Personal data protection information notice

 

Personal data protection is a matter of high importance and a principal goal of our company. In this regard, through this web site, we fulfill our obligation to provide information to data subjects whose personal data we process for different purposes listed below.  This information notice is regularly updated and entails information for data subjects under Art. 13 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 / EC (General Data Protection Regulation) (hereinafter as "GDPR Regulation") as well as other relevant legislation related to personal data protection (including the UK General Data Protection Regulation and the UK’s Data Protection Act 2018).

 

The personal data controller is Sportvideos365 GmbH, registered seat: Cumberlandstrasse 40/4/1, 1140 Vienna, Austria, Company ID: FN 430195s (hereinafter only as "Sportvideos" or "Controller"). The Controller has designated a data protection officer for the purposes of supervision of personal data protection, to emphasize the protection of personal data by the controller. The data protection officer may be contacted at the e-mail address: [email protected]

 

Where cross-border transfers of personal data to a third country or an international organization should occur, the Controller will fulfill his obligation to inform the relevant data subjects in addition to this general information. The related data subjects will be also informed of the adequate and appropriate safeguards guaranteeing the security of personal data in their cross-border transfer. According to applicable case law of Court of Justice of the European Union (Case-101/01 Bodil Lindqvist case), making data accessible on the internet by loading personal data onto an internet page is not considered transfer of personal data to a third country under applicable data protection law.

 

There is no profiling or automated decision making on the rights and freedoms of the data subjects when processing the personal data by the Controller.

 

As a data subject, you have the right of access to personal data being processed about your person, the right to rectification of your personal data (Article 16 of the GDPR Regulation), in cases stated by law the right to erasure of your personal data (Article 17 of the GDPR Regulation), in cases stated by law the right to restriction of processing of your personal data (upon which the Controller will mark the personal data stored about your person in order to limit its processing in the future) (Article 18 of the GDPR Regulation), in cases stated by law the right to data portability (Article 20 of the GDPR Regulation), the right to object to the processing of personal data, in particular where the legal basis for the processing of personal data of data subjects is justified by the Controller's legitimate interest (Article 21 of the GDPR Regulation), the right to file a complaint to the supervisory authority (respective Office for Personal Data Protection, e.g. https://dataprotection.gov.sk), i.e. to file a motion to initiate proceedings regarding your rights related to the protection of your personal data, in the case of a violation of your rights as the data subject by the Controller.

 

Information to be provided when personal data is collected from the data subjects referred to in the paragraphs above relates to all purposes for which the controller processes personal data. In the following paragraphs, the controller provides the information to be provided when collecting personal data from the data subject, relating to specific processing purposes (filing systems) identified by the controller, for which the information differs according to specific filing system (purposes of processing) of personal data.

 

Data subjects in the videos on our website (athletes, content creators, others (e.g. coaches, audience members, referees etc.)

 

The purpose of processing is processing of personal data related to the recorded sporting event to make it available for future viewing on our platform or the platform of our business partners. The legal basis of processing is the legitimate interest of the controller to process said personal data. The legitimate interest of the controller is not overridden by the interests and fundamental rights and freedoms of the data subjects, because the data subjects can reasonably expect the extent of processing (sporting events are regularly recorded for future references) and the processing is done in favor of the data subject (to promote their sport, their event, their performance, to allow them to review their performance etc.). The recipients of the data are the video viewers, our cloud supplier, the supplier of graphic design services and possibly our business partners (for example in case the content is used for cross promotion). The data retention period is 50 years from the last video view. The source of data is the content creator recording the sporting event. The provision of personal data is not a statutory or contractual requirement; the provision of personal data is not a requirement to enter a contract with the Controller. In case the data is not provided, the Controller will not keep the data subject’s personal data on his platform.  

 

Users of the sport.video website and application software

 

The purpose of processing of personal data of our website users and users of our application software is to allow the users to access the application features designed for the specific user roles. We also use the collected data to assess if our application software is used for its intended purpose and to understand how the users use our applications, to be able make our apps even better and more user friendly. The legal bases of processing are our terms of service, our license agreement, and our legitimate interest. The legitimate interest of the controller is not overridden by the interests and fundamental rights and freedoms of the data subjects, because there is an appropriate relationship between the controller and the data subject (the provider and the user of the application software), the personal data is processed only in a way the data subjects may reasonably expect and the processing is done in favor of the data subject (to allow access to the required features, to recognize the data subject’s personal settings, to better the user experience etc.). The recipient of the data is our cloud storage supplier. The data retention period is 10 years after contract termination or after deactivating the user account. The retention period for unregistered users depends on their specific cookie settings and preferences. The provision of personal data is not a statutory or contractual requirement (the data subjects are not required to register by law or contract); the provision of personal data may in some cases be a requirement to enter a contract with the Controller (the controller needs to identify the user through the means of registration to allow the user to access the premium content). In case the data was not provided, the Controller would not be able to provide the user with premium features accessible only through the registration process and accepting the terms of service. 

 

Livestream

 

The purpose of processing of personal data for livestreaming purposes is to make the sporting event available for live viewing on our platform, the platform of our business partners or on third party application software (e.g. other providers of streaming solutions). The legal basis of processing is the legitimate interest of the controller to process said personal data or the consent of the data subject (in case of cross border transfers of personal data, if no other safeguard applies). The legitimate interest of the controller is not overridden by the interests and fundamental rights and freedoms of the data subjects, because the data subjects can reasonably expect the extent of processing (sporting events are regularly streamed live) and the processing is done in favor of the data subject (to promote their sport, their event, their performance, to allow them to review their performance etc.). The recipients of the data are the video viewers, our cloud supplier, the supplier of graphic design services and possibly our business partners (for example in case the content is used for cross promotion) and third-party-application-software providers. The data retention period is 50 years from the last video view if the live stream is also recorded. If the live stream is not recorded, there is no data retention period. The source of data is the content creator recording the sporting event. The provision of personal data is not a statutory or contractual requirement; the provision of personal data is not a requirement to enter a contract with the Controller. In case the data is not provided, the Controller will not be able to stream the data subject’s personal data live on his platform.  

 

Marketing

 

The purpose of processing of personal data for marketing purposes is to be able to expand the controller’s business activity by direct marketing. The legal basis of processing is the legitimate interest of the Controller. The legitimate interest of the Controller in processing of personal data for his business purposes is not overridden by the interests and fundamental rights and freedoms of the data subjects, because the processing happens in favor of the data subjects (the Controller contacts potential clients only upon a preexisting probability the approached subject may be interested in the Controller’s business activity, e.g. the approached subject conducts business related to sports) and the extent of processing is in accordance with the principle of data minimization. The GDPR regulation recognizes direct marketing as a legitimate interest in the recital of 47 of the GDPR Regulation. The recipient of the personal data is the supplier of marketing and IT services. The source of contact information is the Internet, public registers, and previous references. The retention period is three years from acquiring the contact information. The provision of personal data is not a statutory or contractual requirement or a requirement to enter a contract with the Controller. If the approached subject objects to processing of its personal data by the Controller, Controller will no longer process its data and the approached subject will not be able to profit from the synergy of its and Controller’s business activity.

 

Analytical activities

 

We partner with Microsoft Clarity and Microsoft Advertising to capture how you use and interact with our website through behavioral metrics, heatmaps, and session replay to improve and market our products/services. Website usage data is captured using first and third-party cookies and other tracking technologies to determine the popularity of products/services and online activity. Additionally, we use this information for site optimization, fraud/security purposes, and advertising. For more information about how Microsoft collects and uses your data and the list of recipients of your data, visit the Microsoft Privacy Statement (https://privacy.microsoft.com/sk-SK/privacystatement). The legal basis for processing personal data for the stated purpose is the user’s consent granted through our cookies banner. The provision of personal data for this purpose is not a statutory or contractual requirement or a requirement to enter a contract with the Controller. If the user does not grant us consent to process the related cookies, we will not be able to use the user’s interaction with the website to better the user experience.

 

Newsletter

 

The purpose of processing of personal data of data subjects is to process their contact information based on their interest in the Controller’s business activity by voluntarily subscribing to a newsletter. The legal basis of processing is the data subject’s consent. The retention period is three years from acquiring the contact information. The person who granted the consent has the right to withdraw his/her consent, which will mean he/she will not receive the Sportvideos newsletter anymore. The data subject is informed about his/her right to unsubscribe from the newsletter in each newsletter. The recipient of data is the supplier of mass mailing services. The retention period is 3 years from granting of the consent. The provision of personal data is not a statutory or a contractual requirement; the provision of personal data is not a requirement to enter a contract with the Controller. If the data subject does not provide his/her e-mail address for the newsletter purposes, he/she will not be informed of news related to the controller’s progress in business activities.

 

Legal matters

 

The purpose of processing of personal data for legal matters is to process data related to contracts, disputes, audits of supervisory authorities, company register filings and personal data protection. The legal bases of processing are fulfilling a legal obligation of the controller (e.g., processing of personal data on accounting documents to fulfil accounting obligations) and the controller’s legitimate interests. The legitimate interest of the Controller in processing of personal data for his business purposes is not overridden by the interests and fundamental rights and freedoms of the data subjects, because the processing is necessary to defend from legal claims and to prove legal claims. The recipient of the personal data is the supplier of legal services. The retention period is ten years from contract termination, dispute resolution or the end of a proceedings with the supervisory authority. The provision of personal data is not a statutory or contractual requirement or a requirement to enter a contract with the Controller. If the data subject would not provide data for legal matters, the Controller would not be able to identify data subjects for the purposes related to the Controller’s legal matters.   

 

Recordkeeping

 

The purpose of processing of personal data is to keep records for record keeping purposes required by law, after the cessation of the primary purpose of processing. The legal basis of processing is the compliance with legal obligations under The Archives and Recordkeeping Act

The recipient of data is the cloud services supplier. The retention period depends on the specific records, mostly it is 10 years after the cessation of the primary purpose of processing, in some cases the records are kept longer (e.g., employee records). The provision of personal data is a statutory requirement. If the data was not provided, the Controller would not be able to fulfill his statutory obligation

 

Correspondence

 

The purpose of processing personal data related to correspondence is to process of solicited and unsolicited personal data in received correspondence before the termination of unneeded personal data or before designating the solicited personal data to the respective filing system. The legal basis of processing is the legitimate interest of the Controller. The legitimate interest of the Controller in processing of personal data for his business purposes is not overridden by the interests and fundamental rights and freedoms of the data subjects, because the processing happens to an extent the data subjects may reasonably expect (they send the personal data in the correspondence themselves), the processing happens in favor of the data subjects (e.g. they are looking to enter into a contract with the Controller) and the extent of processing is in accordance with the principle of data minimization (processing is limited to solicited and useful data). The retention period is three years for the solicited data, the unsolicited correspondence is not kept. The provision of personal data is not a statutory or contractual requirement; the provision of personal data is not a requirement to enter a contract with the Controller. Not providing the data will mean the Controller is unable to determine the sender of the correspondence.

 

Contractors

 

The purpose of processing of personal data of contractors is to process the contact details, and communication with contractors, related to regular business activity of the Controller. The legal basis of processing is the legitimate interest of the Controller. The legitimate interest of the Controller in processing of personal data for his business purposes is not overridden by the interests and fundamental rights and freedoms of the data subjects, because the processing happens to an extent the data subjects may reasonably expect (they control the content of the communication with the Controller), the processing happens in favor of the data subjects (communication is used to negotiate the contents of a contract with the Controller) and the extent of processing is in accordance with the principle of data minimization (processing is limited to using the data to fulfill a contract with the respective contractor). The recipient is the supplier of accounting services. The retention period is ten years after contract termination. The provision of personal data is not a statutory or contractual requirement. The provision of personal data is a requirement to enter a contract with the Controller, because it is necessary to negotiate the contents of the contract. Not providing the data, by not communicating with the Controller may mean the Controller will not be able to conclude a contract with the respective contractor.

 

Accounting

 

The purpose of processing of personal data for accounting purposes is to process personal data on accounting documents. The legal basis of processing is the compliance with legal obligations under accounting laws. The recipient of personal data is the supplier of account services. The retention period is ten years. The provision of personal data is a statutory requirement. Not providing the data would mean the Controller would not be able to comply with the law. 

 

Sportvideos Group

 

The purpose of processing of personal data is to process personal data within the organizational structure of Sportvideos and within affiliated companies. The legal basis of processing is the legitimate interest of the Controller. The legitimate interest of the Controller in processing of personal data for his business purposes is not overridden by the interests and fundamental rights and freedoms of the data subjects, because the processing happens to protect the Controller’s assets. The legitimacy of the interest is recognized by recital 48 of the GDPR Regulation. The recipients of data are the Sportvideos group companies and affiliated companies. The retention period for all data processed for this purpose (e.g. communication) is ten years. The provision of personal data is not a statutory requirement; The provision of personal data is a contractual requirement only for the employees/consultants of affiliated companies; the provision of personal data is not a requirement to enter a contract with the Controller. If Sportvideos would not be able to transfer personal data within the group of affiliated companies, it would excessively hinder Sportvideos from conducting business. 

 

Business partners

 

The purpose of processing is processing of personal data related to Sportvideos’ business partners. The legal basis of processing is the performance of a contract with the business partner (in case the business partner is a natural person) or the legitimate interest in case of business partners who are legal persons. The legitimate interest of the controller is not overridden by the interests and fundamental rights and freedoms of the data subjects, because the data subjects can reasonably expect the extent of processing and an appropriate relationship exists between the controller and the data subject (the contracting party and the representative of the other contracting party). The recipient of the data is the supplier of accounting services. The data retention period is 10 years after contract termination. The provision of personal data is not a statutory or contractual requirement; the provision of personal data is not a requirement to enter a contract with the Controller. In case the data is not provided, the Controller will not be able to identify or communicate with the business partner.  

 

The Controller has adopted reasonable security measures to ensure the security of personal data processed in all the above-mentioned filing systems and has documented the security measures in the Sportvideos Security Project.