Data Protection Notice for SCC EVENTS GmbH for JOYBOX participants
With this notice we inform you about the processing of your personal data by SCC EVENTS GmbH (hereinafter also referred to as "SCC" or "we") and the rights to which you are entitled according to the data protection regulations within the scope of your registration and use of the JOYBOX.
1.) Responsible for data processing and data protection officer
SCC EVENTS GmbH
Hanns-Braun-Strasse / Adlerplatz
Managing directors: Christian Jost, Jürgen Lock
Phone: 030 / 30 12 88 – 10
Fax: 030 / 30 12 88 – 20
The data protection officer can be contacted by post at the above address with the addition of "data protection" or by e-mail: firstname.lastname@example.org.
2.) Purposes and legal basis of data processing
We process your personal data in compliance with the applicable data protection provisions from the EU Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG).
From September 8, 2021 to October 3, 2021, participants in the BMW BERLIN-MARATHON 2021 sporting event will have the opportunity to create and use a personal digital mailbox via the website https://run-for-joy.com/, into which family and friends can upload motivational greetings in the form of videos, images or voice messages. The retrieval of the uploaded content for the participants is possible starting on September 23, 2021.
The legal basis for the lawful processing of your personal data results from:
- B) Article 6 Para. 1 lit (f GDPR on the basis of a balancing of interests: e.g. The verification of authorisation to use the JOYBOX is carried out by means of an SSO procedure via the SCC user account and enables the personal JOYBOX to be evoked after registration. Further legitimate interests in the context of the provision of the JOYBOX are the assertion of legal claims, the defence in legal disputes, the guarantee of IT security and the processing of support requests.
- C) Article 6 Para. 1 lit. c) for the fulfilment of legal obligations, such as obligations under company law, contractual law, data protection regulations, civil law or supervisory law, in compliance with the respective legal regulations.
3.) Recipients or categories of recipients of personal data
In order to fulfil our contractual services and legal obligations, personal data is partly processed by external service providers if this is necessary and legally permitted for the fulfilment of the aforementioned purposes. In doing so, we always observe the provisions of data protection regulations; in particular, processing by service providers used by us only takes place after conclusion of contracts with a corresponding confidentiality clause.
|Recipient||Purpose of disclosure|
|IT service provider||Hosting, maintenance and servicing of IT systems (hardware and software), processing of support requests|
|Website host |
Hosting of the web pages and the personalised links to the JoyBox
Salesforce.com Germany GmbH SCC user account for SSO procedure to verify the user authorisation
|Law firms and courts||Enforcement of claims, defence in legal disputes|
|Data destruction service provider||Disposal of files and data carriers|
When using JOYBOX, personal data may be processed in the USA or in other countries outside the European Economic Area through the use of service providers. You can find more information on this under point 6).
4.) Duration of data storage
We process your data in the context of the creation and use of the personalized JOYBOX.
Your personal details stored in your SCC user account and your event-related orders and information will not be deleted as long as you maintain an SCC user account with us. Further information can be found in the data protection information for the SCC user account, available at https://www.scc-events.com/corporate/kontakt/datenschutz/informationspflicht.
Data from the SSO procedure is deleted immediately as soon as the authorisation status has been transmitted.
All content in the JOYBOX, including the personal data of the participants, will be irretrievably deleted no later than 7 days after the JOYBOX is closed. If you send us a corresponding message, we will also delete your JOYBOX and its contents before this date. You can change or delete the freely selectable name of your JOYBOX yourself at any time.
Log and protocol data of our online offers (websites) will be deleted as soon as they are no longer required, at the latest 3 months after the last access to the website(s). Further information can be found in the data protection notices of the respective website.
We store the data protection enquiries we receive from data subjects or supervisory authorities on data protection issues for 3 years for accountability purposes.
5.) Data protection rights for data subjects
All data subjects have the right to information under Article 15 of the GDPR, the right to rectification of their data under Article 16 of the GDPR, the right to erasure under Article 17 of the GDPR, the right to restriction of processing of their data under Article 18 of the GDPR and the right to data transfer under Article 20 of the GDPR.
Right to object:
In accordance with Article 21 of the GDPR, data subjects also have the right to object at any time to the processing of personal data concerning them.
A) Individual right of objection pursuant to Article 21 Para. 1 GDPR
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6 Para. 1 lit. (f GDPR (data processing on the basis of a balance of interests). If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.
B) Right to object to processing of data for direct marketing purposes pursuant to Article 21 Para. 2 GDPR
Should we process your personal data in order to carry out direct advertising, you have the right to object at any time to the processing of personal data concerning you for the purpose of such advertising. The processing of your data for this purpose is not intended within the framework of the provision of the JOYBOX.
Please send any enquiries regarding the exercising of your rights as a data subject, stating your full name, by post or e-mail to our data protection officer: SCC EVENTS GmbH, Data Protection Officer, Olympiapark Berlin, Hanns-Braun-Strasse / Adlerplatz, 14053 Berlin or email@example.com.
Right of appeal:
If you suspect that we are processing your data unlawfully, you can of course seek judicial clarification of the issue at any time. In addition, any other legal option is open to you. Irrespective of this, you have the option of contacting a supervisory authority in accordance with Article 77 Para. 1 GDPR. The right of complaint pursuant to Art. 77 GDPR is available to you in the EU member state of your place of residence, your place of work and/or the place of the alleged infringement, i.e. you can choose the supervisory authority to which you turn from the places mentioned above. The supervisory authority to which the complaint has been submitted will then inform you of the status and outcome of your submission, including the possibility of a judicial remedy pursuant to Article 78 GDPR.
6.) Transfer of data to a third country or an international organisation
We sometimes transfer personal data to third countries or international organisations. A list of these services and service providers, which may be used in the context of the provision of the JOYBOX, can be found in the further course of this document.
Third countries are countries outside the EEA where the GDPR is not directly applicable. The USA is a so-called third country. There is no adequacy decision of the EU Commission for the USA. It is therefore considered an unsafe third country. The level of data protection is not comparable to that in the EU. An adequate level of data protection cannot be ensured due to the legal situation in the USA.
In order to compensate for the existing data protection deficit in the event of a lack of an adequacy decision, we have agreed with the service providers concerned in the third country or with the international organisation on further appropriate guarantees for the processing of personal data in addition to the standard data protection clauses, so that the data protection standards in these data transfers are compatible with the statutory data protection provisions of the EU and an adequate level of protection is ensured in the processing of the personal data.
The standard data protection clauses for our processors (C-P) are available at: https://eur-lex.europa.eu/legal-content/DE/TXT/?uri=celex:32010D0087.
|Name and address of the company||Processor or joint controller, activities/purpose of the transfer || Legal basis for the transfer of data to a third country or the international organisation|
|Salesforce.com Germany GmbH / Salesforce.com, Inc. , Salesforce Tower, 415 Mission Street, 3rd Floor, San Francisco, CA 94105,USA|| Processor, SSO procedure with SCC user account||International organisation, standard data protection clauses C-P|
Amazon Web Services, Inc.
410 Terry Avenue North
Seattle WA 98109
|Order processor of the IT service provider, hosting and backup of the database and the uploaded content||International organisation, standard data protection clauses C-P|
7.) Voluntariness and obligation to provide personal data
The use of the JOYBOX is basically voluntary. If you wish to use the JOYBOX, the registration and login data are necessary and contractually required. Failure to provide the data will result in your inability to use the JOYBOX. We have marked the information that is voluntary in the respective data collection form.
In connection with the SSO procedure via the existing SCC user account, further personal data is processed. Further information can be found in the data protection notice for the SCC user account, available at
8.) Automated decision-making, profiling
"Profiling" is a form of automated processing of personal data evaluating personal aspects relating to a natural person, in particular for the purpose of analysing or forecasting the data subject's performance at work, economic situation, health, personal preferences or interests, reliability or behaviour, location or change of location, where this produces legal effects concerning the data subject or similarly significantly affects him or her. Your data will not be processed for profiling purposes by SCC EVENTS GmbH.