SCC EVENTS GmbH Data Protection Policy
for Participation in the Sports Event
VeloCity Berlin 2023

The following English version is provided solely to aid in understanding. In the event of any conflicts arising about wording, the German original version shall be exclusively binding for all parties involved.

With this notice, we would like to inform you about the processing of your personal data by SCC EVENTS GmbH (hereinafter also referred to as “SCC” or “we”) and the rights to which you are entitled under the Data Protection Act in connection with your registration and participation in our event VeloCity Berlin 2023.

1. Responsible for data processing and data protection officer

SCC EVENTS GmbH

Olympiapark Berlin, Hanns-Braun-Strasse / Adlerplatz, 14053 Berlin

Managing directors: Christian Jost, Jürgen Lock

e-mail: informationspflicht@scc-events.com

Phone: 030 / 30 12 88 - 10

Fax: 030 / 30 12 88 - 20

The data protection officer can be contacted by post at the above address with the keywords “Data Privacy” or by e-mail: datenschutz@scc-events.com.

2. Purposes and legal basis of data processing

We process your personal data in accordance with the legal regulations of the EU General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG) and other relevant laws (e.g. tax laws).

The processing of your personal data is carried out within the scope of your registration and your participation in our above-mentioned sporting event, in particular for the organisation, implementation and handling of all related processes.

Prerequisite for the registration for our sports event is the existence of an active user account in our online booking portal (https://login.scc-events.com/s/) in accordance with the General Terms and Conditions (GTC) (https://login.scc-events.com/s/terms-conditions) and the valid terms of participation for the sports event, available at: https://velocity.berlin/en/service/conditions-of-participation and the regulations for the VeloCiity Berlin 2023, available at: https://velocity.berlin/en/registration/reglement.

The legal basis for the lawful processing of your personal data is derived from:

1. Article 6 (1) lit. b) GDPR: for the fulfilment of contractual obligations and pre-contractual measures: Processing is carried out for the purpose of initiating and/or concluding a contract in our online booking portal for participation in the VeloCity Berlin 2023, taking into account the applicable terms of participation. This includes all data required for the processing of your individual order or booking of your participation in the sporting event. The scope of the data is supplemented by mandatory data processing in connection with the use of the online booking portal, available at: https://www.scc-events.com/en/privacy-information.
   During the execution of the sports event, we collect and process further data from you on the basis of the aforementioned legal basis. This includes in particular: Timing data, results data and competition lists as well as data for the documentation of rule violations, starting bans and for medical care, if applicable.
2. Article 6 (1) lit f) GDPR on the basis of weighing interests: e.g. to assert legal claims, to defend ourselves in legal disputes, to guarantee IT security, to display and publish results lists, for the purpose of direct advertising and event reminders (post and e-mail), for media coverage by the press and media, to document advertising measures for sponsors and partners, to document competitions and recognise records, to create professional competition images by exclusive photo service providers. Information on offered and published photo recordings processed in the course of your participation in the sports event is available at https://www.scc-events.com/en/privacy-information
3. Article 6 (1) lit. c) to comply with legal obligations such as commercial and tax law retention obligations, corporate, data protection and civil law obligations or regulatory requirements in compliance with the relevant legal regulations.
4. Article 6 (1) lit. a) GDPR with your consent e.g. for the recording of emergency contact data, to subscribe your registered e-mail address for the newsletter or for other purposes explicitly described in the respective declaration of consent.
5. Article 9 (1) lit. a) GDPR with your consent, e.g. when performing the PAPS test on our website www.paps-test.de/en and generating, using and storing the PAPS key.

If we have been granted permission to process personal data for specific, previously mentioned purposes, the legality of this processing is based on the consent. Consent that has been granted can be revoked at any time. The revocation of consent does not affect the lawfulness of the processing until revocation.

Processing activities related to the online booking portal are described in the user account privacy policy, available at: https://www.scc-events.com/en/privacy-information.

Processing activities related to the creation and publication of photos and videos taken during and after the sports event are described in the “Photo and Video” privacy policy, available at: https://www.scc-events.com/en/privacy-information.

3. Recipients or categories of recipients of personal data

In order to fulfil our contractual services and legal obligations, your data is partly processed in part by external service providers and partners if this is necessary to fulfil the aforementioned purposes and is permitted by law. In doing so, we always follow the provisions of data protection law, in particular any processing carried out by service providers engaged by us only takes place after the conclusion of contracts with a corresponding confidentiality clause.

In the context of the publication of personal data (result lists, competition results, photo and video recordings) on our Internet pages, on social media profiles, on video platforms or vis-à-vis the supervising sports associations, it cannot be excluded that personal data may be transferred to other states outside the European Economic Area (EEA) (so-called third countries). Further information on the transfer of such data to third countries can be found under point 6).

In general, when publishing personal data on the Internet (regardless of the platform selected), it cannot be ruled out that this data may also be accessed from countries that do not have an adequate level of data protection. A permitted publication of personal data on the Internet does not constitute a transfer of personal data to a third country in this sense.

Processing activities in connection with the creation and publication of photo and video recordings during and after the sporting event are described in the “Photo and Video” data protection information, available at: https://www.scc-events.com/en/privacy-information.

The operators of the social media platforms are jointly or individually responsible and are listed below:

1. Twitter: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07 Ireland
2. Facebook: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland
3. Instagram: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

The operators of the video platforms are own responsible parties or order processors and are listed below:

1. Vimeo: Vimeo Inc., 555 West 18th Street, New York, 10011, USA
2. YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

Our sports event is organised under the supervision of the following associations:

1. Bund deutscher Radfahrer e.V. (Otto-Fleck-Schneide 4, 60528 Frankfurt / Main)
2. Union Cycliste Internationale (Allée Ferdi Kübler 12, 1860 Aigle Switzerland)

In accordance with the current rules of the associations, personal data (especially result lists) are processed for the recognition and listing of records by these associations. Further information can be found in the respective association rules. These are available at: https://www.scc-events.com/agb/verbandsregeln

4. Duration of data storage

We process your data in order to carry out the registration and your participation in the sports event for the duration of the contract and the resulting storage obligations.

The storage period for all processing activities in connection with the online booking portal is described in the data protection information regarding the user account, available at: https://www.scc-events.com/en/privacy-information

PAPS keys will be deleted one year after their creation.

Competition data that are part of the reporting and documentation of the public, international competition will not be deleted (this concerns the recognition and listing of records, media reporting, the provision of digital certificates, as well as the final result lists with the following data of the participants: surname, first name, start number, nationality, placement, club, year, gender, age group, result times). The right to object remains unaffected. Please note that within the scope of archiving for journalistic or statistical purposes, result lists or records may be stored worldwide even beyond the periods specified here (Art. 85 and Art. 89 GDPR).

After the publication of competition data on the websites of SCC or supervising sports associations, the data can be accessed worldwide on the Internet. Further distribution or indexing by search engines or copies by third parties are thus possible. A deletion of these data cannot be guaranteed continuously.

The data and information on recorded rule violations and valid sanctions according to the rule list will be deleted if and as soon as 3 years after the end of the sanction and/or rule violation and no further entries have been made on the participants by the race management.

The data and information on recorded doping violations and ongoing proceedings will be stored for 5 years in accordance with the regulations for the purpose of preventing eligibility.

Emergency contact data will be deleted 4 weeks after the end of the event.

Log and protocol data will be deleted as soon as they are no longer needed, at the latest 3 months after retrieval of our online offers (websites, online booking portal). Further information can be found in the data protection declarations of the respective websites. The privacy policy of the online booking portal is available at https://login.scc-events.com/s/data-protection.

The storage period for created and published photo and video recordings is described in the privacy policy “Photo and Video”, available at: https://www.scc-events.com/en/privacy-information

We store data that are processed on the basis of consent until revocation or until the respective purpose is fulfilled. Corresponding information can be found in the respective declaration of consent. The revocation of a consent does not affect the legality of the data processed until the revocation.

We store our responses to the data protection inquiries regarding information, correction, deletion or restriction of processing, as well as other inquiries from data subjects or supervisory authorities regarding data protection issues for the purpose of accountability for three years.

5. Rights of data subjects

All data subjects have the right to access their personal data referred to in Art. 15 GDPR, the right to obtain rectification of their inaccurately stored data according to Art. 16 GDPR, the right to obtain the erasure of personal data according to Art. 17 GDPR, the right to obtain the restriction of the processing of their data according to Art. 18 GDPR and the right to receive their personal data according to Art. 20 GDPR. Given consent may be revoked at any time. The revocation of a consent does not affect the lawfulness of the processing until the revocation.

Right to object :

According to Art. 21 GDPR, data subjects also have the right to object at any time to the processing of personal data concerning them.

A) Individual rights of objection according to Art. 21 (1) 1 GDPR

You have the right to object at any time, for reasons arising from your particular situation, to the processing of personal data concerning you, which is carried out on the basis of Art. 6 (1) lit f) GDPR (data processing based on a balancing of interests). If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for processing which outweigh your interests, rights and freedoms or the processing serves to assert, exercise or defend legal claims.

B) Right to object to the processing of data for the purposes of direct marketing in accordance with Art. 21 (2) GDPR

In individual cases, we process your personal data for the purpose of direct advertising (by post and e-mail). You have the right to object at any time to the processing of your personal data for the purpose of such advertising. If you object to the processing for direct marketing purposes, we will no longer process your personal data for these purposes.

Please send any requests to exercise your rights as a data subject, stating your full name, by post or e-mail to our data protection officers: SCC EVENTS GmbH, Data Protection Officer, Olympiapark Berlin, Hanns-Braun-Strasse / Adlerplatz, 14053 Berlin or datenschutz@scc-events.com

Right of appeal:

If you suspect that we are processing your data unlawfully, you can of course obtain a judicial clarification of the issue at any time. In addition, every other legal option is open to you. Irrespective of this, you have the option of contacting a supervisory authority in accordance with Art. 77 (1) GDPR. The right of appeal according to Art. 77 GDPR is available to you in the EU member state of your place of residence, your place of work and/or the place of the alleged infringement, i.e. you can choose the supervisory authority to which you turn from the above-mentioned places. The supervisory authority to which the complaint has been submitted will then inform you of the status and results of your submission, including the possibility of a judicial remedy in accordance with Art. 78 GDPR.

Note on publication:

We would like to point out that in particular the data in the results lists and media coverage are only partially the responsibility of SCC EVENTS GmbH. In particular, printed products such as daily newspapers or live broadcasts via radio and television are subject to reporting in the public interest due to the competitive character of this sporting event, so that the rights of individual affected persons do not fundamentally prevail. Therefore, please contact us directly if you have any questions or requests regarding these topics: Revocation of a consent or objection to data processing in the case of publication of names, images or result lists on the websites and social media appearances of SCC, on video platforms, on websites and social media channels of other operators (sponsors, associations, photo service providers), in the press or in media reports.

Please note that in the context of archiving for journalistic or statistical purposes, result lists or records may be stored worldwide beyond these specified periods (Art. 85 and Art. 89 GDPR).

After the publication of personal data, the data can be accessed worldwide on the Internet. Further distribution or indexing by search engines or copying by third parties is possible. A deletion of these data cannot be guaranteed continuously.

In general, when publishing personal data on the Internet (regardless of the platform selected), it cannot be ruled out that the data may also be accessed from countries that do not have an adequate level of data protection. A permitted publication of personal data on the Internet does not constitute a transfer of personal data to a third country in this sense.

6. Transfer of data to a third country or international organisation

We sometimes transfer personal data to third countries or to international organisations. A list of these services and service providers that may be used in connection with booking and participation in the above-mentioned sporting event is provided below in this document.

Third countries are those countries outside the EEA where the GDPR is not directly applicable. The level of data protection is not comparable with that in the EU. To compensate for the existing data protection deficit in the absence of an adequacy decision, we have agreed further suitable guarantees for the processing of personal data with the service providers concerned in the third country or with the international organisation in addition to the standard data protection clauses, so that the data protection standards for these data transfers are compatible with the legal data protection provisions of the EU and adequate protection is ensured when processing personal data.

7. Voluntary nature and obligation to provide personal data

Registration and Participation in the sports event is always voluntary. In the case of participation, the data required for the organisation and realisation of the sports event in accordance with the terms of participation and contractually stipulated must be provided. Failure to provide the data will result in the inability to participate in the sporting event. The terms of participation for our sports event are available at: https://login.scc-events.com/s/terms-participation.

Prerequisite for the registration to our sports event is the existence of an active user account in our online booking portal https://login.scc-events.com/s/ according to the General Terms and Conditions (GTC) https://login.scc-events.com/s/terms-conditions. Processing activities in connection with the online booking portal are described in the data protection information for the user account, available at: https://www.scc-events.com/en/privacy-information.

If requested information is voluntary, we have marked this information in the respective survey form and in the terms of participation. You can revoke the processing of personal data on the basis of consent at any time for the future.

8. Automated decision making, profiling

Automated decision-making in the sense of Art. 22 DSGVO is not carried out.

“Profiling” is a form of automated processing of personal data using the assessment of personal aspects relating to a natural person, in particular for the purpose of analysing or predicting the performance of work, economic situation, health, personal preferences or interests, reliability or conduct, whereabouts or change of location of the data subject, where this produces legal effects concerning the data subject or significantly affects him/her in a similar way. Your data will not be processed by SCC EVENTS GmbH for the purpose of profiling.