• Data protection

Privacy policy

Information about the processing of personal data

In the following, we inform you about the processing of personal data when using our website. Personal data is any information relating to an identified or identifiable natural person, such as surname, first name, address, email address, membership number, user behaviour, etc.

 

I. Name and address of the person responsible

The responsible party within the meaning of the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection regulations is the:
ADAC Südbayern e. V.
Ridlerstr. 35
80339 Munich
Germany
Tel.: 089 - 5195 116
E-Mail: info@mitropa-rally-cup.com
Website: https://mitropa-rally-cup.com

II. Name and address of the data protection officer

The data protection officer of the responsible is:

ADAC Südbayern e.V.
Datenschutzbeauftragter

Ridlerstr. 35
80339 München
Deutschland
E-Mail: dsb-mail @ sby.adac.de

III. General

1. Scope of the processing of personal data

As a matter of principle, we only process the personal data of our users to the extent that this is necessary for the provision of a functioning website, for the services offered and for the content.

2. legal basis for the processing of personal data

The basis for the processing of personal data are legal regulations and / or a consent of the user.

Insofar as we obtain the consent of the data subject for processing operations of personal data, Art. 6 (1) lit. a EU General Data Protection Regulation (DSGVO) serves as the legal basis for the processing of personal data.

When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Art. 6 (1) (b) DSGVO serves as the legal basis. This also applies to processing operations that are necessary for the performance of pre-contractual measures.

Insofar as the processing of personal data is necessary for the fulfilment of a legal obligation to which our company is subject, Art. 6 (1) c DSGVO serves as the legal basis.

In the event that vital interests of the data subject or another natural person make processing of personal data necessary, Art. 6 (1) (d) DSGVO serves as the legal basis.

If the processing is necessary to protect a legitimate interest of our company or a third party and the interests, fundamental rights and freedoms of the data subject do not outweigh the first-mentioned interest, Art. 6 (1) lit. f DSGVO serves as the legal basis for the processing.

3. Data deletion and storage period

The personal data will be deleted or blocked as soon as the purpose of the storage no longer applies. Storage beyond this may take place if a longer storage period is provided for in European or national regulations, laws or other provisions. Storage periods prescribed in these standards will be observed and data will be blocked or deleted unless the continued storage of the data is necessary for the conclusion or fulfilment of a contra

IV. Processing of personal data when you visit our website and creation of log files

Whenever you visit our website, our system automatically collects data and information from the computer system of the computer you are using for this purpose.

1. Legal basis

The legal basis for the temporary storage of the data and the log files is Art. 6 para. 1 lit. f DSGVO.

2. Description and scope of data processing

In the case of mere informational use of the website, i.e. if you do not register or otherwise transmit information to us, we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure its stability and security:

Apache web server
Data is stored in the log files of the web server each time the website is accessed. The data is needed to ensure the operation and to analyse attacks on the website. The data is deleted after 3 days. The following data is stored: : 

  1. IP address
  2. Date and time of the request
  3. Time zone difference to GMT
  4. Content of the web page
  5. Access status (HTTP status)
  6. Amount of data transferred
  7. Website from which you came to our website
  8. Web browser
  9. Operating system
  10. Language and version of the browser



FTP/SFTP server

Data is stored in the log files of the FTP/SFTP server for each access. The data is deleted after 30 days. The following data is stored:

  1. IP address
  2. User name of the user
  3. Date and time of the request
  4. Time zone difference to GMT
  5. Information whether a file was downloaded or uploaded
  6. Path and file name of the transferred file
  7. Transferred data menu


SSH access
Data is stored in the log files of the terminal service when logging in. This data is deleted after 3 days. The following data is stored:

  1. IP address
  2. Username of the user
  3. Date and time of the request


Apache Error Log
In the event of an error, messages from the Apache web server are stored in log files. This data is deleted after 30 days at the latest. The following data is stored:

  1. IP address
  2. Date and time of the error
  3. Error code
  4. Error message in text form


MySQL Error Log 
In case of an error, messages from the MySQL database server are stored in log files. This data is deleted after 30 days at the latest. The following data is stored:

  1. IP address
  2. Date and time of the error
  3. Name of the database used
  4. Error code
  5. Error message in text form, if applicable including the database query used


Mail server log
Metadata is stored in the log files of the mail servers and deleted after 3 days. The following data is stored:

  1. Sender
  2. Recipient
  3. Time of sending
  4. IP address of the sender
  5. Size of the e-mail

This data is not stored together with other personal data of yours.

The log files are not stored in the customer account. The IP address is anonymised in the FTP log files and in the log of the customer menu.

3. purpose of data processing

The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session.

The storage in log files is done to ensure the functionality of the website. In addition, we use the data to optimise the website and to ensure the security of our information technology systems. An evaluation of this data for marketing purposes does not take place in this context.

These purposes also result in our legitimate interest in data processing in accordance with Art. 6 Para. 1 lit. f DSGVO.

4 Duration of storage

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of the collection of data for the provision of the website, this is the case when the respective session has ended.

In the case of storage of data in log files, this is done in accordance with section IV, point 2. Storage beyond this is possible. In this case, the IP addresses of the users are deleted or alienated, so that an assignment of the calling client is no longer possible.

5. possibility of objection and removal

The collection of data for the provision of the website and the storage of the data in log files is absolutely necessary for the operation of the website. Consequently, there is no possibility for the user to object.

V. Use of cookies

Our website uses cookies. In addition to the previously mentioned data, cookies are therefore stored on your computer when you use our website. Cookies are text files that are stored in the Internet browser or by the Internet browser on the user's computer system when a website is called up, and which provide the party setting the cookie (in this case us) with certain information. Cookies contain a characteristic string of characters that enables the browser to be uniquely identified when the website is called up again. Cookies cannot execute programs or transmit viruses to your computer.

1. Legal basis

The legal basis for the processing of personal data using technically necessary cookies is Art. 6 para. 1 lit. f DSGVO.

The legal basis for the processing of personal data using cookies for analysis purposes (see section VIII. Use of web analysis tools) is Art. 6 para. 1 lit. a DSGVO if the user has given his consent in this regard.

2. Description and scope of data processing

This website uses the following types of cookies, the scope and functionality of which are explained below:

- Transient cookies (for this purpose a))

- Persistent cookies (see b))

a) Transient cookies include, in particular, session cookies. These store a so-called session ID, with which various requests of your browser can be assigned to the common session. This enables your computer to be recognised when you return to our website.

b) Persistent cookies have a longer shelf life and are automatically deleted after a specified period of time, which may vary depending on the cookie.

c) Furthermore, we use HTML5 storage objects that are stored on your terminal device. These objects store the required data independently of the browser you are using and have no automatic expiry date.

3. purpose of data processing

Cookies serve to make the Internet offer more user-friendly and effective overall. The purpose of using technically necessary cookies is to simplify the use of websites for users. Some functions of our website cannot be offered without the use of cookies, as these require the browser to be recognised even after a page change. We use cookies to identify you for subsequent visits if you have an account with us. Otherwise you would have to log in again for each visit.

Analysis cookies are used to improve the quality of our website and its content. Through analysis cookies, we learn how the website is used and can thus continuously improve our offer. For example, we can expand our offer on topics viewed by a large number of users and concentrate on these. If we recognise from the analysis that some topics are not of great interest, we can reduce our efforts in these areas and concentrate on the topics that are more interesting for the users.

These purposes also result in our legitimate interest in data processing according to Art. 6 (1) lit. f DSGVO.

4 Duration of storage

a) Transient cookies are automatically deleted when you close the browser. Session cookies belonging to the transient cookies are deleted when you log out or close the browser.

b) Persistent cookies remain on the hard disk even after you close the page and are automatically deleted after a predefined period of time, which may differ depending on the cookie.

5. objection and removal options

As a user, you have full control over the use of cookies. You can configure your browser settings according to your wishes and, for example, refuse or restrict the acceptance of third-party cookies or all cookies. Cookies that have already been stored can be deleted at any time in the security settings of your browser - also automatically.

Please note that in these cases you may not be able to use all the functions of this website.

You can prevent the use of HTML5 storage objects by setting your browser to private mode. We also recommend that you regularly delete your cookies and browser history manually.

VI. Contacting us: e-mail contact

An e-mail address is available on our website for contacting us.

1 Legal basis

The legal basis for the processing of data is Art. 6 para. 1 lit. a DSGVO if the user has given his consent.

The legal basis for the processing of data transmitted in the course of sending an e-mail is Art. 6 para. 1 lit f DSGVO. If the e-mail contact aims at the conclusion of a contract, the additional legal basis for the processing is Art. 6 para. 1 lit. b DSGVO.

2 Description and scope of data processing

E-mail messages can be used for electronic contact. The e-mail address and other information entered by you will be used and stored exclusively for processing the transaction.

3 Purpose of data processing

In the case of contacting us by e-mail, this also constitutes the necessary legitimate interest in processing the data.

These purposes also result in our legitimate interest in data processing according to Art. 6 Para. 1 lit. f DSGVO.

4 Duration of storage

The data will be deleted as soon as they are no longer required to achieve the respective purpose of their collection. For personal data sent by e-mail, this is the case when the respective conversation with the user has ended. The conversation is terminated when it can be inferred from the circumstances that the matter in question has been conclusively clarified.

5 possibility of objection and removal

You have the option to revoke your consent to the processing of personal data at any time. You can object to data processing in the context of e-mail contact at any time with immediate effect. However, we will then no longer be able to process your request and continue the conversation.

The revocation should be sent to: sport@sby.adac.de

All personal data stored in the course of contacting you will be deleted in this case, unless there are legal retention periods that we must observe regardless of a revocation.

VII. Use of web analysis tools (web analytics)

The use of web analytics tools serves to analyse the surfing behaviour of our users and to improve our website on a regular basis.

A.     Use of Matomo (formerly Piwik)

We use the open source software tool Matomo (formerly PIWIK) on our website to analyse the surfing behaviour of our users.

1 Legal basis

The legal basis for the use of Matomo is Art. 6 para. 1 p. 1 lit. f DSGVO.

2 Description and scope of data processing

For this evaluation of surfing behaviour, cookies (see section V. for more details) are stored on your computer. The information collected in this way is stored by the responsible party exclusively on its server in Germany.

This website uses Matomo with the extension "AnonymizeIP". This means that IP addresses are processed in abbreviated form, which means that they cannot be directly linked to a person. The IP address transmitted by your browser via Matomo is not merged with other data collected by us.

The Matomo programme is an open source project. Information from the third-party provider on data protection is available at matomo.org/privacy-policy/.

3 purpose of data processing

This website uses the web analysis service Matomo to analyse and regularly improve the use of our website. The statistics obtained enable us to optimise our offer and make it more interesting for you as a user.

These purposes also result in our legitimate interest in data processing according to Art. 6 Para. 1 lit. f DSGVO.

4 Duration of storage

The data is deleted as soon as it is no longer required for our recording purposes. In our case, this is the case after 90 days.

5 possibility of objection and removal

You can adjust the evaluation by deleting existing cookies and preventing the storage of cookies by changing the settings in your internet browser accordingly. If you prevent the storage of cookies, we would like to point out that you may not be able to use this website to its full extent. You can prevent the storage of cookies by changing the settings in your browser. Preventing the use of Matomo is possible by removing the following tick and thus activating the opt-out plug-in:

VIII Social Plugins, Google AdWords and use of Youtube

1. social plugins

Our online platform contains plugins from social networks such as Facebook, Google+, Twitter, etc. (so-called social plugins). (so-called third-party portals) are integrated (so-called social plugins). This gives you the opportunity to share information that you find interesting on our online platform more easily with your friends and connections on the respective third-party portal. The terms of use and data protection of the respective portals apply to the use of the third-party portals.

Only if you actively and voluntarily use the function, i.e. click on the plug-in, can data about your respective online platform use be retrieved from the relevant third-party portal via the social plug-in. The legal basis is therefore your consent to the provider of the third-party portal, Art. 6 para. 1 lit. a DSGVO. The provider of this portal ("portal operator") has also provided you with data protection information during your registration with details of which data it processes for which purposes when using the social plug-in. We ourselves do not transmit any information that enables your person to be directly identified. Insofar as we receive data from the provider of the third-party portal, this is only aggregated and does not allow any reference to a person.

In accordance with Art. 7 (3) DSGVO, you have the right to revoke your consent at any time with effect for the future. To do so, simply click on the social plugin to deactivate the corresponding function.

The third-party portals are not offered by us, but by the respective portal operators. They are responsible for their portals and process data there on the basis of their terms of use. If you use these third-party portals, you must therefore accept them each time you register. The terms of use of the third-party portals also contain information about which data is transferred to us via so-called social plug-ins when you use these functions on a page outside the third-party portal and thus also on our portal. You can find out more about the data protection conditions of the third-party portals on our online platform here:

Facebook privacy terms

Youtube privacy policy

Google+ privacy policy

Twitter privacy policy

2. tracking via the provider Google AdWords

As an AdWords customer, we use Google Conversion Tracking, an analysis service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google AdWords sets a cookie on your computer ("conversion cookie") if you have accessed our website via a Google ad. These cookies lose their validity after 30 days and are not used for personal identification. If you visit certain pages of ours and the cookie has not yet expired, we and Google can recognise that someone has clicked on the ad and thus been redirected to our site. Each AdWords customer receives a different cookie. Cookies can therefore not be tracked across AdWords customers' websites. The information obtained using the conversion cookie is used to create conversion statistics for AdWords customers who have opted for conversion tracking. The AdWords customers learn the total number of users who clicked on their ad and were redirected to a page tagged with a conversion tracking tag. However, they do not receive any information with which users can be personally identified. If you do not wish to participate in the tracking process, you can also refuse the setting of a cookie required for this - for example, via a browser setting that generally deactivates the automatic setting of cookies. You can also deactivate cookies for conversion tracking by setting your browser to block cookies from the googleadservices.com domain.

Right to object to data collection via Google services: By using this website, you consent to the processing of data about you by Google in the manner and for the purposes set out above. We would like to point out once again that the data collected in connection with web controlling technologies will not be used by us to personally identify users of the ADAC website.

However, you can adjust the ad settings for ads in Google Search at any time or deactivate them completely. You can find more information on this here:

www.google.com/settings/ads/

Alternatively, you can disable the use of cookies by third parties by visiting the Network Advertising Initiative's disable page:

www.networkadvertising.org/choices/Erfahren to learn more about Google Advertising Privacy Policy:

www.google.de/policies/technologies/ads/

and the general privacy policy of Google services:

www.google.de/policies/privacy/

3. use and application of YouTube

The controller has integrated YouTube components on this website. YouTube is an Internet video portal that allows video publishers to post video clips free of charge and other users to view, rate and comment on them, also free of charge. YouTube allows the publication of all kinds of videos, which is why complete film and television programmes, but also music videos, trailers or videos made by users themselves can be accessed via the internet portal.

The operating company of YouTube is YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA. YouTube, LLC is a subsidiary of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Each time one of the individual pages of this website operated by the data controller is called up and on which a YouTube component (YouTube video) has been integrated, the internet browser on the information technology system of the data subject is automatically caused by the respective YouTube component to download a representation of the corresponding YouTube component from YouTube. Further information on YouTube can be found at www.youtube.com/yt/about/de/. Within the scope of this technical procedure, YouTube and Google receive information about which specific sub-page of our website is visited by the data subject.

If the data subject is logged into YouTube at the same time, YouTube recognises which specific sub-page of our website the data subject is visiting when a sub-page containing a YouTube video is called up. This information is collected by YouTube and Google and assigned to the respective YouTube account of the data subject.

YouTube and Google always receive information via the YouTube component that the data subject has visited our website if the data subject is logged into YouTube at the same time as calling up our website; this takes place regardless of whether the data subject clicks on a YouTube video or not. If the data subject does not want this information to be transmitted to YouTube and Google, he or she can prevent the transmission by logging out of his or her YouTube account before accessing our website.

The data protection provisions published by YouTube, which can be accessed at www.google.de/intl/de/policies/privacy/, provide information on the collection, processing and use of personal data by YouTube and Google.

IX. Rights of the data subject

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:

1. right to information

You may request confirmation from the controller as to whether personal data concerning you is being processed by us.

If there is such processing, you may request information from the controller about the following:

  1. The purposes for which the personal data are processed;
  2. the categories of personal data which are processed;
  3. the recipients or categories of recipients to whom the personal data concerning you have been or will be disclosed;
  4. the planned duration of the storage of the personal data relating to you or, if specific information on this is not possible, criteria for determining the storage period;
  5. the existence of a right to obtain the rectification or erasure of personal data concerning you, a right to obtain the restriction of processing by the controller or a right to object to such processing;
  6. the existence of a right of appeal to a supervisory authority;
  7. any available information on the origin of the data if the personal data is not collected from the data subject;
  8. the existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) of the GDPR and, at least in these cases, meaningful information about the logic involved and the scope and intended effects of such processing for the data subject.

You have the right to request information on whether personal data concerning you are transferred to a third country or to an international organisation. In this context, you may request to be informed about the appropriate safeguards pursuant to Article 46 of the GDPR in connection with the transfer.

2. right of rectification

You have a right to rectification and/or completion vis-à-vis the controller if the personal data processed concerning you are inaccurate or incomplete. The controller must make the rectification without undue delay.

3. right to restriction of processing

You may request the restriction of the processing of personal data concerning you under the following conditions:

  1. if you contest the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy of the personal data;
  2. the processing is unlawful and you object to the erasure of the personal data and request instead the restriction of the use of the personal data;
  3. the controller no longer needs the personal data for the purposes of the processing but you need them for the establishment, exercise or defence of legal claims; or

if you have objected to the processing pursuant to Article 21(1) DSGVO and it has not yet been determined whether the controller's legitimate grounds override your grounds.

If the processing of personal data relating to you has been restricted, such data may - apart from being stored - only be processed with your consent or for the assertion, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or a Member State.

If the restriction of processing has been restricted in accordance with the above conditions, you will be informed by the controller before the restriction is lifted.

4. right to erasure

a) Obligation to delete

You may request the controller to erase the personal data concerning you without undue delay and the controller is obliged to erase such data without undue delay if one of the following reasons applies:

  1. The personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed.
  2. You withdraw your consent on which the processing was based pursuant to Art. 6 (1) (a) or Art. 9 (2) (a) DSGVO and there is no other legal basis for the processing.
  3. You object to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) of the GDPR.
  4. The personal data concerning you have been processed unlawfully.
  5. The erasure of the personal data concerning you is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject.
  6. The personal data concerning you has been collected in relation to information society services offered pursuant to Article 8(1) of the GDPR.

b) Information to third parties

If the controller has made the personal data concerning you public and is obliged to erase it pursuant to Article 17(1) of the GDPR, it shall take reasonable steps, including technical measures, having regard to the available technology and the cost of implementation, to inform data controllers that process the personal data that you, as the data subject, have requested them to erase all links to, or copies or replications of, that personal data.

c) Exceptions

The right to erasure does not apply to the extent that the processing is necessary

  1. for the exercise of the right to freedom of expression and information;
  2. for compliance with a legal obligation which requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
  3. for reasons of public interest in the area of public health pursuant to Art. 9(2)(h) and (i) and Art. 9(3) DSGVO;
  4. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Art. 89(1) DSGVO, insofar as the right referred to in section a) is likely to render impossible or seriously prejudice the achievement of the purposes of such processing; or
  5. for the assertion, exercise or defence of legal claims.

5. right to information

If you have asserted the right to rectification, erasure or restriction of processing against the controller, the controller is obliged to inform all recipients to whom the personal data concerning you have been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort.

You have the right to be informed of these recipients by the controller.

6. right to data portability

You have the right to receive the personal data concerning you that you have provided to the controller in a structured, common and machine-readable format. You also have the right to transfer this data to another controller without hindrance from the controller to whom the personal data was provided, provided that

  1. the processing is based on consent pursuant to Art. 6 (1) a DSGVO or Art. 9 (2) a DSGVO or on a contract pursuant to Art. 6 (1) b DSGVO and
  2. the processing is carried out with the help of automated procedures.

In exercising this right, you also have the right to have the personal data concerning you transferred directly from one controller to another controller, insofar as this is technically feasible. This must not affect the freedoms and rights of other persons.

The right to data portability does not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
 

7. right of objection

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6(1)(e) or (f) DSGVO; this also applies to profiling based on these provisions.

The controller shall no longer process the personal data concerning you unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the purpose of asserting, exercising or defending legal claims.

If the personal data concerning you is processed for the purposes of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purposes of such marketing; this also applies to profiling insofar as it is related to such direct marketing.

If you object to the processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.

You have the possibility, in connection with the use of information society services, notwithstanding Directive 2002/58/EC, to exercise your right to object by means of automated procedures using technical specifications.

8. right to revoke the declaration of consent under data protection law

You have the right to revoke your declaration of consent under data protection law at any time. The revocation of the consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

9 Automated decision-making in individual cases including profiling

You have the right not to be subject to a decision based solely on automated processing - including profiling - which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

  1. is necessary for the conclusion or performance of a contract between you and the controller,
  2. is permitted under Union or Member State legislation to which the controller is subject and that legislation contains appropriate measures to safeguard your rights and freedoms and your legitimate interests, or
  3. is done with your explicit consent.

However, these decisions must not be based on special categories of personal data pursuant to Art. 9(1) of the GDPR, unless Art. 9(2)(a) or (g) applies and appropriate measures have been taken to protect the rights and freedoms and your legitimate interests.

With regard to the cases referred to in (1) and (3), the controller shall take reasonable steps to safeguard the rights and freedoms as well as your legitimate interests, including at least the right to obtain the intervention of a person on the part of the controller, to express his or her point of view and to contest the decision.

10. right to complain to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

The supervisory authority to which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy under Article 78 GDPR.

X. Service provider

In some cases, we use external service providers who have been carefully selected and commissioned by us to process this data. These service providers are bound by our instructions. We will inform you in detail about the respective processes below. In doing so, we will also state the defined criteria for the storage period.

We use the following service providers to operate the website:

jweiland.net 
Echterdinger Street 57
70794 Filderstadt near Stuttgart 

Furthermore, we use service providers for the following purposes:

- Support and maintenance of the website/ DP services