Privacy Statement

Brief Overview

Datasport mainly processes personal data of athletes in competitions of various event organisers that engage it to perform timekeeping, registration management and other services. Datasport does this on behalf of these event organisers and thus acts as their processor.

However, Datasport also operates services in its own name, such as "myDS", with which athletes can hold a public or non-public account or profile that serves as an archive of their results in various competitions and enables athletes to access their registrations with the various event organisers online. These account and public profile services as well as the publicly available service "DS live", which was developed by Datasport (for automatically sending intermediate times, results and information about the individual athletes and additional services, such as access to diplomas (certificates of participation issued by event organisers) and particularly the tracking service "DS Mobile Tracking" (for determining and displaying the athlete's current and expected positions in an event) are operated by Datasport at its own responsibility, as is an internal archive containing the master data and event participation of athletes who do not have a "myDS" account (technically, it is also part of "myDS" but offers no account or public profile).

The present Privacy Statement covers both types of processing: the data processing performed by the event organisers, insofar as Datasport administers it, as well as the data processing performed by Datasport itself.

Summary: Data Processing by Datasport and Event Organisers

Datasport's core service consists of performing the timekeeping for mass sporting events and administering athletes' registrations. In addition, Datasport offers organisers a variety of services, such as processing registrations (online and offline), administering athletes' data, collection of payments, timekeeping, a results service, starting-number procedures and participant advertising and information. This also includes sending out newsletters and other information in the name of the organisers, publishing starting lists and rankings, automatically sending out intermediate times, results and information about the individual athletes (e.g., diplomas), and other services, such as producing personal starting numbers.

Datasport also distributes part of the information about the respective athlete through the "DS live" service, which Datasport operates at its own responsibility, as well as via the Datasport website, its own mobile apps and other channels of its own and of third parties. These third-party channels include, in particular, social media platforms of third-party providers like Facebook (the respective athlete decides which of these supported third-party providers are used). With these third-party channels, the respective privacy policies of the relevant platform's operator apply.

Datasport does not conduct these events and is not a contracting party of the athletes in this regard. Instead, that is the role of the individual event organisers that engage Datasport to administer the participants and data and/or the timekeeping or other services. For every organiser and event, Datasport keeps a database in which it stores the participants' details, their results at the respective event, and the results of prior stagings of the same event series, if available, and other data for performing the services. The respective organisers are responsible for these databases and the associated data processing; they can request that Datasport provides these data at any time, and they can also access these data online upon request. In this respect, Datasport acts as their processor. The event organisers' databases are managed by Datasport within its "Windata" application. Datasport does not know what the organisers do with the data apart from Datasport, nor is it involved in such activities. Furthermore, as this Privacy Statement provides no information in this regard, the websites and other sources of information of the event organisers should be consulted.

In order to provide these services, Datasport performs the following data processing:

• Datasport operates its Online Shop (or the "Online Registration", as applicable) in its own name. Via this Online Shop, not only can users register for events and pay registration fees to the event organisers, but they can also obtain other products and services from third parties, such as, namely, cancellation insurance, training schedules and merchandising products.
• Datasport operates the application "myDS" in its own name (available together with accounts and profiles via https://www.datasport.com/en/for-athletes/myds/). Via this application, every athlete can set up an account that is independent of the individual events and through which he can maintain and publish a profile and in which his participation (including results) in individual events is recorded. The "myDS" account is also used to give athletes online access to registrations and to administer their master data and settings (e.g., consents) for each event. Athletes normally make the accounts (and the event participation recorded therein) publicly available, which means that they can be searched and queried by third parties.
• Datasport also uses "myDS" to prepopulate the athlete's master data and inputs that are already known to it in connection with registrations for new events and to calculate starting-position availabilities and performance-class divisions, which requires access to data from prior events in which the athlete participated.
• The application "myDS" and various other features on Datasport's website are also available via apps and other channels provided by Datasport.
• Datasport also offers its own apps and services especially for events, such as "DS Mobile Tracking". The athlete can install these apps on his mobile phone and then carry the phone with him during the competition. The app records the position and continually sends this information to Datasport, where it is edited so that the persons invited by the athlete can follow his location and performance via web, app or other channels in real time.

In "myDS", the athlete is given the option to adjust his privacy settings (newsletter delivery, display of photo links in the rankings, inclusion of social media platforms, etc.) regarding the data processing by the event organisers and Datasport at any time.

Event registration is normally done online via Datasport by the athlete himself, but it can also be done by family members (e.g., parents in the case of children), via the event organisers or via sports clubs.

Controllers, Contact Information

Regarding the collecting and processing of personal data in "myDS", "DS live" or "DS Mobile Tracking" and the Online Shop (or the "Online Registration", as applicable) Datasport AG, PO Box 117, Bolacker 1, 4563 Gerlafingen, Switzerland acts as controller.

Regarding the collecting and processing of personal data related to the individual events for which Datasport provides services, the respective event organiser acts as controller. A list of these organisers and events is available on the Datasport website. The individual organisers may be contacted via Datasport or its website.

Through its Online Shop, Datasport also offers products and services of third parties. A list of these other providers, including their contact information, can be found here.

Datasport itself has not appointed a data protection officer. Any privacy-related enquiries may be sent via email to [email protected] or in writing to Datasport AG, PO Box 117, Bolacker 1, 4563 Gerlafingen. Athletes can also edit and view their master data and manage their consents online via "myDS".

Insofar as Datasport falls within the scope of application of the GDPR, it has appointed a representative in accordance with Art. 27 GDPR: Datasport Germany GmbH, Heisinger Strasse 12, 87437 Kempten, Germany.

Collecting, Processing and Using Personal Data

On its own behalf and on behalf of the organisers of the respective events, Datasport collects and processes personal data pertaining to:

• athletes;
• athletes' contact persons in case of emergencies;
• users of the websites and apps or other channels owned by Datasport;
• recipients of newsletters and marketing mailings;
• recipients of text messages during events;
• persons who purchase products or services in the Online Shop;
• persons who communicate with Datasport via e-mail, telephone or otherwise;
• persons who contribute content for the websites, apps or other channels owned by Datasport;
• persons who have applied for a job with Datasport.

The personal data are generally collected from the respective persons themselves, for instance, by an athlete registering for an event and opening a "myDS" account or registering for a newsletter. However, they may also be collected via third parties, for instance when an athlete is registered by a family member, friend, sports club, school or the event organiser.

Furthermore, data are exchanged between "myDS" and the data collections of the individual events for which the athlete has registered.

Event organisers collect the following categories of data, in particular, via Datasport:

• Athletes' personal data and contact information (master data), such as salutation, first name, last name, sex, birthday, birth year, nationality, address, country, e-mail address, mobile phone number;
• Athletes' data related to the registration for, participation in and holding of the respective event;
• Any data from prior years if the athlete has participated in this event previously;
• Data related to newsletters and promotional offers;
• Text message recipients for the text message results service for each event.

In order to provide these services, Datasport collects the following categories of data:

• Master data, Datasport ID ("DSID"), currency used by athletes for registration fees;
• Athletes' data related to their accounts on "myDS", particularly their user name and password (only in encrypted form);
• Information for connecting to other "myDS" accounts (e.g., family members);
• Events for which the athlete has registered, together with any results and age and performance classes;
• Data related to the ordering and implementation of additional services via "DS live", the apps and other channels owned by Datasport and third parties, such as tracking data associated with "DS Mobile Tracking";
• Data related to the Online Shop, such as the customer's IP address and e-mail address, payment methods, shopping cart;
• Data related to newsletters and promotional offers;
• Data related to linking a "myDS" account with social networks (e.g., Facebook);
• Data pertaining to remote access users of Datasport's systems;
• Data related to communication, such as records of correspondence and communication with Datasport.

If children (under 16 years of age) actively participate in events, their data, too, are generally processed to the same extent as the data of other athletes and users. These data are normally collected via the parents or legal guardians, as applicable, or (with their consent) via a sports club, school etc.

If the registration for an event is completed via the Online Shop, Datasport carries this out in the name of the event organiser but uses the athlete's data already existing in "myDS" and required for the registration. These data are thus disclosed to the event organiser in accordance with data protection laws.

If adjustments are made to the master data as part of the registration or of the event, Datasport restores them to "myDS" so that "myDS" remains up-to-date. Conversely, athletes can use "myDS" to manage data and settings regarding individual events.

Purpose of Processing Personal Data

Insofar as Datasport collects and processes personal data as a controller, it does so to the extent permitted by applicable law, particularly for the following purposes:

• For purposes of contracting for and providing services for athletes, particularly "myDS";
• To calculate performance figures for additional events based on an athlete's results history;
• For operating the apps and other channels of Datasport and services like "DS live" and "DS Mobile Tracking";
• For the linking of athletes' "myDS" accounts to their respective profiles on social media platforms;
• For advertising and marketing, particularly sending out marketing mailings;
• For operating the Online Shop, including combating fraud and processing orders and payments;
• For the operation, security, maintenance and further development of the website, services, products and systems of Datasport;
• For statistical evaluations, analyses and documentation;
• For purposes of fulfilling applicable legal requirements and internal rules of Datasport;
• For individual communication with users of Datasport's services.

The respective event organisers for which Datasport acts as a processor collect and process data, particularly for the following purposes:

• For conducting events, particularly for organising the registration, the timing, start, intermediate and finish times, and starting-number processes;
• For purposes of supporting Datasport's services;
• Communication with athletes and users regarding events;
• In connection with advertising and marketing;
• For purposes of fulfilling applicable legal requirements;
• For statistical evaluations, analyses and documentation.

Generally, Datasport and the event organisers do not take any automated individual decisions that have legal or similar significant effects on the data subject.

For starting-number processes, e.g., the assignment of starting blocks, the athletes' performance classes are sometimes determined automatically (based on their prior performance). This is necessary for purposes of implementing the event organiser's agreement.

Datasport, in its role as controller, processes the aforementioned personal data on the following legal bases:

• Conclusion and fulfilment of Datasport's agreements with event organisers, athletes and users;
• Compliance with legal requirements by Datasport;
• Consent of the athletes, particularly regarding "DS live" or "DS Mobile Tracking", newsletter and advertising opt-ins;
• Consent of persons with whom permanent cookies are used;
• Legitimate interests of Datasport and other parties.

Data Disclosure and Data Transfer Abroad

The personal data processed by Datasport on its own behalf and on behalf of the event organisers may be transferred to the following categories of recipients to the extent permitted by applicable data protection law:

• To Datasport or the respective event organiser, as applicable;
• Businesses and organisations that offer their products and services via Datasport's Online Shop;
• Photo services and other providers, as well as other organisers;
• Associations, clubs, schools, other approved sports associations and sports organisations;
• Parents, respectively legal guardians and representatives of the athletes;
• Local, national and foreign authorities;
• Media organisations;
• Recipients of results text messages;
• Persons invited by the athletes with regard to "DS live" or "DS Mobile Tracking";
• Third-parties, including IT service providers, payment service providers, legal firms, trustees;
• Advertising customers and sponsors;
• Operators of social networks;
• The public, including visitors to Datasport's website and particularly the "myDS" database and the "myDS" search feature;
• Buyers or parties interested in acquiring the company or in other corporate transactions.

The information accessible on Datasport's website is available worldwide. Datasport currently utilises the following processors: Horisen (Switzerland, text messaging), Clickatell (England, text messaging), Google (Ireland, website analysis), 1&1 (Germany, combating fraud).

Datasport currently utilises payment service providers headquartered in Switzerland (PostFinance, TWINT, payrexx), Germany (Deutsche Postbank, Concardis, sofort, Unzer) and Singapore (PayPal).

The data subjects may obtain a copy of the contractual warranties from the contact person specified above or be advised by him or her where they may obtain a copy.

Data Retention

Unless otherwise provided by law, Datasport generally stores the personal data processed as part of the service on its own behalf and for event organisers with no specific time limit unless reasons exist for earlier deletion. The list of recipients of results text messages is deleted after the respective event. An athlete's additional event-specific information is stored for up to ten years and subsequently deleted, unless the event organiser has agreed otherwise with Datasport.

The "myDS" accounts are kept indefinitely. If an athlete terminates his "myDS" account, all data in "myDS" are deleted except for the person's master data (DSID, first name, last name, sex, date of birth, birth year, nationality). The master data are likewise deleted ten years after the termination of the account.

For business data that include personal data (e.g., records and logs), shorter retention periods of up to twelve months generally apply.

If actual or suspected cases of fraud are discovered and the athlete in question is blocked, the relevant data are retained for approximately six months. Serious cases are marked as such and retained for up to five years.

Business documents, including correspondence, are retained for as long as Datasport or the event organiser has a legitimate interest in them or is obligated to do so. Data from orders made via the Online Shop can generally be retained permanently.

Cookies and Google Analytics

Datasport utilises cookies on the website. Cookies are a widespread technology in which the browser of the website user is assigned an identifier that the browser stores locally and exhibits upon request. On the one hand, Datasport utilises session cookies, which are automatically deleted once the user leaves the website and are used for purpose of enabling the server to maintain the connection to the user. On the other hand, Datasport also uses permanent cookies, which are only deleted after a period specified for each website (e.g., two years after the last visit) and are used for the purpose of storing the user's default settings (e.g., language) over multiple sessions or to enable automatic logins. By using the website and the corresponding features, the user agrees to the use of such permanent cookies. The user of a website can block the use of cookies in his browser or delete them there, but this could potentially affect use of the website.

Datasport may utilise Google Analytics or similar services on its website. This is a service provided by a third party (in the case of Google Analytics, the provider, Google Inc., is headquartered in the USA, www.google.com), and it allows Datasport to measure and analyse the use of its website. This is also accomplished by using permanent cookies, which this service provider implements. The service provider does not receive any personal data from Datasport (and does not retain any IP addresses outside of Europe) but can track the user's utilisation of the website and combine this information with data from other websites. Datasport receives non-personal information from the service provider concerning the use of the website.

Rights of the Athlete, the User and Other Data Subjects

An athlete with an account can view and modify all information concerning him in "myDS" via Datasport's website. The information about the individual events for which the athlete is registered can also be viewed and modified via "myDS". A "myDS" account may be opened by any athlete himself at any time.

Every data subject has a right to be informed about his data and can request information about them and demand that they be corrected. Moreover, every data subject has the right to request the deletion and restriction of the use of his personal data by Datasport or the event organiser and to refuse such processing of his personal data. If the processing of the personal data is based on a consent, the consent may be revoked by the data subject at any time.

The individual event organisers and, for its own purposes, Datasport as well, offer the athletes a variety of options for selective consents (opt-ins) to various processing of their data or the option to selectively refuse such processing (opt-out). These consents can be administered via "myDS".

The data subject has, upon submitting the corresponding request, the right to receive the data generated through the use of online services in a structured, common and machine-readable format.

Enquiries concerning these rights should be addressed to the contact person (see section 3 above). The data subject must clearly indicate which right they wish to exercise, which personal data are affected and provide proof of identity along with their request.

Changes to the Privacy Statement

Datasport may modify the present Privacy Statement at any time without prior notice or announcement. The current version published on the website www.datasport.com shall apply.

If the Privacy Statement is part of an agreement with athletes, users or another data subject, then, in the event of an update, Datasport may inform them of such update via e-mail or other appropriate means. If no objection is raised within 30 days, then the new Privacy Statement is deemed accepted.

Annexes

APPENDIX 1 - CATEGORIES OF PERSONAL DATA, CATEGORIES OF DATA SUBJECTS, DESCRIPTION OF DATA PROCESSING AND PURPOSE, LIST OF SUB-PROCESSORS.