IBU Privacy Policy

IBU PRIVACY POLICY

DATA PROTECTION INFORMATION PURSUANT TO ART. 13, 14 GDPR

The following entity is the data controller for the data processings occurring on the IBU Platforms (as defined below) in accordance with Art. 4 No. 7 of the General Data Protection Regulation (“GDPR”):

International Biathlon Union Sonystraße 20 5081 Anif (Salzburg) Austria

Represented by Max Cobb

The International Biathlon Union (“IBU” or “we”, “us” and “our”) takes your privacy seriously and understands the importance of maintaining the confidentiality of your personal data and other information stored about you. In particular, IBU is committed to observing its obligations under the GDPR. For this purpose, in order to provide you with the required information concerning the processing of your personal data, IBU has prepared this document (“Privacy Policy”).

The terms used in this Privacy Policy have the meaning ascribed to them in the GDPR (in particular its Art. 4), unless explicitly defined otherwise herein.

The Privacy Policy is available at any time on IBU Platforms (as defined below) and may be amended from time to time. We shall place an updated version on the applicable page of the respective IBU Platforms (as defined below). The respective IBU Platform (as defined below) may also provide notices of changes to this Privacy Policy or other matters by displaying notices or links to notices to you.

You are responsible for regularly reviewing this Privacy Policy. IBU reserves the right to change this Privacy Policy at any time without prior notice to you. In case IBU changes in material way any processing activities concerning your data for which IBU has obtained your consent, IBU will ask you for your consent in respect to the new processing activity.

Date of issue of the latest version of this Privacy Policy: 11/2021

1. WHAT THIS PRIVACY POLICY COVERS

This Privacy Policy applies to IBU’s processing of your personal data when you visit or use any website, app or service operated by IBU which links to or presents this Privacy Policy (jointly the “IBU Platforms” and each an “IBU Platform”). Personal data means any information which relates to an identified or identifiable data subject, ie the natural person to whom the data relates. Your personal data therefore includes any information which can be related to you directly or indirectly, such as a name, identification number, your registered account or an online ID such as an IP address.

2. THE PERSONAL DATA WE COLLECT FROM YOU

IBU collects and processes personal data in respect of your use of and interactions with the IBU Platforms. The types of Personal Data we may collect and process vary from Platform to Platform but can be summarised as follows:

§ Identity data, which includes given name, middle name, last name, username or similar identifier, date of birth, gender and locale.

§ Contact data, which includes email address or social media identifier (nickname or similar).

§ Technical data, which includes internet protocol (IP) address, your login data, the referring website, your preferred language, browser type and version, time zone setting, your location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access IBU Platforms.

§ Profile data, which includes your username and password for any IBU Platform as well as your interests, preferences, location, date of birth and gender.

§ Usage data, which includes information about how you use IBU Platforms, such as screen captures and diagnostic logs.

§ Marketing and communications data, which includes your preferences in receiving marketing from us and our third parties and your communication preferences.

§ Cookie and device data, which includes data collected by cookies used by IBU Platforms, the details of which can be found in section 4.

§ Submitted data, which includes any information you may provide to us, for example photographs and competition entries.

3. HOW WE COLLECT YOUR PERSONAL DATA

We collect your personal data in a number of ways as described below.

3.1 Information you give to us directly

We collect information on you where you:

§ register for an account with us (including via social media profiles such as Facebook) or log in and make changes to your online account;

§ register to receive marketing communications from us;

§ enter into a competition on IBU Platforms;

§ interact with our social media profiles; and

§ contact us (including via email or social media messaging).

3.2 Personal data we collect automatically

IBU also automatically receives and records non-sensitive information on its technical infrastructure logs about your device when you visit IBU Platforms, regardless of whether you have registered for an account or not by just browsing our servers. This includes technical data and usage data referred to in section 2 above.

IBU also further collects certain data by use of cookies on IBU Platforms. Please refer to section 4 for more details in relation to our use of cookies.

4. COOKIES

When you visit IBU Platforms, information relating to the pages you look at may be saved in so-called cookies that are stored on the device that you use to access the IBU Platforms, or using similar technologies such as tracking pixels.

4.1 What is a cookie?

Cookies are text files that may – depending on your settings – be stored on the hard drive of your device (be it a computer, tablet, mobile phone or any other device that can access the internet) when you visit a website or click on an advertisement. Cookies are used to identify the device on which they are saved and are operational for a limited period of time.

4.2 Why do we use cookies?

There are four different types of cookies that may be saved on your device while browsing the IBU Platforms. The intended purpose of each is described below:

4.2.1 Essential cookies

Essential cookies help make the IBU Platforms work by enabling basic functions required to navigate the website, access secure areas, authenticate logins and use contact forms, as well as other enhanced functionalities. This type of operational cookie cannot be disabled. You can set your browser to block or alert you to them, but if you block their use some parts of the IBU Platforms will not work.

4.2.2 Personalisation cookies

Session-based personalisation cookies allow the IBU Platforms to link your actions during a particular browser session. These cookies expire each time you close your browser and do not remain on your device afterwards.

Persistent personalisation cookies are stored on your device in between browser sessions. They are used to remember your preferences or actions across IBU Platforms, such as items between the IBU website and app. These cookies remain on your device until they expire or you delete them.

4.2.3 Analysis cookies

Analysis cookies allow us to count visits and traffic sources, so we can measure and improve the performance of the IBU Platforms. They help us know which pages are the most and least popular, and show us how visitors move around the site. If you do not allow these cookies we will not know when you have visited IBU Platforms and will not be able to monitor their performance.

4.2.4 Targeting/advertising cookies

Targeting cookies may be sent through the IBU Platforms by our advertising partners, to help them build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

4.3 What are tracking pixels?

In addition to the four types of cookie described above, the IBU Platforms may use so-called tracking pixels to monitor the effectiveness of various elements of the IBU Platforms (including advertising elements). Tracking pixels are very small 1x1 pixel images integrated into the code of the IBU Platforms.

When you visit IBU Platforms, tracking pixels send a limited amount of information to the pixel server. This information is used only for statistical purposes in relation to (i) the number of different users of the IBU Platforms; (ii) the number and type of pages visited; and (iii) the effectiveness of advertising strategies. The information collected may include, for example, match locations browsed, match dates browsed, ticket categories browsed, your browser language, your IP address and your location data (for example, country of residency).

4.4 How do I manage cookies?

The Cookie Preference Centre can be used to customise your cookie preferences at any time according to your needs and preferences. This tool records your consents and specifically controls the performance and targeting cookies activated when using the IBU Platforms.

If you wish to restrict or block the use of cookies in general, you can configure your browser to display a warning message each time a cookie is about to be stored, or you can block all cookies. You can also manually delete any cookies already sent through your browser.

For ease of navigation, IBU recommends that you accept cookies on IBU Platforms and do not delete them. Otherwise, some of the features of the IBU Platforms may not display or function properly.

5. HOW DO WE PROCESS YOUR PERSONAL DATA

The personal data we hold on you will be used for a number of purposes depending on the IBU Platform as explained below. Under data protection laws we have to have a lawful basis for processing your personal data. In this section, we will describe how we use your personal data, namely (i) for what purposes and (ii) under what legal basis.

5.1 Providing IBU Platforms

We will process your personal data, including specifically technical data and profile data, to operate the IBU Platforms, including addressing technical errors and defend the respective IBU Platform from abuse and technical attacks, and provide you with access to IBU Platforms. This data processing is based on our legitimate interest to operate IBU Platforms, as well as on the necessity to fulfil our contractual obligations if we agree to provide you with access to the parts of IBU Platforms subject to registration.

5.2 Marketing and Communications

We will process your personal data, including specifically your identity data, contact data, and marketing and communications data, to send you marketing and other communications concerning IBU, IBU events etc., as well as marketing and other communication on behalf of our partners and sponsors, concerning their organisation, businesses and events organized by them. This data processing is based on your consent, which we will ask from you separately (e.g. when you register to receive marketing communication from us). You may withdraw your consent at any time for the future by contacting us (please see section 9 for contact details).

5.3 Competitions

We may process your personal data, including specifically your identity data and contact data, to manage your participation in any competition we organize and you decide to enter. This data processing is based on the necessity to fulfil our contractual obligations under the terms of the respective competition.

5.4 Data collected by cookies

We will use the data collected by cookies for the following purposes:

§ Essential cookies: to optimize the respective IBUPlatform for easy use, address any technical errors, defend the respective IBU Platform from abuse and technical attacks, access secure areas, authenticate logins and use contact forms, as well as other enhanced functionalities.

§ Personalisation cookies: to provide you a better user experience by linking your actions during a particular browser session and remembering your preferences or actions across IBU Platforms.

§ Analysis cookies and tracking pixels: to count visits and traffic sources and compile statistics on features popularity and the kinds of software and computers visitors use, so we can measure and improve the performance of the IBU Platforms.

§ Targeting/advertising cookies and tracking pixels: to identify your device to provide you personalized advertising and track the effectiveness of such advertising.

Our use of essential cookies is based on our legitimate interests to operate the IBU Platforms effectively. For using all other cookies as well as tracking pixels and any similar technologies on your device, we ask for your permission (consent). There is a notice on IBU Platforms that describes how we use cookies and requests your consent to place cookies on your device. You may revoke this consent at any time in the Cookie Preference Centre or by deleting cookies in your browser, either manually or by configuring your browser to delete cookies automatically (eg whenever it is closed). Please refer to section 4.4 for more information.

6. WITH WHOM DO WE SHARE YOUR PERSONAL DATA

We may share your personal data with the parties set out below for the purposes set out as follows:

§ With internal departments and external third parties who perform functions on our behalf and who also provide services to us, such as professional advisors, technology providers and hosting companies; advertising companies and exchanges; analytics companies; payment providers. The purposes for such data sharing will be limited to the provision of their respective services and is based on our legitimate interest to obtain such services.

§ With external third-party advertisers (such as Facebook or Google) for the purposes of helping us identify customers similar to our audience or to serve relevant adverts to you on third party websites. The information shared with these advertisers is pseudonymised to protect your personal data. This sharing is based on your consent given through your cookies consent, which may be revoked at any time. Please see sections 4 and 5.4 for more details.

§ With police and state authorities, in particular in case of any investigations or disclosure requests pursuant to orders or court warrants. This sharing is based on our legal obligations pursuant to the relevant applicable laws.

§ With our partners and sponsors, concerning the marketing and other communication we would be sending to you on their behalf. This sharing is based on your consent, which may be revoked at any time.

Your personal data is generally stored within the EEA, but in limited circumstances may be transferred to suppliers located outside EEA. In such cases, we will have put in place adequate measures to offer equivalent protection as your personal data would receive within the EEA and in compliance with applicable data protection laws. If you wish to obtain more information about the locations in which your personal data may be shared and the specific measures to protect your personal data, please contact us at any time (please see section 9 for contact details).

7. HOW LONG WE RETAIN YOUR PERSONAL DATA

Your personal data will be retained as long as necessary to fulfil the respective purpose for which it was collected, and will be deleted as soon as it is no longer necessary to achieve that purpose. In the case of data collection for provision of the IBU websites, this will be undertaken once the respective session has ended. The IP address of the user must remain stored for the duration of the session in order to enable use of the website.

8. WHAT ARE YOUR RIGHTS

By law, you have a number of rights (subject to certain conditions) when it comes to your personal data, as described in this section 8. Further information and advice about your rights can be obtained from the data protection regulator in your country.

8.1 Your right to object to processing

You have the right to object to certain types of processing, including processing for direct marketing (i.e. if you no longer want to be contacted with potential offers or opportunities). Unsubscribing from newsletters and e-mail marketing communications can most easily be done by clicking on the unsubscribe link at the bottom of any e-mail newsletter we have sent to you or, alternatively, by modifying your account settings and preferences. You may also object by contacting us via the contact data provided in section 9.

You may also object to any data processing based on our legitimate interests, on grounds relating to your particular situation. Please note however that we may be able to continue the processing in this case if we can demonstrate compelling legitimate grounds for the processing which override our interests.

8.2 Your right to be informed

You have the right to be provided with clear, transparent and easily understandable information about how we use your personal data and your rights. This is why we are providing you with the information in this Privacy Policy.

8.3 Your right to access your personal data

You have the right to request confirmation from us about whether we process your personal data, and if that is the case, obtain access to your personal data, as well as certain other information (similar to that provided in this Privacy Policy).

8.4 Your right to update and rectification

You are entitled to have your personal data corrected if it is inaccurate or incomplete.

You are able to review, correct or update some of your personal data at any time by accessing your account on the IBU Platforms where it has been created. However, you may choose to send us a written request to do so on your behalf at any time.

8.5 The right to erasure (the “right to be forgotten”)

You may request the deletion or removal of your personal data and accounts you create where there is no compelling reason for us to keep using it. This is not a general right to erasure, but may rather be requested only in following cases:

§ The personal data is no longer necessary for the purposes for which it was collected and/or processed.

§ You have withdrawn your consent for the processing of personal data, and there is no other legal basis to justify the processing.

§ You have successfully objected to our processing of your personal data (as detailed in section 8.1 above) and (in case of processing on the basis of our legitimate interests) there are no overriding legitimate grounds for the processing.

§ Your personal data was unlawfully processed.

§ The deletion of your personal data is necessary to fulfil a legal obligation under EU law or the law of the Member States to which we are subject.

§ You are under 14 years old and your personal data has been collected based on your consent.

This right is further subject to exceptions, in which case we may still be entitled to retain your data. This is in particular the case if we exercise our right to the freedom of expression and information, for reasons of public interest in the field of public health, or if we need your data to establish or exercise our legal claims or defend against others’ legal claims.

8.6 Your right to restrict processing

You have rights to request that the processing of your personal data is restricted. When processing is restricted, we can still store your personal data, but will not use it further. This right is available to you:

§ if you contest the accuracy of your personal data, for a period which enables us to verify the accuracy of such data;

§ if the processing is unlawful but you refuse to have the personal data deleted and instead request a restriction on the use of the personal data;

§ if we no longer need the personal data for the purposes of processing, but the you need it to assert, exercise, or defend against legal claims, or

§ if you object to processing and it is not yet clear whether our justified reasons outweigh your reasons for objection.

8.7 Your right to data portability

You have rights to obtain and reuse your personal data for your own purposes across different services and the right to obtain your personal data in a structured, common, and machine-readable format. You may also request us that your personal data are transferred directly from us to another responsible party, insofar as this is technically feasible. The freedoms and rights of other persons must not be affected by this.

8.8 Your right to lodge a complaint

You have the right to lodge a complaint about the way IBU handles or processes your personal data with your national data protection regulator by contacting the applicable data protection regulator directly. In Austria, this is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), www.dsb.gv.at, Barichgasse 40-42, 1030 Vienna, Phone: +43 1 52 152-0, E-Mail: dsb@dsb.gv.at.

8.9 Your right to withdraw consent

If you have given us your consent to anything we do with your personal data, you have the right to withdraw your consent at any time, with effect for the future. This includes your right to withdraw consent to us using your personal data for marketing purposes.