GENERAL PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA

pursuant to Articles 12, 13 and, where applicable, 14 of Regulation (EU) 2016/679 – GDPR

RAFTING REPUBLIC – GRAPE S.C. / ANATREDIFIUME ASD

Version 2026.2 – DRAFT TO BE VALIDATED – update concerning AI image processing

1. WHO PROCESSES THE DATA

GRAND PARADIS EMOTIONS SOC. COOP. – GRAPE S.C.
Brand: Rafting Republic
Registered office: Frazione Ferrière, 11010 Aymavilles (AO), Italy
Operational headquarters: Località Clos Savin, 11010 Aymavilles (AO), Italy
Tax Code/VAT No. 01052910070 – REA AO-64036
Certified Email (PEC): gpemotion@pro-pec.it – Email: info@raftingrepublic.com
Legal representative: Brunet Jean-Pierre

ANATREDIFIUME ASD
Registered office: Frazione Ferrière, 11010 Aymavilles (AO), Italy
Operational headquarters: Località Clos Savin, 11010 Aymavilles (AO), Italy
Tax Code 91048250079 – VAT No. 01134730074 – Unique Code M5UXCR1
Certified Email (PEC): anatredifiume@pec.it – Operational email: info@raftingrepublic.com
President and legal representative: Elia China-Bino

Under the current organizational and contractual structure, GRAPE S.C. and Anatredifiume ASD operate as independent data controllers for the processing activities falling within their respective areas of responsibility. Data may be shared between the two organizations only to the extent necessary to carry out their respective activities and related services.

Operational privacy contact: info@raftingrepublic.com. Requests will be directed to the competent entity. Internal contact for coordinating privacy requests: Brunet Jean-Pierre. No Data Protection Officer (DPO) has been appointed.

2. ALLOCATION OF ROLES BY ACTIVITY

Classic, Advanced, Selection and other activities marketed by GRAPE S.C.

• GRAPE S.C. manages the commercial relationship with the customer, booking, sales, payment collection, administration, customer care and its own services.
• Anatredifiume ASD is involved in the practical, technical and logistical delivery of the river descent through its instructors.
• The Head Guide may access only the operational data necessary for organizing the activity and ensuring safety; the system must be configured in accordance with the principle of access minimization.
• Participants in these activities are not registered as F.I.Raft members solely as a result of taking part.

Family activity

• The Family activity is sold and provided by Anatredifiume ASD.
• Bookings use the Rafting Republic/GPE platform; proceeds from the activity are routed through financial channels held in the name of Anatredifiume ASD.
• For the Family activity, participants are registered in accordance with the applicable F.I.Raft procedures.
• GRAPE S.C. independently manages its additional services, including the Photo/Video service, any promotional use of images, and Rafting Republic newsletters/marketing.

3. CATEGORIES OF PERSONAL DATA PROCESSED

• identification and personal details: first name, surname, Italian tax code, date and place of birth;
• contact details: telephone number, email address and residential address;
• data relating to bookings, activities, date, time, group/crew and participation;
• data relating to payments, deposits, balances, transaction outcomes and administrative documentation;
• statements relating to informed participation and activity safety;
• graphical signature provided on paper or via touch/mouse, date and time of signing, version of the accepted texts and choices expressed;
• data relating to consents, refusals, withdrawals and subsequent versions of the registration;
• data relating to the parent, holder of parental responsibility, legal guardian or responsible/accompanying adult when the participant is a minor;
• photographs and video footage, where produced;
• data contained in communications by email, certified email (PEC), telephone or WhatsApp Business;
• technical browsing data and cookie preferences in accordance with the Cookie Policy.

The standard participation form does not request diagnoses, specific medical conditions, treatments, medication or other health details. Health-related data may be processed only in specific situations, for example in the event of an emergency, injury or insurance claim, and only to the extent necessary.

4. PURPOSES AND LEGAL BASES

4.1 Booking, registration, organization and performance of the activity

• handling enquiries and bookings;
• identifying participants and organizing time slots, groups and crews;
• operational communications, changes, cancellations and customer assistance;
• providing the activity and managing technical and safety decisions;
• managing payments, deposits, balances and related documents.

Legal basis: Article 6(1)(b) GDPR – performance of pre-contractual measures and of the relationship with the data subject.

4.2 Safety, risk prevention and protection of rights

• documenting that information on risks has been provided and recording the statements made by the participant;
• managing any exclusions, interruptions or changes to the activity for safety reasons;
• preventing abuse, disputes and misuse;
• establishing, exercising or defending legal claims in out-of-court or judicial proceedings.

Legal basis: Article 6(1)(b) GDPR and, where applicable, Article 6(1)(f) GDPR – legitimate interest in safety, proper organization and the protection of rights.

4.3 Administrative, tax and legal obligations

Data are processed for accounting, tax, invoicing/receipts, compliance with legal requirements, requests from public authorities and obligations connected with the activities carried out.

Legal basis: Article 6(1)(c) GDPR – compliance with legal obligations.

4.4 Accidents, injuries, insurance claims and health-related data

In the event of an accident, injury or insurance claim, additional data may be processed, including health-related information or documents, solely where necessary to manage the event, protect the data subject, handle insurance matters or establish, exercise or defend a legal claim.

For health-related data, depending on the specific circumstances, the conditions set out in Article 9 GDPR apply, in particular where processing is necessary to protect vital interests or to establish, exercise or defend a legal claim.

5. FAMILY ACTIVITIES AND F.I.RAFT REGISTRATION

For the Family activity, Anatredifiume ASD uses the data necessary for participant registration and membership in accordance with the procedures of the Italian Rafting Federation – F.I.Raft.

The necessary data are transmitted to or entered into the federation systems. F.I.Raft processes the data, for the purposes falling within its own responsibility, as an independent data controller in accordance with its own privacy notice.

F.I.Raft privacy notice for users/bookings: https://firaftbooking.it/terms/utenti-prenotazione

Within the Family workflow, acknowledgement of the F.I.Raft privacy notice and the request for registration/membership must be presented separately and clearly distinguishable from the other optional consents.

6. MINORS

When the participant is a minor, the minor’s data and the data of the adult completing the registration are processed. The system distinguishes between a parent/holder of parental responsibility, a legal guardian and a responsible/accompanying adult.

For organized groups, schools and scout groups, the standard rule is that each parent completes the form for their own child. The involvement of another responsible adult does not automatically confer the status of parent or legal guardian.

For a minor, the email address of the adult responsible for the registration is used as the contact address. Any marketing consent relates to the adult who owns the email address and not to the minor.

7. PAYMENTS

Electronic payments are managed through payment service providers, including Worldline, or other payment tools made available by the relevant operator.

• For GRAPE activities, payments are routed through systems and channels held in the name of GRAPE S.C.
• For the Family activity, payments are routed through systems and channels held in the name of Anatredifiume ASD.
• The Photo/Video service is financially managed by GRAPE S.C., including when it relates to a Family activity.

Full payment card details, such as the complete card number and CVV, are entered directly into the payment service provider’s systems and are not stored in the Rafting Republic management system. Operators receive only the information necessary to manage and reconcile the transaction.

8. PHOTO AND VIDEO SERVICE FOR THE RIVER DESCENT

GRAPE S.C. / Rafting Republic may take photographs and video footage during the activity to allow participants to view them and, where applicable, purchase/receive them.

• Consent to the Photo/Video service is optional and covers both photographs and videos under a single consent.
• Refusal does not prevent participation in the activity.
• For organizational reasons, where it is not possible to reliably respect the preferences of all participants in a crew/group, the service may not be provided for the entire group.
• Consent to the standard Photo/Video service does not authorize promotional or advertising use of the image.

Legal basis: consent of the data subject, Article 6(1)(a) GDPR.

8-bis. CREATION OF DE-IDENTIFIED VERSIONS USING ARTIFICIAL INTELLIGENCE

GRAPE S.C. may select individual photographs and temporarily process a copy using artificial intelligence tools in order to replace participants’ faces and produce a version intended for promotional communications with reduced identifiability.

The original → AI service → human review stage still constitutes processing of personal data. The process is designed around data minimization: one photograph at a time, neutral filename, no name or booking data in the prompt, restricted access, human review and deletion of internal temporary copies at the end of processing.

The AI provider may temporarily process the photograph in order to provide the service. Before the process is implemented on a stable basis, GRAPE completes the provider qualification, validation of the applicable legal basis and assessment of the contractual/technical safeguards. Under the transitional setup using ChatGPT Plus, the internal measures set out in Photo Procedure v2 are applied, including disabling the use of content for model improvement and using Temporary Chat for identifiable originals.

The legal basis for this specific processing is currently being validated. This section does not automatically authorize the publication of recognizable real persons: where an image remains identifiable, the rules and authorizations applicable to promotional use of the image apply.

The final version is subject to human review for fidelity and non-identifiability. If the result is uncertain, the photograph is redone or excluded from promotional use.

9. PROMOTIONAL USE OF IMAGES

The use of recognizable photographs or videos for Rafting Republic communication, promotional or advertising purposes is managed by GRAPE S.C. and constitutes a purpose separate from the standard Photo/Video service.

Possible channels include:

• Rafting Republic website;
• Instagram, Facebook and YouTube;
• newsletters;
• printed and promotional materials;
• online and offline advertising campaigns, including paid campaigns.

For adults, an optional general promotional consent covering the listed channels is requested. For particularly significant uses – for example testimonials, use as the main subject, or high-exposure campaigns – an additional specific authorization may be requested.

For minors, the standard participation form does not constitute general promotional authorization. The use of a specific recognizable image/video requires separate authorization. For online/social media publication and, as a precautionary rule, for promotional use of recognizable images of a minor, the procedure generally requires authorization from both holders of parental responsibility, except where there is documented evidence of a sole holder of parental responsibility or a legal guardian. For particularly significant uses, the specific material and scope of use must also be identified.

Privacy legal basis: consent of the data subject or of the person lawfully exercising the relevant authority, Article 6(1)(a) GDPR, without prejudice to the applicable rules on image rights.

10. NEWSLETTERS AND PROMOTIONAL COMMUNICATIONS

GRAPE S.C. may use the email address of the adult data subject for newsletters, information about Rafting Republic activities, news, offers and promotional communications only with prior optional consent.

• Marketing consent is collected once for the adult/email address, not for each registered minor child.
• Rafting Republic marketing is carried out by GRAPE S.C., not by Anatredifiume ASD or F.I.Raft.
• WhatsApp Business is used for assistance, bookings and operational communications, not for marketing.
• Email communications may be managed through Brevo.

Consent may be withdrawn at any time by using the unsubscribe link or by writing to info@raftingrepublic.com. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Legal basis: consent of the data subject, Article 6(1)(a) GDPR.

11. NATURE OF THE PROVISION OF DATA

The provision of data necessary for identification, booking, registration, organization, payment, participation, safety, administrative compliance and, for the Family activity, federation registration/membership is necessary in order to properly provide the service.

Consent to the Photo/Video service, consent to promotional use of images and marketing consent are instead optional and separate. Refusal of these optional processing activities does not prevent participation in the activity.

12. METHODS OF PROCESSING, ACCESS AND SECURITY

Data are processed using IT and telematic tools and, in exceptional cases, on paper. Access must be configured according to necessity, role and the principle of minimization.

• Administrators: full access limited to authorized persons.
• Reception/secretarial staff: access to the data necessary for bookings, payments, registration and consents, without technical system functions.
• Head Guide: access only to the necessary operational data, such as first name, surname, age/date of birth, activity/group and Photo/Video consent status.
• Photo/Video operators: access only to the data necessary to identify the group/participant and the Photo/Video consent status.
• IT technicians: access only where necessary for support, maintenance, security or development, in accordance with authorizations and contractual agreements.

Security measures include, where available and configured, strong authentication, access controls, protected devices, device encryption, security updates, backups and access revocation procedures.

13. EXTERNAL PARTIES AND RECIPIENTS

Within the limits of what is necessary, data may be processed by or disclosed to:

• hosting and infrastructure providers, including Ergonet;
• email, cloud and collaboration providers, including Google Workspace;
• payment service providers, including Worldline;
• newsletter and marketing providers, including Brevo;
• temporary file transfer providers, including Smash;
• cookie preference management providers, including CookieYes;
• IT technicians, consultants and professionals authorized or appointed according to the role performed;
• insurance companies, Federations, consultants and professionals in the event of a claim or specific need;
• public authorities or other parties where required by law.

Depending on the activity performed, these parties may act as data processors, independent data controllers or authorized persons. An up-to-date list of the main providers and their respective roles may be requested at info@raftingrepublic.com.

• artificial intelligence service providers used for temporary de-identification of images, subject to role qualification, contractual review and implementation of the minimization measures set out in the internal procedure;

14. TRANSFERS OUTSIDE THE EEA

The use of certain technology providers may, in some circumstances, involve processing or transfers of data outside the European Economic Area. Where applicable, such transfers take place in accordance with Chapter V of the GDPR, through adequacy decisions, Standard Contractual Clauses or other mechanisms recognized by applicable law.

15. RETENTION PERIODS

Data are retained according to different criteria based on the purpose:

• Digital registration forms, declarations, signatures and consents: 10 years from the date of the activity, unless there is a dispute, insurance claim or other legal requirement.
• Paper forms: 5 years, unless connected with insurance claims, disputes or other specific requirements.
• Administrative, accounting, tax and contractual data: up to 10 years, or for any different period required by law.
• General email enquiries not resulting in a booking: generally 24 months from the last communication.
• Ordinary WhatsApp Business conversations: generally 24 months from the last interaction, unless specific relevant communications need to be retained.
• Accident/injury/insurance claim files: 10 years from closure of the case, unless there is a dispute, longer applicable limitation periods or another documented need.
• Photo/Video material for standard sale: approximately 15 days in operational systems; approximately 30 days in temporary delivery systems such as Smash.
• Authorized ordinary promotional material: generally up to 5 years, subject to periodic review. Particularly significant uses follow the duration of the specific authorization.
• Marketing/newsletters: until consent is withdrawn or the purpose ceases, while retaining what is necessary to document the withdrawal and prevent further communications.
• Backups: according to limited retention cycles and overwrite procedures; backups are not used as permanent archives.
• Internal temporary copies used for AI processing: deleted immediately after completion and review of the job; any copies held by the provider follow the technical/contractual retention periods of the service used. Under the transitional setup using Temporary Chat, the provider states that data may be retained for up to 30 days for security purposes.

16. DIGITAL SIGNATURE, VERSIONS AND DUPLICATES

Digital registration uses a link associated with the booking. The signatory enters the data independently and provides a graphical signature via touch/mouse. The system stores the date and time, graphical signature, version of the texts signed and choices expressed.

In the standard workflow, no strong identity verification is carried out via OTP or identity document. Enhanced verification may be required for particularly sensitive authorizations.

Where multiple registrations can be linked to the same person, the most recent registration takes precedence operationally. Previous versions must be retained in the history and marked as SUPERSEDED/not valid, without being deleted.

17. DATA SUBJECT RIGHTS

Where applicable, the data subject may exercise the rights to:

• access personal data;
• rectification and completion;
• erasure;
• restriction of processing;
• data portability, where applicable;
• object, where applicable;
• withdraw consent previously given, without affecting the lawfulness of processing carried out before the withdrawal;
• obtain information about recipients or categories of recipients.

The data subject may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) in accordance with the procedures established by the Authority.

18. EXERCISING RIGHTS AND CONTACT DETAILS

Common operational contact: info@raftingrepublic.com
GRAPE S.C. – Certified Email (PEC): gpemotion@pro-pec.it
Anatredifiume ASD – Certified Email (PEC): anatredifiume@pec.it

The request will be handled by the competent entity in relation to the specific processing activity. Where necessary, the two organizations will cooperate to ensure a complete response.

19. DATA COLLECTED THROUGH THE WEBSITE AND COOKIES

The Rafting Republic website uses cookies and technologies necessary for the operation of the site and, subject to consent where required, analytics, advertising, conversion measurement and remarketing tools.

Preferences are managed through the consent management system available on the website. For categories, providers, retention periods and methods for changing preferences, please refer to the updated Cookie Policy.

20. AUTOMATED DECISION-MAKING

Data collected through registration and participation forms are not used for decisions based solely on automated processing that produce legal effects or similarly significant effects within the meaning of Article 22 GDPR.

21. UPDATES

This privacy notice may be updated in the event of changes to applicable law, organizational arrangements, technical systems, contractual arrangements or the providers used. The current version is made available through Rafting Republic channels and, where necessary, at the operational headquarters.

SHORT ACKNOWLEDGEMENT WORDING FOR USE IN FORMS

I declare that I have received or had the opportunity to consult the Rafting Republic – GRAPE S.C. / Anatredifiume ASD General Privacy Notice on the processing of personal data, which sets out the entities processing the data, the purposes, legal bases, recipients, retention periods and data subject rights.

☐ I declare that I have read the Privacy Notice on the processing of personal data.

For the Family activity:

I also declare that I have received or had the opportunity to consult the specific F.I.Raft Privacy Notice relating to registration/membership.

☐ I declare that I have read the F.I.Raft Privacy Notice.