Privacy Policy
This Privacy Policy explains how Cyprus Swim Series collects and uses personal data when you visit our website, book a race, take part in our events or contact us. It is written to meet the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Cyprus law that implements it (Law 125(I)/2018).
1. Who we are
The controller of your personal data is I.E. Athletic Tourism (Cyprus) Ltd, which organises the Cyprus Swim Series (“we”, “us”).
- Company registration number: HE371637 (Republic of Cyprus)
- Address: 7 Rigenis Street, 8200 Geroskipou, Paphos, Cyprus
- Email: hello@cyprusswimseries.com
We have not appointed a Data Protection Officer. For any question about this policy or your data, email us at the address above.
2. The personal data we collect
When you book a race
Bookings are made through our ticketing providers (see section 6). For each booking we receive:
- Buyer details: full name, email address, phone number.
- Participant details: full name, email address, phone number, date of birth, gender, nationality, T-shirt size, chosen race and how many times you have taken part before.
- Booking and payment details: booking reference, products bought, amount, payment status and refunds. Card details are handled by the payment provider and are never seen or stored by us.
- Technical details from the booking: the country associated with the IP address used to book.
When you take part in an event
- Bib (race) number, check-in and bag pick-up records.
- Timing results: finishing time, place, race and age/gender category.
- Photographs and video taken at the event (see section 5).
- For participants under 18: the details on the Parental Consent Form, including the parent or guardian’s name and contact details (see section 4).
- If you receive first aid or medical help at the event, the medical team records what happened and what treatment was given. This is health data and is handled with extra care (see section 3).
When you contact us or follow us
- Your name, contact details and the content of your messages (email, phone, social media).
- If you subscribe to our newsletter: your email address and name.
When you visit our website
- Necessary data: your cookie choices (stored in your browser) and the technical data our hosting provider logs to deliver and secure the site (IP address, date and time, page requested, browser type).
- Statistics, only if you agree: Google Analytics collects pages viewed, approximate location (city/country), device and browser information and a pseudonymous identifier. See our Cookie Policy.
We do not ask for data we do not need. If you do not provide the details required for a booking we cannot register you for a race.
3. Why we use your data and our legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Registering you for a race, assigning race categories, issuing bibs, timing, sending race information and running the event. | Performance of a contract (Art. 6(1)(b)). For participants under 18, the contract is with the parent or guardian. |
| Safety at sea: sharing the start list with lifeguards, the medical team and, if needed, the Port and Marine Police or other emergency services; contacting you or your emergency contact. | Legitimate interests in running a safe event (Art. 6(1)(f)); vital interests in an emergency (Art. 6(1)(d)). |
| Recording first aid or medical treatment given at the event. | Protecting vital interests (Art. 9(2)(c)) and establishing or defending legal claims (Art. 9(2)(f)). Medical information you choose to give us on the Parental Consent Form is used with your explicit consent (Art. 9(2)(a)). |
| Publishing race results (name, bib, category, time and place) on our website, at the venue and through our timing partner. | Legitimate interests in fair and transparent competition and keeping a record of the event (Art. 6(1)(f)). You can object at any time (section 9). |
| Event photography and video for event coverage, our galleries and social media. | Legitimate interests in reporting on and promoting our events (Art. 6(1)(f)). Using a clearly identifiable image of you in paid advertising requires your consent (Art. 6(1)(a)). |
| Invoicing, accounting and tax. | Legal obligation (Art. 6(1)(c)). |
| Proving the proper use of EU co-funding for the Pissouri 3rd Edition 2026 to the competent national and EU authorities (monitoring, verification and audit). | Legal obligation under Regulation (EU) 2021/1060 and the national rules of the Programme (Art. 6(1)(c)), and our legitimate interest in demonstrating compliance with our funding conditions (Art. 6(1)(f)). |
| Sending our newsletter and news about future events. | Consent (Art. 6(1)(a)), or, for people who have booked with us before, news about similar events with an opt-out in every email (Law 112(I)/2004, section 106). We never send marketing to children. |
| Website statistics (Google Analytics). | Consent (Art. 6(1)(a)), asked through our cookie banner. |
| Answering your questions and handling complaints. | Legitimate interests (Art. 6(1)(f)) or steps before a contract (Art. 6(1)(b)). |
| Establishing, exercising or defending legal claims. | Legitimate interests (Art. 6(1)(f)). |
Where we rely on consent, you can withdraw it at any time without affecting what we did before. For cookies, use the cookie settings; for anything else, email us.
4. Children and young participants
Our Kids race (0.5 km, ages 8–12) and Juniors race (1.25 km, ages 13–17) are for children, and young people may also take part in other races where the race rules allow. We take extra care with their data:
- A parent or legal guardian must make the booking. Anyone under 18 must be registered by their parent or legal guardian, who accepts the Terms & Conditions on the child’s behalf. Under Cyprus law a child can give their own consent to online services from the age of 14 (Law 125(I)/2018, section 8), but because a race involves a contract and real safety risks, we require a parent or guardian for every participant under 18.
- Parental Consent Form. A signed Parental Consent Form must be handed in at bag pick-up before the child can race. It records the parent or guardian’s contact details, any medical information they choose to share, and their choices about results and photos.
- Only what we need. For children we use the name, date of birth (to check the age category and for safety), gender (for race categories), T-shirt size and the parent or guardian’s contact details.
- Results. Results show the child’s name, category, time and place, as for every participant. A parent or guardian can ask us at any time to show only initials or to remove the child’s name; tick the option on the consent form or email us and we will do it within one month, normally much sooner.
- Photos and video. Our events are photographed and filmed. We do not publish a child’s contact details, date of birth or other identifying information with photos, and we do not tag children on social media. We only use a clearly identifiable image of a child in promotional material (for example adverts, posters or brochures) if a parent or guardian has agreed on the consent form. A parent or guardian can ask us to remove any photo of their child at any time.
- No marketing to children. We do not send newsletters or marketing to children. Any communication goes to the parent or guardian who made the booking.
- Children’s rights. A parent or guardian can exercise the child’s data protection rights on their behalf (section 9). Young people can also contact us directly about their own data.
- If we find out that we hold data about a child without the involvement of a parent or guardian, we will contact the family or delete the data.
5. Event photography and video
Our photographers and videographers cover the races, the start and finish areas and the award ceremonies. Images are published in our galleries, on social media, shared with the media and, for the EU co-funded Pissouri 3rd Edition 2026, may be provided to the Programme authorities and the European Commission, which have the right to use communication material about co-funded projects. If you would prefer not to be photographed, tell our photographers or the registration desk. If you want a published image of you (or your child) removed, email us with a link to the image and we will remove it from our channels.
6. Who we share your data with
We do not sell your data and we do not give participant data to sponsors for their own marketing. We share data only with:
- Ticketing providers that run our booking pages and process payments on our behalf: TicketingHub and Luma, together with the payment service providers they use.
- Our timing partner, Arrow Live Results, which times the races and publishes the results.
- Safety and medical teams working at the event, and emergency services or the Port and Marine Police when needed.
- Photographers and videographers we engage for our events.
- IT and website providers, including our website hosting provider and, if you consent, Google (Google Analytics).
- Professional advisers such as our accountants, auditors and lawyers.
- EU funding authorities, for the Pissouri 3rd Edition 2026 only: the Department of Fisheries and Marine Research (Intermediate Body), the Directorate-General for Growth of the Ministry of Finance (Managing Authority), the Audit Authority of the Republic of Cyprus, the European Commission, the European Court of Auditors and the European Anti-Fraud Office (OLAF), for the monitoring, verification and audit of the co-funded project.
- Public authorities when the law requires it.
Our service providers act on our instructions under data processing agreements and may not use your data for their own purposes.
7. Transfers outside the European Economic Area
Some providers are based outside the EEA, such as in the United Kingdom or the United States. We only transfer data where the destination has an adequacy decision of the European Commission (for example the United Kingdom, or US companies certified under the EU-US Data Privacy Framework), or where the provider has signed the European Commission’s Standard Contractual Clauses. Email us for a copy of the relevant safeguards.
8. How long we keep your data
We keep personal data only as long as we need it. In summary:
- Booking and participation records: 6 years after the event (longer where a legal claim period is extended, for example for people who were children at the time).
- Records of the EU co-funded Pissouri 3rd Edition 2026: 5 years from 31 December of the year of the final payment of the funding, as required by Regulation (EU) 2021/1060 (Article 82).
- Accounting records: 7 years.
- Published results: kept as the historical record of the event, unless you ask us to anonymise them.
- Newsletter: until you unsubscribe, or after 3 years without opening any email.
- Google Analytics: 14 months.
The full schedule is in our Data Retention Policy.
9. Your rights
You have the right to:
- access your personal data and receive a copy;
- correct inaccurate or incomplete data;
- erase your data where we no longer have a reason to keep it;
- restrict how we use your data in certain cases;
- receive your data in a portable format, or have it sent to another organisation;
- object to our use of your data based on legitimate interests, including the publication of results and photos. You can always object to direct marketing;
- withdraw consent at any time.
To use any of these rights, email hello@cyprusswimseries.com. We will reply within one month. We may ask you to confirm your identity first. Parents and guardians can exercise these rights for their children.
We do not make decisions about you based solely on automated processing.
10. Complaints
If you are unhappy with how we use your data, please contact us first so we can try to put it right. You also have the right to complain to the Cyprus supervisory authority:
Office of the Commissioner for Personal Data Protection
Kypranoros 15, 1061 Nicosia, Cyprus (P.O. Box 23378, 1682 Nicosia)
Tel. +357 22 818456 · commissioner@dataprotection.gov.cy · www.gov.cy/dataprotection
If you live in another EU country, you can also complain to the authority in your country.
11. Security
We protect personal data with access controls, secure providers and by limiting access to the people who need it to run our events. Paper forms (such as Parental Consent Forms) are kept locked away and destroyed securely when no longer needed.
12. Changes to this policy
We will update this policy when our events or the law change. The date at the top shows the latest version. If we make important changes, we will tell participants by email or on this website.
