I. For the data controller

The controller in the sense of the General Data Protection Regulation (GDPR), other national data protection regulations of the member states, and other data protection regulations is the person referred to under the “Team” menu item as the trainer or admin of the team (hereinafter “Trainer”). The contact information can be accessed by clicking on the trainer.

II. General information on data processing

1. Scope of the processing of personal data

The trainer collects and uses the personal data of team members for the clear organization of the team and on a regular basis only after the user (team member) consents. Exceptions are made in cases in which prior consent cannot be obtained for factual reasons and where the processing of the data is permitted by legal regulations.

2. Legal basis for the processing of personal data

Insofar as consent from the data subject is obtained for the processing of personal data, Art. 6 (1) (a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis for the processing of personal data.

In the processing of personal data that is required for the performance of a contract in which the contractual party is the data subject, Art. 6 (1) (b) GDPR serves as the legal basis. This also applies to processing that is required to carry out pre-contractual measures.

Insofar as the processing of personal data is required to fulfill a legal obligation to which the controller is subject, Art. 6 (1) (c) GDPR serves as the legal basis.

If vital interests of the data subject or another natural person require the processing of personal data, Art. 6 (1) (d) GDPR serves as the legal basis.

If the processing is required to safeguard a legitimate interest of the controller or a third party and the interests, basic rights, and basic freedoms of the data subject do not outweigh the former interest, Art. 6 (1) (f) GDPR serves as the legal basis for the processing.

3. Data deletion and storage period

The personal data of the data subject are deleted or blocked as soon as the purpose of the storage is no longer applicable. This is regularly the case if users request the deletion of their data/account. Furthermore, users can manage their editable personal data on their own.

Additionally, data may be stored if this has been provided for by the European or national legislator in EU regulations, laws, or other provisions to which the controller is subject. Data is also restricted or erased if a storage period prescribed by the above-mentioned standards expires, unless there is a need to continue storing the data in order to fulfill or conclude a contract.

III. Categories of personal data that are processed

• First and last name
• Address
• Date of birth
• User name
• E-Mail address
• Phone and cell phone number
• Profile picture
• Representatives and contact persons
• Garment size
• Jersey number
• Position (attack, defense, midfield, etc.)
• Member number (sports club/team)
• Confirmations and cancellations of events including the reasons
• Line-up
• Participation in carpools
• Assigned tasks within the team
• Data from the match report (such as goals, fouls, penalties, etc.)
• Team treasury (penalties, contributions)
• Betting behavior (betting community)
• Voting behavior

Chat feature

• Chat histories
• Data entered in the chat or contact forms
• Users can subscribe to chats after registering. Users will initially get a confirmation email to verify that they own the email address they provided. Within the provided chat feature, the selected user name and shared chat content are collected as data and stored during the chat.
• The chat history is deleted if the player is deleted from the respective team or if the team is deleted. Each chat message can also be deleted by its respective author. The Trainer reserves the right to moderate the chat messages.

Special data category

• Absence due to illness/injury (health data)

IV. Recipient or categories of recipients of the personal data

Trainer (controller), club management, team members.

V. Purposes for which the personal data are to be processed and the legal basis for the processing

The personal data are used to organize a sports team. The legal basis for the processing is your consent, which you give by voluntarily providing your personal data (Article 6 (1) (a) GDPR). This consent given to the Trainer can be revoked at any time by entering the letter “X” in the fields that should not or no longer be filled or by means of a complete deregistration.

VI. Access rights of the app

To provide the full functionality of the app, the following access rights are required to access certain features on a user’s device:

• Device number of your smartphone. This is collected for the following purpose: Recognition of the smartphone to assign already existing data and selected features to the respective user and to avoid having to log in again in order to make the app user-friendly.
• Photos, videos. This is collected for the following purpose: Providing the “profile picture” feature.
• Camera. This is collected for the following purpose: Use of the “take photo” feature.
• Memory. (Reading/writing of files) This is collected for the following purpose: Providing and using the “team cloud” feature.
• Internet. This is collected for the following purpose: Connection with and to Internet services.
• Network status. This is collected for the following purpose: Determining the connection quality.
• Contacts. This is collected for the following purpose: Displaying the contacts in order to send an invitation to use the app.

Access rights are required to enable you to use certain features of the app (e.g., “News from the region”, “Profile picture”) and to make the app user-friendly.

The legal basis for the access is your consent, which you have given in the scope of the installation and setting of the access rights (Art. 6 (1) (a) GDPR).

VII. Rights of the data subject

If your personal data are being processed, you are a data subject as defined by the GDPR, and you have the following rights in relation to the controller:

1. Right of access

You can request confirmation from the controller as to whether we are processing your personal data.

If such processing has taken place, you can request information from the controller on the following topics:

1. the purposes for which the personal data are processed;
2. the categories of personal data being processed;
3. the recipients or categories of recipients to whom your personal data have been or will be disclosed;
4. the planned duration of the storage of the personal data concerning you, or, if no specific information on this is available, criteria for determining the storage period;
5. the existence of a right to the rectification or erasure of the personal data or restriction of processing of personal data concerning you, or a right to object to this processing;
6. the existence of a right to appeal to a supervisory authority;
7. any available information about the source of the data if the personal data are not being collected from the data subject;
8. the existence of an automated decision-making process including profiling as defined by Art. 22 (1) and (4) GDPR and – at least in these cases – meaningful information about the logic involved as well as on the scope and intended effects of such processing on the data subject.

You have the right to request information as to whether your personal data are being transferred to a third country or to an international organization. In this context, you can request to be informed about the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.

2. Right to rectification

You have the right to request that the controller correct and/or complete the data if the processed personal data concerning you is incorrect or incomplete. The controller must immediately make the correction.

3. Right to restriction of processing

Under the following conditions, you may request the restriction of the processing of your personal data:

1. if you contest the accuracy of the personal data concerning you for a period that enables the controller to verify the accuracy of the personal data;
2. if the processing is unlawful and you object to the erasure of the personal data and instead request a restriction of their use;
3. if the controller no longer needs the personal data for the processing purposes, but you need them to assert, pursue, or defend legal claims; or
4. if you have objected to the processing pursuant to Art. 21 (1) GDPR and it is not yet established whether the legitimate reasons of the controller outweigh your reasons.

If the processing of your personal data has been restricted, these data – with the exception of storage – may only be processed with your consent or for the purpose of asserting, pursuing, or defending legal claims or for protecting the rights of another natural or legal person or for reasons related to an important public interest of the Union or a member state.

If the restriction of processing was restricted in accordance with the above conditions, the controller will inform you before the restriction is lifted.

4. Right to erasure

a) Obligation to delete

You may request that the controller erases your personal data without delay. The controller is then obligated to immediately delete the data if one of the following reasons applies:

1. The personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed.
2. You revoke your consent on which the processing pursuant to Art. 6 (1) (a) or Art. 9 (2) (a) GDPR was based and there is no other legal basis for the processing.
3. You object to the processing pursuant to Art. 21 (1) GDPR and there are no overriding legitimate reasons for the processing, or you object to the processing pursuant to Art. 21 (2) GDPR.
4. The personal data concerning you have been processed unlawfully.
5. The erasure of the personal data concerning you is necessary to comply with a legal obligation under Union law or the law of the member states to which the controller is subject.
6. The personal data concerning you have been collected in relation to services offered by an information society pursuant to Art. 8 (1) GDPR.

b) Information to third parties

If the controller has made your personal data public and is obligated to their erasure pursuant to Art. 17 (1) GDPR, the controller, in consideration of the available technology and implementation costs, will take appropriate measures, including technical ones, to inform the persons responsible for the data processing that you, as a data subject, have requested the erasure of all links to these personal data or copies or replications thereof.

c) Exceptions

The right to erasure does not exist if the processing is required

1. to exercise the right to freedom of expression and information;
2. to comply with a legal obligation that requires the processing according to a law of the Union or member states to which the controller is subject or to perform a task carried out in the public interest or in the exercise of official authority vested in the controller;
3. for reasons of public interest in the field of public health pursuant to Art. 9 (2) (h) and (i) and Art. 9 (3) GDPR;
4. for archival purposes, scientific or historic research purposes in the public interest, or for statistical purposes pursuant to Art. 89 (1) GDPR, insofar as the law referred to in section a) is likely to render impossible or seriously interfere with the attainment of the objectives of such processing; or
5. to assert, exercise, or defend legal claims.

5. Right to be notified

If you have asserted the right to the rectification, erasure, or restriction of processing towards the controller, the controller is obligated to notify all recipients to whom your personal data have been disclosed of this rectification, erasure or restriction of processing, unless this proves impossible or involves disproportionate effort.

You are entitled to receive information from the controller about these recipients.

6. Right to data portability

You have the right to receive the personal data concerning you that you provided to the controller in a structured, commonly used, and machine-readable format. You also have the right to have this data transmitted to another responsible person without interference from the controller to whom the personal data has been communicated, provided that

1. the processing is based on consent pursuant to Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR or on a contract pursuant to Art. 6 (1) (b) GDPR; and
2. the processing is carried out by automated means.

In exercising this right, you also have the right to request that your personal data be transferred directly from one controller to another, insofar as this is technically feasible. This must not affect the freedoms and rights of other people.

The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7. Right to object

You have the right to object, for reasons arising from your particular situation, at any time to the processing of your personal data that is carried out pursuant to Art. (6) (1) (e) or (f) GDRP; this also applies to profiling based on these provisions.

The controller will no longer process your personal data, unless the controller can demonstrate compelling legitimate reasons for the processing that outweigh your interests, rights, and freedoms, or unless the processing serves to assert, exercise, or defend legal claims.

If personal data concerning you are processed for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for the purpose of such marketing; this also applies to profiling to the extent that it is linked to such direct marketing.

If you object to the processing for the purposes of direct marketing, your personal data will no longer be processed for those purposes.

You have the option of exercising your right to object in relation to the use of information society services – notwithstanding Directive 2002/58/EC – by using automated procedures that involve technical specifications.

8. Right to revoke the data protection declaration of consent

You have the right to revoke your data protection declaration of consent at any time. Revoking the consent does not affect the legality of the processing that has occurred on the basis of the consent up until it was revoked.

9. Automated decision-making in individual cases, including profiling

You have the right not to be subject to a decision based solely on automated processing – including profiling – that has a legal effect on you or significantly affects you in a similar manner. This does not apply if the decision

1. is required for the conclusion or performance of a contract between you and the controller;
2. is permissible according to statutory regulations of the Union or member states to which the controller is subject and these regulations provide for appropriate measures to safeguard your rights, freedoms, and your legitimate interests; or
3. is made with your express consent.

However, these decisions may not be based on special categories of personal data pursuant to Art. 9 (1) GDPR, unless Art. 9 (2) (a) or (g) applies and appropriate measures have been taken to safeguard rights and freedoms and your legitimate interests.

With respect to the cases referred to in (1) and (3), the controller will take appropriate measures to safeguard the rights and freedoms and your legitimate interests, which include at least the right to obtain the intervention of a person on behalf of the controller, to express his or her own point of view and to challenge the decision.

10. Right to lodge a complaint with a supervisory authority

Regardless of any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state in which you reside, your place of work, or the place of the alleged infringement, if you believe that the processing of the personal data concerning you is in breach of the GDPR.

The supervisory authority to which the complaint has been lodged will inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.