Privacy Policy

Scope

supodo is a platform for disability, inclusion and senior sport, made up of several services all operated by the same controller. This document applies to all supodo services. The individual services publish no legal notice and no privacy policy of their own but point to these pages instead.

Including:

• supodo landing page — Website
• supodo manager — Manager for organisations and events
• supodo app — Finding and following activities
• supodo link — Short links
• supodo wiki — Wikis for organisations
• supodo auth — Sign-in and user accounts
• supodo mail — Newsletter sign-up and email delivery

Beyond these, this document applies to any further publicly offered supodo service reachable at dev.supodo.com and its subdomains, or at dev.supodo.link.

It also applies to this service, which the same controller operates:

• wann.link — Group scheduling, without a user account

Internal test and development environments are not covered. Where they are publicly reachable, they publish their own details for that environment.

Which sections apply to which service

The table lists, for each service, the sections on its purposes. All other sections apply to every service.

Controller

Except where section “Health and disability data” says otherwise for classification, or section “Sports results and records” does, the controller for the processing on all of the services listed above in section “Scope”, within the meaning of Art. 4(7) GDPR, is:

supodo
Marib Aldoais
Leimbergerstraße 43a
91052 Erlangen
Germany

Email: kontakt@supodo.com
Phone: +49 170 9000109

Data protection officer

We have not appointed a data protection officer; Section 38(1) of the German Federal Data Protection Act (BDSG) does not require us to. For any data protection question, please use the contact details above.

The legal bases we rely on

We process personal data only on a legal basis, and we name it at each processing activity. Four bases occur:

Wherever we rely on legitimate interests, we have carried out a balancing exercise against your rights and freedoms. We will tell you its outcome on request.

Children and young people

In youth sport, minors use our services too. Where we rely on your consent, that consent is valid under Art. 8(1) GDPR only from the age of 16. Germany has not used the option in that article to set a lower age limit, so 16 applies. Below the age of 16, consent must be given or authorised by a parent or other holder of parental responsibility. There is more to it: an activity can state a minimum and a maximum age. If you take part in one aimed explicitly at children or young people, your approximate age can be inferred from that — even though you never told us your date of birth. We collect a date of birth only in the person profile for classification (section “Health and disability data”), which parents can also create for their child. There we check the age when consent is given: under 16 a parent consents, from 16 the person themselves. Otherwise we do not collect an age and we do not check it technically. Published results and records state the age group (section “Sports results and records”).

From the age of 16, a parent can hand their child's person profile over to the young person's own account. The parent receives a one-time code, valid for seven days, and passes it on outside supodo; a new code replaces the previous one. Once the young person accepts the handover with the code in their own account, the profile and its classifications belong to them, and the parent no longer has access. A measurement started for the profile but not yet submitted is cancelled. We record the handover in the register's log (section “Retention for classification”).

This age limit applies only to processing based on consent, not to processing that performs a contract or rests on legitimate interests.

Our newsletter is addressed to adults. We do not knowingly enrol anyone under 16. If we learn that a sign-up was made without the required consent of a parent or guardian, we delete it.

Where an organisation enters a minor as a member or participant, it is the organisation — not us — that obtains the required consent from the parent or guardian. We have no contact with the parent or guardian and cannot obtain that consent. The organisation remains responsible for the lawfulness of the data it enters.

If you hold parental responsibility and have a question about a child's data, or want it deleted, please use the contact details in section “Controller”. We treat such requests as a priority.

Common to all services

This section applies to every service.

Hosting

All of our services run on servers we operate with a provider in Germany. All personal data arising from your use is stored there.

We use the following hosting provider:
Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany

The legal basis is Art. 6(1)(b) GDPR where hosting serves to provide a service you have asked for, and Art. 6(1)(f) GDPR for our interest in secure, fast and reliable operation by a competent provider.

We have a data processing agreement with the hosting provider under Art. 28 GDPR. It processes data only on our instructions. Our IT infrastructure is located in Germany, and the agreement confines processing to the EU and the EEA. No transfer to a third country takes place through the hosting provider.

Log data

Operating our services produces technical log data. Requests to our database and sign-in interface — which sits behind, among others, the Manager, the app, the wiki and the short links — are recorded in a log store on the same servers. This records:

• the time of the request
• the interface called
• the HTTP method used
• the response status
• your IP address
• your browser identifier (user agent)

We do not combine this data with other sources and do not build user profiles from it.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the technically faultless operation of our services, fault-finding, and defending against attacks and misuse. For the same reason we briefly count how often a form on the website is submitted from one IP address, and refuse further submissions once a limit is reached. These counters are held in memory only; they are not stored permanently and are discarded after a short time.

We remove the IP address and the interface called from these logs automatically after 7 days and delete the rest of the entry after 30 days. We do not need the data for the purposes named above any longer than that.

Cookies and storage on your device

We use strictly necessary cookies only, in particular for sign-in and sessions in the Manager, the app, the wiki and the platform administration console. No consent is required for these under section 25(2) no. 2 of the German TDDDG, because they are strictly necessary to provide the service you have expressly requested. We use no cookies for analytics, advertising or audience measurement, no third-party analytics tools, and no embedded external fonts, maps or videos. We count how often a short link is opened ourselves, without cookies (see “Short links”). That is why our services carry no cookie banner.

We store further items on your device, likewise without consent under section 25(2) no. 2 of the German TDDDG. On the website and in our applications, in particular the Manager, the app and the platform administration console, a cookie remembers the language version you chose, so that a visit without a language in the address appears in that language; this cookie is a session cookie and is deleted when you close the browser. In the Manager and the platform administration console, your browser remembers in local storage whether you collapsed the side bar. In the Manager, a cookie remembers up to twelve organisations you administer and most recently opened, so that the side bar offers you those first; we delete this cookie after 30 days. After you save a change, the Manager uses a cookie to show you the confirmation message for one minute. For the additional confirmation of your sign-in (section “User accounts and sign-in”), the Manager sets a cookie with check values for at most ten minutes. After you delete your user account, the Manager sets a cookie for at most five minutes that holds only when your account was deleted and whether we sent you the confirmation by email, so that the confirmation page can show both. In the app, a service worker can store in your browser's cache storage the files the app needs to display its pages, an offline page, and copies of public pages you opened, each with the time it was fetched, so that you can open those pages without an internet connection. It stores no page you open while signed in, and the copies stay on your device until a new version of the app replaces them, we switch the feature off, or you clear the site data in your browser. In the wiki, your browser remembers in local storage which branches of the page tree you expanded. These items are part of the services you deliberately opened and serve only their function and presentation; we do not evaluate them and do not combine them with anything. The short-link service stores nothing on your device (section “Public display of activities”).

Security

We transmit all pages over encrypted HTTPS only, and take technical and organisational measures under Art. 32 GDPR to protect your data against loss, alteration and unauthorised access. In the Manager and the app, access to other users' data is enforced in the database itself, not only in the application.

Links to external websites

Our services contain links to third-party websites. We are not responsible for their content or their data protection practices. Please check their privacy information before entering personal data there.

Data is transmitted to the link target only once you click an external link. This is technically necessary because of the protocol underlying the internet (TCP/IP). What is transmitted includes your IP address, the time you clicked, and the operating system and browser version of your device.

Contact form, and enquiries by email or phone

Applies to: the dev.supodo.com website

When you write to us through the contact form, we process your email address, the subject and your message, in order to handle your enquiry and in case of follow-up questions. You receive a confirmation at the address you gave, which reproduces your message. If you contact us by email or phone, the same applies to the data arising there.

The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or its preparation. In all other cases it is Art. 6(1)(f) GDPR — our legitimate interest in answering enquiries addressed to us — or your consent under Art. 6(1)(a) GDPR where you volunteer additional information.

Your email address is required so that we can reply; without it we cannot handle your enquiry. The form does not ask for your name. There is no statutory or contractual obligation to provide it.

We delete your enquiry once it has been dealt with conclusively, unless a statutory retention period applies.

Newsletter

Applies to: the dev.supodo.com website and the newsletter

For the newsletter we process your email address and the language you chose. We do not ask for your name when you sign up; you can add it yourself later in your newsletter preferences. Sign-up uses the double opt-in procedure: after signing up you receive an email in which you have to confirm. We store the time of sign-up and of confirmation in order to be able to demonstrate consent, together with delivery and bounce information so that we stop sending to invalid addresses.

The legal basis is your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time, using the unsubscribe link in every newsletter or by messaging us. Withdrawal takes effect for the future only.

We run delivery ourselves, using the Listmonk software on the servers we rent, described in section “Common to all services” (see also section “User accounts and sign-in”). No external mailing service is involved.

We store your data until you unsubscribe. If you do not confirm your sign-up, we delete the entry automatically 30 days after you signed up. After you unsubscribe, or if we block your address, we keep your entry, with the times of sign-up, of your confirmation and of unsubscription or blocking, for three years after it last changed. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is being able to demonstrate your consent and its withdrawal and so to defend against claims. After the three years we delete the entry automatically.

Protection against abuse

Applies to: the dev.supodo.com website and the newsletter

To protect the contact form, the newsletter sign-up and the reporting form against automated abuse, our server sets your browser a computation which it solves in the background. It only starts once you tick the box below the form — nothing is loaded and nothing is computed for it before that. You do not have to solve a picture puzzle. The mechanism runs entirely on our own servers; no third-party service is involved.

Once you tick the box, your browser fetches the task from our server and computes the answer on your device. Only the task and its answer are transmitted. We process your IP address as we do on any other request to our servers, in order to limit the number of requests (section “Common to all services”). We do not evaluate information about your browser or your device for this mechanism, and no data is passed to third parties in the process.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is protecting our forms against spam, against bulk sending, and against our confirmation email being used to write to arbitrary third parties.

User accounts and sign-in (auth.dev.supodo.com)

Applies to: the Manager, the platform administration console, websites for organisations, and wikis for organisations

Sign-in runs on a service we operate ourselves, on the servers described in section “Common to all services”.

For your user account we process your username, email address, first and last name, your password exclusively as a hash that cannot be reversed, any passkeys you have registered, the status of email verification, linked external identities, and session data: sign-in times, session and access tokens, and counters of failed sign-in attempts. We also record when you accepted our terms of use — we have to be able to demonstrate that. For specially protected functions, such as classification (section “Health and disability data”), we ask you to confirm your sign-in a second time, for example with a passkey or a one-time code from an authenticator app; for this we store any one-time-code setup you create with your account, and record which session the confirmation is for and until when it is valid.

Our sign-in service additionally writes a log event for security-relevant activity around your account, in particular signing in, signing out, a failed sign-in, registration, confirmation of your e-mail address, and a change of your password. It records the time, the type of event, your account identifier and your IP address. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the security of accounts and the investigation of misuse. We delete these log events automatically after 90 days.

When you register, we send an email to the address you gave, which you have to confirm. Without confirmation the account cannot be used. We send that email through a mailbox at our hosting provider; no further service provider is involved.

You can alternatively sign in with a Google account. If you do, Google transmits your email address, your name and an identifier to us, and we create an account here from that. We adopt the email address Google has already verified as confirmed, so no further confirmation email is needed. Google is the controller for the processing of your data at Google; the transmission is triggered by your decision to sign in that way. If you would rather not, register with an email address and a password.

The legal basis is Art. 6(1)(b) GDPR for the account and sign-in, and Art. 6(1)(f) GDPR for email verification and the counters of failed sign-in attempts — our legitimate interest being account security.

We store account data until you delete your account or ask for its deletion. Session data is deleted shortly after it arises, and the sign-in service's log events automatically after 90 days.

Organisations, events and roles

Applies to: the Manager

The Manager is used by people who maintain activities and events on behalf of an organisation, and it requires a user account.

Sign-in goes through our central sign-in service; section “User accounts and sign-in” sets out what data arises there. Within the Manager itself we additionally store which roles your account holds in which organisations and events, and who created a record. For organisations, contact details, images and short links we also record who last changed them.

For organisations and events we process the information the people responsible enter there: name, description, type of organisation, sports, target groups, times, places and addresses, costs, images, links to social networks, and contact details such as email address, telephone and fax number. Contact details are often personal data, even where they belong to an organisation.

About people we process roles: administrator, member and follower at organisation level; event manager, participant, support and follower at event level. Technically, a role consists only of a reference to your account, a reference to the organisation or event, and the kind of role. What can nevertheless follow from that is set out in section “Health and disability data”.

Where an organisation enters data about a person who does not hold the account themselves, we receive that data not from the data subject but from the organisation. We provide this information here in accordance with Art. 14 GDPR. The organisation is responsible for the lawfulness of that entry and for informing the person concerned.

Invitations: an administrator of an organisation can invite another person by email address or username to help manage the organisation. For this we store, in particular, the address or username entered, the organisation, who sent the invitation, the invitation's language and whether it was accepted, declined or withdrawn, and we send at most one email. If the person already has a supodo account, we link the invitation to that account and send the email to its confirmed address. While the invitation is open, the organisation's administrators see the address or username entered and whether an account exists for it. We receive this data not from the invited person but from the inviting organisation (Art. 14 GDPR). The purpose is to deliver the invitation and show it at sign-in; the legal basis is Art. 6(1)(f) GDPR – the organisation's legitimate interest in growing its team. We delete an open invitation after 30 days, an accepted or withdrawn one a day after the answer, and a declined one 30 days after the answer. To prevent abuse, we count for one day how often someone sends invitations. If someone no longer wants to receive invitations by email, we store only a hash (SHA-256) of their address until they turn this off again.

The legal basis is Art. 6(1)(b) GDPR for the account, sign-in and the maintenance of one's own content. For the public visibility of published activities it is Art. 6(1)(f) GDPR — the organisation's legitimate interest, and our own, in making disability, inclusion and senior sport activities findable; that is precisely what these services exist for.

Content remains stored until the organisation deletes it. If an organisation deletes itself, its data initially remains stored and can be restored by the organisation; we have not yet set a fixed period after which it is removed for good — once it is set, we will name it here. Roles remain stored until they are ended. If you delete your account, your roles are deleted with it.

Public display of activities

Applies to: the app and short links

We show organisations and events publicly so that sports activities can be found. This also covers the events widget and every page on which published activities appear.

Organisations and events become publicly visible once the organisation sets them to "published". Before that they are visible only to the accounts entitled to see them. Roles, memberships and participation are not publicly visible; the exception is competition results and records (section “Sports results and records”).

No sign-in is needed to search and view published activities. Only the log data described in section “Common to all services” arises. The same applies to the events widget, with which an organisation shows its published events on its own website: your browser loads it from our servers when you open that website. The widget sets no cookies and stores nothing on your device.

Short links (dev.supodo.link)

The short-link service resolves a short address and forwards you to its target. There is no sign-in, and no content of yours is stored.

When you open a short link, we determine its target and forward you there. The target may be a supodo page or an external website.

This service sets no cookies. It stores nothing on your device and builds no user profiles.

We hold your IP address only briefly in memory to limit the number of requests per IP address and so protect the service against automated abuse; it is not stored. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the stable, abuse-free operation of the service.

We count how often a short link is opened. For each forward we store, in particular, the hour of the request, the name of the website you came from, and whether the request came from a browser or an automated program. The people responsible for the organisation that manages the short link see only how often it was opened. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is showing organisations how their short links are used. After 30 days we combine the information into a total number of visits and delete it; we delete the total together with the short link.

As soon as we forward you, data is transmitted to the target — including where the target is somebody else's website; section “Links to external websites” says which. For processing on a third-party target page, its operator is responsible.

Following and anonymous accounts

Applies to: the app

In the app you can follow organisations and events.

The first time you do something that has to be stored — following an organisation, for instance — we automatically set up an anonymous account for your device. That account holds no name, no email address and no password; it consists only of an identifier stored in your browser, and serves solely to find your list of followed activities again. We cannot link an anonymous account to a person known by name. It is nonetheless personal data within the meaning of Art. 4(1) GDPR, because it amounts to an online identifier.

When you follow an organisation or an event, we store a follower role for it — the reference to your account, the reference to the activity, and the time. That list is visible only to you. Please note section “Health and disability data”, which applies even if you only follow.

The legal basis is Art. 6(1)(b) GDPR: without this anonymous account a list of followed activities cannot technically be kept, and that list is the very function you asked for.

If you clear your browser data, your anonymous account is no longer reachable by you. Anonymous accounts that never followed anything are deleted automatically after 30 days. For anonymous accounts that do have followed activities we have not yet set a fixed period; we will delete them once we have determined one, and will state it here. On request we delete your anonymous account at any time.

Platform statistics

Applies to: the platform administration console

To run the platform we record daily how many organisations, events, accounts and short links exist and which status each organisation and event holds. Accounts are only counted. Because the address of an organisation or event can contain a person's name, we treat this history as personal data.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is an overview of how the platform develops and runs.

We keep the history of figures and statuses permanently. We remove the address of a deleted organisation or event from it 90 days after it was last recorded.

Reports about illegal content and breaches of the Terms of Use

Applies to: the dev.supodo.com website

When you report content to us through the reporting form, we process the kind of report you chose, the exact address of the content, your description and — where you provide them — your name and email address. The report therefore also contains personal data about the person whose content you are reporting. We use this information solely to review the report, to confirm receipt and communicate our decision to you, and to give a statement of reasons to the person affected.

For reports about illegal content the legal basis is Art. 6(1)(c) GDPR: handling them is required of us by Art. 16 of Regulation (EU) 2022/2065. Where you report a breach of our Terms of Use, no such legal obligation exists. That processing rests on Art. 6(1)(b) GDPR as far as it serves the performance of the terms agreed with the person concerned, and otherwise on Art. 6(1)(f) GDPR — our legitimate interest in keeping our services free of content that breaks our own rules. If you do not state the kind of report you are making, we classify it ourselves; until then we process it on the basis of Art. 6(1)(f) GDPR.

Without the exact address and a description we cannot act on a report. For reports about illegal content your contact details are required by law, unless the report concerns content involving the sexual abuse of children — in that case you may report without them. For reports about a breach of the Terms of Use there is no legal duty to give them; we ask for them because we otherwise cannot settle the report with you. Without contact details we can tell you neither that the report arrived nor what we decided.

We do not pass your contact details to the person whose content you reported. What we must give that person is the reasoning behind our decision — not the identity of whoever reported it.

If we restrict a piece of content, we send the statement of reasons to the administrators of the organisation concerned and store who decided and to whom the statement was sent. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 17 of Regulation (EU) 2022/2065. We keep this information as long as reports.

We keep reports and the related correspondence for three years from the final decision.

Websites for organisations (pages.dev.supodo.com)

Applies to: websites for organisations

On this platform we run websites for organisations. People whom an organisation has entrusted with maintaining its website sign in there, which requires a user account.

Sign-in goes through our central sign-in service; section “User accounts and sign-in” sets out what data arises there. On the platform itself we additionally store your email address and user name from the sign-in service, the identifier of your account there, which role you hold for which website, your sessions and your settings for the user interface. While you edit a page, it is marked as locked by your account so that nobody changes the same page at the same time; the lock takes effect for at most five minutes after your last activity. An organisation’s administrators see the accounts that have access to its website.

The platform sets in particular a cookie for sign-in that expires after two hours, and during sign-in a cookie with check values for at most ten minutes. After you sign in through our central sign-in service, it sets one further cookie that expires after seven days and can be read only by the server; it holds the sign-in service's session and access tokens and the time of the last check, so that the platform checks at most once a minute, rather than on every request, whether your sign-in is still valid. It is not set for an emergency sign-in with a password. Two further cookies remember for up to one year which website you last edited and in which language the user interface appears. In local storage, your browser remembers for example which view you use to edit the navigation. This too requires no consent under section 25(2) no. 2 of the German TDDDG, because it serves only the function of the platform you are deliberately using. To fend off abuse, we also briefly count how often sign-in is attempted from an IP address; we hold these counters in memory only and discard them after a short time.

The organisation concerned is responsible for the content of its website and for messages sent to it through a contact form. Its website’s privacy policy sets out the details.

The legal basis is Art. 6(1)(b) GDPR for the account, sign-in and the maintenance of the website. For counting sign-in attempts it is Art. 6(1)(f) GDPR; our legitimate interest is protecting accounts against abuse.

Your account on the platform remains stored until you delete it yourself, the organisation deletes it, or you ask us to delete it; your roles, sessions and settings are deleted with it. If you have not signed in for 24 months, we delete it automatically. Deleting your central user account does not automatically delete this account.

Sports results and records

Applies to: websites for organisations

Organisations publish the results and records of their competitions on their websites, including internationaldwarfsportsfederation.org and wdg2023.com. The purpose is to document sporting achievements and keep them comparable over the years.

The published data includes the athletes' name, nation, age group, gender and class, the discipline, the mark, the placing or medal, and the Games at which the mark was set. It includes results of children and young people.

The controller is the organisation that publishes the results or records on its website; it is named in that website's legal notice and privacy policy. We store and publish the data on its behalf. We receive it not from the athletes themselves but from the organisations that host the competitions or keep the records, in particular from the official result and record lists of the Games (Art. 14 GDPR).

The legal basis is Art. 6(1)(f) GDPR — the organisation's legitimate interest in documenting and announcing the results of its competitions. The class, and taking part in competitions for athletes with dwarfism, indicate dwarfism; this is health data under Art. 9(1) GDPR. Which exception under Art. 9(2) GDPR its publication rests on has not yet been settled.

The recipient is the public: anyone can view the results and records without signing in.

Results and records are kept as a lasting record of the Games. They remain published until the organisation removes them or an objection or erasure request succeeds.

If you appear in results or records, you can object to their publication (Art. 21 GDPR) or ask for erasure (Art. 17 GDPR) — with the organisation that publishes them, or with us using the contact details in section “Controller”. For a child, a parent or guardian can do this. We pass requests we receive on to the organisation and carry out its decision. You can exercise your other rights from section “Your rights” the same way, including access and rectification.

Wikis for organisations (wiki.dev.supodo.com)

Applies to: wikis for organisations

In the wikis, organisations write, comment on and publish their own pages. Each organisation has its own wiki, kept apart from the wikis of the others.

To take part you need a user account; you sign in through our central sign-in service (section “User accounts and sign-in”). Pages released to the public can also be read without signing in.

Each time you sign in to the wiki, we create or update a wiki profile from your user account: your identifier, a display name and, if your account supplies one, the address of a profile picture. The display name is the name in your user account; if none is stored there, it is your email address. The other members of the wikis you belong to see your display name and your role, the display name for example on your comments, in the version history and when they mention someone.

We store which wikis your account belongs to and which role it holds there: administration, editing, commenting or reading. An organisation can also give you further rights for individual areas or pages; we store those too. On every request we use these details to check what you may see and do.

Invitations: whoever administers a wiki can invite a person by their email address. For this we store the address, the intended role, who sent the invitation and when it was accepted. We send no email when this happens. If you sign in with an account whose confirmed email address matches an invitation, you become a member of that wiki. We receive this data not from the invited person but from the inviting organisation (Art. 14 GDPR).

For pages, drafts, templates and comments we process the content, who created or last changed it, and the times. If you mention a person, we store their display name and identifier in the content and notify them in the wiki. You also receive notifications about pages you watch; you automatically watch a page you create. Where content names another person, we receive that data not from them (Art. 14 GDPR). The organisation running the wiki is responsible for the lawfulness of such data.

When several people edit a page at the same time, they see each other's display names, identifiers and the place where each is writing; we do not store this display. We store the individual changes with the identifier of the person who made them until enough of them have accumulated to combine them into an overall state of the page, or until the draft is discarded.

Version history: a page becomes visible only once it is published; until then only people who may edit it see its draft. Each time a page is published we keep that state as a version, together with who published it and when, and a summary of the change if someone wrote one.

We store uploaded files in non-public storage, together with the original file name and who uploaded them. We serve a file only after checking that you may read the page it belongs to.

Individual pages can be readable publicly, without signing in. That requires two separate releases: the page must be public, because it, a parent page or the area it belongs to is marked public, and the organisation must have allowed public access for its wiki as a whole. If either is missing, the page is not publicly accessible. Once a page is public, its files, its earlier versions and its comments can be retrieved publicly too, the comments with the display name of the person who wrote them. If no name is stored in your user account, that is your email address. For the versions, we do not show who published them.

If an organisation sets a logo from another website for its wiki, or a page contains an image from another website, your browser loads it directly from there. The operator of that website necessarily receives your IP address in the process; it is itself responsible for what it does with it afterwards.

For the administrators of a wiki we keep a log of events in their wiki, in particular invitations with the invited email address, role changes, the removal of members, new comments, and the creation, publication, moving, renaming, deletion and restoration of pages, each with the account that acted and the time.

The legal basis is Art. 6(1)(b) GDPR for the profile, membership and rights, content, comments, mentions, notifications, joint editing and files. For the other processing it is Art. 6(1)(f) GDPR, each with this legitimate interest: for the version history, the traceability and recoverability of jointly edited content; for invitations, the organisation's interest in admitting people to its wiki; for the log, the organisation's interest in tracing changes in its wiki and investigating misuse; for public pages, the organisation's interest in making the content of its wiki generally accessible; for images loaded from other websites, the organisation's interest in designing its wiki with images and its logo.

Pages, comments and files remain stored until the organisation deletes them. We remove a deleted file from storage immediately. We hide deleted pages and comments, and the organisation can restore a deleted page; they are finally removed together with the organisation's wiki. We keep a page's version history and invitations for as long as well. We delete notifications after 180 days and log entries after 365 days. If the organisation withdraws your membership, we delete your watched pages, notifications and further rights in that wiki along with it. If you delete your user account, your wiki profile, memberships and contributions remain stored; you can ask for their deletion at any time (section “Your rights”).

Group scheduling (wann.link)

Applies to: wann.link

wann.link helps a group find a time that suits everyone. There is no sign-in and no user account.

Whoever creates a meeting enters a title and the days or weekdays to choose from. Whoever takes part enters a name of their choice and marks when they are available. The name does not have to be a real name. Without a name you cannot enter your times; there is no statutory obligation to provide one. We do not ask for an email address or any other contact details.

Anyone who has a meeting's link can see it: the title and every name and time entered. So share the link only with the people who should take part.

Creating and answering meetings on wann.link sets no cookies and stores nothing on your device.

The legal basis is Art. 6(1)(b) GDPR: without these details no common time can be found, and finding one is the very function you are using.

A meeting with fixed days is deleted automatically, with every name and time, 7 days after the last day on offer. A meeting by weekday has no last day; it is deleted automatically one year after it was created.

Recipients and processors

We do not pass personal data to third parties except in the cases named in this policy, where you have agreed, or where we are legally required to. Those involved include:

Beyond that, data can reach organisations you have joined yourself — these are not processors but are themselves controllers for the processing within their own area. And we may be obliged to disclose data to public authorities or courts; we do so only to the extent we are legally required to.

Transfers to third countries

All data stored on our servers stays in Germany. The only transfer to a country outside the EU and the EEA is for classification: we make that data available to IDSF in the United Kingdom (sections “Health and disability data” and “Recipients and processors”). A European Commission adequacy decision applies to the United Kingdom (Art. 45 GDPR). If you sign in with a Google account, our counterpart is Google Ireland Limited in Ireland and therefore within the EEA; whether and how Google passes data on to the United States beyond that is Google's own decision and responsibility as an independent controller (sections “User accounts and sign-in” and “Recipients and processors”). If your browser loads an image from another website in the wiki, that website's server may also be outside the EU and the EEA (section “Wikis for organisations”).

Retention periods

How long we keep data is stated in the section on each purpose; where no period has been set yet, that section says so. For every purpose, the following also applies:

Deleted data remains in backup copies at our hosting provider for up to 90 days. We use those copies only to restore operation after an outage or error, and they are overwritten when the backup expires.

Where deletion is not possible because the data is still needed for other permissible purposes, we restrict the processing instead: the data is then processed for that purpose only and not used further.

Your rights

You have the following rights in relation to us. Exercising them is free of charge, and you do not have to give reasons — with the exception of objection.

• Access (Art. 15 GDPR): you can find out whether and what data we process about you, for what purposes, for how long, who we pass it to and where we got it, and obtain a copy of it.
• Rectification (Art. 16 GDPR): you can have inaccurate data corrected and incomplete data completed.
• Erasure (Art. 17 GDPR): you can ask us to delete your data, to the extent we no longer need it and are not legally required to keep it.
• Restriction of processing (Art. 18 GDPR): you can require us to store data only, for the time being, and not use it further — for instance while we check a rectification.
• Data portability (Art. 20 GDPR): you can receive the data you provided to us on the basis of consent or a contract in a common, machine-readable format, or have it transmitted to another controller.
• Withdrawal of consent (Art. 7(3) GDPR): you can withdraw consent you have given at any time, as easily as you gave it. Processing carried out before the withdrawal remains lawful.

How to exercise your rights

A message to the contact details in section “Controller” is enough; no particular form is required. We reply without undue delay and at the latest within one month of receipt. Where a request is complex we may extend that period by up to two further months, and will tell you if we do. To prevent us handing data to the wrong person, we may have to ask a question to verify your identity; we will not ask for more information than necessary.

Complaining to a supervisory authority

If you are not satisfied with our answer, please write to us again — we review every complaint ourselves and respond to it. Independently of that, you have the right under Art. 77 GDPR to complain to a data protection supervisory authority, in particular in the Member State of your residence, your place of work, or the place of the alleged infringement. The authority responsible for us is:

Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany

No automated decision-making

We take no decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). For classification (section “Health and disability data”) the software calculates the classes from the measurements; they apply only once IDSF's Chief Classification Officer has reviewed and confirmed the measurement. Beyond that, we carry out no profiling, no scoring or rating of people, and no ad targeting. The bot check on the forms described in section “Protection against abuse” assesses a single form submission, not you as a person; if a submission is rejected you can try again or email us directly.

Information for users outside the EU

supodo is aimed at sports communities in Germany and Europe. Our services are reachable from anywhere, but we do not offer them into other markets on purpose. Foreign data protection law generally attaches to whether a service targets a market, not to whether a page can be opened there. What governs us is therefore the GDPR and German law. The following notes are added so that you can place your own situation.

Australia

We do not carry on business in Australia within the meaning of section 5B of the Privacy Act 1988 (Cth), and so we are not currently subject to that Act or to the Australian Privacy Principles. We nonetheless follow the substance of APP 1 — a clearly expressed, up-to-date privacy policy — and add the two items APP 1.4 requires beyond Art. 13 GDPR.

Overseas recipients and their countries: your data is stored in Germany. Recipients outside Germany include: the International Dwarf Sports Federation (IDSF) in the United Kingdom, which receives the classification data; and, if you sign in with a Google account, Google Ireland Limited in Ireland, which may pass data on to the United States within its own responsibility (sections “Health and disability data”, “User accounts and sign-in”, “Recipients and processors” and “Transfers to third countries”).

How complaints are handled: write to us using the contact details in section “Controller”. We acknowledge receipt, review the matter ourselves, reply within one month, and give you the outcome with our reasons. If you disagree with it, you can approach the supervisory authority named in section “Your rights”.

Changes to this privacy policy

We adapt this policy when our services or the legal requirements change. The version published on this page is the one that applies; the date below shows its status. Where a change materially affects you, we additionally give notice at a suitable place within the service concerned. If a processing activity based on your consent changes, we obtain fresh consent beforehand.