Privacy Statement

Version 1.01 - August 2023 

This Privacy Statement explains the collection and further processing of personal data by Datasport AG (hereinafter called Datasport) for itself and for the event organisers on whose behalf it acts, unless such processing is covered by other privacy statements, arises from the circumstances or is determined by law, as applicable. The term "personal data" refers to any information relating to an identified or identifiable person. 

1. Brief Overview

Datasport mainly processes personal data of athletes in competitions of various event organisers that engage it to perform timekeeping, registration management and other services. Datasport does this on behalf of these event organisers and thus acts as their processor. 

However, Datasport also operates services in its own name, such as "myDS", with which athletes can hold a public or non-public account or profile that serves as an archive of their results in various competitions and enables athletes to access their registrations with the various event organisers online. These account and public profile services as well as the publicly available service "DS live", which was developed by Datasport (for automatically sending intermediate times, results and information about the individual athletes and additional services, such as access to diplomas (certificates of participation issued by event organisers) and particularly the tracking service "DS Mobile Tracking" (for determining and displaying the athlete's current and expected positions in an event) are operated by Datasport at its own responsibility, as is an internal archive containing the master data and event participation of athletes who do not have a "myDS" account (technically, it is also part of "myDS" but offers no account or public profile). 

The present Privacy Statement covers both types of processing: the data processing performed by the event organisers, insofar as Datasport administers it, as well as the data processing performed by Datasport itself.

2. Summary: Data Processing by Datasport and Event Organisers

Datasport's core service consists of performing the timekeeping for mass sporting events and administering athletes' registrations. In addition, Datasport offers organisers a variety of services, such as processing registrations (online and offline), administering athletes' data, collection of payments, timekeeping, a results service, starting-number procedures and participant advertising and information. This also includes sending out newsletters and other information in the name of the organisers, publishing starting lists and rankings, automatically sending out intermediate times, results and information about the individual athletes (e.g., diplomas), and other services, such as producing personal starting numbers. 

Datasport also distributes part of the information about the respective athlete through the "DS live" service, which Datasport operates at its own responsibility, as well as via the Datasport website, its own mobile apps and other channels of its own and of third parties. These third-party channels include, in particular, social media platforms of third-party providers like Facebook (the respective athlete decides which of these supported third-party providers are used). With these third-party channels, the respective privacy policies of the relevant platform's operator apply. 

Datasport does not conduct these events and is not a contracting party of the athletes in this regard. Instead, that is the role of the individual event organisers that engage Datasport to administer the participants and data and/or the timekeeping or other services. For every organiser and event, Datasport keeps a database in which it stores the participants' details, their results at the respective event, and the results of prior stagings of the same event series, if available, and other data for performing the services. The respective organisers are responsible for these databases and the associated data processing; they can request that Datasport provides these data at any time, and they can also access these data online upon request. In this respect, Datasport acts as their processor. The event organisers' databases are managed by Datasport within its "Windata" application. Datasport does not know what the organisers do with the data apart from Datasport, nor is it involved in such activities. Furthermore, as this Privacy Statement provides no information in this regard, the websites and other sources of information of the event organisers should be consulted.

In order to provide these services, Datasport performs the following data processing:

  • Datasport operates its Online Shop (or the "Online Registration", as applicable) in its own name. Via this Online Shop, not only can users register for events and pay registration fees to the event organisers, but they can also obtain other products and services from third parties, such as, namely, cancellation insurance, training schedules and merchandising products. 
  • Datasport operates the application "myDS" in its own name (available together with accounts and profiles via https://www.datasport.com/en/for-athletes/myds/). Via this application, every athlete can set up an account that is independent of the individual events and through which he can maintain and publish a profile and in which his participation (including results) in individual events is recorded. The "myDS' account is also used to give athletes online access to registrations and to administer their master data (see 4.3) and settings (e.g., consents) for each event. Athletes normally make the accounts (and the event participation recorded therein) publicly available, which means that they can be searched and queried by third parties (in this case, the account is displayed as a profile).
  • Datasport also uses "myDS" to prepopulate the athlete's master data and inputs that are already known to it in connection with registrations for new events and to calculate starting-position availabilities and performance-class divisions, which requires access to data from prior events in which the athlete participated. For this reason, registering for an event requires that these data be entered in the "myDS" system in advance, even if no account or profile is set up by the athlete. In this case, "myDS" serves only as a Datasport-internal archive that Datasport needs in order to provide its services to the event organisers. However, if an athlete later opts to have an account in "myDS", the information contained in the archive is transferred to his account, and he is given online access to it. The athlete can choose whether or not to make his account publicly available (and thus displayed as a profile that can be called up by the public). This can be changed online at any time via the "myDS" account.
  • The application "myDS" and various other features on Datasport's website are also available via apps and other channels provided by Datasport. The statements made regarding the website apply in like manner to these apps and other channels. 
  • Datasport also offers its own apps and services especially for events, respectively can provide this (e.g., as part of its service "DS Mobile Tracking"). Namely, the athlete can install these apps on his mobile phone and then carry the phone with him during the competition. As part of Datasport's service "DS Mobile Tracking", an app records the position and continually sends this information to Datasport, where it is edited so that the persons invited by the athlete can follow his location and performance via web, app or other channels (e.g., over third-party social media platforms selected by the athlete, such as Facebook) in real time and can see when the athlete is expected to be at certain positions.

In "myDS", the athlete is given the option to adjust his privacy settings (newsletter delivery, display of photo links in the rankings, inclusion of social media platforms, etc.) regarding the data processing by the event organisers and Datasport at any time. An overview of the default potential opt-ins and opt-outs provided by the event organisers and Datasport can be found upon logging in to the Datasport webiste. Athletes may adjust these settings themselves online via a "myDS" account and thus adjust their data as well (not only for the individual events but also for "myDS" itself). If an athlete does not have a "myDS" account, his default privacy settings will specify restricted data processing. He can adjust these settings by setting up an account or by contacting Datasport.

Event registration is normally done online via Datasport by the athlete himself, but it can also be done by family members (e.g., parents in the case of children), via the event organisers or via sports clubs. The persons or clubs making these multiple registrations act in the name and on behalf of the individual athletes. At any rate, the registration results in a corresponding entry in "myDS". If the registered person already owns an account or his information is kept in another person's account (e.g., children in the cases of families), the registration or participation, as applicable, in such event is assigned to this account in "myDS". If an entry cannot be assigned to an account, the data are stored in "myDS" – together with the athlete's master data and inputs – for internal archiving purposes without an account. Datasport needs these data to provide its services to the event organisers (e.g., for starting-block calculations based on participation in prior events), as well as to transfer the data into the athlete's account if he decides to set one up at a later date. An additional advantage that this offers the athlete is that he himself can thus manage his privacy settings (particularly the various consents) online. 

3. Controllers, Contact Information 

Regarding the collecting and processing of personal date in "myDS", "DS live" or "DS Mobile Tracking" and the Online Shop (or the "Online Registration", as applicable) Datasport AG, PO Box 117, Bolacker 1, 4563 Gerlafingen, Switzerland acts as controller (particularly, as defined in Art. 4 Section 7 of the European General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (FADP), insofar as the respective provisions apply in the specific case). 

Regarding the collecting and processing of personal data related to the individual events for which Datasport provides services, the respective event organiser acts as controller. A list of these organisers and events is available on the Datasport website. The individual organisers may be contacted via Datasport or its website. The organisers engage Datasport to process the data related to these events insofar as the organisers utilise its systems and services. The organisers themselves are responsible for any data processing performed on their own systems or on third-party systems. 

Through its Online Shop (namely, as a web shop in the context of "Online Registration"), Datasport also offers products and services of third parties (besides the event organisers). A list of these other providers, including their contact information, can be found here. The responsibility for the additional processing of the data associated with a purchase in the Online Shop rests with these third parties, each of which is indicated in the Online Shop. Datasport provides them the data necessary for concluding and implementing the agreement. The present Privacy Statement does not include any additional information about data processing by these third parties.

Datasport itself has not appointed a data protection officer as referred to in Art. 37 GDPR nor a data protection consultant as referred to in Art. 10 of the Data Protection Act, as none is required. Any privacy-related enquiries may be sent via email to [email protected] in writing to Datasport AG, PO Box 117, Bolacker 1, 4563 Gerlafingen. Athletes can also edit and view their master data and manage their consents online via "myDS", not only regarding the individual events for which they have registered, but also for the data in "myDS".

Insofar as Datasport falls within the scope of application of the GDPR, it has appointed a representative in accordance with Art. 27 GDPR: Datasport Germany GmbH, Heisinger Strasse 12, 87437 Kempten, Germany.

4. Collecting, Processing and Using Personal Data 

4.1 Data Subjects

On its own behalf and on behalf of the organisers of the respective events, Datasport collects and processes personal data pertaining to:

  • athletes;
  • athletes' contact persons in case of emergencies (for Datasport and event organisers);
  • users of the websites and apps or other channels owned by Datasport (for Datasport);
  • recipients of newsletters and marketing mailings (for Datasport);
  • recipients of text messages during events (for the event organiser);
  • recipients of text messages within "DS live" or "DS Mobile Tracking", as applicable, and other services (for Datasport and event organisers);
  • persons who purchase products or services in the Online Shop (or the "Online Registration", as applicable) (for Datasport, event organisers and other providers);
  • persons who communicate with Datasport via e-mail, telephone or otherwise, such as via the contact form on the website (for Datasport, event organisers and other providers);
  • persons who contribute content for the websites, apps or other channels owned by Datasport (for Datasport);
  • persons who have applied for a job with Datasport. 

4.2 Data Sources

The personal data are generally collected from the respective persons themselves, for instance, by an athlete registering for an event and opening a "myDS" account or registering for a newsletter. However, they may also be collected via third parties, for instance when an athlete is registered by a family member, friend, sports club, school or the event organiser and an entry is established in his name (in which case, Datasport assumes that these third parties are authorised by the data subject to do this for him as an athlete; otherwise, the data subject may have his information and consents pertaining to the data applications corrected after the fact or may correct and manage them himself by using "myDS", or he may close the account or profile, as applicable). 

Indicating contact persons in case of emergencies and specifying recipients for text message results notifications, the information for activating an athlete's data on the app and the information for setting up accounts on Datasport's systems for remote access by the event organisers' employees is likewise done via third parties, meaning the athlete (or his agents) or the event organisers, as applicable. These third parties are responsible for notifying the data subjects regarding the processing of their data by Datasport and for obtaining the necessary consents from them. 

Furthermore, data are exchanged between "myDS" and the data collections of the individual events for which the athlete has registered (e.g., transfer of master data from "myDS" in connection with a new registration, transfer of an athlete's results into "myDS" after an event) (see section 4.5).

4.3 Collected Data

The data marked with *) are the minimum data required for concluding the agreement with the organisers or with Datasport, as applicable; without these data, it is impossible to participate in the events or use the Online Shop, as applicable (particularly the "Online Registration", but also any web shop in this context) and "myDS". The other data are partially necessary in order to utilise certain additional services provided by the event organisers and Datasport. 

Event organisers collect the following categories of data, in particular, via Datasport: 

  • Athletes' personal data and contact information (master data), such as salutation, first name, last name, sex, birthday, birth year, nationality, address, country, e-mail address, mobile phone number; *)
  • Athletes' data related to the registration for, participation in and holding of the respective event (event data), such as events for which a person has registered, data related to timing and results (including ranking), race status, links to photos and videos of the athlete supplied by third-party providers, age and performance categories, starting number or bib number, emergency contact, licence-related information, event-specific data (such as the team at the event, clothing size for t-shirts, etc.), currency used for event registration fee; *)
  • Any data from prior years if the athlete has participated in this event previously (transferred from the event data);
  • Data related to newsletters and promotional offers from third parties and other services, such as opt-ins and opt-outs regarding the event organiser's newsletter, as well as opt-ins and opt-outs for promotional offers of third parties and other services;
  • Text message recipients for the text message results service for each event.

In order to provide these services, Datasport collects the following categories of data:

  • Master data, Datasport ID ("DSID"), currency used by athletes for registration fees; *)
  • Athletes' data related to their accounts on "myDS", particularly their user name and password (only in encrypted form) *), voluntary information provided by the athlete regarding his family, children, himself ("About me"), interests, occupation, education, films, books, music, best location, best holidays, motto, sport, training, best training location, sporting flops, best sporting performances, current and former memberships, sponsors, gear;
  • Information for connecting to other "myDS" accounts (e.g., family members);
  • Events for which the athlete has registered, together with any results and age and performance classes (times), as well as the other information collected for Datasport's event organisers that the athlete himself can manage via "myDS" (e.g., opt-ins and opt-outs that the athlete has set for the respective event), all of which is based, in each case, on the event data; *)
  • Data related to the ordering and implementation of additional services via "DS live", the apps and other channels owned by Datasport and third parties, such as tracking data associated with "DS Mobile Tracking"
  • Data related to the Online Shop (respectively the Online Registration), such as the customer's IP address and e-mail address, payment methods (in accordance with PCI standards and information about the payment method requested by the customer), shopping cart (master data and data related to registrations, details regarding products and services purchased by third parties via the Online Shop (particularly as a web shop as part of the "Online Registration"), including data regarding any insurance and event-specific information, such as t-shirt size); *)
  • Data related to newsletters and promotional offers from third parties and other services, such as opt-ins and opt-outs regarding the Datasport's newsletter, as well as opt-ins and opt-outs for promotional offers of third parties and other services;
  • Data related to linking a "myDS" account with social networks (e.g., Facebook), such as the profile photo and other data in accordance with the settings of the athlete, the corresponding login details (only in encrypted form) for linking the "myDS" account with the social network, etc. in accordance with the configured settings;
  • Data pertaining to remote access users of Datasport's systems, such as name, e-mail address, event organiser, login details, Apple/Windows user, language etc.;
  • Data related to communication, such as records of correspondence and communication with Datasport, requests for quotes, etc. 

Datasport also collects:

  • Data pertaining to event organisers and its employees, particularly contact details, information regarding their function, requests for quotes, users of event organisers with remote access;
  • Data related to the use of the website and the apps or other channels owned by Datasport, such as access logs and session cookies and permanent cookies, for registered and unregistered users alike;
  • Data pertaining to persons who have applied for a job with Datasport including their curriculum vitae, letter of motivation, employment and education references, information about their current employment (e.g. notice period) and information in connection with an interview

4.4 Children

If children (under 16 years of age) actively participate in events, their data, too, are generally processed to the same extent as the data of other athletes and users. These data are normally collected via the parents or legal guardians, as applicable, or (with their consent) via a sports club, school etc. If an event organiser requests that its data be returned by Datasport, data pertaining to children are only be transferred to the event organiser upon express request (or a corresponding agreement). 

4.5 Exchange between Datasport and Event Organisers

If the registration for an event is completed via the Online Shop (meaning via the "Online Registration"), Datasport carries this out in the name of the event organiser (the participation agreement is made directly with the event organiser) but uses the athlete's data already existing in "myDS" and required for the registration. These data are thus disclosed to the event organiser in accordance with data protection laws (and they henceforth continue to be processed by Datasport, but now as processor for the event organiser). 

If adjustments are made to the master data as part of the registration or of the event, as applicable, Datasport restores them to "myDS" so that "myDS" remains up-to-date. Conversely, athletes can use "myDS" to manage data and settings regarding individual events (e.g., consents), for purposes of which Datasport must also technically store and match these data in "myDS". However, Datasport's databases and those of the event organisers are kept separately, including the opt-ins and opt-outs (e.g., an athlete can decide and configure for Datasport and for each event whether he wants to receive newsletters and promotional mailings).

If an athlete is registered for or has taken part in an event and has a "myDS" account, Datasport imports (in its own name) from each athlete and from the respective event organiser the (published) event information, the athlete's category and his results, if and as soon as they are available. This information is stored independently in "myDS" and by the event organiser. If the athlete has a public "myDS" account, the details are also available to the public in the form of a "myDS" profile. If he only has a "myDS" account, then only he can call them up.

As a rule, the same procedure is followed even if a registration is completed by sending the information to Datasport or via an event organiser. In this case, Datasport will attempt to identify the registered athlete in its database and enter his participation in "myDS". If this results in misattributions or a linking fails to be made, this is corrected upon notification. If a "myDS" account does not yet exist, then for registrations not made via its Online Shop (respectively, the "Online Registration"), Datasport will make an entry but will store these data only for the purpose of enabling the subsequent setup of an account (and the recording of events participated in under such account) and of managing or issuing, as applicable, of the necessary authorisations for additional services provided by the event organiser (e.g., a photo service). The athlete may open an account at any time and view these data and modify them via "myDS". It is impossible to register without a "myDS" entry. Datasport requires this to administer the data it stores for the individual athletes (e.g., master data and opt-ins and opt-outs), to give the athletes access to these data, and to calculate starting position availabilities and performance-class divisions for event organisers as needed based on an athlete's history (e.g., to determine the best starting sector for an athlete to start in based on his prior results). 

5. Purpose of Processing Personal Data

5.1 Purpose of Collecting and Processing of Personal Data by Datasport

Insofar as Datasport collects and processes personal data as a controller, it does so to the extent permitted by applicable law, particularly (but not exclusively) for the following purposes: 

  • For purposes of contracting for and providing services for athletes, particularly "myDS", for the setup, maintenance and updating of the "myDS" account (including data from events), for the account management and access control and for providing data at the time of registration for an event in order to give the athlete online access to the data from his individual registrations (including the administration of his consents), for publishing the "myDS" profile and the associated search feature;
  • To calculate performance figures for additional events based on an athlete's results history (e.g., the best starting block for an athlete to start from based on his prior performance) and to provide these figures to the respective event organisers;
  • For operating the apps and other channels of Datasport and services like "DS live" and. "DS Mobile Tracking" (e.g., particularly displaying the athlete's current and computed location data, but also additional information in this regard for the persons invited by him);
  • For the linking of athletes' "myDS" accounts by the athletes themselves to their respective profiles on social media platforms (e.g., Facebook);
  • For advertising and marketing, particularly sending out marketing mailings for advertising customers, as well as sending out advertising and newsletters of Datasport;
  • For operating the Online Shop (particularly the Online Registration and any associated web shops), including combating fraud and processing orders and payments;
  • For the operation, security, maintenance and further development of the website, services, products and systems of Datasport;
  • For statistical evaluations, analyses and documentation, reports and public relations work;
  • For purposes of fulfilling the applicable legal requirements and internal rules of Datasport, pursuing and implementing various rights, asserting and defending against legal claims and complaints, combating abuse, and for purposes of legal investigations or proceedings related to answering enquiries from the authorities;
  • For individual communication with users of Datasport's services, e.g., enquiries and complaints and responding to same;
  • The sale or purchase of companies and other corporate transactions and the associated transfer of user data; and 
  • For other purposes, where a legal duty requires the processing or where these purposes were evident or appropriate based on the circumstances at the time of data collection. 

5.2 Purpose of Collecting and Processing of Personal Data by the Respective Event Organisers

The respective event organisers for which Datasport acts as a processor collect and process data to the extent permitted by applicable law, particularly (but not exclusively) for the following purposes: 

  • For conducting events, particularly for organising the registration, the timing, start, intermediate and finish times, for starting-number processes (such as creating starting and ranking lists with photo and video links, printing starting numbers with and without first names, assigning starting blocks to the events, team-building), collection of payments, performing other event-related services (e.g., printing starting numbers, finisher t-shirts, diplomas), statistical evaluations, etc.; 
  • For purposes of supporting Datasport's services, particularly matching registration data with existing "myDS" accounts and transmitting data regarding events attended (especially results, category etc.) to Datasport for import into "myDS";
  • Communication with athletes and users regarding events (e.g., welcome and results text messages, information from the event organisers, making contact in case of emergency, answering questions and requests), for delivering starting times and starting numbers, as well as results to the athletes, for participant advertising, as well as for mailings and marketing by the event organiser and third parties;
  • In connection with advertising and marketing, particularly sending out advertising for sponsors, advertising customers and the event organisers themselves;
  • For purposes of fulfilling the applicable legal requirements and internal rules of the event organiser, pursuing and implementing various rights, asserting and defending against legal claims and complaints, combating abuse, and for purposes of legal investigations or proceedings related to answering enquiries from the authorities;
  • For statistical evaluations, analyses and documentation, reports and public relations; and 
  • For other purposes, where a legal duty requires the processing or where these purposes were evident or appropriate based on the circumstances at the time of data collection. 

5.3 Automated Individual Decisions

Generally, Datasport and the event organisers (insofar as they have delegated the processing of personal data to Datasport) do not take any automated individual decisions that have legal or similar significant effects on the data subject. 

However, to the extent the creation of ranking lists based on the timing at an event is deemed as such, the data subject is informed, in accordance with the legal duty to provide information, that the ranking lists are created based on the data subject's times as measured by Datasport's systems, with the fastest time generally yielding the best ranking. Different provisions are possible in this area and are implemented according to the specifications of the event organisers or approved associations (whose regulations are declared binding by the event organiser). If penalty points, disqualifications or other factors are to be included, this is always done through human intervention, normally by involving a person who is designated by the event organiser but may also be provided by an approved association, and thus not exclusively automatically. 

Furthermore, for starting-number processes, e.g., the assignment of starting blocks, the athletes' performance classes are sometimes determined automatically (based on their prior performance). This is necessary for purposes of implementing the event organiser's agreement. These are not individual decisions; if athletes are not satisfied with an assignment, they can contact Datasport to the attention of the respective event organiser. 

5.4 Legal Bases of Data Processing

Datasport, in its role as controller, processes the aforementioned personal data on the following legal bases: 

  • Conclusion and fulfilment of Datasport's agreements with event organisers, athletes, the users of Datasport's products and services and Datasport’s suppliers;
  • Conclusion and fulfilment of agreements with third parties (besides event organisers; in this regard, see below) made by users of the Online Shop (particularly the "Online Registration" and any associated web shops);
  • Compliance with legal requirements by Datasport;
  • Consent of the athletes (directly or via their authorised representatives), particularly regarding "DS live" or "DS Mobile Tracking", as applicable (including location-tracking mode, which can be switched on and off via the corresponding app or other means of use), newsletter and advertising opt-ins, any other opt-ins within "myDS" (administration of these consents is possible online via "myDS");
  • Consent of persons with whom permanent cookies are used;
  • Consent of employees (via the event organisers) for whom event organisers establish an account for the purpose of remote access;
  • Conclusion of applicant employment contracts;
  • Legitimate interests of Datasport and other parties: 
    • Operation of the website and other systems of Datasport;
    • Implementation, evaluation and documentation of the event, as well as future events;
    • Information provided to the public and interested groups;
    • Carrying out advertising, marketing and public relations work;
    • Maintenance and secure and efficient organisation of the business, including a secure and effective operation and the successful continuing development, and enhancement of new services, as well as of the website;
    • Sound business management and development;
    • Successful acquisition or sale of companies, as well as corporate transactions;
    • Interest in preventing fraud, abuse, crimes and other offences, as well as in the investigation of such offences and other inappropriate conduct, handling of legal complaints, claims and other actions against Datasport, involvement in legal proceedings and cooperation with the authorities, and otherwise asserting, exercising and defending legal claims. 

The event organisers have Datasport, in its role as processor, process the aforementioned personal data based on the following legal grounds in each instance: 

  • Conclusion and fulfilment of the event participation agreements with the athletes;
  • Compliance with legal requirements on the part of the event organisers;
  • Consent of the athletes (directly or via their authorised representatives), particularly for newsletters and advertising opt-ins, as well as any other opt-ins related to an event (e.g., photo and video links), as specified by the respective event organiser (administration of these consents is possible online via "myDS");
  • Legitimate interests of the event organisers and other parties:  
    • Implementation, evaluation and documentation of the event, as well as future events;
    • Information provided to the public and interested groups;
    • Carrying out advertising, marketing and public relations work;
    • Maintenance and secure and efficient organisation of the business, including a secure and effective operation and the successful continuing development, and enhancement of new services, as well as of the website;
    • Sound business management and development;
    • Interest in preventing fraud, abuse, crimes and other offences, as well as in the investigation of such offences and other inappropriate conduct, handling of legal complaints, claims and other actions against Datasport, involvement in legal proceedings and cooperation with the authorities, and otherwise asserting, exercising and defending legal claims. 

6. Data Disclosure and Data Transfer Abroad 

The personal data processed by Datasport on its own behalf and on behalf of the event organisers may be transferred to the following categories of recipients to the extent permitted by applicable data protection law:

  • To Datasport or the respective event organiser, as applicable (mutual exchange of the data kept by both parties, e.g., template for event registrations generated from "myDS", and transfer of the results to "myDS" for storage therein; exchange of athletes' data regarding their registrations, which can be administered from within "myDS", e.g., event-specific consents);
  • Businesses and organisations that offer their products and services via Datasport's Online Shop (particularly Online Registration and any associated web shops) along with the event organisers; 
  • Photo services and other providers, as well as other organisers;
  • Associations, clubs, schools, other approved sports associations and sports organisations (e.g., International Triathlon Union, Swiss Athletics, Swiss Triathlon, Swiss Runners);
  • Parents, respectively legal guardians and representatives of the athletes;
  • Local, national and foreign authorities;
  • Media organisations;
  • Recipients of results text messages (input by the recipients themselves or by third parties);
  • Persons invited by the athletes with regard to "DS live" or "DS Mobile Tracking"
  • Third-parties, including IT service providers, payment service providers, providers for the transmission of text messages, providers for combating fraud, website analysis services, legal firms, trustees);
  • Advertising customers and sponsors;
  • Operators of social networks;
  • The public, including visitors to Datasport's website and particularly the "myDS" database and the "myDS" search feature;
  • Buyers or parties interested in acquiring the company or in other corporate transactions;
  • Other parties to potential or actual legal proceedings.

The information accessible on Datasport's website is available worldwide; furthermore, the recipients of services sent via text messages or app or other channels, such as "myDS" and "DS live" and the associated data may be located anywhere in the world and are not necessarily subject to data privacy laws. In this case, Datasport, respectively the event organisers, do not take any additional precautions regarding data privacy but rely, insofar as an international disclosure of personal data within the meaning of the law has even occurred, on the exception of consent, or of the initiation and execution of an agreement, or the justification that the data were published by the data subject himself. 

  • Furthermore, the data subjects have to assume that their personal data may otherwise be transferred to any country in the world, particularly to all countries in which the respective event organisers are located or in which Datasport's service providers are located: If data are sent to an event organiser or another provider in the Online Shop (particularly the Online Registration and any associated web shops), then this party, as the client of Datasport or contractual partner of the customer, as the case may be, has sole responsibility for data privacy, and it is assumed that the data subject agrees to the transmission from Datasport to this party, even without taking special precautions to protect the data on the part of Datasport, respectively the exception of initiation and execution of an agreement applies. This is true even if an athlete is registered for an organiser's event other than via the Online Shop (i.e., the "Online Registration") and event organisers thereby gain access to the athlete's data, even from within countries lacking adequate data protection. Datasport is under no obligation to warrant or ensure that these event organisers comply with data protection;
  • If data are transferred by Datasport to a (sub-)processor in a country lacking adequate data protection, Datasport (or the event organiser, as applicable) guarantees adequate protection by using contractual warranties, particularly based on the EU model clauses, or it relies on the exceptions for consent or for initiation and execution of an agreement. Currently, Datasport utilises the following processors on its own behalf or in its role as processor for the event organisers: Horisen (Switzerland, text messaging, for event organisers and Datasport), Clickatell (England, text messaging, for event organisers and Datasport), Google (Ireland, website analysis, for Datasport), 1&1 (Germany, combating fraud, for Datasport);
  • If a service provider used by Datasport is not a processor, e.g., providers of payment services and operators of social media platforms like Facebook, the transfer is made on the basis of the exceptions for consent and for initiation and execution of an agreement, to the extent these providers are located in countries lacking adequate data protection. Datasport currently utilises payment service providers headquartered in Switzerland (PostFinance, TWINT, payrexx), Germany (Deutsche Postbank, Concardis, sofort, Unzer (only Datasport Germany)) and Singapore (PayPal).

On an exceptional basis, additional transfers may be made abroad, including to countries lacking adequate data protection, e.g., in connection with lawsuits, contact with public authorities and media organisations, as well as in cases of emergencies. If Datasport or the event organiser cannot ensure adequate protection through the use of contractual warranties, particularly based on the EU model clauses, the transfer is made on the basis of the exceptions for consent, the initiation and execution of an agreement, the determination, exercise or enforcement of legal rights, overriding public interests, the justification that the data were published by the data subject himself or because it is necessary to protect the integrity of these persons.

The data subjects may obtain a copy of the contractual warranties from the contact person specified above or be advised by him or her where they may obtain a copy. Datasport or the event organiser, as the case may be, reserves the right to redact such copies for reasons of data protection or confidentiality. 

7. Data Retention

Unless otherwise provided by law, Datasport generally stores the personal data processed as part of the service on its own behalf and for event organisers with no specific time limit unless reasons exist for earlier deletion. This is the case if the data are no longer needed or if Datasport or the event organiser, as the case may be, is required to delete such data. The list of recipients of results text messages is deleted after the respective event. An athlete's additional event-specific information is stored in connection with setting up a follow-on event (i.e., normally after one year) for up to ten years and subsequently deleted, unless the event organiser has agreed otherwise with Datasport. The results of an event are stored permanently, however, the information on which they are based, in the same manner as the additional event-specific information, are stored for up to ten years in connection with the setup of the follow-on event and subsequently deleted, unless otherwise agreed with the event organiser.

The "myDS" accounts are kept indefinitely. If an athlete terminates his "myDS" account, all data in "myDS" are deleted except for the person's master data in "myDS" (DSID, first name, last name, sex, date of birth, birth year, nationality). The master data are likewise deleted ten years after the termination of the account. However, the data included in (otherwise available) starting and ranking lists generally remain available even after the termination of the "myDS" account, unless their deletion is expressly requested by the athlete. 

For business data that include personal data (e.g., records and logs), shorter retention periods of up to twelve months generally apply.

If actual or suspected cases of fraud are discovered and the athlete in question is blocked, the relevant data are retained for approximately six months. Serious cases are marked as such and retained for up to five years.

Business documents, including correspondence, are retained for as long as Datasport or the event organiser, as applicable, has a legitimate interest in them (particularly an evidentiary interest in the event of claims, documentation of compliance with certain legal or other requirements, an interest in an evaluation of non-personal data) or is obligated to do so (by contract, law or based on other requirements). Data from orders made via the Online Shop (particularly the Online Registration and any associated web shops) can generally be retained permanently. Legal duties regarding, for instance, the early deletion or anonymisation or pseudonymisation of the data, are reserved. 

8. Cookies and Google Analytics

Datasport utilises cookies on the website. Cookies are a widespread technology in which the browser of the website user is assigned an identifier that the browser stores locally and exhibits upon request. On the one hand, Datasport utilises session cookies, which are automatically deleted once the user leaves the website and are used for purpose of enabling the server to maintain the connection to the user (and, e.g., keep the contents of the shopping cart from being lost) as the user pages through the website. On the other hand, Datasport also uses permanent cookies, which are only deleted after a period specified for each website (e.g., two years after the last visit) and are used for the purpose of storing the user's default settings (e.g., language) over multiple sessions or to enable automatic logins. By using the website and the corresponding features (e.g., choice of language, automatic login, tracking), the user agrees to the use of such permanent cookies. The user of a website can block the use of cookies in his browser or delete them there, but this could potentially affect use of the website. 

Datasport may utilise Google Analytics or similar services on its website. This is a service provided by a third party, which may be located in any country in the world (in the case of Google Analytics, the provider, Google Inc., is headquartered in the USA, www.google.com), and it allows Datasport to measure and analyse the use of its website. This is also accomplished by using permanent cookies, which this service provider implements. The service provider does not receive any personal data from Datasport (and does not retain any IP addresses outside of Europe) but can track the user's utilisation of the website, combine this information with data from other websites that the user has visited and that are also tracked by the service provider, and use these findings for its own purposes (e.g., directing placement of advertising). If the user himself has registered with the service provider, it knows his identity. His personal data are then processed by the service provider under its authority and in accordance with its privacy policy. Datasport receives non-personal information from the service provider concerning the use of the website.

9. Rights of the Athlete, the User and Other Data Subjects

An athlete with an account can view and modify all information concerning him in "myDS" via Datasport's website (although a change of name, sex or birthday must be cleared by Datasport as these data are used to identify a person; likewise, the combination of multiple "myDS" accounts must be cleared by Datasport). The information about the individual events for which the athlete is registered, such as, in particular, the event-specific consents, can also be viewed and modified via "myDS". A "myDS" account may be opened by any athlete himself at any time. A person who no longer has his access data to "myDS" can obtain them from Datasport.

Every data subject has a right to be informed about his data and can request information about them and demand that they be corrected. Moreover, every data subject has the right to request the deletion and restriction of the use of his personal data by Datasport or the event organiser and to refuse such processing of his personal data. If the processing of the personal data is based on a consent, the consent may be revoked by the data subject at any time.

The individual event organisers and, for its own purposes, Datasport as well, offer the athletes, as part of "myDS" and their participation in an event, a variety of options for selective consents (opt-ins) to various processing of their data or the option to selectively refuse such processing (opt-out). These consents can be administered or provided, as applicable, via "myDS". If the requested opt-out is not specified, a request therefor should be addressed to the contact person (see section 3 above).

The data subject has, upon submitting the corresponding request, the right to receive the data generated through the use of online services in a structured, common and machine-readable format that permits the further use and transmission of the data. 

Enquiries concerning these rights should be addressed to the contact person (see section 3 above). The data subject must clearly indicate which right they wish to exercise, which personal data are affected and provide proof of identity along with their request.Datasport reserves the right to restrict the rights of the data subject in accordance with applicable law and, e.g., not to issue complete information or not to delete data. Requests pertaining to personal data for which an organiser is responsible for handling must be submitted to the organiser. If these requests are sent to Datasport, Datasport shall forward these on to the organiser.

If Datasport or an event organiser takes an automated decision regarding an individual person (cf. section 5.3 or based on separate, previous information) that has legal or similar significant effects on the data subject, the data subject may speak with a responsible person at Datasport or the event organiser and request a reconsideration of the decision or that the decision be taken by a person from the outset, to the extent provided by applicable law. In this case, it is possible that the data subject will no longer be able to use certain automated services.

10. Changes to the Privacy Statement

Datasport may modify the present Privacy Statement at any time without prior notice or announcement. The current version published on the website www.datasport.com shall apply. 

If the Privacy Statement is part of an agreement with athletes, users or another data subject, then, in the event of an update, Datasport may inform them of such update via e-mail or other appropriate means. If no objection is raised within 30 days, then the new Privacy Statement is deemed accepted. If an objection is raised, Datasport may terminate the agreement in whole or in part for good cause and without notice or restrict or adjust the services it provides to the data subject in order to appropriately address his withholding of acceptance.

 

Annexes:

APPENDIX 1 - CATEGORIES OF PERSONAL DATA, CATEGORIES OF DATA SUBJECTS, DESCRIPTION OF DATA PROCESSING AND PURPOSE, LIST OF SUB-PROCESSORS.