Data Protection Notice for registration and participation in the hydration systems project

This notice informs you about the processing of your personal data by SCC EVENTS GmbH (hereinafter also referred to as "SCC EVENTS" or "we") and the rights to which you are entitled under data protection laws.
For reasons of better readability, the simultaneous use of the language forms male, female and diverse (m/f/d) is waived. All personal designations apply equally to all genders.

SCC Events GmbH, Olympiapark Berlin, Hanns-Braun-Strasse / Adlerplatz, 14053 Berlin
Managing Directors: Christian Jost, Jürgen Lock
E-Mail: trinksysteme@scc-events.com
Telephone: 030 / 30 12 88 - 10
Fax: 030 / 30 12 88 - 20

The data protection officer can be contacted by post at the above address with the addition of "data protection officer" or by e-mail: datenschutz@scc-events.com.

Your personal data is processed for the purpose of organising and carrying out the "hydration systems" project.

The aim of the project is to obtain valid data on the use of hydration systems, so in the future we as the organiser can effectively focus on environmental aspects with recommendations for the public. Information about the project is available at: https://www.bmw-berlin-marathon.com/en/your-preparation/hydration-systems-project/

Registration data for participation in the project: Interested participants can register to participate in the project informally, but must provide their last name, first name, zip code, and date of birth by e-mail to trinksysteme@scc-events.com. In order to verify the participants and to allow them to register for the project, we will compare the aforementioned data with their confirmed participation in the BMW BERLIN-MARATHON 2021. Prior to the BMW BERLIN-MARATHON 2021, participants will be provided with project-relevant information via e-mail. After the event, participants will have the opportunity to take part in our online survey. Participants will receive a link to the survey by e-mail.

Log data for the online survey: As part of the technical processing of the online survey on the survey page, log file data will be collected for technical reasons. For details on the processing of your personal data on the web-based survey page, please refer to the privacy policy for the survey page.

Response data from the online survey: The scope of the data processing primarily corresponds to the information that you provide through your entries in the online questionnaire. The questionnaire includes a query about your experience with hydration systems during participation in the BMW BERLIN-MARATHON 2021. Information in free text fields may also be the subject of processing.

The data categories are not merged, and it is not intended to draw conclusions about survey participants within the framework of the evaluation of the survey responses.

A) Article 6 Para. 1 lit. a) GDPR on the basis of your consent: Registration for the project and the associated electronic communication before and after the event are based on the confirmatory action of the interested parties. Participation in the online survey is voluntary after the sending of the survey link. The information in the questionnaire is voluntary and forms the basis for further evaluation.

B) Article 6 Para. 1 lit. f) GDPR on the basis of a balance of interests, specifically: to ensure IT security, to prevent multiple participations, to verify project participants, to consolidate and anonymise the response data from the online survey, to fulfil data protection-related documentation obligations.

In order to organise and carry out the processing activities in the hydration systems project, only those employees/departments within SCC receive access to the respective personal data that require it to fulfill the respective purpose. Some of the data will be processed by external service providers if this is necessary to fulfil the aforementioned purposes and is permitted by law. In doing so, we always observe the provisions of data protection regulations; in particular, processing by all service providers utilised only takes place after conclusion of contracts with a corresponding confidentiality clause.

In the context of participation in the hydration systems project, personal data may be processed in the USA or in other countries outside the European Economic Area through the use of service providers. Further information on this can be found under point 6).

Registration data for participation in the project: The data of registered and confirmed participants will be deleted no later than 4 weeks after the end of the project. If registration is not possible (e.g. after comparing to the participant data for the event), the associated data will be deleted immediately after our cancellation.

Log data for the online survey: Data that ensure the security of the processing as well as the prevention of security incidents and multiple participations (log data of the IT systems) are completely deleted after 7 days.

Response data from the online survey: The response data collected as part of the survey will be deleted no later than 4 weeks after completion of the survey and consolidation. The anonymised evaluation reports are also available to us for an unlimited period of time after the survey has ended and are no longer part of the legal data protection provisions.

In the event of revocation of consent, data processing shall be terminated prematurely. The revocation of consent does not affect the lawfulness of the data processed until the revocation. In the event of a (permissible) objection, data processing is also terminated.

Data protection enquiries: We store the enquiries we respond to from data subjects or supervisory authorities on data protection issues for 3 years from the end of the action for accountability purposes.

All data subjects have the right to information under Article 15 of the GDPR, the right to rectification of their data under Article 16 of the GDPR, the right to erasure under Article 17 of the GDPR, the right to restriction of processing of their data under Article 18 of the GDPR and the right to data transfer under Article 20 of the GDPR.

Consent given can be revoked at any time. The revocation of consent does not affect the lawfulness of the data processed until the revocation.

Right to object:
Pursuant to Article 21 of the GDPR, data subjects also have the right to object at any time to the processing of personal data concerning them. This concerns in particular these cases:

A) Individual right of objection pursuant to Article 21 Para. 1 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data, which is carried out on the basis of Article 6 Para. 1 lit. (f GDPR (data processing on the basis of a balance of interests). If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

B) Right to object to processing of data for direct marketing purposes pursuant to Article 21 Para. 2 GDPR

In individual cases, we process your personal data in order to carry out direct advertising (by post and by e-mail). Data subjects have the right to object at any time to the processing of their personal data for the purpose of such advertising. Once an objection has been lodged, we will no longer process this data for the aforementioned purpose of direct advertising.

Data subjects may send their requests for the exercise of their data subject rights informally by post or e-mail, stating their full name: SCC EVENTS GmbH, Hydration Systems, Olympiapark Berlin, Hanns-Braun-Strasse / Adlerplatz, 14053 Berlin or trinksysteme@scc-events.com.

Right of appeal:
If data subjects suspect that their data is being processed unlawfully on the part of SCC, they can of course bring about a judicial clarification of the issue at any time. In addition, all other legal options are open to the data subjects. Irrespective of this, data subjects have the option of contacting a supervisory authority in accordance with Article 77 Para. 1 GDPR. The right of appeal under Article 77 GDPR is available to data subjects in the EU Member State of their place of residence, place of work and/or place of the alleged infringement, i.e. they can choose the supervisory authority to which they turn from the places mentioned above. The supervisory authority to which the complaint has been submitted will then inform them of the status and outcome of the submission, including the possibility of a judicial remedy pursuant to Article 78 GDPR.

The data protection supervisory authority responsible for SCC is:
Berlin Commissioner for Data Protection and Freedom of Information

Friedrichstr. 219,
10969 Berlin
Tel.: +49 (0)30 13889-0; Fax: +49 (0)30 2155050; E-Mail: mailbox@datenschutz-berlin.de

6.) Data transfer to a third country or an international organisation

We sometimes transfer personal data to third countries or to international organisations as part of our business processes. A list of these services and service providers that may be used can be found later in this document.

Third countries are countries outside the EEA where the GDPR is not directly applicable. The USA, for example, is a so-called third country. There is no adequacy decision of the EU Commission for the USA. It is therefore considered an unsafe third country. The level of data protection is not comparable to that in the EU. An adequate level of data protection cannot be ensured due to the legal situation in the USA.

In order to compensate for the existing data protection deficit in the event of a lack of an adequacy decision, we have agreed with the service providers concerned in the third country or with the international organisation on further appropriate guarantees for the processing of personal data in addition to the standard data protection clauses, so that the data protection standards in these data transfers are compatible with the statutory data protection provisions of the EU and an adequate level of protection is ensured in the processing of the personal data.

The standard data protection clauses for our processors (C-P) are available at: https://eur-lex.europa.eu/legal-content/DE/TXT/?uri=celex:32010D0087.

Name and address of the company	Processor or joint controller, activities/purpose of the transfer	Legal basis for the transfer of data to a third country or the international organisation
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland / Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA	Processor, IT infrastructure, server for storage and archiving of business transactions, documents and e-mails	International organisation, standard data protection clauses C-P

7.) Voluntariness of the provision of personal data

The registration and participation in the hydration systems project is basically voluntary and is neither contractually nor legally required. In the event of participation, the data required to carry out the eligibility check must be provided. Failure to provide the data will result in an inability to participate in the hydration systems project.

8.) Automated decision making, performance of profiling

As a matter of principle, we do not use exclusively automated decision-making within the meaning of Article 22 GDPR to justify and carry out the survey.

Profiling means a form of automated processing of personal data involving an assessment of personal aspects relating to a natural person, in particular for the purpose of analysing or forecasting the data subject's performance at work, economic situation, health, personal preferences or interests, reliability or behaviour, location or change of location, where this produces legal effects concerning the data subject or similarly significantly affects him or her. Profiling does not take place.

Recipient	Purpose of disclosure
E-mail provider	Transport of data from e-mails and attachments
Telecommunications Provider	Transport and storage of connection data
Website host and survey service provider	Hosting and provision of the IT systems (hardware and software) for the online questionnaire and the tools for anonymisation and evaluation of the response data
IT and telecommunications service provider	Maintenance, care and upkeep of IT systems and applications (hardware and software)