Privacy policy

The data controller is Club Natación Batalla de Rande, tax ID G05350533, registered at Calle Barcelona 86, 4.º C, 36211 Vigo (Pontevedra), España.

For anything concerning your personal data, write to info@batalladerande.com.

The club has not appointed a Data Protection Officer: it is not a public authority, it does not monitor people on a large scale and it does not process special categories of data on a large scale.

When you register: name and surname, ID document, date of birth, sex, nationality, postcode, email, phone number, T-shirt size, your long distance experience, whether you hold a federation licence with your club and licence number, and the name and phone number of an emergency contact.

The registration form asks for no health data at all. There are no fields for allergies, medication or medical notes, and you should not write any in the experience box.

Only if you are selected, and as a separate step later on, will you be asked for the documents required by the rules: a health questionnaire, which every participant completes; a medical fitness certificate, only if, in the light of your answers to the questionnaire, the organisers consider it necessary; your legal guardian’s authorisation if you are under 18; and proof of your federation licence. Your payments are also recorded.

If you withdraw and a refund is due, we ask you for your bank account number so that we can make the transfer. We only ask it of those who paid by bank transfer: what was paid by card goes back to that same card and nothing else is needed. The number is stored encrypted and is not used for anything other than that refund.

If you have taken part before: your published results and the history of your applications.

A passport-style photo, if you choose to upload one from your locker. It is optional: not uploading it affects neither your entry nor the selection. It is resized in your own browser before being sent, so the original file —with its camera data and often the place where it was taken— never leaves your device.

From family and companions who will be boarding: full name, ID number, date of birth and a phone number. They are asked for because anyone boarding a boat has to appear on the boarding list and on the policy, just like the swimmer.

From volunteers: full name, ID number, date of birth, postal address, email and phone number, what they can help with and when, whether they hold a boating licence or own a boat or kayak, and their shirt size. The address is required by the insurer to add them to the public liability and accident policy that covers them. Those who do come are then asked whether they are attending the dinner, where their kayak should be taken and, if they ask for a parking space, their car details.

Handling your application and deciding the selection of participants.

Organising the event: swim groups, race numbers, support boats, feed stations and kit.

Keeping you safe during the crossing, including sending notices through the event WhatsApp group.

Meeting the organisation’s legal obligations, such as insurance and official permits.

Photographing and filming the event, and publishing those images as coverage of the race on the website and social media.

Collect the entry fee and, where the rules provide for it, refund what is due to you.

Your application and participation are processed to carry out the relationship created when you register, and on the legitimate interest of running the event safely.

The health questionnaire and, where applicable, the medical certificate are health data. They are processed solely to assess your physical fitness for a 27 km open water crossing, to decide whether you need to be asked for a certificate, and to be able to help you if something happens during the event, with your explicit consent. Your answers to the questionnaire are seen only by the organisation staff responsible for assessing them and by the event medical team.

Race results are published on the legitimate interest of reporting a sporting competition.

Photographs and videos are published on that same legitimate interest, not on your consent. We do it this way because it would not be honest to ask for a permission we could not undo: a photo of a hundred swimmers starting cannot be withdrawn because one person changes their mind.

What you can exercise is your right to object. If you write to us, we will stop featuring you prominently — posters, individual social media posts — and we will note it for future editions. Group shots in which you appear as part of the field are not removed.

If you are under 18, publishing your image requires the express authorisation of your parent or legal guardian, collected along with the rest of your documents.

Notices about the race — timings, sea conditions, start instructions, last-minute changes — are sent so that the crossing can be held safely, and are part of your registration. They are not advertising and are not used to promote anything.

The passport-style photo is not the same as the event photographs and is not processed on the same grounds. Those are coverage of the event; this one is used to recognise you during the year and to identify you on the day. You upload it yourself and with your consent, which you can withdraw by removing it from your locker while your edition is open, or by writing to us at any time. It is not published, not shared with anyone, and not used to decide the selection.

Passing your name, ID number and date of birth to the insurer, the shipping company and the national park is not optional and does not rest on your consent: without being added to the policy, without the boarding list and without the park permit the event cannot be held, and therefore cannot be taken part in. It is done to perform the relationship established when you enter and to meet the legal obligations of the organisers.

The organising team members who need each piece of data for their role.

The three disclosures that follow reach everyone taking part: swimmers, family and companions who board a boat, and volunteers of any kind. All of them board a vessel and all of them set foot in the national park, so it affects all of them alike.

HOWDEN IBERIA, S.A.U., insurance and reinsurance broker, and through it whichever insurer applies, for the accident and liability policies. They are given full name, ID number and date of birth, which is what the insurer requires to add each person to the policy.

Registered office at Paseo de Recoletos 37, 4th floor, 28004 Madrid. Entered in the Madrid Commercial Registry, volume 14658, page 158, entry 1, sheet M-243014, tax ID A-82473349. Entered in the administrative register of insurance and reinsurance distributors of the Directorate-General for Insurance and Pension Funds under insurance broker code J-2393 and reinsurance broker code RJ-0003.

Naviera Illa de Ons, S.L. (tax ID B-36299667), trading as Naviera Nabia, for boat transport to the Cíes Islands, to San Simón island and between points of the course. They are given the full name, ID number and date of birth of everyone who boards, because maritime passenger transport requires a named list on board.

The Atlantic Islands of Galicia Maritime-Terrestrial National Park, managed by the Xunta de Galicia, for the activity permit and access control: the number of people setting foot on the islands is capped and the permit is granted against a named list.

The authorities that permit the event, where required.

The timing company, to produce the results.

The Port Authority of Vigo, only the number plate, make, model and colour of the cars of volunteers who ask for a parking space, and only so that it authorises the vehicle to enter on the day. They are sent because the volunteer asks for the space; if you do not ask for one, there is nothing to send.

Data is hosted on Supabase servers located in the European Union.

It is never sold or shared with third parties for commercial purposes.

Your personal record and participation history are kept while the event continues to be held, because your record in previous editions is one of the selection criteria.

The health questionnaire, the medical certificate and the rest of the health documentation are deleted once the edition they were submitted for has finished.

The details of family members and companions are deleted at the end of each edition. They are kept only while they are needed to arrange boat places, the dinner and transport for that particular edition. Someone accompanying a swimmer is not part of the sporting record of the event, and there is no reason to keep their details a year longer.

Volunteers' car details —number plate, make, model and colour— are deleted once the edition closes. They exist to get a car into the port on one specific day; after that they organise nothing and still identify a person.

The passport-style photo is deleted automatically after three editions without taking part. It exists to recognise the people who come; keeping the face of someone who no longer does serves no purpose. You can also remove it yourself from your locker while your edition is open, or ask us to delete it whenever you like.

Financial records are kept for the periods required by tax law.

The bank account given for a refund is deleted thirty days after the edition closes. It is asked for with a single purpose —making the transfer— and once that is done, and the window for saying it never arrived has passed, there is no reason left to keep it. The amount refunded does stay, because that is a financial record.

You can ask to access your data, correct it, delete it, object to or restrict its processing, or ask us to hand it over in a portable format. Write to info@batalladerande.com.

You can withdraw your consent at any time, without affecting what was processed before then.

If you feel we have not handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

Every time a questionnaire or a medical certificate is opened, the person who opened it and the moment they did so are recorded. It is an extra safeguard for health data.

The organisers also keep an internal record of activity on your data: who consulted or changed it, what was done and when. It exists so we can answer you if you ask why your application changed status, and to meet the accountability duty set out in the Regulation.

For security-related operations —signing in to the management system, searching the swim record, opening a personal link— we also store the IP address it came from and, when the attempt fails, the email address or year that was typed. The ID number entered in the swim record search is stored truncated, keeping only its last few characters.

To get into your personal space you are asked, on top of the link, for your ID document and your date of birth. Nothing of what you type is stored: only whether it matched, when, and an irreversible fingerprint of the origin from which the address cannot be recovered. These are kept for ninety days and then deleted automatically.

This is done under legitimate interest in protecting your data against unauthorised access: without the originating address there is no way to tell someone mistyping their password from someone trying thousands of combinations. IP addresses are deleted automatically after ninety days; the rest of the entry, without the address, is kept until the edition closes.

These records are not used for profiling or to make any decision about your selection, and are accessible only to system administration.