Privacy and Personal Data

NOTICE OF PERSONAL DATA PROCESSING

Novo Nordisk A/S is required by law to protect your personal data. This Notice explains how we process (e.g. collect, use, store, and share) your personal data. We will process any personal data about you in accordance with this Notice and with applicable law.

1. WHO ARE WE?

The company responsible for processing your personal data is:

Novo Nordisk A/S
Novo Allé
DK- 2880 Bagsværd
Denmark

To be processed by its data processor:

TRACS, Inc
400 Main Street
Suite 2
events@tracs.net
+1 617-965-6811


You can always contact TRACS, Inc. at events@tracs.net or the Novo Nordisk Data Privacy Officer at privacy@novonordisk.com with questions or concerns about how we process your personal data.

2. HOW DO WE COLLECT PERSONAL DATA ABOUT YOU?

We get your personal data from the following sources:

From you directly

From a person who registers you on your behalf (colleague, assistant, etc.)

3. WHY DO WE PROCESS YOUR PERSONAL DATA?

We process personal data about you for the following purpose:

Your participation to 5K@EASD Virtual Challenge and Novo Nordisk sponsored disease awareness activities.

Novo Nordisk A/S and TRACS, Inc. to use your name, voice, video, audio, photographs, motion pictures, pictures, records and/or photographic portraits as is or with changes/alterations in any broadcast, telecast, publication, advertising, promotion in relation to 5K@EASD without any compensation.

You are not required to provide us with your personal data. However, if you do not provide your personal data, we will not be able to participate in the 5K@EASD Virtual Challenge.

4. WHAT PERSONAL DATA DO WE PROCESS ABOUT YOU?

For the purpose described above in Section 3, we may process the following types of personal data:

Contact information (name, country, email address)

Financial information (credit card number and billing address)

Data concerning gender and date of birth

Data concerning attendance of 2023 EASD Congress and affiliation with EASD

Data concerning preference to run/walk or handcycle/wheelchair

Data concerning preference for language

Data concerning how the registrant heard about the 5K@EASD

Data opt-in for SMS messaging

Data concerning runner shirt size, if purchasing

Your photographs, motion pictures, voice, video, audio, photographic portraits, records

5. WHY ARE WE ALLOWED BY LAW TO PROCESS YOUR PERSONAL DATA?

Our processing of your personal data requires a legal basis. By law, we are allowed to process your personal data described above in Section 4 based on the follow legal bases:

You gave consent for us to process your personal data

The processing of your personal data is necessary for your entry in the 5K run/walk

The processing is necessary for our compliance with a legal obligation

6. HOW DO WE SHARE YOUR PERSONAL DATA?

We only share your data for the purposes of conducting the 5K@EASD race and may share your personal data with:

Suppliers or vendors that assist our company (e.g., consultants, IT service providers, financial institutions, law firms)

Other Novo Nordisk entities.

We may use your photographs, motion pictures, voice, video, audio, photographic portraits, records in relation to 5K@EASD website and subsequent 5K@EASD publications

7. WHEN DO WE TRANSFER YOUR PERSONAL DATA OUTSIDE THE EU/EEA?

For the purposes described above in Section 3, we transfer your personal data to countries outside the European Economic Area (EEA). The level of data protection in certain countries outside the EEA does not conform to the level of data protection for personal data currently applied and enforced within the EEA.

We therefore use the following safeguards, as required by law, to protect your personal data in case of such transfers:

The transfer is to a Novo Nordisk entity covered by Novo Nordisk’s Binding Corporate Rules, available at https://www.novonordisk.com/content/dam/nncorp/global/en/data-privacy/novo-nordisk-binding-corporate-rules.pdf.

The destination countries are deemed by the EU Commission to have an adequate level of protection of personal data

We have entered into Standard Contractual Clauses for the Transfer of Personal Data to Third Countries. You can get a copy of the Clauses by contacting us as described in Section 1.

8. HOW LONG WILL WE KEEP YOUR PERSONAL DATA?

We will store the personal data collected by us in the course of fulfilling the contract until the expiry of the limitation period after fulfillment of the contract, unless there are legal retention periods. For insurance reasons, data collection is a minimum of seven years from the Event.

8.1 Processing for contract execution, publication, results database
The personal data provided by participants when registering will be stored and processed by us for the purposes of organizing and processing the Event, including the printing of the race results on personalized certificates and/or the medical care of the participants on the course and at the finish by the medical services supervising the event, as well as for payment processing.

8.2 Publication of results, results database
In addition, we process and publish the surname, first name, year of birth, nationality, gender, group (if applicable), start number and result (placement and times) of the participants for the presentation of participant and result lists in the relevant media accompanying the event (on the 5K@EASD website, as well as on the Internet) and transfer these data for publication by third parties (e.g. newspapers, result services, etc.) and store them for the creation of a historical result database.

8.3 Documentation in image and sound
The collection, processing and storage of personal data in connection with the image and sound recordings carried out and/or arranged by us in accordance with conduct of the Event is reserved in perpetuity for our legitimate interests.

9. WHAT ARE YOUR RIGHTS?

In general, you have the following rights:

You can get an overview of what personal data we have about you

You can get a copy of your personal data in a structured, commonly used and machine-readable format

You can get an update or correction to your personal data

You can have your personal data deleted or destroyed

You can have us stop or limit processing of your personal data

If you have given consent for us to process your personal data (see Section 5), you can withdraw your consent at any time. Your withdrawal will not affect the lawfulness of the processing carried out before you withdrew your consent

You can submit a complaint about how we process your personal data to a Data Protection Authority.

Under applicable law, there may be limits on these rights depending on the specific circumstances of the processing activity. Contact us as described in Section 1 with questions or requests relating to these rights.