Legal notice & privacy

1. Controller

Bundesverband Deutscher Kettlebell Sportler e.V. (BVDKS e.V.)
Schlossberg 20
52222 Stolberg
Germany
Phone: +49 151 12331261
Email: info@bvdks.de

Represented by the board pursuant to § 26 BGB.

2. General information on legal bases

Personal data is only processed if there is a legal basis for doing so. Depending on the processing, the following legal bases in particular may apply:

• Art. 6(1)(a) GDPR in the case of consent.
• Art. 6(1)(b) GDPR for the initiation or performance of a contract or a membership or participation relationship.
• Art. 6(1)(c) GDPR for compliance with legal obligations.
• Art. 6(1)(f) GDPR to protect legitimate interests, provided that the interests or fundamental rights of the data subject do not prevail.

Where processing is based on legitimate interests, these interests are named in the respective section.

3. Hosting and server log files

The website is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. IONOS processes, on our behalf, data that is technically generated when the website is accessed. This may include in particular the IP address, date and time of access, page or file accessed, amount of data transferred, referrer URL, browser type and version, operating system and access status.

Processing is necessary to deliver the website, ensure its stability and security and detect technical faults or attacks. The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in the secure and functional operation of the website.

Server log files are deleted as soon as they are no longer needed to ensure the operation, stability and security of the website. Longer storage only takes place if, in individual cases, it is necessary to investigate or document a security incident or to fulfil legal obligations. A data processing agreement pursuant to Art. 28 GDPR has been concluded with IONOS.

4. Cookies and access to end devices

This website uses cookies and similar technologies. Where storing information on the end device or accessing information already stored is strictly necessary, this is done in accordance with § 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG).

Non-essential cookies and similar technologies are only used with prior consent pursuant to § 25(1) TDDDG. The processing of personal data associated with these optional services is based on consent pursuant to Art. 6(1)(a) GDPR. Technically necessary processing and the respective legal bases are described separately in the following sections.

Consent given can be withdrawn or changed at any time with effect for the future via the permanently accessible cookie settings.

5. Consent management

Real Cookie Banner is used to obtain, manage and document consent. This may involve processing the consent status, the time and scope of the selection, a randomly generated identifier and technically necessary device and browser information. The consent information is generally stored locally on the WordPress installation.

Processing is necessary to store the selection and to be able to prove that consent was given or refused. The legal bases are Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR and § 25(2) TDDDG.

6. Audience measurement with Burst Statistics

We use Burst Statistics to understand which pages are visited most often and how we can improve the information we provide. Analysis takes place on our own web server; statistics data are not sent to the developer of Burst.

Cookieless mode without device fingerprinting is enabled. In particular, the pages visited, time of access, referring website and general browser and device information are recorded. To associate a visit technically, an identifier is calculated from the IP address and browser identifier using a random value that changes daily. The full IP address is not stored in the Burst statistics tables. No tracking cookies are set, and visitors are not recognised across different days.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to analyse website use with minimal data collection and improve our website. Statistical analyses are retained for comparisons over time; they are not combined with membership, contact or registration data.

The browser’s “Do Not Track” setting is respected: if the browser sends this preference, Burst does not record the visit. Logged-in administrators are also excluded from tracking. Optional sharing of usage data with the plugin developer is disabled.

Jetpack remains disabled; no audience measurement with Jetpack takes place.

7. Contacting us

If you contact us by email, phone or contact form, the data transmitted, in particular contact details and the content of the message, is processed in order to handle the enquiry and, if necessary, answer follow-up questions.

If the contact serves to initiate or carry out a contractual, membership or participation relationship, the legal basis is Art. 6(1)(b) GDPR. Otherwise, processing is based on Art. 6(1)(f) GDPR; the legitimate interest lies in the proper handling of enquiries.

To protect the contact form against automated spam messages, a hidden check field (honeypot) and a check of the completion time are used. The content of the check field and a technical time value are evaluated. These checks take place within our website; no external CAPTCHA service is called. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in preventing misuse and ensuring that the association can be reached.

The data is deleted after final processing unless statutory retention obligations, an interest in providing evidence or ongoing legal matters prevent this. Communication relevant to contracts and bookkeeping is retained in accordance with the statutory periods.

8. Membership and member administration

When you apply for membership, as well as during and after membership, the necessary master, contact, membership, function, communication, fee and payment data is processed. This may include in particular name, address, date of birth, email address, phone number, club affiliation, date of joining and leaving, function, fee status, bank details and SEPA mandate data.

The purposes are to review the membership application, establish and manage the membership, communicate with members, collect fees, keep accounts, fulfil the purposes set out in the statutes and comply with legal and tax obligations. The legal bases are Art. 6(1)(b), (c) and (f) GDPR. Legitimate interests exist in particular in orderly association administration and in asserting or defending claims.

To the extent necessary, recipients may include board members and responsible association members, credit institutions, payment service providers, tax advisers, IT and administrative service providers and legally authorised authorities. Data is only transferred to other sports organisations if this is necessary for membership, licensing, insurance or participation in sporting events, or if there is another legal basis.

After membership ends, operational data that is no longer required is deleted. Fee, payment and accounting records are stored in accordance with the statutory retention periods. Data required to assert or defend claims may be retained until the relevant limitation periods expire.

8.1 Protected members' area and meeting minutes

In accordance with § 14 of the statutes, minutes of the general meeting are published in the protected members' area. In particular, the names and functions of the chair of the meeting, the minute-taker, applicants, persons elected and other persons named in resolutions may be processed.

Processing serves to inform members in accordance with the statutes and to ensure transparent organisation of the association. The legal bases are Art. 6(1)(b) and (f) GDPR. The legitimate interest lies in transparency and proper documentation of the association's work. Only authorised members have access. Unnecessary personal details and sensitive content are avoided or redacted before publication. The minutes are only kept accessible for as long as necessary for information, evidence and archiving.

8.2 Webling: online membership application and member portal

We use Webling for member administration, the online membership application and the member portal. The provider is uSystems GmbH, Klosterstrasse 34, 8406 Winterthur, Switzerland. Webling processes the member data we manage on our behalf for the technical provision of the association software. BVDKS e.V. remains the controller for the purposes and scope of this member administration.

In the online membership application, the master, contact, membership and payment data requested there, including the details of the SEPA direct debit mandate, are transmitted to Webling. In the member portal, the data required for login, access authorisation and the member functions used are processed. The purposes, legal bases, recipients and criteria for the storage period of our member administration are described in section 8.

The membership application and the member portal are reached via external links. A connection to Webling is only established when you open these services. Technical connection data is generated in the process, in particular the IP address as well as browser and device information. For data that Webling processes under its own responsibility when operating the service or handling support requests, the provider's privacy policy also applies.

According to Webling, the member data stored on our behalf is stored in Switzerland or in countries of the European Union. An adequacy decision of the European Commission pursuant to Art. 45 GDPR exists for Switzerland. Subprocessors used may also process data in other countries; the requirements set out in section 19 apply to this. Webling provides information about its service providers in its current list of subprocessors.

Further information: Webling privacy policy · Webling subprocessors.

9. Competition registrations and event management

For the registration, planning and running of competitions, courses and other events, the data processed includes in particular names, contact details, year of birth or age category, gender or scoring category, body weight or weight class, club, discipline, performance and qualification data, eligibility to compete, registration and payment status and organisational communication.

Processing is carried out to perform the participation relationship on the basis of Art. 6(1)(b) GDPR. Where legal or tax obligations exist, Art. 6(1)(c) GDPR is the legal basis. Organisational documentation, fraud prevention and enforcement of competition rules may be based on Art. 6(1)(f) GDPR; the legitimate interests lie in safe, fair and transparent sporting operations.

If, exceptionally, health data, medical certificates or information on health restrictions is collected, separate information will be provided. In such cases, a legal basis pursuant to Art. 9(2) GDPR will be ensured.

Mandatory fields are marked as such in the registration form. Participation is not possible without the details required for class allocation, contact, eligibility and payment allocation. Voluntary details are marked accordingly and can be omitted without disadvantage.

Recipients are only the persons and bodies responsible for the respective competition, in particular the competition management, the local host, the registration office, judges, those responsible for cash and accounting, and any IT or payment service providers used, insofar as the transfer is necessary for their respective task.

Registration data is deleted after the competition as soon as it is no longer needed for billing, documentation of results, proof of qualification or rankings, fulfilment of statutory retention obligations or the assertion or defence of claims. Start lists are removed after the event unless there are documentation reasons to keep them. Results lists, rankings and record lists may remain published long-term because of their purpose of documenting sports history.

9.1 Competition registration via Jotform

The Jotform service is used for some competition registrations. The provider is Jotform Inc., 4 Embarcadero Center, Suite 780, San Francisco, CA 94111, USA.

When the form is accessed and completed, Jotform processes technical connection data as well as the registration, contact and competition data entered in the form. This may include in particular name, contact details, year of birth or age category, gender or scoring category, club, discipline, weight class, performance and qualification data, eligibility to compete, registration and payment status and organisational details.

Jotform processes the form data as a processor. This is based on a data processing agreement pursuant to Art. 28 GDPR. Jotform's Data Processing Addendum contains appropriate safeguards for transfers outside the European Economic Area, in particular EU standard contractual clauses where required.

Where EU data storage is activated for the Jotform account used, the form data is stored on European servers, in particular in Frankfurt am Main, according to Jotform. The storage setting selected can be viewed in the Jotform user account.

EU data storage does not rule out that individual support, security, sub-processing or legally required processing operations may take place outside the European Economic Area. Jotform names, among others, possible processing in the USA, the United Kingdom and Turkey.

The legal basis for processing the competition registration is Art. 6(1)(b) GDPR. Where legal or tax obligations are concerned, Art. 6(1)(c) GDPR also applies. For technically unnecessary embeds, external CAPTCHA services or comparable technologies, consent pursuant to § 25(1) TDDDG and Art. 6(1)(a) GDPR is obtained beforehand where required.

The embedded form is only loaded after you actively enable it. Alternatively, a clearly marked external link to the form may be offered. The privacy information for the specific event can be accessed directly at the form.

The data collected in the form is deleted after the respective event as soon as it is no longer needed for billing, documentation of results, proof of qualification or rankings, statutory retention obligations or the assertion or defence of legal claims.

Before the form is submitted, reference is made to this privacy policy and to the event-specific privacy information. An acknowledgement does not replace consent. Voluntary consent, in particular for individual portraits, promotional photos or other image publications, is obtained separately, explicitly, without pre-ticked boxes and can be withdrawn at any time.

Further information: https://www.jotform.com/privacy/

10. Results lists, rankings and records

For the sporting evaluation and documentation of competitions, name, club, nation, age and weight class, discipline, competition weight used, performance achieved, placing, qualification, ranking points and records may be published on the website, in competition protocols and in association media.

Information on the type, scope and purpose of publication is provided in the respective competition announcement and registration form. The immediate presentation of results is part of running the competition and is based on Art. 6(1)(b) GDPR. Further publication and archiving are based on Art. 6(1)(f) GDPR. The legitimate interests lie in transparent presentation of results, comparability of sporting performances, maintaining rankings and records, and documenting the history of the association.

Publication is generally limited to the details required for the sporting evaluation. Particular consideration is given to minors and other vulnerable persons. Justified objections as well as requests for rectification, restriction or erasure are examined on a case-by-case basis.

Results lists, rankings and record lists may remain available long-term because of their purpose of documenting sports history. The statutory rights of the data subjects remain unaffected.

11. Photographs at events

Photos may be taken at public association events and competitions. Overview shots, photos of general sporting action and photos of award ceremonies may be published on the website, in association media and on social media profiles for reporting, documentation and the public image of BVDKS e.V., where permissible in the individual case.

Targeted individual portraits, highlighted individual shots, promotional photos and comparable publications are only made on the basis of separate, expressly given consent pursuant to Art. 6(1)(a) GDPR. This consent is obtained separately from the competition registration, is not pre-ticked and can be withdrawn at any time with effect for the future.

Information on planned photography and publication is provided in the respective competition announcement and registration form. The interests and rights of the persons depicted are taken into account. Objections may be raised to photos based on legitimate interests on grounds relating to the particular situation of the data subject. In the case of minors, age and need for protection are taken into account; where necessary, the consent of the persons with parental responsibility is obtained.

12. Club, studio and coach directory

Map and list entries of clubs and businesses offering kettlebell training are published. The entries may contain the name or company name, business or club address, website, name of a contact person, email address and phone number.

Personal contact details are only published at the express voluntary request of the data subject. The legal basis is consent pursuant to Art. 6(1)(a) GDPR. Consent can be withdrawn at any time with effect for the future. After withdrawal, the personal details are promptly removed from the public directory unless there is another legal basis.

Consent is documented and includes the specific details released as well as the notice that the data can be accessed worldwide via the internet and indexed by search engines.

The GDPR does not apply to pure company or club data without reference to a person. If the entry contains personal data of a contact person, the above information applies.

13. Google Maps

Maps from the Google Maps service may be embedded on individual pages. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When a map is loaded, the IP address, device and browser information and the page accessed in particular are transmitted to Google.

Google Maps and the associated Google fonts are only loaded after your voluntary consent. You can make this choice in the cookie banner or directly on the blocked map; it applies to Google Maps throughout this website. Without consent, the map remains blocked. You can change or withdraw your consent at any time with effect for the future using the privacy settings or “Withdraw consent” in the footer. The legal bases are Art. 6(1)(a) GDPR and, where information is stored on or read from your device, § 25(1) TDDDG.

This may also involve the transfer of personal data to Google companies in the USA. Publishing information about training locations is separate from Google’s processing of website visitors’ data.

Further information: https://policies.google.com/privacy

14. Donations

If you donate directly to BVDKS e.V., the data required for processing and booking is processed, in particular name, account details, amount, payment reference and, where applicable, address for a donation receipt. The legal bases are Art. 6(1)(b) and (c) GDPR. Payment and accounting records are stored in accordance with the statutory retention periods.

The Bildungsspender offer can also be accessed via a link. Clicking on it takes you away from this website. The operator of that website is generally responsible for the processing there. Where personal data is received in the course of donation accounting, it is processed for allocation, accounting and fulfilment of tax obligations on the basis of Art. 6(1)(b) and (c) GDPR.

Privacy information: https://www.bildungsspender.de/bildungsspender/datenschutzerklaerung

15. Merchandise shop

The product catalogue from Spreadshop (sprd.net AG, Gießerstraße 27, 04229 Leipzig, Germany) is embedded on our shop page and is only loaded after your voluntary consent through the central cookie banner or the placeholder on the shop page. This choice applies to the embedded shop on our website and can be changed or withdrawn at any time using the privacy settings in the footer. The legal bases for this optional integration are Art. 6(1)(a) GDPR and, where information on your device is accessed, § 25(1) TDDDG. In particular, your IP address and browser and device information are transmitted to the provider; cookies and processing in the USA are possible. Preferences for optional analytics and advertising can be set under “Tracking” in the shop. Further information is available in the provider’s privacy policy linked below. The purchase contract is concluded directly with the Spreadshirt company identified in the shop. Spreadshirt is responsible for orders, customer accounts, payment processing, production, shipping and the associated processing of personal data.

BVDKS e.V. does not receive any order, customer, payment or shipping data from buyers. Only a sales-related commission or contribution and the billing information required for this are processed, without being assigned to individual buyers. This billing data is processed for bookkeeping and fulfilment of tax obligations on the basis of Art. 6(1)(c) GDPR.

Privacy information: https://service.spreadshirt.com/hc/de/articles/115000978409-Datenschutz

16. Newsletter

A newsletter is planned as a possible future service but is not currently used. No newsletters are being sent at present. Before its introduction, this privacy policy will be supplemented with specific information about registration, any mailing service provider, the data processed and retention periods. Registration will require separate, voluntary consent that can be withdrawn at any time. Your choice in the cookie banner does not subscribe you to a newsletter.

17. Social networks and external links

The website may contain simple links to profiles or offers on Facebook, Instagram, YouTube, X and other platforms. Merely visiting the website does not transfer any data to the linked provider through a simple link. Only when you click on it is the provider's website accessed; there, the respective provider processes data in accordance with its own privacy policy.

If plugins, feeds, preview images or embedded content are used instead of simple links, the consent and privacy information provided for them applies.

18. Recipients and service providers

Within BVDKS e.V., only persons who need access to personal data for their tasks are given access. In addition, data may be transferred to carefully selected IT, hosting, administrative, payment, tax advisory or event service providers, sports organisations, insurers and legally authorised authorities, where there is a legal basis for doing so.

Service providers who process data exclusively on instruction are used on the basis of a contract pursuant to Art. 28 GDPR. Providers who themselves determine the purposes and means of processing, by contrast, act as independent or, where applicable, joint controllers. The respective role depends on the specific service and contract.

19. Transfers to third countries

With some services, processing may take place in countries outside the European Union or the European Economic Area. Data is only transferred if the requirements of Art. 44 et seq. GDPR are met, for example on the basis of an adequacy decision of the European Commission, a valid certification of the specific US recipient under the EU-U.S. Data Privacy Framework or appropriate safeguards such as EU standard contractual clauses.

Details can be found in the information on the respective service.

20. Storage period

Personal data is only stored for as long as necessary for the respective purpose. It is then deleted or anonymised unless statutory retention periods, legitimate evidence or archiving interests or the establishment, exercise or defence of legal claims require further storage. Specific periods are stated in the respective sections.

21. Your rights

Where the legal requirements are met, you have the following rights in particular:

• Access to personal data pursuant to Art. 15 GDPR.
• Rectification of inaccurate data pursuant to Art. 16 GDPR.
• Erasure pursuant to Art. 17 GDPR.
• Restriction of processing pursuant to Art. 18 GDPR.
• Data portability pursuant to Art. 20 GDPR.
• Objection to processing based on Art. 6(1)(e) or (f) GDPR pursuant to Art. 21 GDPR.
• Withdrawal of consent with effect for the future pursuant to Art. 7(3) GDPR.

To exercise these rights, a message can be sent to info@bvdks.de . Statutory restrictions and exceptions remain unaffected.

22. Right to lodge a complaint

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority. In particular, the authority of your habitual residence, place of work or place of the alleged infringement may be responsible.

The authority generally responsible for the association's registered office in Stolberg is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW) – State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia
PO Box 20 04 44
40102 Düsseldorf
Kavalleriestraße 2–4
40213 Düsseldorf
Phone: +49 211 38424-0
Email: poststelle@ldi.nrw.de
Website: https://www.ldi.nrw.de

23. Data security

Appropriate technical and organisational measures are taken to protect personal data against loss, alteration and unauthorised access. The website uses TLS encryption. An encrypted connection can usually be recognised by „https://“ and the corresponding symbol in the browser.

24. Updates to this privacy policy

This privacy policy is updated when the legal situation, the website, the services used or processing procedures change. The current version published on this website applies.