Data Protection Notice for SCC EVENTS GmbH for JOYBOX participants

With this notice we inform you about the processing of your personal data by SCC EVENTS GmbH (hereinafter also referred to as "SCC" or "we") and the rights to which you are entitled according to the data protection regulations within the scope of your registration and use of the JOYBOX.

1.) Responsible for data processing and data protection officer


Olympiapark Berlin,

Hanns-Braun-Strasse / Adlerplatz

14053 Berlin

Managing directors: Christian Jost, Jürgen Lock


Phone: 030 / 30 12 88 – 10

Fax: 030 / 30 12 88 – 20

The data protection officer can be contacted by post at the above address with the addition of "data protection" or by e-mail:

2.) Purposes and legal basis of data processing

We process your personal data in compliance with the applicable data protection provisions from the EU Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG).

From September 8, 2021 to October 3, 2021, participants in the BMW BERLIN-MARATHON 2021 sporting event will have the opportunity to create and use a personal digital mailbox via the website, into which family and friends can upload motivational greetings in the form of videos, images or voice messages. The retrieval of the uploaded content for the participants is possible starting on September 23, 2021.

The processing of the associated personal data takes place in the context of the creation and subsequent further use of your individual JOYBOX. The existence of an active SCC user account in the online booking portal of the website: in connection with the confirmed registration for the aforementioned sports event is the prerequisite for registration for the use of the JOYBOX. The registration process is completed when the terms of use of the JOYBOX have been confirmed (available at: and an individual, freely selectable name has been assigned.

The legal basis for the lawful processing of your personal data results from:

  • A) Article 6 Para. 1 lit. b) GDPR for the performance of the contract in accordance with the terms of use: In order to legitimise the right to use the JOYBOX, at minimum this data must be provided: Log-in data for the SCC user account and freely selectable name. In the log-in area of the JOYBOX, the selected name is processed and a personalized link is generated for further use, if necessary in connection with a freely selectable welcome message for the supporters.
  • B) Article 6 Para. 1 lit (f GDPR on the basis of a balancing of interests: e.g. The verification of authorisation to use the JOYBOX is carried out by means of an SSO procedure via the SCC user account and enables the personal JOYBOX to be evoked after registration. Further legitimate interests in the context of the provision of the JOYBOX are the assertion of legal claims, the defence in legal disputes, the guarantee of IT security and the processing of support requests.
  • C) Article 6 Para. 1 lit. c) for the fulfilment of legal obligations, such as obligations under company law, contractual law, data protection regulations, civil law or supervisory law, in compliance with the respective legal regulations.

3.) Recipients or categories of recipients of personal data

In order to fulfil our contractual services and legal obligations, personal data is partly processed by external service providers if this is necessary and legally permitted for the fulfilment of the aforementioned purposes. In doing so, we always observe the provisions of data protection regulations; in particular, processing by service providers used by us only takes place after conclusion of contracts with a corresponding confidentiality clause.

Recipient Purpose of disclosure
IT service provider
Hosting, maintenance and servicing of IT systems (hardware and software), processing of support requests
Website host 

Hosting of the web pages and the personalised links to the JoyBox Germany GmbH SCC user account for SSO procedure to verify the user authorisation

Law firms and courts
Enforcement of claims, defence in legal disputes
Data destruction service provider
Disposal of files and data carriers

When using JOYBOX, personal data may be processed in the USA or in other countries outside the European Economic Area through the use of service providers. You can find more information on this under point 6).

4.) Duration of data storage

We process your data in the context of the creation and use of the personalized JOYBOX.

Your personal details stored in your SCC user account and your event-related orders and information will not be deleted as long as you maintain an SCC user account with us. Further information can be found in the data protection information for the SCC user account, available at

Data from the SSO procedure is deleted immediately as soon as the authorisation status has been transmitted.

All content in the JOYBOX, including the personal data of the participants, will be irretrievably deleted no later than 7 days after the JOYBOX is closed. If you send us a corresponding message, we will also delete your JOYBOX and its contents before this date. You can change or delete the freely selectable name of your JOYBOX yourself at any time.

Log and protocol data of our online offers (websites) will be deleted as soon as they are no longer required, at the latest 3 months after the last access to the website(s). Further information can be found in the data protection notices of the respective website.

We store the data protection enquiries we receive from data subjects or supervisory authorities on data protection issues for 3 years for accountability purposes.

5.) Data protection rights for data subjects

All data subjects have the right to information under Article 15 of the GDPR, the right to rectification of their data under Article 16 of the GDPR, the right to erasure under Article 17 of the GDPR, the right to restriction of processing of their data under Article 18 of the GDPR and the right to data transfer under Article 20 of the GDPR.

Right to object:

In accordance with Article 21 of the GDPR, data subjects also have the right to object at any time to the processing of personal data concerning them.

A) Individual right of objection pursuant to Article 21 Para. 1 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6 Para. 1 lit. (f GDPR (data processing on the basis of a balance of interests). If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

B) Right to object to processing of data for direct marketing purposes pursuant to Article 21 Para. 2 GDPR

Should we process your personal data in order to carry out direct advertising, you have the right to object at any time to the processing of personal data concerning you for the purpose of such advertising. The processing of your data for this purpose is not intended within the framework of the provision of the JOYBOX.

Please send any enquiries regarding the exercising of your rights as a data subject, stating your full name, by post or e-mail to our data protection officer: SCC EVENTS GmbH, Data Protection Officer, Olympiapark Berlin, Hanns-Braun-Strasse / Adlerplatz, 14053 Berlin or

Right of appeal:

If you suspect that we are processing your data unlawfully, you can of course seek judicial clarification of the issue at any time. In addition, any other legal option is open to you. Irrespective of this, you have the option of contacting a supervisory authority in accordance with Article 77 Para. 1 GDPR. The right of complaint pursuant to Art. 77 GDPR is available to you in the EU member state of your place of residence, your place of work and/or the place of the alleged infringement, i.e. you can choose the supervisory authority to which you turn from the places mentioned above. The supervisory authority to which the complaint has been submitted will then inform you of the status and outcome of your submission, including the possibility of a judicial remedy pursuant to Article 78 GDPR.

6.) Transfer of data to a third country or an international organisation

We sometimes transfer personal data to third countries or international organisations. A list of these services and service providers, which may be used in the context of the provision of the JOYBOX, can be found in the further course of this document.

Third countries are countries outside the EEA where the GDPR is not directly applicable. The USA is a so-called third country. There is no adequacy decision of the EU Commission for the USA. It is therefore considered an unsafe third country. The level of data protection is not comparable to that in the EU. An adequate level of data protection cannot be ensured due to the legal situation in the USA.

In order to compensate for the existing data protection deficit in the event of a lack of an adequacy decision, we have agreed with the service providers concerned in the third country or with the international organisation on further appropriate guarantees for the processing of personal data in addition to the standard data protection clauses, so that the data protection standards in these data transfers are compatible with the statutory data protection provisions of the EU and an adequate level of protection is ensured in the processing of the personal data.

The standard data protection clauses for our processors (C-P) are available at:

Name and address of the companyProcessor or joint controller, activities/purpose of the transfer 
 Legal basis for the transfer of data to a third country or the international organisation Germany GmbH /, Inc. , Salesforce Tower, 415 Mission Street, 3rd Floor, San Francisco, CA 94105,USA
 Processor, SSO procedure with SCC user account
International organisation, standard data protection clauses C-P

Amazon Web Services, Inc.

410 Terry Avenue North

Seattle WA 98109

United States

Order processor of the IT service provider, hosting and backup of the database and the uploaded content
International organisation, standard data protection clauses C-P

7.) Voluntariness and obligation to provide personal data

The use of the JOYBOX is basically voluntary. If you wish to use the JOYBOX, the registration and login data are necessary and contractually required. Failure to provide the data will result in your inability to use the JOYBOX. We have marked the information that is voluntary in the respective data collection form.

In connection with the SSO procedure via the existing SCC user account, further personal data is processed. Further information can be found in the data protection notice for the SCC user account, available at

8.) Automated decision-making, profiling

Automated decision-making in the sense of Article 22 GDPR takes place on the basis of the terms of use for JOYBOX and the technically implemented SSO procedure. If the result of the automated decision-making requires further examination of the decision by means of manual intervention, data subjects have the right to contact our contact details mentioned under point 1). If you believe that you have been wrongly excluded from using JOYBOX as a result of an automated decision, you are welcome to explain your point of view to us in writing. We will then review the automated decision in accordance with Article 22 Para. 3 GDPR in the specific individual case.

"Profiling" is a form of automated processing of personal data evaluating personal aspects relating to a natural person, in particular for the purpose of analysing or forecasting the data subject's performance at work, economic situation, health, personal preferences or interests, reliability or behaviour, location or change of location, where this produces legal effects concerning the data subject or similarly significantly affects him or her. Your data will not be processed for profiling purposes by SCC EVENTS GmbH.