Privacy Policy

Which services does this cover?

supodo is a platform for sport for people with disabilities, for inclusive sport, and for senior sport. supodo has several services. One person runs all of them. This document covers all supodo services. The services have no legal pages of their own. They point to these pages instead.

For example, these services:

• supodo landing page — the website
• supodo manager — the Manager for organisations and events
• supodo app — finding and following activities
• supodo link — the short links
• supodo wiki — the wikis for organisations
• supodo auth — signing in, and user accounts
• supodo mail — newsletter sign-up and sending emails

This document also covers all other public supodo services. That means everything you can reach at dev.supodo.com, including its sub-addresses, and at dev.supodo.link.

The same person is also responsible for this service. This document covers it too:

• wann.link — finding a time that suits a group, with no user account

We also have internal test systems. This document does not cover them. If you can reach a test system on the internet, it has its own details.

Which section applies to which service?

The table shows which sections belong to each service. All other sections apply to every service.

Who is responsible?

This person is responsible for your data. That is true for every service listed under “Which services does this cover?” at the top. There are two exceptions: classification, and sports results and records. Sections “Data about health and disability” and “Sports results and records” explain them.

supodo
Marib Aldoais
Leimbergerstraße 43a
91052 Erlangen
Germany

Email: kontakt@supodo.com
Phone: +49 170 9000109

Is there a data protection officer?

No. We do not need one. The German Federal Data Protection Act says so in section 38(1). If you have a question about your data, just write to us. Our address is above.

Why are we allowed to use your data?

We may only use your data if we have a reason for it. The law calls that reason a legal basis. The law is called the GDPR. That stands for General Data Protection Regulation. It is a European law. In this text we name our reason at every point. There are four reasons:

Where we rely on a good reason of our own, we weighed things up first. So we compared our reason against your rights. You can ask us what the result was. We will tell you.

Children and young people

In youth sport, children and young people use our services too. Sometimes we ask permission first. That permission only counts from age 16. This is in Article 8(1) GDPR. Countries are allowed to set a lower age. Germany did not do that. So in Germany the age is 16. Anyone under 16 needs a parent's permission. One more thing is important. A sport activity can have a lowest age. And a highest age. Do you take part in an activity for children? Then someone can guess your rough age. Even if you never told us your date of birth. We only ask for a date of birth for classification. Section “Data about health and disability” explains it. Parents can also create a profile for their child for this. There we check the age: under 16, a parent says yes. From 16, the person says yes themselves. Apart from that, we never ask for an age. But results and records show the age group. Section “Sports results and records” says more.

From age 16, a parent can hand their child's profile over to the child. The child needs their own account for this. For this, a parent gets a code. The code works only once and only for 7 days. Does the parent get a new code? Then the old one stops working. We do not send the code on. The parent gives it to the young person, for example in person. The young person enters the code in their own account. From then on, the profile and the classifications belong to them. The parent can then no longer see or change the profile. Is a measurement for the profile still running and not sent yet? Then we cancel it at the handover. We write the handover into the record of who did what. Section “How long do we keep classification data?” says more.

This age limit only applies when we ask permission first. It does not apply when we need the data for our service. And it does not apply when we have a good reason of our own.

Our newsletter is for adults. We do not knowingly sign up children under 16. If we find out about one, we delete the sign-up.

Sometimes an organisation enters a child. As a member, for example, or as someone taking part. The organisation then asks the parents for permission. Not us. We do not know the parents. We cannot ask them. The organisation is responsible for this.

Are you a parent or guardian? Do you have a question about your child's data? Or should we delete it? Then write to us. Our address is in section “Who is responsible?”. We deal with these requests first.

This applies to every service

This section applies to every service.

Where are our servers?

Our services run on servers in Germany. We rent these servers from a company. All the data from your use sits there.

This is the company:
Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany

We need the servers so our services can run. And we have a good reason of our own: our services should be safe and fast. For that we need a company that knows how to do this.

We have a contract with this company. The law calls it a data processing agreement. It is in Article 28 GDPR. The company may only use the data the way we tell it to. All our servers are in Germany. The contract only allows processing inside the European Union. So the company does not take your data to other countries.

Log data

You use, for example, the Manager, the app, the wiki or a short link. Your requests then go through our database and our sign-in service. These make a note of the requests that reach them. The log is kept on our own servers. This is what is in it:

• when the request came
• which part was asked for
• what kind of request it was
• whether the request worked
• your IP address. That is your device's number on the internet.
• the identifier of your browser

We do not join this data up with other data. We do not build a profile about you from it.

We have a good reason of our own for this. Our services should run properly. We want to find faults. And we want to stop attacks. We also count for a short time: how often is a form on the website sent from one internet address? If there are too many, we refuse the next ones. We do not store these counts. After a short time they are gone.

After 7 days we delete your IP address from the log. We also delete which part was asked for. After 30 days we delete the whole entry.

Cookies and storage on your device

Cookies are small files on your device. We only use cookies that are technically necessary. For example, we need them to sign you in to the Manager, the app, the wiki and the platform administration pages. We do not have to ask permission for those cookies. A German law allows this: section 25(2) no. 2 of the TDDDG. We use no cookies for advertising. We use no cookies to count visitors. We use no outside programs that measure what you do. We do not embed fonts, maps or videos from other companies. We count ourselves how often a short link is opened. We need no cookies for that. Section “The short links” says more. That is why you see no cookie window on our pages.

We store a few more things on your device. We do not have to ask permission for these either. A cookie remembers which language you chose. For example, this happens on the website, in the Manager, in the app and in the platform administration pages. Our pages stay in that language while your browser is open. When you close the browser, your browser deletes the cookie. In the Manager and in the platform administration pages, your browser remembers whether you closed the side bar. In the Manager, a cookie remembers up to twelve organisations. These are the organisations you manage and opened most recently. Then the side bar can show you those first. We delete this cookie after 30 days. When you save something in the Manager, a cookie shows a confirmation for one minute. Sometimes you have to confirm your sign-in once more. For this the Manager sets a cookie for at most ten minutes. Section “Your account and signing in” says more. When you delete your account, the Manager sets a cookie for at most five minutes. It only holds the time you deleted your account. And whether we sent you an email about it. That way the page that confirms the deletion can show you both. In the app, your browser can save pages for later. The app uses a service worker for this. This is a small program in your browser. It keeps the pages in the cache. The cache is storage inside your browser. Then you can open these pages without the internet. It only saves public pages you have already opened. It also notes when it saved each page. It also saves the files the app needs to show its pages. And a page that tells you: you have no internet right now. It does not save pages you open after you sign in. Everything stays on your device. A new version of the app replaces the saved pages. If we switch this feature off, the app deletes the pages. You can also delete them yourself. To do this, delete the app's saved data in your browser. In the wiki, your browser remembers which parts of the page tree you opened. These items belong to the services you opened yourself. We do not evaluate them. We do not join them with anything. On the short links we store nothing at all on your device. Section “What everyone can see” says more.

Security

All our pages are encrypted. You can tell by the https at the start of the address. So nobody can read along. We also protect your data with technical measures. In the Manager and the app, for example, the database itself checks who is allowed to see what. This is in Article 32 GDPR.

Links to other websites

Our pages contain links to other websites. We are not responsible for those websites. We do not know what happens to your data there. Please read their own privacy page. Do that before you enter any data there.

Data only goes to the other website once you click the link. It has to work that way technically. The internet only works like this. This data goes with you: your IP address, the time, your operating system and your browser.

The contact form, email and phone

This applies to: our website dev.supodo.com

You write to us through the contact form. We then use your email address, the subject and your message. We need that to answer your question. And in case we have to ask something back. You get a confirmation by email. That email repeats your message. Do you write by email or ring us instead? The same applies to that data.

Is your question about a contract with us? Then we need the data for that. Is it about something else? Then we have a good reason of our own: we want to answer questions people ask us. Do you tell us more about yourself than we asked? That is your own choice.

We need your email address. Otherwise we cannot reply. The form does not ask for your name. But you do not have to give us your email address. No law and no contract requires it.

Once your question is answered, we delete it. Unless a law says we have to keep it.

The newsletter

This applies to: our website dev.supodo.com and the newsletter

For the newsletter we use your email address. And the language you chose. We do not ask for your name when you sign up. You can add it yourself later. Signing up takes two steps. First you sign up. Then you get an email. In that email you confirm the sign-up. We store when you signed up and when you confirmed. That way we can prove you said yes. We also store whether the email arrived. Then we stop sending to wrong addresses.

You said yes. That is our reason. You can take your yes back at any time. Every newsletter has a link for that. Or just write to us. We then stop sending.

We send the newsletter ourselves. We use a program for that. The program is called Listmonk. It runs on servers that we rent. Sections “This applies to every service” and “Your account and signing in” say more. No other company sends the newsletter for us.

We store your data until you unsubscribe. You have to confirm your sign-up. If you do not, we delete your entry automatically after 30 days. After that we keep your entry for three more years. The same is true if we block your address. The three years start from the last change to your entry. The entry shows when you signed up and when you confirmed. It also shows when you unsubscribed, or when we blocked your address. That way we can prove that you said yes, and that you took it back. We have a good reason of our own: we need that proof if there is ever a dispute about it later. After the three years we delete the entry automatically.

Protection against misuse and spam

This applies to: our website dev.supodo.com and the newsletter

Sometimes computer programs send thousands of messages to forms automatically. That is called spam. We use a protection against it. There is a box to tick below every form. You tick the box. Only then does your browser get a sum from us to work out. It works the sum out in the background. Nothing happens for this before that. You do not have to solve a picture puzzle. One thing matters here. This protection runs on our own servers. No outside company is involved.

You tick the box. Your browser then fetches a small task from our server. It works out the answer on your device. Then it sends the answer back to us. Nothing else is sent. We see your IP address while it does. That happens on every visit to our servers. We use it to limit how often someone can send requests. Section “This applies to every service” says more. We do not look at details about your browser or your device for this. And no data goes to other companies.

We have a good reason of our own for this. We do not want spam in our forms. And we want to stop people misusing our confirmation email. Otherwise someone could write to strangers using our name.

Your account and signing in (auth.dev.supodo.com)

This applies to: the Manager, the platform administration pages, websites for organisations, and wikis for organisations

For signing in we use a program. We run it ourselves. It runs on servers that we rent. Section “This applies to every service” says more.

For your user account we store: your username, your email address, your first name and your last name. We do not store your password as text. We only store a scrambled check value. Nobody can work your password back out from it. We also store passkeys, if you set any up. And: whether your email address is confirmed, linked accounts from other providers, when you signed in, your session keys, and how often a sign-in failed. We also record when you accepted our terms of use. We have to be able to prove that. Some areas have extra protection. One example is classification in section “Data about health and disability”. There you must confirm your sign-in once more. For example with a passkey. Or with a one-time code from an app. Do you set up a one-time code? Then we store that with your account. We also store which session the confirmation is for, and until when.

Our sign-in service also makes a note of what happens with your account. For example: when you sign in. When you sign out. When a sign-in does not work. When you set up an account. When you confirm your e-mail address. And when you change your password. It stores: the time, what happened, the number of your account, and your IP address. We do this for the security of the accounts. And to look into misuse. The legal basis is Article 6(1)(f) of the GDPR. After 90 days we delete these notes automatically.

You register for the first time. We then send an email to your address. You have to confirm that email. Without confirming, you cannot use the account. We send that email through a mailbox at our server company. No other company is involved.

You can also sign in with your Google account. Google then sends us three things: your email address, your name and a number. We make an account here from that. Google has already checked your email address. So we do not send a confirmation email. Google is responsible for your data at Google. You decide yourself whether to use this route. Do you not want it? Then register with an email address and a password.

We need the data to give you your account and let you sign in. Article 6(1)(b) GDPR allows this. For confirming the email address we have a good reason of our own: accounts should be safe. The same goes for counting failed sign-ins.

We store your account data until you delete your account. Or until you ask us to delete it. We delete session data quickly. We delete the sign-in notes automatically after 90 days.

Organisations, events and roles

This applies to: the Manager

In the Manager you look after activities and events for an organisation. You need a user account for it.

You sign in through our central sign-in. Section “Your account and signing in” says what data that involves. In the Manager we also store which role your account has, in which organisation and in which event. And who created a record. For organisations, contact details, images and short links we also store who changed the record last.

For each organisation and each event we store what the people in charge enter. For example: name, description, type of organisation, sports, target groups, times, places, addresses, costs, pictures and links to social networks. And contact details like email address, phone number and fax number. Watch out for one thing. Contact details often belong to a particular person. Even when they sit under an organisation.

About people we store roles. An organisation has these roles: admin, member and follower. An event has these roles: event manager, taking part, support and follower. Technically a role is only three things: a link to your account, a link to the organisation or event, and the kind of role. Section “Data about health and disability” says what someone could still guess from that.

Sometimes an organisation enters data about a person who has no account. We then do not get the data from that person. We get it from the organisation. We have to tell you this. It is in Article 14 GDPR. The organisation has to make sure the entry is allowed. And the organisation has to inform the person. Not us.

Invitations: an organisation can invite a person. The person can then help manage the organisation. For this, an administrator of the organisation types in an email address or a user name. We store, for example: the address or name, the organisation, who sent the invitation, the language and the answer. We send 1 email at most. Does the person already have a supodo account? Then we link the invitation to the account. The email goes to the address of that account. The administrators of the organisation can see: is there already an account for this address or name? We get this data from the organisation. Not from the invited person. This is in Article 14 GDPR. We need the data for 2 things: to send the invitation, and to show it when the person signs in to supodo. Why are we allowed to do this? The organisation has a legitimate interest: it wants to make its team bigger. We delete an open invitation after 30 days. We delete an accepted or withdrawn invitation 1 day after the answer. We delete a declined invitation 30 days after the answer. To stop misuse, we count for 1 day how often someone sends invitations. You do not want invitations by email any more? Then we only store a code made from your address. You cannot simply read the address from the code. We keep it until you allow invitations again.

We need the data for the account, the sign-in and your own content. And for the public activities we have a good reason of our own: people should be able to find sport for people with disabilities, inclusive sport and senior sport. That is exactly what our platform is for.

Content stays stored until the organisation deletes it. An organisation can also delete itself. Its data still stays stored at first. The organisation can bring it back. We have not yet decided when we delete the data for good. When we know, we will write it here. Roles stay stored until they end. Do you delete your account? Then we delete your roles with it.

What everyone can see

This applies to: the app and short links

We show organisations and events in public. That way people can find sports activities. This is also true for the events widget and every page with published activities.

An organisation or an event becomes public when the organisation sets it to "published". Before that, only accounts with permission can see it. Roles, memberships and taking part are not public. One exception is results and records of competitions. Section “Sports results and records” says more.

You do not need to sign in to search and look around. Only the log data in section “This applies to every service” comes up. This also applies to the events widget. With it, an organisation shows its events on its own website. Your browser then loads the widget from our servers. The widget sets no cookies. It stores nothing on your device.

The short links (dev.supodo.link)

Some internet addresses are very long. So we also have short ones. A short link forwards you to the right page. There is no sign-in here. We store no content from you.

You open a short link. We look up where it belongs. Then we forward you there. The target is a supodo page or somebody else's website.

This service sets no cookies. It stores nothing on your device. It builds no profile about you.

We keep your IP address only for a short time in memory. That way we limit how many times one IP address can call the service. That protects it against misuse. We do not store the IP address. We have a good reason of our own: the service should keep running.

We count how often a short link is used. Each time we forward you, we store things like this: the time, but only the hour. The name of the website you came from. And whether a browser or a computer program made the request. The people responsible for the organisation that manages the short link only see numbers: how often the short link was used. We have a good reason of our own: organisations should see how their short links are used. After 30 days we only keep one number: how often the short link was used in total. We delete the details then. We delete the number when the short link is deleted.

We forward you. From that moment data goes to the target. That is true even when the target is somebody else's website. Section “Links to other websites” says which data. For somebody else's website, whoever runs it is responsible. Not us.

Following activities and your anonymous account

This applies to: the app

In the app you can follow organisations and events.

At some point you do something we have to store. Following an organisation, for example. We then set up an account for your device automatically. That account is anonymous. That means: it holds no name. It holds no email address. It holds no password. It is only a number in your browser. We need the number so you can find your list again. We cannot see who you are. Even so, that number counts as personal data. This is in Article 4(1) GDPR.

You follow an organisation or an event. We then store a follower role for it. So: a link to your account, a link to the activity, and the time. Only you can see that list. Please also read section “Data about health and disability”. It applies even if you only follow.

We need this anonymous account for your list. Without an account the list cannot work technically. And the list is exactly what you wanted.

Do you clear the data in your browser? Then you cannot reach your anonymous account any more. Some anonymous accounts never follow anything. We delete those automatically after 30 days. For anonymous accounts with a list we have not set a time limit yet. We will set one and write it here. But you can write to us at any time. We then delete your anonymous account straight away.

Numbers about the platform

This applies to: the platform administration pages

Every day we write down how many organisations, events, accounts and short links there are. We also write down the status of each organisation and event, for example published. Accounts are only counted. The address of an organisation or event can contain a person's name. So we treat this record as personal data, and data protection law applies to it.

We have a good reason of our own: we want to see how the platform grows and whether it runs well.

We keep the numbers and statuses for good. If an organisation or event is deleted, we remove its address 90 days after the last day we recorded it.

Reports about content that breaks the law or our rules

This applies to: our website dev.supodo.com

Do you report content to us? Then we save: the kind of your report. The address of the page. And your description. Did you give your name and your email address? Then we save those too. The report also contains data about the other person. We only use this data for the report.

Is it about content that breaks the law? Then a law says that we must deal with the report. It is the Digital Services Act of the European Union. Is it only about our own rules? Then there is no law for that. We then deal with the report because we want to enforce our rules.

We need the address of the page. And we need your description. Without them we cannot do anything. We also need your name and your email address. Only reports about the sexual abuse of children are different. Then you may report without a name. But then we cannot write back to you.

The other person does not get your name. And not your email address either. We only tell the other person the reason for our decision.

Sometimes we limit a piece of content. Then we send the reasons to the admins of the organisation. We store who made the decision. And we store who got the reasons. An EU law requires this. We keep this information as long as reports.

We keep reports and the messages about them for 3 years. The 3 years start with our final decision.

Websites for organisations (pages.dev.supodo.com)

This applies to: websites for organisations

On this platform we run websites for organisations. An organisation decides who looks after its website. These people sign in there with a user account.

You sign in through our central sign-in. Section “Your account and signing in” says which data that creates. From the sign-in we get your email address, your user name and the number of your account. We store these on the platform. We also store which role you have for which website, your sessions, and your settings for the platform. Are you editing a page? Then the page is locked for others. So nobody can change the same page at the same time. The lock ends at most five minutes after you last did something. The admins of an organisation see the accounts for its website.

For signing in, the platform sets a cookie, for example. It expires after two hours. While you sign in, it sets one more cookie for at most ten minutes. It checks that the sign-in is safe. Do you sign in through our central sign-in service? Then the platform sets one more cookie. It expires after seven days. Only our server can read it. It holds the keys for your sign-in. And the time of the last check. So the platform checks at most once a minute: is your sign-in still valid? There is no such cookie for an emergency sign-in with a password. Two more cookies remember for up to one year: which website you edited last. And in which language you see the platform. Your browser also saves settings on your device, for example which view you chose for the navigation. All of this is only there so the platform works. So we do not have to ask permission. A German law allows this: section 25(2) no. 2 of the TDDDG. We also briefly count how often someone tries to sign in from an IP address. This protects the accounts. We keep these numbers only in memory on our server. We never write them down. We delete them after a short time.

The organisation is responsible for the content of its website. This also covers messages sent through the website’s contact form. The website’s privacy policy says more.

We need the data for your account, signing in and looking after the website. Article 6(1)(b) GDPR allows this. Counting sign-in attempts protects the accounts. That is a good reason of our own. Article 6(1)(f) GDPR allows this.

Your account on the platform stays stored until it is deleted. You can do this yourself. The organisation can do it. Or you ask us to do it. Then we also delete your roles, sessions and settings. If you do not sign in for 24 months, we delete your account automatically. Please note: if you delete your central user account, this account stays.

Sports results and records

This applies to: websites for organisations

Organisations publish the results and records of their competitions on their websites. For example on internationaldwarfsportsfederation.org and wdg2023.com. The purpose: sporting achievements should stay on record. And people should be able to compare them over the years.

They show, for example: the athlete's name, nation, age group, gender and class. Also the discipline (for example the 100 metres), the result, the place or medal, and the Games where it happened. Results of children and young people are there too.

The organisation that shows the results or records on its website is responsible for them. Its name is in that website's legal notice and privacy policy. We store and show the data on its behalf. The data does not come from the athletes themselves. It comes from the organisations that run the competitions or keep the records. For example, from the official result lists and record lists of the Games.

The organisation has a good reason of its own. The law calls this a legitimate interest. It wants to record the results of its competitions and make them known. The rule for this is Article 6(1)(f) GDPR. From the class, and from taking part in competitions for people of short stature, someone can work out that the person is of short stature. This is data about health. Such data may only be published in certain exceptional cases. These exceptions are in Article 9(2) GDPR. It is not settled yet which exception allows publishing here.

This data is public. Anyone can see it without signing in.

Results and records are meant to keep a lasting record of the Games. So they stay published. This ends when the organisation removes them. Or when an objection or a request to delete succeeds.

Are you named in results or records? Then you can object. Or you can ask for your data there to be deleted. Write to the organisation that shows the results. Or write to us. Our contact details are in section “Who is responsible?”. For a child, a parent or guardian can do this. If you write to us, we pass your request on to the organisation. We then do what the organisation decides. You can use your other rights this way too. For example, to find out what is stored about you, or to have a mistake corrected. Section “Your rights” says more.

The wikis for organisations (wiki.dev.supodo.com)

This applies to: wikis for organisations

A wiki is a set of pages on the internet. Several people write them together. Each organisation has its own wiki with us. The wikis are kept apart from each other.

You need an account to take part. You sign in through our central sign-in. Section “Your account and signing in” says more. You can read public pages without signing in.

When you sign in to the wiki, we make a profile for the wiki. Or we update it. The details come from your account. The profile holds your ID and your display name. Sometimes your account also has a profile picture. Then we store the address of that picture. Your display name is the name in your account. Is there no name there? Then it is your email address. The other members of your wiki see your display name and your role. For example on your comments. Or in the version history. Or when they want to mention someone.

We store which wiki your account belongs to. And which role it has there: admin, writing, commenting or reading. An organisation can also give you more rights for single areas or pages. We store that too. On every request we use this to check what you may see and do.

Invitations: whoever runs a wiki can invite other people. They enter the person's email address for this. We store the address and the role for that person. We also store who sent the invitation. And when it was accepted. We do not send an email for this. You sign in and your confirmed email address matches an invitation? Then you become a member of that wiki. We do not get this data from the invited person. We get it from the organisation. We have to tell you this. It is in Article 14 GDPR.

We store the pages, the drafts, the templates and the comments. And who created or last changed them. And when. You mention a person? Then we store their display name and their ID in the text. And we tell them in the wiki. You can watch pages. Then we tell you in the wiki when something happens there. You watch a page you create without doing anything. Someone writes about another person in a text? Then we do not get this data from that person. It is in Article 14 GDPR. The organisation has to make sure this is allowed. The wiki belongs to it.

Sometimes several people write on a page at the same time. Then they see each other's display names and IDs. And the place where each of them is writing. We do not store that. But we do store each single change. And who made it. Once there are enough changes, we join them into one version of the page. Or someone discards the draft. Then we delete them too.

We also store older versions of a page. That is called the version history. People can only see a page once it is published. Before that it is a draft. Only people who may edit the page see the draft. Each time a page is published, we store that version. We store who published it. And when. Sometimes someone notes what changed. We store that too.

You can upload files. Those files sit in a protected area. We also store the name of the file. And who uploaded it. We only hand a file over after checking: may you read the page the file belongs to?

Some pages can be read by anyone. Even without signing in. Two things have to be switched on for that. First: the page has to be public. It is public if it is marked public itself. Or a page above it. Or the area it is in. Second: the organisation has to allow public pages at all. Is one of the two missing? Then the page is not public. Is a page public? Then anyone can also get its files, its older versions and its comments. Each comment shows the display name of the person who wrote it. Is there no name in your account? Then that is your email address. For the older versions, we do not show who published them.

An organisation can use a logo from another website for its wiki. Or a page shows a picture from another website. Then your browser fetches the picture straight from there. The other website gets your IP address when this happens. Technically there is no other way. What it does with it after that is its own responsibility.

Whoever runs a wiki can see a log. It shows what happened in that wiki. For example: someone was invited. Then the log also holds the invited person's email address. Or: a role was changed. A member was removed. Someone wrote a comment. A page was created, published, moved, renamed, deleted or brought back. Each entry shows which account did it. And when.

We need the data to run the wiki. This covers the profile, the membership and the rights. And the content, the comments, the mentions, the notifications, writing together and the files. Article 6(1)(b) GDPR allows this. For the other data there is a good reason on the organisation's side. Article 6(1)(f) GDPR allows this. For the version history: people should see who changed what. And they should be able to bring an old version back. For invitations: the organisation wants to bring people into its wiki. For the log: the organisation wants to see what changed in its wiki. And it wants to be able to look into misuse. For public pages: the organisation wants everyone to be able to read the content. For pictures from other websites: the organisation wants to design its wiki with pictures and its logo.

Pages, comments and files stay stored until the organisation deletes them. We remove a deleted file at once. We stop showing deleted pages and comments. The organisation can bring a deleted page back. They are only gone for good when the organisation's wiki is deleted. The older versions of a page and the invitations stay that long too. We delete notifications after 180 days. We delete entries in the log after 365 days. The organisation takes away your membership? Then we also delete which pages you watch. And your notifications and your rights in that wiki. You delete your account? Then your wiki profile, your memberships and your contributions stay stored. You can ask us to delete them at any time. Section “Your rights” says more.

Finding a time together (wann.link)

This applies to: wann.link

wann.link helps a group find a time that suits everyone. There is no sign-in and no user account.

If you create a meeting, you enter a title. And you suggest days or weekdays. If you join a meeting, you enter a name. And you show when you are free. The name does not have to be your real name. Without a name you cannot enter your times. No law says you must give a name. We do not ask for your email address or other contact details.

Anyone with the link can see the meeting. They see the title. And they see every name and time. So only give the link to people who should take part.

When you create or join a meeting, wann.link sets no cookies. It stores nothing on your device.

We need these details so your group can find a time. Without them, this cannot work. And that is exactly what you use wann.link for.

We delete a meeting with fixed days automatically. We do this 7 days after the last day people could choose. All names and times are deleted too. A meeting with weekdays has no last day. We delete it automatically one year after it was made.

Who gets your data?

We do not pass your data to anyone else. There are three exceptions: the cases on this page, cases where you said yes, and cases where a law makes us. Those involved are, for example:

There are two more cases. First: you join an organisation yourself. That organisation then sees your data. The organisation is responsible for it from then on. Second: sometimes we have to give data to authorities or courts. We only do that when a law makes us.

Does data go to other countries?

Our servers are in Germany. The data on our servers stays there. We send data to a country outside the EU and the EEA only for classification. EEA means: the EU plus Norway, Iceland and Liechtenstein. We send this data to the IDSF in the United Kingdom. The European Commission has checked that data is properly protected there. Sections “Data about health and disability” and “Who gets your data?” say more. Apart from that, we do not send any data to a country outside the EU and the EEA ourselves. You can sign in with a Google account. Then the company Google Ireland Limited in Ireland is our counterpart. Ireland is part of the EU. Google can still pass your data to the USA. Google decides that itself. Google is also responsible for it. Sections “Your account and signing in” and “Who gets your data?” say more. In the wiki, your browser sometimes fetches a picture from another website. That website may have its server outside the EU and the EEA. Section “The wikis for organisations” says more.

How long do we keep your data?

How long we keep your data is written under each purpose. If there is no set time yet, it says so there too. For every purpose, this also applies:

When we delete data, it stays in backup copies for up to 90 more days. The backup copies are kept by our hosting company. We only need them if something breaks. After 90 days at most they are written over.

Sometimes we are not allowed to delete data. For example because we still need it for another permitted purpose. We then lock the data. That means: we only use it for that one purpose. For nothing else.

Your rights

You have rights. You can use them at any time. It costs you nothing. And you do not have to give a reason. Only for an objection do we need a reason.

• See your data: you may ask which data we hold about you. We also tell you what we use it for, how long we keep it and who gets it. And we send you a copy. This is in Article 15 GDPR.
• Correct your data: is something wrong? Then we have to correct it. Is something missing? Then we have to add it. This is in Article 16 GDPR.
• Delete your data: you may ask us to delete your data. That applies when we do not need it any more. And when no law makes us keep it. This is in Article 17 GDPR.
• Lock your data: you may ask us to store your data only. We then may not use it any further. That is useful while we are checking a mistake, for example. This is in Article 18 GDPR.
• Take your data with you: you may get your data from us. In a file computers can read. We send it to you. Or we send it straight to another company. This covers the data you gave us yourself. This is in Article 20 GDPR.
• Take your yes back: did you say yes to something? You may take that back at any time. It has to be as easy as saying yes was. What happened before stays lawful. This is in Article 7(3) GDPR.

How to use your rights

Just write to us. Our address is in section “Who is responsible?”. A letter or an email is enough. There is no special form. We answer as fast as we can. At the latest within one month. Is your question very complicated? Then we may need longer. Two months longer at most. We will tell you if that happens. One more thing. We must not give your data to the wrong person. So sometimes we ask a question to check it is really you. We only ask what we have to.

Complaints

Are you unhappy with our answer? Then please write to us again. We look at every complaint ourselves. And we answer you. You can also complain to a government authority. You may always do that. You do not have to ask us first. This is in Article 77 GDPR. This is the authority responsible for us:

Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany

Does a computer make decisions about you?

No. No computer here decides about you on its own. One example is classification. There a program works out your class from the measurements. Section “Data about health and disability” says more. But a person decides there too: the IDSF's Chief Classification Officer checks the result. Only then does the class count. Apart from that, we do not rate you. And we do not sort you into groups. We do not pick adverts to match you. The protection program in section “Protection against misuse and spam” only checks one single entry in a form. It does not judge you as a person. Did it not work? Then try again. Or send us an email. The rule is Article 22 GDPR.

Notes for people outside the EU

supodo is for sports communities in Germany and Europe. Anyone anywhere can open our pages. But we do not offer our services into other countries on purpose. One thing matters here. Privacy laws in other countries usually only apply once a company actually looks for customers there. Not just because you can open the page there. So the GDPR and German law are what govern us. Here are a few notes anyway.

Australia

We do no business in Australia. So Australian privacy law does not apply to us. But we still follow the idea behind the Australian rule APP 1: a privacy page should be clear and up to date. Australia asks for two extra pieces of information. Here they are:

Who abroad gets data, and in which country? Your data sits in Germany. Some recipients outside Germany get data. For example: the IDSF in the United Kingdom gets the classification data. The company Google Ireland Limited in Ireland gets data. But that only happens if you sign in with a Google account. Google can also pass your data to the USA. You can read more in these sections: “Data about health and disability”, “Your account and signing in”, “Who gets your data?” and “Does data go to other countries?”.

How we deal with a complaint: write to us. Our address is in section “Who is responsible?”. We confirm your complaint arrived. We look at it ourselves. We answer within one month. And we explain our decision. Do you disagree with it? Then contact the authority in section “Your rights”.

Changes to this page

Sometimes we change this page. Because we add a new service, for example. Or because a law changes. The version on this page is always the one that counts. The date is at the bottom. Is a change important for you? Then we also tell you inside the service it affects. And if we need your yes for something, we ask you again first.