Data Protection Notice from SCC EVENTS GmbH for supporters of JOYBOX participants
With these instructions we inform you about the processing of your personal data by SCC EVENTS GmbH (hereinafter also referred to as "SCC" or "we") and the rights to which you are entitled according to the data protection laws within the framework of the use of the JOYBOX.
1.) Responsible for data processing and data protection officer
SCC EVENTS GmbH
Hanns-Braun-Strasse / Adlerplatz
Managing directors: Christian Jost, Jürgen Lock
Phone: 030 / 30 12 88 – 10
Fax: 030 / 30 12 88 – 20
The data protection officer can be contacted by post at the above address with the addition of "data protection" or by e-mail: email@example.com.
2.) Purposes and legal basis of data processing
We process your personal data in compliance with the applicable data protection provisions from the EU Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG).
From September 8, 2021 to October 3, 2021, participants in the BMW BERLIN-MARATHON 2021 sporting event will have the opportunity to create and use a personal digital mailbox via the website https://run-for-joy.com/, into which family and friends can upload motivational greetings in the form of videos, images or voice messages. The retrieval of the uploaded content for the participants is possible starting on September 23, 2021.
The legal basis for the lawful processing of your personal data results from:
- B) Article 6 Para. 1 lit. f) GDPR on the basis of a balancing of interests: As part of the provision of the JOYBOX, log and protocol data of the IT systems are processed to ensure IT security. The assertion of legal claims, the defence in legal disputes and the review and/or deletion following reports of unlawful content or unlawful use are also based on the balance of interests.
- C) Article 6 Para. 1 lit. (c GDPR to comply with legal obligations, such as obligations under company law, contractual law, data protection regulations, civil law or supervisory law, in compliance with the relevant legal provisions.
3.) Recipients or categories of recipients of personal data
The uploaded JOYBOX content will be available for retrieval by the linked parties (specifically: registered and eligible participants of the BMW BERLIN MARATHON 2021 sports event) starting on September 23, 2021.
In order to fulfil our contractual services and legal obligations, personal data is partly processed by external service providers if this is necessary and legally permitted for the fulfilment of the aforementioned purposes. In doing so, we always observe the provisions of data protection law; in particular, processing by service providers used by us only takes place after conclusion of contracts with a corresponding confidentiality clause.
|Recipient||Purpose of disclosure|
|IT service provider||Hosting, maintenance, care and upkeep of IT systems (hardware and software)|
|Website host||Hosting of the web pages and the personalized links to the JOYBOX|
|Law firms and courts|| Enforcement of claims, defence in legal disputes|
|Data destruction service provider|| Disposal of files and data carriers|
When using JOYBOX, personal data may be processed in the USA or in other countries outside the European Economic Area through the use of service providers. You can find more information on this under point 6).
4.) Duration of data storage
All content in the JOYBOX, including the personal data of the participants, will be irretrievably deleted no later than 7 days after the closure of the JOYBOX. At the request of the participants or supporters, we will also delete JOYBOX content before this date.
Log and protocol data from our online offers (websites) will be deleted as soon as they are no longer required, at the latest 3 months after the last access to the website(s). Further information can be found in the data protection statements of the respective website.
We store the data protection enquiries we receive from data subjects or supervisory authorities on data protection issues for 3 years for accountability purposes.
5.) Data protection rights for data subjects
All data subjects have the right to information under Article 15 of the GDPR, the right to rectification of their data under Article 16 of the GDPR, the right to erasure under Article 17 of the GDPR, the right to restriction of processing of their data under Article 18 of the GDPR and the right to data transfer under Article 20 of the GDPR.
Right to object:
In accordance with Article 21 of the GDPR, data subjects also have the right to object at any time to the processing of personal data concerning them.
A) Individual right of objection pursuant to Article 21 Para. 1 GDPR
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6 Para. 1 lit (f GDPR (data processing on the basis of a balance of interests). If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.
B) Right to object to processing of data for direct marketing purposes pursuant to Article 21 Para. 2 GDPR
Should we process your personal data in order to carry out direct advertising, you have the right to object at any time to the processing of personal data concerning you for the purpose of such advertising. The processing of your data for this purpose is not intended within the framework of the provision of the JOYBOX.
Please send any enquiries regarding the exercise of your rights as a data subject, stating your full name, by post or e-mail to our data protection officer: SCC EVENTS GmbH, Data Protection Officer, Olympiapark Berlin, Hanns-Braun-Strasse / Adlerplatz, 14053 Berlin or firstname.lastname@example.org.
Right of appeal:
If you suspect that we are processing your data unlawfully, you can of course seek judicial clarification of the issue at any time. In addition, any other legal option is open to you. Irrespective of this, you have the option of contacting a supervisory authority in accordance with Article 77 Para 1 GDPR. The right of complaint pursuant to Article 77 GDPR is available to you in the EU member state of your place of residence, your place of work and/or the place of the alleged infringement, i.e. you can choose the supervisory authority to which you turn from the places mentioned above. The supervisory authority to which the complaint has been submitted will then inform you of the status and outcome of your submission, including the possibility of a judicial remedy pursuant to Article 78 GDPR.
6.) Transfer of data to a third country or an international organisation
We sometimes transfer personal data to third countries or international organisations. A list of these services and service providers, which may be used in the context of the provision of the JOYBOX, can be found in the further course of this document.
Third countries are countries outside the EEA where the GDPR is not directly applicable. The USA is a so-called third country. There is no adequacy decision of the EU Commission for the USA. It is therefore considered an unsafe third country. The level of data protection is not comparable to that in the EU. An adequate level of data protection cannot be ensured due to the legal situation in the USA.
In order to compensate for the existing data protection deficit in the event of a lack of an adequacy decision, we have agreed with the service providers concerned in the third country or with the international organisation on further appropriate guarantees for the processing of personal data in addition to the standard data protection clauses, so that the data protection standards in these data transfers are compatible with the statutory data protection provisions of the EU and an adequate level of protection is ensured in the processing of the personal data.
The standard data protection clauses for our processors (C-P) are available at: https://eur-lex.europa.eu/legal-content/DE/TXT/?uri=celex:32010D0087.
|Name and address of the company||Processor or joint controller, activities/purpose of the transfer||Legal basis for the transfer of data to a third country or the international organisation|
Amazon Web Services, Inc.
410 Terry Avenue North
Seattle WA 98109
|Order processor of the IT service provider, hosting and backup of the database and the uploaded content||International organisation, standard data protection clauses C-P|
7.) Voluntariness and obligation to provide personal data
The use of the JOYBOX is basically voluntary. If you wish to use the JOYBOX, the registration and login data are necessary and contractually required. Failure to provide the data will result in your inability to use the JOYBOX. Only the file formats described in the upload section can be uploaded, and they must not be larger than specified there. We have marked the information that is voluntary in the respective data collection form.
8.) Automated decision-making, profiling
An automated decision-making in the sense of Article 22 GDPR does not take place.
"Profiling" is a form of automated processing of personal data evaluating personal aspects relating to a natural person, in particular for the purpose of analysing or forecasting the data subject's performance at work, economic situation, health, personal preferences or interests, reliability or behaviour, location or change of location, where this produces legal effects concerning the data subject or similarly significantly affects him or her. Your data will not be processed for profiling purposes by SCC EVENTS GmbH.