer payments, fees, reimbursements and financial records;
to maintain competition results, rankings and historical sporting records;
to ensure safety, safeguarding and integrity in United Rafting activities;
to administer disciplinary and anti-doping matters;
to prevent fraud, abuse, security incidents and unauthorised access;
to comply with legal, regulatory, accounting and financial obligations;
to maintain and improve United Rafting websites, platforms and services;
to conduct statistical and institutional analysis;
to communicate news, events and activities where permitted by applicable law.

Where the GDPR applies, the relevant legal basis may include performance of a contract or implementation of pre-contractual measures, compliance with a legal obligation, the legitimate interests pursued by United Rafting or a third party, consent, or another legal basis expressly provided by applicable law.

Where consent constitutes the applicable basis for processing, it may be withdrawn at any time, without affecting the lawfulness of processing carried out before withdrawal.

Personal Data requiring enhanced protection under applicable law, including health, anti-doping, safeguarding or disciplinary information, shall be processed only where necessary and subject to appropriate safeguards.

Promotional communications and partners
United Rafting may send institutional or promotional communications concerning its activities, events and programmes where permitted by law.

Personal Data shall not be disclosed to commercial partners or sponsors for their own direct marketing purposes without an appropriate legal basis and, where required, the data subject's consent.

ART. 4 – DISCLOSURE OF PERSONAL DATA
United Rafting does not sell or rent Personal Data.

Personal Data may be disclosed where reasonably necessary to:

Member Federations and Continental Areas;
Organising Committees of United Rafting events;
authorised United Rafting officers, employees, volunteers, Departments, Commissions and officials;
payment providers;
email and communications providers;
professional advisers, auditors and accountants;
travel or logistical service providers where necessary;
anti-doping organisations and sporting authorities;
competent governmental, judicial or regulatory authorities where required by law.

Service providers acting on behalf of United Rafting may process Personal Data only for the purposes for which they have been engaged and subject to appropriate confidentiality, security and data protection obligations.

United Rafting shall limit disclosures to the Personal Data reasonably necessary for the relevant purpose.

ART. 5 – INTERNATIONAL TRANSFERS AND STORAGE OF PERSONAL DATA
United Rafting operates internationally. Personal Data may therefore be processed or stored in Switzerland, the European Economic Area or other countries in which United Rafting, its Member Federations, Organising Committees or authorised service providers operate.

Where Personal Data are transferred to a country that does not provide an adequate level of data protection under applicable legislation, United Rafting shall implement appropriate safeguards where required, including recognised standard contractual clauses or other legally permitted mechanisms.

United Rafting shall take reasonable steps to ensure that persons and organisations processing Personal Data on its behalf maintain appropriate technical and organisational security measures.

Payment transactions are processed through authorised payment providers using appropriate security measures.

No method of transmission or electronic storage can guarantee absolute security. United Rafting nevertheless implements measures proportionate to the nature of the Personal Data processed and the risks involved.

ART. 6 – COOKIES AND SIMILAR TECHNOLOGIES
6.1 Cookies
Cookies are small files stored on a User's device when accessing a website. They may be used to allow the website to function, retain User preferences, authenticate Users and understand how digital services are used.

United Rafting may use cookies that are necessary for the operation of its websites and Online Platform.

Subject to applicable law and, where required, the User's consent, United Rafting may also use analytical or other non-essential cookies.

Cookies may be used for purposes including:

Authentication. To recognise authenticated Users and maintain a secure login session.
Security and fraud prevention. To identify potentially harmful, fraudulent or unauthorised use of United Rafting services.
Preferences. To remember settings and User preferences.
Analytics and performance. To understand how Users access and interact with websites and services and to identify technical improvements.

6.2 Third-party technologies
United Rafting may use authorised third-party analytics or technology services. Such providers may use cookies or comparable technologies in accordance with their own privacy documentation and the contractual arrangements entered into with United Rafting.

Where non-essential technologies require consent under applicable law, they shall not be activated before the required consent has been obtained.

6.3 Managing cookies
Users may manage or delete cookies through their browser settings and, where available, through the cookie management interface provided on the relevant United Rafting website.

Disabling strictly necessary cookies may prevent certain website or Online Platform functions from operating correctly.

ART. 7 – RIGHTS OF DATA SUBJECTS
Subject to the conditions and limitations established by applicable law, data subjects may have the right to:

obtain confirmation as to whether their Personal Data are being processed;
request access to their Personal Data;
obtain correction of inaccurate or incomplete Personal Data;
request deletion or destruction of Personal Data where the applicable conditions are met;
request restriction of processing where provided by applicable law;
object to certain processing;
withdraw consent where processing is based on consent;
receive Personal Data in a commonly used and machine-readable format where the right to data portability applies;
request transmission of Personal Data to another controller where legally and technically applicable;
obtain information concerning automated individual decisions and request human review where applicable;
lodge a complaint with a competent data protection supervisory authority.

The exercise of these rights may be restricted where United Rafting is required or permitted to retain or process Personal Data for legal, regulatory, sporting integrity, anti-doping, disciplinary, safeguarding, accounting or other legitimate purposes.

Requests may be subject to reasonable identity verification measures.

ART. 8 – RIGHT OF ACCESS
A data subject may request confirmation as to whether United Rafting processes Personal Data concerning them.

Where applicable, the data subject may obtain information regarding:

the identity and contact details of the controller;
the Personal Data being processed;
the purposes of processing;
the categories of Personal Data concerned;
the recipients or categories of recipients;
where applicable, the countries to which Personal Data are transferred and the safeguards used;
the envisaged retention period or the criteria used to determine that period;
the source of the Personal Data where they were not collected directly from the data subject;
the existence of automated individual decision-making, where applicable;
the rights available under applicable data protection legislation.

Requests shall be processed within the time limits established by applicable law.

United Rafting may refuse, restrict or defer access where permitted by law and shall provide the reasons for doing so where required.

ART. 9 – SECURITY AND RETENTION
United Rafting maintains organisational, technical and administrative measures designed to protect Personal Data against unauthorised access, disclosure, alteration, loss, destruction or misuse.

Access to Personal Data is restricted to persons who require such access for their authorised functions.

United Rafting shall retain Personal Data only for as long as reasonably necessary for the purposes for which they were collected or subsequently lawfully processed.

Retention periods may vary according to the type of information and the purpose of processing.

In particular, Personal Data may be retained for longer periods where necessary to:

comply with statutory, accounting or tax retention obligations;
establish, exercise or defend legal claims;
maintain official competition results and historical sporting records;
maintain records of qualifications, certifications and disciplinary or anti-doping decisions where continued retention is justified;
prevent fraud and protect the integrity of United Rafting activities;
comply with contractual or regulatory obligations.

When Personal Data are no longer required, they shall be deleted, anonymised or otherwise disposed of in accordance with applicable law and United Rafting's internal retention procedures.

ART. 10 – CHANGES TO THIS PRIVACY POLICY
United Rafting may amend this Privacy Policy where necessary to reflect changes in its activities, digital services, organisational structure or applicable legislation.

The current version shall be published through the official United Rafting website or other appropriate official channels.

Where amendments materially affect the processing of Personal Data, United Rafting shall provide additional notice where required by applicable law.

ART. 11 – DATA CONTROLLER AND CONTACT
For the purposes of applicable data protection legislation, the data controller is:

United Rafting
c/o Fiduciaria Lago Sagl
Via Luigi Lavizzari 4
6850 Mendrisio
Switzerland

Email: This email address is being protected from spambots. You need JavaScript enabled to view it.
Email: This email address is being protected from spambots. You need JavaScript enabled to view it.

Questions, requests or complaints concerning this Privacy Policy or the processing of Personal Data by United Rafting may be addressed to the United Rafting Secretariat using the contact details above.

Where applicable, data subjects also retain the right to contact or lodge a complaint with the competent data protection supervisory authority.