With this notice we inform you about the processing of your personal data by SCC EVENTS GmbH (hereinafter also referred to as "SCC" or "we") and the rights to which you are entitled according to the data protection laws within the scope of your registration and use of the Key Visual campaign 2022.

1.) Responsible for data processing and data protection officer

SCC EVENTS GmbH

Olympiapark Berlin,

Hanns-Braun-Strasse / Adlerplatz

14053 Berlin

Managing directors: Christian Jost, Jürgen Lock

E-Mail: runforjoy@scc-events.com

Phone: 030 / 30 12 88 – 10

Fax: 030 / 30 12 88 – 20

The data protection officer can be contacted by post at the above address with the addition of "data protection" or by e-mail: datenschutz@scc-events.com.

2.) Purposes and legal basis of data processing

We process your personal data in compliance with the applicable data protection provisions from the EU Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG) within the scope of your participation and for the implementation of the Key Visual 2022 campaign on the basis of the Terms of Use, available at: https://run-for-joy.com/key-visual-tnb.

From November 3, 2021 to December 6, 2021, participants in the Key Visual Campaign will have the opportunity to upload a screenshot from their running app showing their favourite running route as a route line using the participation form with upload function provided by us on the https://run-for-joy.com/ website.

The data provided in this context will be processed to create a graphic collage with running course lines, which will represent the key visual for the BMW BERLIN-MARATHON 2022 and will be used and published for the entire 2022 season for public relations and advertising purposes.

The legal basis for the lawful processing of your personal data results from:

A) Article 6, Para. 1, lit. b) GDPR for contract performance: The processing of the content data of the provided favourite running routes (image files) is based on the terms of use for the Key Visual 2022 campaign. In accordance with the terms of use, the publication of the data is limited to the content of the uploaded images/image files, specifically the running routes. The publication takes place for commercial and advertising purposes within the framework of the Key Visual 2022 campaign for the BMW BERLIN-MARATHON on social media and video platforms, on the websites and in various print products of SCC. The number of uploaded image files will be recorded for the purpose of counting and evaluating the first 1000 submissions.

B) Article 6 Para. 1 lit. f) GDPR on the basis of a balancing of interests: The processing of the metadata associated with the image files as well as the log and usage data collected through the online upload form is carried out solely for the purpose of ensuring IT security and data backup. In order to assert or defend legal claims, the data that are the subject of the Key Visual 2022 campaign may also be processed by us on the basis of the balancing of interests.

C) Article 6 Para. 1 lit. a) GDPR with your consent: If you provide us with the location of your favourite route via the online upload form, we process this information on the basis of your voluntarily granted declaration of consent and link this information to the uploaded file or the content thereof (specifically: to the running route). The publication of the location information will then take place (in the same manner as the favourite running routes) for commercial and advertising purposes as part of the Key Visual 2022 campaign for the BMW BERLIN-MARATHON on social media platforms, on the websites and in various print products of SCC.

Insofar as we have been granted consent to process personal data for specific, previously stated purposes, the lawfulness of this processing is given on the basis of the consent. A given consent can be revoked at any time. The revocation of consent does not affect the lawfulness of the data processed until the revocation.

3.) Recipients or categories of recipients of personal data

In order to fulfil our contractual services and legal obligations, personal data is partly processed by external service providers if this is necessary and legally permitted for the fulfilment of the aforementioned purposes. In doing so, we always observe the provisions of data protection law; in particular, processing by service providers used by us only takes place after conclusion of contracts with a corresponding confidentiality clause.

When storing the image files from the upload form and in the context of publishing the graphic collage with the running course lines, personal data may be processed in the USA or in other countries outside the European Economic Area through the use of service providers or social media platforms. Further information on this can be found under point 6.).

The operators of the social media platforms are joint or own controllers and are listed below:

A) Twitter: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07 Ireland

B) Facebook: Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

C) Instagram: Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

The operators of the video platforms are common or own responsible persons and are listed below:

A) Vimeo: Vimeo Inc., 555 West 18th Street, New York, 10011, USA

B) YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

4.) Duration of data storage

We process the data you provide to create a graphic collage with running course lines. The deletion of the files including the metadata takes place as soon as the collage has been designed, at the latest by the end of February 2022.

As part of the implementation of the Key Visual 2022 campaign, the data that are part of the collage will be published and used for public relations and promotional activities for the entire 2022 season. Deletion of the data used for the Key Visual 2022 campaign is not foreseen.

Log and protocol data of our websites will be deleted as soon as they are no longer needed, at the latest 3 months after the last access to the website(s). Further information can be found in the Privacy Policy of the website www.run-for-joy.com.

We store data processed on the basis of consent until it is revoked or until the respective purpose is fulfilled. The revocation of consent does not affect the lawfulness of the data processed until revocation.

In individual cases, legal retention periods arise that require data storage in deviation from the aforementioned regulations.

A) Legal claims: In the context of asserting, exercising or defending legal claims, legal storage obligations may arise. After expiry of the statutory retention periods arising in each individual case, the data will be completely deleted.

B) Data protection requests: We store the requests for information, correction, deletion or restriction of processing answered by us, as well as other requests from data subjects or supervisory authorities on data protection issues for the purpose of accountability for 3 years from the end of the action.

Note on publication:

After the publication of personal data, the data can be accessed worldwide on the Internet. Further dissemination or indexing by search engines or copies by third parties are thus possible. A deletion of this data cannot be ensured continuously.

In principle, when personal data is published on the Internet (regardless of the platform chosen), it cannot be ruled out that it will also be accessed from countries that do not have an adequate level of data protection. A permissible publication of personal data on the Internet is not a transfer of personal data to a third country in this sense.

5.) Data protection rights for data subjects

All data subjects have the right to information under Article 15 of the GDPR, the right to rectification of their data under Article 16 of the GDPR, the right to erasure under Article 17 of the GDPR, the right to restriction of processing of their data under Article 18 of the GDPR and the right to data transfer under Article 20 of the GDPR.

Right to object:

In accordance with Article 21 of the GDPR, data subjects also have the right to object at any time to the processing of personal data concerning them.

A) Individual right of objection pursuant to Article 21 Para. 1 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6 Para. 1 lit. f) GDPR (data processing on the basis of a balance of interests). If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

B) Right to object to processing of data for direct marketing purposes pursuant to Article 21 Para. 2 GDPR

Should we process your personal data for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing. The processing of your data for this purpose is not envisaged within the framework of the Key Visual 2022 campaign.

Please send any enquiries regarding the exercise of your rights as a data subject, stating your full name, by post or e-mail to our data protection officer: SCC EVENTS GmbH, Data Protection Officer, Olympiapark Berlin, Hanns-Braun-Strasse / Adlerplatz, 14053 Berlin or datenschutz@scc-events.com.

Right of appeal:

If you suspect that we are processing your data unlawfully, you can of course seek judicial clarification of the issue at any time. In addition, any other legal option is open to you. Irrespective of this, you have the option of contacting a supervisory authority in accordance with Article 77 Para. 1 GDPR. The right of complaint pursuant to Article 77 GDPR is available to you in the EU member state of your place of residence, your place of work and/or the place of the alleged infringement, i.e. you can choose the supervisory authority to which you turn from the places mentioned above. The supervisory authority to which the complaint has been submitted will then inform you of the status and outcome of your submission, including the possibility of a judicial remedy pursuant to Article 78 GDPR.

6.) Transfer of data to a third country or an international organisation

We sometimes transfer personal data to third countries or international organizations. A list of these services and service providers that may be used in the Key Visual 2022 campaign can be found later in this document.

Third countries are countries outside the EEA where the GDPR is not directly applicable. The USA is a so-called third country. There is no adequacy decision of the EU Commission for the USA. It is therefore considered an unsafe third country. The level of data protection is not comparable to that in the EU. An adequate level of data protection cannot be ensured due to the legal situation in the USA.

In order to compensate for the existing data protection deficit in the event of a lack of an adequacy decision, we have agreed with the service providers concerned in the third country or with the international organisation on further appropriate guarantees for the processing of personal data in addition to the standard data protection clauses, so that the data protection standards in these data transfers are compatible with the statutory data protection provisions of the EU and an adequate level of protection is ensured in the processing of the personal data.

The standard data protection clauses for our processors (C-P) are available at: https://eur-lex.europa.eu/legal-content/DE/TXT/?uri=celex:32010D0087

The standard data protection clauses for joint responsibility (C-C, Set2) are available at

https://eur-lex.europa.eu/legal-content/DE/TXT/?qid=1603205251739&uri=CELEX:32004D0915. 

7.) Voluntariness and obligation to provide personal data

Participation in the Key Visual 2022 campaign is strictly voluntary. If you participate in the campaign, you must provide the data required to participate in the campaign in accordance with the terms of use and contractually required. Failure to provide the data will result in the inability to participate in the campaign.

Where a response is voluntarily, we have marked it in the respective survey form and in the terms of use. You can revoke the processing of personal data on the basis of consent at any time for the future.

8.) Automated decision making, profiling

An automated decision-making in the sense of Article 22 GDPR does not take place.

"Profiling" is a form of automated processing of personal data evaluating personal aspects relating to a natural person, in particular for the purpose of analysing or forecasting the data subject's performance at work, economic situation, health, personal preferences or interests, reliability or behaviour, location or change of location, where this produces legal effects concerning the data subject or similarly significantly affects him or her. Your data will not be processed for profiling purposes by SCC EVENTS GmbH.