Privacy Policy

PRIVACY POLICY
DISCLAIMER & PRIVACY POLICY

1.          Scope of the processing of personal data

You can rely on the protection and security of your personal data: The protection of your privacy when processing personal data is an important concern for Sportsfitality BV (“SF“, “we“, “us“), which we take into account in all our business processes. With this data protection notice, we would therefore like to take this opportunity to explain to you the basic rules of our handling of personal data which naturally takes place in compliance with the applicable European and national data protection regulations. We collect and use our users’ personal data only to the extent necessary to provide a functional website and our content and services. The collection and use of our users’ personal data only takes place regularly with the user’s consent. An exception applies in cases where prior consent cannot be obtained for factual reasons and the processing of the data is permitted by law.

This privacy policy applies to all English-language pages of the https://hyroxnetherlands.com/ domain.

2.          Legal basis for the processing of personal data

Insofar as we obtain the consent of the data subject for the processing of personal data, Article 6 (1) (a) EU General Data Protection Regulation (“GDPR”) serves as the legal basis for the processing of personal data.

When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Article 6 (1) (b) GDPR serves as the legal basis. This also applies to processing operations that are necessary to carry out pre-contractual measures.

Insofar as the processing of personal data is necessary to fulfill a legal obligation to which our company is subject, Article 6 (1) (c) GDPR serves as the legal basis.

In the event that vital interests of the data subject or another natural person require the processing of personal data, Article 6 (1) (d) GDPR serves as the legal basis.

If the processing is necessary to safeguard a legitimate interest of our company or a third party and if the interests, fundamental rights and freedoms of the data subject do not outweigh the former interest, Article 6 (1) (f) GDPR serves as the legal basis for the processing.

3.          Description, purpose and scope of data processing

a)          Accessing our website

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer. This data is recorded in the form of logs.

The following data is collected:

• Visited website
• Time at the time of access
• Amount of data sent in bytes
• Source/reference from which you reached the page
• Browser used
• Operating system used
• IP address used

This data is not merged with other data sources.

We use the logs to make the website and its functions available to you. We use the collected data to optimize our website and to ensure the security of our IT systems. We use logs as part of our legitimate interest in the provision and ongoing development of our website. The legal basis is Article 6 (1) (f) GDPR.

b)          Booking and holding of events

(1)        Event booking and carrying out events

An event booking form is available on our website, which can be used for the electronic booking of events and event photography. If a user makes use of this option, the data entered in the input mask (name, e-mail address, date of birth, billing address, gender, name and telephone number of an emergency contact and the registration number) will be transmitted to us and our processors and stored. In addition, you can optionally indicate how you heard about us and whether you are a member of a fitness studio or a partner studio. Apart from the information you enter in the respective input screen, no other data is recorded.

In connection with the event booking, we pass on the data you enter to our processor Vivenu GmbH, based at Kesselstraße 2, 40221 Düsseldorf, Germany. We have concluded a data processing agreement with Vivenu and payment for the booking is processed by our processor Stripe Payments Europe Ltd, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (“Stripe”).

The data will only be used to process the booking and carrying out events, i.e. the processing of the personal data from the input screen is used solely to process the booking, process the payment, carry out the event, compile statistics (see below under (2)) on the event and for event photography (see below under (3)). When you make a booking, you will receive important information about the event you have booked via a distribution list by email. We use the same processor for this as for sending the newsletter nederland@hyrox.com. If you no longer wish to receive this information, you can unsubscribe from this mailing list at any time by clicking on “Unsubscribe” in the respective newsletter or by sending an email to nederland@hyrox.com. We compile the statistics using our processor [Fanalist, based at Kerkstraat 54, 1191JD, Ouderkerk aan de Amstel, Netherlands.]

If you have agreed to receive a newsletter as part of the booking, we will also process the data for this purpose. The legal basis for this processing is your consent (Article 6 (1) (a) GDPR). You can withdraw this consent at any time with effect for the future by sending an email to nederland@hyrox.com or belgie@hyrox.com Further information on the processing of your data for the receipt of a newsletter can be found in the “Newsletter” section below.

The data will be deleted by us as soon as it is no longer required for the purpose for which it was collected. For the personal data from the input screen of the event booking form and those sent by email, this is the case when the respective event that the customer has booked has ended.

(2)        Results of the events

To evaluate the event and present the results, we collect your name, nationality, date of birth and split and finish times in the race.

The legal basis for data processing is Art. 6 para. 1 lit. b or f GDPR. The data is required for the displaying of the of the race results. We also have a legitimate interest in tracking the results of the participants in the race. With regard to the publication of this data on the website, the legal basis is your consent in accordance with Art. 6 para. 1 lit. a GDPR. If you do not con-sent, your data will be published in pseudonymised form. The legal basis for this is then Art. 6 para. 1 lit. f GDPR. We have a legitimate interest in publishing the results of all participants in pseudonymised form in order to make the participants comparable with each other.

We process this race data in joint responsibility with Upsolut Sports GmbH. Therefore, there is joint responsibility in this respect between us and Upsolut Sports GmbH in accordance with Art. 26 GDPR. For this purpose, we have concluded an agreement with Upsolut Sports GmbH on this joint responsibility in accordance with Art. 26 GDPR. In the agreement, we have defined how we ensure your rights and specified in more detail which obligations each party fulfils in accordance with the GDPR.

Upsolut Sports GmbH (Bahrenfelder Straße 322, 22765 Hamburg, dach@hyrox.com) is responsible for processing your rights as a data subject. Regardless of the details of the joint controllership agreement, you can assert your rights against any controller. Information on our contact details can be found below.

(3)        Event photography

The event photography is carried out by our contract data processor Sportograf Digitial Solutions GmbH, Süsterfeldstr. 170, Aachen. In the case of an event booking together with event photography, your personal data will be processed to fulfill the contract with you in accordance with Article 6 (1) (b) GDPR, otherwise in accordance with Article 6 (1) (a) GDPR, in which case you can withdraw your consent at any time by sending an e-mail to nederland@hyrox.com with effect for the future.

(4)        Marketing of the events

We process your personal data for the marketing of current and future events to customers.

The processing may concern the following categories of data: Name and email address.

The legal basis for data processing is Article 6 (1) (a) or (f) GDPR.

We maintain online presences within social networks in order to communicate with the interested parties and users active there and to inform them about our events and news. In this context, we integrate external services or content by linking them to our website. If you use such a service (click on the link and open the platform) or if third-party content is displayed to you, communication data (such as IP addresses or general device information) will be exchanged between you and the respective provider for technical reasons.

In addition, it is possible that the provider of the respective external services or content collects personal data about you- for example by means of corresponding cookies- and then processes it for its own purposes. We have configured services or content from providers that are known to process data for their own purposes to the best of our knowledge and belief in such a way that either communication for purposes other than displaying the content or services on our website does not take place or communication only takes place when you actively decide to use the external service. However, as we generally or to a large extent have no influence on the data collected by third parties and its processing by them, we cannot provide any binding information on the purpose and scope of the processing of your data.

Further information on the purpose and scope of the collection and processing of your data by the providers of the corresponding external services as well as information on the data protection notices of the respective providers of the external services or content integrated by us can be found in the corresponding sections relating to the respective social media.

(1)        Facebook fan page

We  operate an online presence on Facebook, a so-called Facebook fan page by Meta Platforms Inc. The following additional reports on data processing activities apply to visits to our fan page.

We are jointly responsible with Meta for the operation of our Facebook fan page in accordance with Article 26 GDPR. To this end, Meta has concluded an agreement with us to determine who fulfills which obligations with regard to data privacy. This agreement can be accessed here. According to this agreement, Meta is primarily responsible for providing the data subject with information about the joint processing and enabling them to exercise their data protection rights. Irrespective of this, we hereby inform you about your visit to our fan page and thus provide you with the information required under data protection law.

You can find general information on data privacy on Meta here.

You can reach the entity at Meta responsible for us at:

Facebook Ireland Ltd.

4 Grand Canal Square,

Grand Canal Harbour,

Dublin 2, Ireland

You can reach Meta online here.

You can contact Meta’s data protection officer at https://www.facebook.com/help/contact/540977946302970

Our contact details and the contact details of our data protection officer can be found in this data privacy notice under section 8.

Collection and storage of personal data as well as type and purpose and their use:

(a)        Data collected by Meta on Facebook:

If you are a Facebook user, Meta collects the data described in the Facebook Data Policy  under “What types of information do we collect?”. If you are not a Facebook user, cookies with identifiers, small text files, may still be stored in your browser to enable tracking of your user behavior.

As a rule, user data is also processed by Meta for market research and advertising purposes when you visit Facebook. Complex user profiles are created based on user behavior (including when visiting our fan page), which Meta can use to display personalized advertisements to visitors inside and outside of Facebook. You can also find more information on this in the Facebook Data Policy.

If you do not agree to this, you can object here (opt-out).

(b)        Data used by us (“Page Insights”) and legal basis:

Meta provides us with statistics and usage data that we can use to analyze the use of our fan page (so-called “Page Insights”). This enables us to continuously improve our offer on Facebook. As the operator, we do not make any decisions regarding the processing of Insights data and all other information resulting from Article 13 GDPR, such as the storage duration of cookies on user end devices. The primary controller under the GDPR for the processing of Insights data is Meta. In this regard, we also refer to the agreement on joint controllership pursuant to Article 26 GDPR that Meta has concluded with us and to the obligations assumed by Meta under this agreement.

As the page administrator, we have no other way of evaluating user behavior on our fan page, not even via user tracking. In principle, it is also not possible for us to identify visitors to our fan page on the basis of page insights. In particular, in accordance with the agreement with Meta, we have no right to demand that Meta disclose individual visitor data. Identification is only possible for us if we can assign individual profile pictures to “Like” information for the page; however, this is only possible if our fan page has been marked with “Like” by the corresponding visitor and the “Like” information is set to “public”.

You can find out what information Meta uses to create Page Insights here.

The operation of the Facebook fan page and the use of page insights serves our legitimate interest in an effective external presentation and communication with our interested parties. This interest justifies the operation of the page both in relation to the legitimate interests of Facebook users and in relation to visitors to our fan page who do not have a Facebook account. The legal basis is therefore Article 6 (1) (f) GDPR.

(2)        Instagram

We have an online presence on Instagram. Instagram is an audio-visual platform by Meta that allows users to share photos and videos and also distribute them on other social networks.

You can reach the entity at Meta responsible for us at:

Facebook Ireland Ltd.

4 Grand Canal Square,

Grand Canal Harbour,

Dublin 2, Ireland

You can reach Meta online here.

You can contact Meta’s data protection officer at

https://www.facebook.com/help/contact/540977946302970.

Further information and the applicable data protection provisions of Instagram can be found at https://help.instagram.com/155833707900388 and https://www.instagram.com/about/legal/privacy/

(a)        Data collected by Meta on Instagram:

If you are an Instagram user, Meta collects the data described in the Instagram Data Policy under “What types of information do we collect?”. If you are not an Instagram user, cookies with identifiers, small text files, may still be stored in your browser, which enable so-called tracking of your user behavior.

As a rule, user data is also processed by Meta for market research and advertising purposes when you visit Instagram. Complex user profiles are created based on user behavior (including when visiting our Instagram), which Meta can use to display personalized advertisements to the visitor inside and outside of Instagram. You can also find more information on this in Instagram Data Policy.

(b)        Data used by us (“Page Insights”) and legal basis:

Meta provides us with statistics and usage data that we can use to analyze the use of our Instagram page (so-called “page insights”). This enables us to continuously improve our offer on Instagram. As the operator, we do not make any decisions regarding the processing of Insights data and all other information resulting from Article 13 GDPR, such as the storage duration of cookies on user end devices. The primary controller under the GDPR for the processing of Insights data is Meta.

As the site administrator, we have no other way of evaluating user behavior on our Instagram page, not even via user tracking. It is also generally not possible for us to identify visitors to our Instagram page based on page insights. In particular, in accordance with the agreement with Meta, we have no right to demand that Meta disclose individual visitor data. In addition to any personal data transmitted directly to us by users, we can see information about the user’s profile, likes and posts, depending on the user’s privacy settings.

The operation of the Instagram page serves our legitimate interest in an effective external presentation and communication with our interested parties. This interest justifies the operation of the page both in relation to the legitimate interests of Instagram users and in relation to visitors to our fan page who do not have an Instagram account. The legal basis is therefore Article 6 (1) (f) GDPR.

(3)        LinkedIn

We have a profile on LinkedIn. LinkedIn is a social network and online platform for professionals, specialists and managers.

We are jointly responsible with LinkedIn for the use of Page Insights when operating our LinkedIn profile in accordance with Article 26 GDPR. To this end, LinkedIn has concluded an agreement with us to determine who fulfills which obligations with regard to data protection. This agreement can be accessed here. LinkedIn is therefore primarily responsible for providing the data subject with information about the joint processing and enabling them to exercise their data protection rights. Irrespective of this, we hereby inform you about your visit to our profile and thus provide you with the information required under data protection law.

You can reach LinkedIn at:

LinkedIn Ireland Unlimited Company

Wilton Place,

Dublin 2, Ireland

You can reach LinkedIn online here.

You can contact LinkedIn’s data protection officer at https://www.linkedin.com/help/linkedin/ask/TSO-DPO

Further information and the applicable data protection provisions of LinkedIn may be retrieved under https://www.linkedin.com/legal/privacy-policy.

(a)        Data collected by LinkedIn

If you are a LinkedIn user, LinkedIn collects the data described in the LinkedIn-Data Policy under “Information we collect”. For members who are not logged in to LinkedIn, a LinkedIn cookie is not set so that identification is not possible. For more information, see the LinkedIn cookie policy at https://www.linkedin.com/legal/cookie-policy?

As a rule, user data is also processed by LinkedIn for market research and advertising purposes when you visit LinkedIn. Complex user profiles are created based on user behavior (including when visiting our LinkedIn profile), which LinkedIn can use to display personalized advertisements to visitors inside and outside LinkedIn. You can also find more information on this in the LinkedIn-Privacy Policy.

(b)        Data used by us and legal basis

LinkedIn provides us with statistics and usage data that we can use to analyze the use of our LinkedIn page (so-called “Page Insights”). This enables us to continuously improve our offer on LinkedIn. As the operator, we do not make any decisions regarding the processing of Insights data and all other information resulting from Article 13 GDPR, such as the storage duration of cookies on user end devices. The primary controller under the GDPR for the processing of Insights data is LinkedIn. In this regard, we also refer to the agreement on joint controllership pursuant to Article 26 GDPR that LinkedIn has concluded with us and to the obligations assumed by LinkedIn under this agreement.

As the page administrator, we have no other way of evaluating user behavior on our LinkedIn page, not even via user tracking. It is also generally not possible for us to identify visitors to our LinkedIn page using Page Insights. In particular, in accordance with the agreement with LinkedIn, we have no right to demand that LinkedIn disclose individual visitor data. In addition to any personal data transmitted directly to us by users, we can see information about the user’s profile, likes and posts, depending on the user’s privacy settings.

You can see what information LinkedIn uses to create Page Insights here.

The operation of the LinkedIn profile and the use of Page Insights serves our legitimate interest in an effective external presentation and communication with our interested parties. This interest justifies the operation of the page both in relation to the legitimate interests of LinkedIn users and in relation to visitors to our profile who do not have a LinkedIn account. The legal basis is therefore Article 6 (1) (f) GDPR.

(4)        YouTube

We operate a profile on YouTube. YouTube is a video platform of Google Ireland Limited (“Google”).

You can reach Google at:

Google Ireland Limited,

Gordon House,

4 Barrow St,

Dublin, D04 E5W5,

Ireland

You can access YouTube online here.

You can contact Google’s data protection officer at

https://support.google.com/policies/answer/9581826?p=privpol_privts&hl=en&visit_id=637054532384299914-2421490167&rd=1

Further information and the applicable data protection provisions of Google may be retrieved under https://policies.google.com/privacy?hl=en

(a)        Data collected by Google on YouTube

By using YouTube, your personal data will be collected, transferred, stored, disclosed and used by Google and transferred to, stored and used in the United States, Ireland and any other country in which Google does business, regardless of your place of residence. It is transferred to companies affiliated with Google and to other trustworthy companies or persons who process it on behalf of Google.

Google processes your voluntarily entered data such as name and user name, e-mail address and telephone number. Google also processes the content that you create, upload or receive from others when using the services. This includes, for example, photos and videos that you save, documents and spreadsheets that you create and comments that you write on YouTube videos.

On the other hand, Google also analyzes the content you share to determine which topics you are interested in, stores and processes confidential messages that you send directly to other users and can determine your location using GPS data, information on wireless networks or your IP address in order to send you advertising or other content.

Google may use analysis tools such as Google Analytics for evaluation purposes. We have no influence on the use of such tools by Google and have not been informed of such potential use. If tools of this type are used by Google for our YouTube channel, we have neither commissioned this nor supported it in any other way. The data obtained from the analysis is also not made available. Only certain subscriber profiles can be viewed by us via our account. Furthermore, we have no way of preventing or disabling the use of such tools on your YouTube channel.

Finally, Google also receives information when you view content, for example, even if you have not created an account. This so-called “log data” may include the IP address, the browser type, the operating system, information about the previously accessed website and the pages you accessed, your location, your mobile phone provider, the end device you use (including device ID and application ID), the search terms you used and cookie information.

You have the option of restricting the processing of your data in the general settings of your Google account. In addition to these tools, Google also offers specific data protection settings for YouTube. You can find out more about this in Google’s guide to data protection in Google products:https://policies.google.com/technologies/product-privacy?hl=en&gl=en.

(b)        Data used by us and legal basis

Google provides us with statistics and usage data that we can use to analyze the use of our YouTube channel (so-called “channel analytics”). This enables us to continuously improve our offering on YouTube. As the operator, we do not make any decisions regarding the processing of analytics data and all other information resulting from Article 13 GDPR, such as the storage duration of cookies on user end devices. The primary controller under the GDPR for the processing of analytics data is Google.

As the site administrator, we have no other way of evaluating user behavior on our YouTube channel, not even via user tracking. It is also generally not possible for us to identify visitors to our YouTube channel using channel analytics. In addition to any personal data transmitted directly to us by users, depending on the user’s privacy settings, we can see information about their profile, their interaction (e.g. likes or dislikes), their saved and shared videos, their comments and their own videos.

You can see what information Google uses to create channel analytics here.

The operation of the YouTube channel and the use of channel analytics serve our legitimate interest in an effective external presentation and communication with our interested parties. This interest justifies the operation of the site both in relation to the legitimate interests of YouTube and Google users and in relation to visitors to our profile who do not have a YouTube or Google account. The legal basis is therefore Article 6 (1) (f) GDPR.

(5)        TikTok

We have a profile on TikTok. The social media application TikTok is an international video portal. It is operated in Europe by TikTok Technology Limited, a company registered in the Republic of Ireland with its registered office at 10 Earlsfort Terrace, Dublin, D02 T380, Ireland.

You can access TikTok online here.

You can find the TikTok terms of use at https://www.tiktok.com/legal/page/eea/terms-of-service/en.

You can find TikTok’s privacy policy at: https://www.tiktok.com/legal/page/eea/privacy-policy/en.

(a)        Data collected by TikTok

If you are an Instagram user, TikTok collects the data described in the Privacy Policy. If you are not a TikTok user, cookies with identifiers, small text files, may still be stored in your browser, which enable so-called tracking of your user behavior.

As a rule, user data is also processed by TikTok for market research and advertising purposes when you visit TikTok. Complex user profiles are created based on user behavior (including when visiting our TikTok site), which TikTok can use to display personalized advertisements to the visitor inside and outside of TikTok. You can also find more information on this in the privacy policy.

(b)        Data used by us (“Page Insights”) and legal basis:

TikTok provides us with statistics and usage data that we can use to analyze the use of our TikTok page (so-called “TikTok Insights”). This enables us to continuously improve our offer on TikTok. As the operator, we do not make any decisions regarding the processing of Insights data and all other information resulting from Article 13 GDPR, such as the storage duration of cookies on user end devices. The primary responsibility under GDPR for the processing of Insights data lies with TikTok.

As the site administrator, we have no other way of evaluating user behavior on our TikTok site, not even via user tracking. In principle, it is also not possible for us to identify visitors to our TikTok page based on the page insights. In particular, in accordance with the agreement with TikTok, we have no right to demand that TikTok disclose individual visitor data. In addition to any personal data transmitted directly to us by users, we can see information about the user’s profile, likes and posts, depending on the user’s privacy settings.

The operation of the TikTok page serves our legitimate interest in an effective external presentation and communication with our interested parties. This interest justifies the operation of the page both in relation to the legitimate interests of TikTok users and in relation to visitors to our fan page who do not have a TikTok account. The legal basis is therefore Article 6 (1) (f) GDPR.

(1)        Google Analytics

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Ltd, 4 Barrow St, Grand Canal Dock, Dublin 4, D04 V4X7, Ireland, (“Google”). Google Analytics 4 uses “cookies”, which are text files placed on your computer, to help the website analyze how users use the site. The following data is processed for this purpose:

• Pages accessed
• Your behavior on the pages (e.g. length of stay, clicks, scrolling behavior)
• Your approximate location (country and city)
• Your IP address (in abbreviated form, so that no clear assignment is possible)
• Technical information such as browser, internet provider, end device and screen resolution
• Source of origin of your visit (i.e. via which website or advertising medium you came to us)

In principle, your data will be processed in the EU if it is still personal. For the exceptional cases in which personal data is transferred to the USA, Google has submitted to the EU-US Data Privacy Framework, https://www.dataprivacyframework.gov/s/.The personal data transmitted by your browser as part of Google Analytics will not be merged with other Google data.

When Google Analytics 4 is used, the IP is truncated by default, thus excluding any direct personal reference. If the data collected about you is therefore personally identifiable, it is immediately excluded and the personal data is deleted immediately.

We use Google Analytics to analyze and regularly improve the use of our website. We can use the statistics obtained to improve our offer and make it more interesting for you as a user. The legal basis for the processing of your data and the storage of cookies by Google Analytics 4 is your consent in accordance with Article 6 (1) (a) GDPR. You can withdraw or amend this consent at any time. You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by Google by downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en-GB.

(2)        Google Maps

We use Google Maps (API) from Google on our website. Google Maps is a web service for displaying interactive (land) maps in order to visualize geographical information. By using this service, you can see our location and make it easier for you to find us.

By using Google Maps, information about the use of this website, including your IP address and the (start) address entered as part of the route planner function, may be transmitted to Google. When you visit our website and you have consented to the use of Google Maps, your browser establishes a direct connection with Google’s servers. The map content is transmitted by Google directly to your browser, which integrates it into the website.

We have no influence on the scope of the data processed by Google. To the best of our knowledge, this is at least the following data

• Date and time of the visit to the website in question,
• Internet address or URL of the website accessed,
• IP address, (start) address entered as part of route planning.

In principle, your data will be processed in the EU if it is still personal. For the exceptional cases in which personal data is transferred to the USA, Google has submitted to the EU-US Data Privacy Framework, https://www.dataprivacyframework.gov/s/. The personal data transmitted by your browser as part of Google Maps will not be merged with other Google data.

The legal basis for the processing of personal data is your consent in accordance with Article 6 (1) (a) GDPR, which you have given on our website. You can withdraw or amend this consent at any time.

Further information on the purpose and scope of data collection and its processing by the plug-in provider can be found in the provider’s privacy policy. There you will also find further information on your rights in this regard and setting options to protect your privacy: https://policies.google.com/privacy?hl=en&gl=de.

(3)        TikTok Pixel

We use the TikTok Pixel on our website. The TikTok Pixel is a TikTok advertiser tool from TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland (“TikTok”). The TikTok Pixel is a code that enables us to understand and track the activities of visitors to our website. The TikTok pixel collects and processes information about visitors to our website or the devices they use. The data collected via the TikTok Pixel is used to target our advertisements and to improve ad delivery and personalized advertising. For this purpose, the data collected on our website using the TikTok pixel is transmitted to TikTok. Some of this data is information that is stored on the device you are using. In addition, the TikTok Pixel also uses cookies to store information on the device you are using. Such storage of information by the TikTok Pixel or access to information that is already stored on your device only takes place with your consent.

The legal basis for the processing of personal data is therefore your consent in accordance with Article 6 (1) (a) GDPR. You can withdraw or amend this consent at any time.

You can find more information on data protection by TikTok in TikTok’s privacy policy at https://www.tiktok.com/legal/page/eea/privacy-policy/en.

(4)        Newsletter

You can register for a newsletter on our website. We use the platform of our processor [ActiveCampaign LLC, 150 N. Michigan Ave Suite 1230, Chicago, IL, US, USA (“Active Campaign”)]. If a user makes use of this option, the data entered in the input mask will be transmitted to us and stored by [ActiveCampaign]. Apart from the information you enter in the respective input mask (name and e-mail address), no other data is recorded.

In connection with the registration for the newsletter, we pass on the data to [ActiveCampaign], which sends the newsletter on our behalf. No data is passed on to third parties in this context. The data is used for the registration and sending of the newsletter, i.e. the processing of the personal data from the input mask serves us solely for this purpose. Before you are added to the list, you must confirm your registration by clicking on a link in a confirmation e-mail (double opt-in).

The newsletters contain a so-called “web-beacon”, i.e. a pixel-sized file that is retrieved from the [ActiveCampaign] server when the newsletter is opened. As part of this retrieval, technical information, such as information about the browser and your system, as well as your IP address and time of retrieval, is initially collected. This information is used for the technical improvement of the services based on the technical data or the target groups and their reading behavior based on their retrieval locations (which can be determined with the help of the IP address) or the access times.

The statistical surveys also include determining whether the newsletters are opened, when they are opened and which links are clicked. For technical reasons, this information can be assigned to individual newsletter recipients. However, it is neither our intention nor that of [ActiveCampaign] to observe individual users. The evaluations serve us much more to recognize the reading habits of our users and to adapt our content to them or to send different content according to the interests of our users.

The legal basis for the processing of personal data is your consent in accordance with Article 6 (1) (a) GDPR. If you no longer wish to receive this information, you can withdraw your consent at any time by clicking on “Unsubscribe” in the respective newsletter or by sending an email to nederland@hyrox.com and unsubscribing from this mailing list. We will then delete your data from our system immediately. Please note that it may take 1-2 working days for the withdrawal to be noted everywhere in the system. During this period, it is possible that you will receive further newsletters.

In principle, your data will be processed in the EU if it is still personal. For the exceptional cases in which personal data is transferred to the USA, [ActiveCampaign] has submitted to the EU-US Data Privacy Framework, https://www.dataprivacyframework.gov/s/. The personal data transmitted by your browser as part of [ActiveCampaign] will not be merged with other [ActiveCampaign] data.

We have also concluded an data processing agreement with [ActiveCampaign]. You can view this at [https://www.activecampaign.com/legal/dpa]. Where necessary, additional technical and organizational measures are taken if an adequate level of data protection cannot otherwise be guaranteed.

(5)        Ranking

Our website contains a ranking of the results of past events and a leaderboard. These results are recorded by us and our processor [MIKA Timing GmbH, Kürtener Str. 11B, 51465 Bergisch Gladbach, Germany] for all our events. In this ranking, the athletes are ranked according to their results. For this purpose, the name, start number, gym, age group, nationality and times are processed. Apart from this data, no other data is processed for the ranking. No data will be passed on to third parties in this context.

The legal basis for the processing of your data is your consent in accordance with Article 6 (1) (a) GDPR. You can withdraw this consent at any time with effect for the future by sending an email to nederland@hyrox.com Please state your name, the event and your starter number in this email so that we can delete your data. We will then remove you from the ranking immediately. Otherwise, this data will be deleted as soon as it is no longer required for the purpose for which it was collected.

(6)        YouTube

We use the YouTube.com platform to post our own videos and make them publicly accessible. YouTube is a service provided by a third party not affiliated with us, namely Google Ireland Limited, Gordon House, Barrow Street, Dublin, D04 E5W5, Ireland (“YouTube”).

Some of our Internet pages contain links or links to YouTube content. In general, we are not responsible for the content of linked websites. However, in the event that you follow a link to YouTube, we would like to point out that YouTube stores the data of its users (e.g. personal information, IP address) in accordance with its own data usage guidelines and uses it for business purposes.

We also directly integrate videos stored on YouTube on some of our websites. With this integration, content from the YouTube website is displayed in parts of a browser window. However, the YouTube videos are only called up by clicking on them separately. This technique is also known as “framing”. When you call up a (sub)page of our website on which YouTube videos are integrated in this form, a connection to the YouTube servers is established and the content is displayed on the website by notifying your browser.

The integration of YouTube content only takes place in “extended data protection mode”. This is provided by YouTube itself and ensures that YouTube does not initially store any cookies on your device. However, when the relevant pages are accessed, the IP address and the other data mentioned in section 4 are transmitted and thus, in particular, which of our Internet pages you have visited. However, this information cannot be assigned to you unless you have logged in to YouTube or another Google service (e.g. Gmail) before accessing the page or are permanently logged in.

In principle, your data will be processed in the EU if it is still personal. For the exceptional cases in which personal data is transferred to the USA, Google has submitted to the EU-US Data Privacy Framework, https://www.dataprivacyframework.gov/s/. The personal data transmitted by your browser to Google will not be merged with other Google data.

The legal basis for the processing of personal data is your consent in accordance with Article 6 (1) (a) GDPR, which you have given on our website. You can withdraw or amend this consent at any time at [LINK].

As soon as you start the playback of an embedded video by clicking on it, YouTube only stores cookies on your device through the extended data protection mode, which do not contain any personally identifiable data, unless you are currently logged in to a Google service. These cookies can be prevented by making the appropriate browser settings and extensions.

Address and link to YouTube’s privacy policy: https://www.youtube.com/static?template=terms.

(7)        Vimeo

We use the provider Vimeo, operated by Vimeo, Inc., 555 West 18th Street, New York, New York 10011 (“vimeo”), to integrate videos into our website.

When you access videos via vimeo on our website, a connection is established to the vimeo servers in the USA. As a result, certain information is transmitted to vimeo, regardless of whether you have a vimeo account or not. This can be, for example

• Your IP address
• Your browser information, e.g. language settings
• Cookie information about already set vimeo cookies
• Information about the website from which you are accessing vimeo’s site

Insofar as vimeo offers the use of certain additional functions, such as rating or sharing videos, these functions are offered exclusively by vimeo and the respective third-party providers. You should check their privacy policies carefully before using the respective functions. We have no knowledge of the content of the data collected by vimeo or third-party providers and have no influence on their use. This will transmit to the vimeo server which of our Internet pages you have visited. If you are logged in to vimeo as a member, vimeo assigns this information to your personal user account. When you use the plugin, e.g. by clicking the start button of a video, this information is also assigned to your user account. You can prevent this assignment by logging out of your vimeo user account before using our website and deleting the corresponding cookies from vimeo.

vimeo processes personal data in the USA and relies, among other things, on the so-called standard contractual clauses of the European Commission, further information on this can be found at https://vimeo.com/privacy#international_data_transfers_and_certain_user_rights“14.2 GDPR(EEA Users)”.

vimeo may share your data with third parties. These are, for example, affiliated companies, business partners and advertising partners who in turn use tracking technologies on the vimeo website.

Further information on data processing and information on data protection by vimeo can be found at https://vimeo.com/privacy and in the cookie policy at https://vimeo.com/cookie_policy.

The legal basis for the processing of personal data is your consent pursuant to Article 6 (1) (a) GDPR, which you give by clicking on the video.

4.          Cookies and similar technologies

Cookies and similar technologies are used when you visit our website. Cookies are small files that your browser automatically creates and that are stored on your end device (laptop, tablet, smartphone, etc.) when you visit our website and you consent to the cookies in accordance with our cookie banner, or they are technically necessary cookies. Information is stored in a cookie that results in each case in connection with the specific end device used. However, this does not mean that we gain knowledge of your identity. We use the following types of cookies

a)          Essential cookies

Essential cookies are required for the basic functionality of the website. They only contain technically necessary services. You cannot object to these services. We use the following essential cookies:

The data processed by essential cookies are necessary for the functioning of our website, i.e. our legitimate interests pursuant to Article 6 (1) (f) GDPR.

b)          Statistical cookies

We also use statistical cookies from Google Analytics to record and analyze the use of our website. Details on the data processed can be found in section 4 of this privacy policy. The following performance cookies can be set for the functions of Google Analytics:

c)          Marketing cookies

Marketing cookies are used by us and third parties to record the behaviour of individual users, to analyze the collected data and, for example, to display personalized advertising. These services allow us to track users across multiple websites. The following marketing cookies are used on our website:

Functional, performance and marketing cookies are only set if you have consented to their storage. You can manage the cookies set on our website with your consent at any time and have the option to change the acceptance or rejection of cookies. The changes will take effect immediately. If you change your settings and reject cookies, certain functions and features of our website may not work as intended.

Any use of cookies that is not absolutely technically necessary constitutes data processing that is only permitted with your express and active consent in accordance with Article 6 (1) (a) GDPR. This applies in particular to the use of functional, performance and marketing cookies. In addition, we only pass on your personal data processed by cookies to third parties if you have given your express consent in accordance with Article 6 (1) (a) GDPR.

5.          Data erasure and storage duration

Personal data will be deleted or blocked as soon as the purpose of storage no longer applies. Storage may also be necessary if this has been provided for by the European or national legislator in EU regulations, laws or other provisions to which the controller is subject. The data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or fulfillment of a contract. We anonymize data stored for technical reasons after 24 hours and delete it after 7 days at the latest.

6.          Possibility of objection and removal

The user has the option to withdraw their consent to the processing of personal data at any time (see also Rights of data subjects). If the user contacts us by email, they can object to the storage of their personal data at any time. In such a case, the conversation cannot be continued.

The collection of data for the provision of the website and the storage of data in log files is absolutely necessary for the operation of the website. Consequently, the user has no option to object.

7.          Rights of the data subjects

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:

• Right to information about your personal data stored by us (Article 15 GDPR);
• Right to rectification, erasure or restriction of processing of your personal data (Article 16- 18 GDPR);
• Right to object to processing that serves our legitimate interest, a public interest or profiling, unless we can demonstrate compelling legitimate grounds for the processing that outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims (Article 21 GDPR);
• Right to data portability (Article 20 GDPR);
• Right to lodge a complaint with a supervisory authority (Article 77 GDPR). Our responsible supervisory authority is: Floor May, floor.may@priviance.nl
• Right to withdraw your consent to the collection, processing and use of your personal data at any time with effect for the future. You can find more information on this in the respective sections above, where data processing based on your consent is described (Article 7 (3) GDPR).

If you wish to exercise your rights, you can, for example, address your request to the data protection officer named below or send an e-mail to legal@hyrox.com

8.          Name and address of the controller

The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection regulations is the:

SPORTSFITALITY BV

Kerkstraat 45, 1191 JD Ouderkerk aan de Amstel

privacy@houseofsports.nl

https://www.houseofsports.nl/

The controller’s data protection officer is:

Floor May
Floor.may@priviance.nl