Version of: 26/09/2018
Introduction
Since the entry into force of the General Data Protection Regulation (GDPR), all persons within the European Economic Area (EEA) have been granted extensive rights regarding their personal data. Eversports recognises that the protection and careful handling of your personal data are very important. As data protection is of great importance at Eversports, Eversports complies strictly with the applicable legal provisions in Austria (GDPR, the Data Protection Act [German acronym: DSG], the Telecommunications Act [German acronym: TKG] of 2003) and in Germany (GDPR, the Federal Data Protection Act [German acronym: BDSG], the Telemedia Act [German acronym: TMG], TKG) when using these data.
Definitions
GDPR: The EU General Data Protection Regulation. In this Privacy Statement, terms such as data subject, personal data, processing, controller, processor and recipient are all used within the meaning of Article 4 GDPR.
Eversports: Eversport GmbH with its business address at Jakov-Lind-Straße 13 H/5. OG, 1020 Vienna, Austria.
Eversports DE: Eversports Germany UG (limited liability company) with its business address at Hansaring 52, 50670 Cologne, Germany. A subsidiary of Eversports.
Appointman: APPOINTMAN UG (limited liability company) with its business address at Kaysers Kamp 3, 26188 Edewecht, Germany. A subsidiary of Eversports.
Eversports Group: Eversports and all of these subsidiaries.
Eversports Platform: The sports search engine and booking platform operated by Eversports online, in its apps and on its websites.
Sports offerings: Various services in the field of sports and leisure activities as well as sports venues that can be searched, booked and reserved via the Eversports Platform.
Users: Persons who have registered online with Eversports in order to use the sports offerings.
Sports providers: Partner companies delivering the sports offerings through their own sales channels.
Eversports service: Provision of the Eversports platform and referral of the associated sports offerings to users.
Eversports Ambassadors: Sports providers acting as consultants for the Eversports Group.
Information pursuant to Article 13 GDPR
1. Contact
Controllers for data processing are detailed in sections 2.1 to 2.6. Please contact the appropriate point of contact for data protection issues:
Eversports
Postal address: Jakov-Lind-Straße 13 H/5. OG, 1020 Vienna, Austria
E-Mail: [email protected]
Eversports DE
Postal address: Hansaring 52, 50670 Cologne, Germany
E-Mail: [email protected]
Ms Ines Janusch Dipl. Ing. (e-mail: dataprivacy@eversports.com) has been appointed Data Protection Officer for the companies mentioned above.
2. Data subjects
This Privacy Statement concerns various groups of people about whom various types of data are processed. For information about the processing of your data, please read the appropriate section carefully.
2.1. Visitors to the website
If you visit one of the Eversports websites (e.g. www.eversports.com or country-specific domains such as www.eversports.at, www.eversports.de etc. and sub-domains such as manager.eversports.com), the following information is relevant to you.
The controller (“we” or “us” in this section) for the processing of your data is Eversports.
2.1.1. Why we process data
In connection with our online offerings, we process data from visitors to our website based on our legitimate interests in the analysis, optimisation and commercial operation of our website for the following purposes:
a) To make the website more user-friendly for visitors;
b) To adapt Eversports services to the preferences of visitors to the website;
c) To verify and optimise the effectiveness of Eversports services;
d) For purposes of troubleshooting and detection of anomalies, to guard against misuse of Eversports services and to track any unauthorised access attempts.
You may object to this processing at any time. For information about the options for objecting, please see the “Technical notes”.
2.1.2. To whom do we transfer data?
We transfer data from visitors to the website to the following recipients and/or categories of recipient:
a) Communication tools for support requests and communication with customers
b) Security tools and tools for fault detection and troubleshooting
c) External hosting providers for data storage
d) Marketing tools
e) Companies in the Eversports Group
2.2. Users with an Eversports online profile
If you have created an online profile with Eversports in order to use Eversports services (e.g. to book sports venues), the information in this section pertains to you. Of course, since you are also visiting our websites as a user, please also read the section “Visitors to the website” carefully.
The controller (“we” or “us” in this section) for the processing of your data is Eversports.
The subject-matter of the contract is the use of the Eversports platform and the associated referral of the sports offerings to users.
2.2.1. Why we process data
We process data from users for the following purposes, in connection with the performance of a contract:
a) To enable the user to use Eversports services after registration and activation of a user account (e.g. browsing the sports offerings and making bookings and online payment);
b) To transfer booking data to the sports provider so that the sports provider can book the sports offerings;
c) To create and send out booking confirmations and invoice documents;
d) To enable appropriate customer support and communication;
e) To adapt Eversports services to users’ preferences and to develop new tools for users.
We also process data from users for the following purposes, as part of our own legitimate interest:
f) To verify and optimise the effectiveness of Eversports services;
g) To display interest-based advertising on third-party service providers’ websites;
h) To prevent misuse of Eversports services and to track unauthorised access attempts;
i) To perform troubleshooting and roll out product improvements;
j) To recommend products via e-mail and to provide information about new features and products from Eversport
Our legitimate interest in processing these data lies in the analysis, optimisation and commercial operation of the Eversports platform and the promotion of our products and services. You may object to this processing at any time. To do so, please contact us at the following e-mail address: [email protected]. For information about the options for objecting, please see the “Technical notes” section.
We process data from users based on consent for the following purposes:
k) To administer newsletter recipients and dispatch newsletters;
l) To display interest-based advertising on third-party service providers’ websites using customer data matching.
Consent to the above purposes is given voluntarily during the registration process. The user may withdraw it at any time, with future effect, in the online profile settings. Subscription to the newsletter may also be cancelled by the user at any time, with future effect, by means of a link in the newsletter e-mails or by e-mail to [email protected].
2.2.2. To whom do we transfer data?
We transfer user data to the following recipients and/or categories of recipient:
a) Payment service providers for online payment processing via the Eversports platform
b) Sports providers for making bookings
c) Communication tools for support requests and communication with customers
d) Fault detection and troubleshooting tools
e) Security and requirements engineering tools
f) External hosting providers for data storage
g) Marketing tools h) Austrian Chartered Accountants [Wirtschaftstreuhänder]
i) Financial administration authorities
j) Companies in the Eversports Group
2.3. Sports providers
If you run a sports venue and use the Eversports platform (e.g. “Ball Sports Manager” or “Studio Manager”) for your company, you need to protect not only your customers’ data, but also your own. Here you can learn about the processing of your data. Since you also visit our websites as part of our collaboration, please also read the section “Visitors to the website” carefully.
The controller (“we” or “us” in this section) for the processing of your data is Eversports or Eversports DE, depending on whom you have signed a contract with.
The subject-matter of the contract is the use of the Eversports Platform, the associated administration of your sports venues and the referral of your sports offerings to users.
2.3.1. Why we process data
We process data from sports providers in connection with the performance of a contract for the following purposes:
a) To enable the sports provider to administer sports venues, resources, courses, activities, products, trainers etc.;
b) To enable the sports provider to check in customers and issue till receipts;
c) To enable the sports provider to update their Eversports sports provider profile and settings (the sports provider’s cancellation conditions, GTCs and privacy policy);
d) To create and send out booking confirmations and invoice documents;
e) To enable communication with customers and resolution of support requests;
f) To provide sports providers with personalised recommendations for making more efficient use of the Eversports Platform;
g) To ensure compliance with licensing conditions.
We also process data from sports providers for the following purposes, as part of our own legitimate interest:
h) To improve the service, in particular by sending sports providers information about Eversports services by e-mail;
i) To adapt the service to the sports provider’s preferences, monitor the effectiveness of the Eversports network and service, and to develop new tools for sports providers.
j) To display interest-based advertising on third-party service providers’ websites;
k) To prevent misuse of Eversports services and to track unauthorised access attempts. Our legitimate interest in processing these data lies in the analysis, optimisation and commercial operation of the Eversports platform and the promotion of our products and services. You may object to this processing at any time. To do so, please contact us at the following e-mail address: [email protected]. For information about the options for objecting, please see the “Technical notes”.
We process data from sports providers based on consent for the following purposes:
l) To display the sports provider’s feedback with their name and photograph on the Eversports websites;
m) To administer newsletter recipients and dispatch newsletters;
n) To display interest-based advertising on third-party service providers’ websites using customer data matching. Consent for purpose
k) is given individually in writing by the respective sports provider and may at any time be withdrawn, with future effect, by e-mail to [email protected]. Consent to the other purposes listed above is given voluntarily during the registration process and/or login. The sports provider may withdraw it at any time, with future effect, in the online profile settings. Subscription to the newsletter may also be cancelled by the sports provider at any time, with future effect, by means of a link in the newsletter e-mails or by e-mail to [email protected].
2.3.2. To whom do we transfer data?
We transfer data from sports providers to the following recipients and/or categories of recipient:
a) Payment service providers for online payment processing via the Eversports platform
b) Communication tools for support requests and communication with customers
c) Fault detection and troubleshooting tools
d) Security and requirements engineering tools
e) External hosting providers for data storage
f) Marketing tools
g) Austrian Chartered Accountants [Wirtschaftstreuhänder]
h) Financial administration authorities
i) Companies in the Eversports Group
j) Eversports Ambassadors
2.4. Applicants
If you contact Eversports or Eversports DE to apply for a job, please read this section for information about data protection as it pertains to the application process.
The controller (“we” or “us” in this section) for the processing of your data is Eversports or Eversports DE, depending on whom you have applied to.
2.4.1. Why we process data
We process data from applicants for the following purposes, in connection with the performance a contract or to take steps prior to entering into a contract:
a) Correspondence with applicants
b) Administration of the application process
We process data from applicants based on consent for the following purposes:
c) Storage of applicant data in the Eversports talent pool Consent to storage may be withdrawn at any time, with future effect, via the applicant’s talent pool administration tool account or by e-mail to [email protected].
2.4.2. To whom do we transfer data?
We transfer data from applicants to the following recipients and/or categories of recipient:
a) External hosting providers for data storage
b) Communication tools for support requests and communication with customers
c) Talent pool administration tools (only with explicit consent)
d) Companies in the Eversports Group
2.5. Prospective customers
If you contact Eversports (via the website form or by e-mail), you can find out about the processing of your data here. If you contact us via the Eversports website, please also read the section “Visitors to the website” carefully.
The controller (“we” or “us” in this section) for the processing of your data is Eversports.
2.5.1. Why we process data
We process data from prospective customers for the following purposes, in order to take steps prior to entering into a contract:
a) Correspondence with prospective customers
2.5.2. To whom do we transfer data?
We transfer data from prospective customers to the following recipients and/or categories of recipient:
a) Communication tools for support requests and communication with customers
b) External IT providers (cloud services, e-mail services, web hosting)
c) Eversports Ambassadors
d) Companies in the Eversports Group
2.6. Web shop customers
If, as a sports provider, you are interested in hardware for your venue – e.g. a receipt printer or cash drawer – you can simply order such hardware via the Eversports web shop (http://eversports.webshopapp.com/) and pay online. Read on to find out about the processing of your data as a web shop customer.
The controller (“we” or “us” in this section) for the processing of your data is Eversports DE.
2.6.1. Why we process data
We process data from web shop customers in connection with the performance of a contract for the following purposes:
a) To accept the order;
b) To ship the items ordered;
c) To create and send out invoice documents;
d) To process requests and queries about products and orders.
2.6.2. To whom do we transfer data?
We transfer data from web shop customers to the following recipients and/or categories of recipient:
a) Payment service providers for online payment processing via the Eversports web shop
b) Transport companies
c) Hardware suppliers
d) Communication tools
e) External hosting providers for data storage
f) Austrian Chartered Accountants [Wirtschaftstreuhänder]
g) Financial administration authorities
3. Recipients and third countries
This section applies to data subject groups in Section 2. “We” and “us” refer to the respective controllers in Sections 2.1 to 2.6.
We commission external service providers to undertake various assignments for us. If one of these assignments involves processing your personal data, any such service provider is a processor within the meaning of the GDPR. We have written agreements with them (in accordance with Article 28 GDPR), which govern the handling of personal data and oblige processors to comply with suitably high security standards.
An up-to-date table of all processors for the Eversports Group is available here:
Some recipients are controllers in their own right for data transferred to them, so such processing does not constitute commissioned processing. The payment service provider that we use, PayPal, is one of these controllers in their own right. All PayPal transactions are subject to the PayPal privacy policy. The sports providers are also controllers in their own right for data transferred to them to arrange your booking. If you would like information about a sports provider’s privacy policy, please contact that sports provider directly.
The Eversports Group companies work together as joint controllers. They have signed a written agreement between them (in accordance with Article 26 GDPR) in order to manage their respective responsibilities.
The joint controllers work together as follows:
The data processing operations defined in Section 2 of this Privacy Statement are carried out by Eversports, Eversports DE and Appointman as joint processing operations within the meaning of Article 26 GDPR. To this end, employees of Eversports Group companies are assigned to teams that cross over the boundaries of the individual corporate entities. The main controller for the data subject categories described in sections 2.1 to 2.6 is defined in the respective sections.
All data processing issues can be addressed by mail to all companies in the Eversports Group. The issues are forwarded accordingly within the Group. Data protection issues can be addressed via e-mail to the following e-mail address: [email protected].
We also transfer certain data to recipients in third countries (i.e. countries outside the EU/EEA). For these third countries there is either an adequacy decision of the EU Commission (recipients in the USA must certify themselves under the Privacy Shield agreement, or we have signed standard contractual clauses with the recipients in order to guarantee an adequate level of protection for your data.
4. Duration of the processing
As a basic principle, your data are processed for the duration of the contractual relationship or for as long as needed for the above purposes. In addition, the data are stored only for as long as legal data retention obligations stipulate. If the use of the data is based on your consent, the data will be processed until such consent is withdrawn.
Inactive Eversports online profiles, including profile data provided by the user, are erased by default three years after the last login if they no longer have any credit.
Correspondence with prospective customers and applicants is stored for six months in case of any follow-up questions.
Server log files are stored for 30 days and then erased.
For details of the retention period for cookies and other technical tools of the Eversports online services, please refer to the “Technical notes” section.
5. Your Rights
As a basic principle, you shall have the rights of access, rectification, erasure, restriction of processing, data portability and objection. To exercise these, you can contact the controller directly. If you are not sure who is the controller for the processing of your data, you can also contact the parent group (Eversports) at any time, and your request will be directed to the right place within the group.
If a user objects to processing for purposes which are necessary for the performance of a contract, that user will no longer be able to use the Eversports services, and as a result their Eversports online profile will be erased. Services from sports providers on Eversports can still be used directly from the sports provider (e.g. local bookings), since existing credit balances with the sports providers do not expire as a result.
Subscribers to our newsletter may withdraw their consent to their subscriptions at any time, with future effect, via the link at the bottom of a newsletter or by e-mail to [email protected].
Sports providers may at any time withdraw their consent to their feedback (including their name and photograph) being displayed on the Eversports websites, with future effect, by e-mail to [email protected].
Consent to interest-based advertising on third-party service providers’ websites may be withdrawn at any time, with future effect, in the Eversports online profile settings.
In accordance with the GDPR, you shall have the right not to be subjected to a decision based solely on automated processing. The Eversports Group does not carry out automated decision-making based on the data collected.
If you believe that the processing of your data contravenes data protection law or otherwise infringes your data protection rights, you may contact the relevant controller or Eversports directly ([email protected]). We always endeavour to resolve your request to your satisfaction. You have the right to contact the supervisory authority at any time and to lodge a complaint. In Austria, this is the Data Protection Authority. A list of the competent supervisory authorities outside Austria is available here: https://www.dsb.gv.at/links
Annex 1: Technical notes
