Data Protection Notice for the 4th BAUHAUS Corporate Challenge Europe 2024

This data protection notice informs you about how BAUHAUS processes personal data in the context of the "BAUHAUS Corporate Challenge Europe" event, what data protection rights you have, and how you can contact us regarding these matters and any questions about data protection. Participation in the BAUHAUS Corporate Challenge Europe by BAUHAUS employees is voluntary. 

I. Scope of this privacy policy

II. Responsible Party and Data Protection Officer

The responsible party within the meaning of Art. 4 No. 7 GDPR is BAUHAUS AG, Mannheim Branch, Gutenbergstr. 21, 68167 Mannheim (hereinafter referred to as "BAUHAUS," "we," or "us").

For specific enquiries, you are also welcome to contact the designated Data Protection Officer directly at any time by e-mail at datenschutzbeauftragter@bauhaus.info. The topics and contents addressed are subject to strict confidentiality.

For general enquiries about data protection and requests for information, please contact the DATA Compliance department of BAUHAUS at datenschutz@bauhaus.info, giving precise details of your request and your contact address.

III. Data subject rights 

As a data subject, you are entitled to the following data protection rights if the applicable conditions are met:

• The right to information (Art. 15 GDPR)
• The right to correction (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing pursuant to Art. 18 GDPR
• The right to data portability (Art. 20 GDPR)
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

If we process data relating to you on the basis of consent given by you pursuant to Art. 6 para. 1 page 1 lit. a GDPR, you may revoke your consent with effect for the future. The lawfulness of the processing carried out prior to the withdrawal of consent remains unaffected. You can send your revocation to us by email to datenschutz@bauhaus.info.

IV. Notes on Data Processing on the Website

We operate a website  https://www.bauhaus-challenge.eu, where we provide information about the Corporate Challenge Europe and offer you the opportunity to register for participation. Within this section, we provide information on the data processing that takes place on the website.

1. Log files

Each time you visit this website, your browser automatically transmits information (log files) to us. These include:

• the IP address of your device;
• date and time of access;
• the name and address of the requested file;
• data volume transferred;
• message as to whether the request was successful;
• information about the browser and operating system used and the name of your internet provider;
• websites from which the user's system accesses our website (tracking);
• websites that are accessed by the user's system via our website.

This data is processed to enable and facilitate the use of the website. In addition, the data is evaluated in anonymised and aggregated form and used in the interest of system security and the technical administration of the network infrastructure. We reserve the right to subsequently review the log data if there is a justified suspicion of unlawful use based on specific indications. The data processing described above is carried out on the basis of our legitimate interests in providing our website in a secure manner and in evaluating the use of our website and based on Art. 6 para. 1 page 1 lit. f GDPR.

The storage period of the data described above is usually seven days from the collection of the data. In exceptional cases, the data is stored to clarify suspected cases of unlawful use until the suspicion has been clarified.

The recipient of the data is the website's hosting provider, one4vision GmbH (Talstraße 34-42, D-66119 Saarbrücken).

2. Registration and queries

We have set up a sub-page for registration to participate in the BAUHAUS Corporate Challenge Europe https://www.bauhaus-challenge.eu. If you are interested in participating in the BAUHAUS Corporate Challenge Europe, you can register for it on the sub-page. In the course of the registration we collect the following data:

• Last name (optional) or name abbreviation (optional) or pseudonym*; 
• First name (optional) or name abbreviation (optional) or pseudonym*;
• Email address*;
• BAUHAUS country/branch number;
• Password;
• Please indicate if you would like to receive a T-shirt and specify the size (S-3XL) (voluntary)

* With a name abbreviation (e.g. MM for Max Mustermann) or pseudonym (e.g. Mannheim68), your personal data is processed such a way that your data can no longer be assigned to a specific person without the addition of additional information. However, complete pseudonymisation is only achieved if you also provide a pseudonymous email address (z.B. Mannheim68@webmail.de).

If you do not complete the registration process because you do not set a password, the data you have provided will not be stored. Only when you have set a password will we store the data you have provided. The processing of the aforementioned data serves the purpose of fulfilling our contractual obligations arising from the contract concluded with you for the participation, implementation and handling of the BAUHAUS Corporate Challenge (Art. 6 para. 1 page 1 lit. b GDPR). If you provide information about your desired T-shirt size, this is done based on the legitimate interests of BAUHAUS to provide its employees with a T-shirt for the BAUHAUS Corporate Challenge and the legitimate interests of the employees to receive a T-shirt from BAUHAUS for the BAUHAUS Corporate Challenge, so they do not have to rely on their own clothing (Art. 6 para. 1 page 1 lit. f GDPR).

We use the personal data you provide during registration to create a clearly identifiable account and for the subsequent clear allocation of your result achieved in the Corporate Challenge Europe. We use your e-mail address to send you a confirmation e-mail with an individual link, the access data and an activation code for the "BCCE" app for tracking the virtual race and to assign an e-mail address to you. Furthermore, it is necessary for the execution and participation that we record your location to determine your result. You can individually control the location tracking on your mobile phone.

We store the password you selected in order to be able to offer you protected access to the "BCCE" app and to prevent misuse. We carry out this data processing on the basis of our legitimate interests in offering a protected account and preventing misuse on the basis of Art. 6 para. 1 page 1 lit. f GDPR.

We store all data from your registration for three months after the end of the BAUHAUS Corporate Challenge Europe.

If you have general questions about the BAUHAUS Corporate Challenge Europe and its procedure, about participation or the participation requirements and conditions, or technical questions about participation in the BAUHAUS Corporate Challenge Europe, you can contact us at any time by e-mail at info@bauhaus-challenge.eu. The processing of the data provided by you in connection with such queries, in particular your e-mail address, serves the purpose of fulfilling our contractual obligations arising from the contract concluded with you or in the process of being concluded for the participation, implementation and handling of the BAUHAUS Corporate Challenge (Art. 6 para. 1 page 1 lit. b GDPR).

The recipient of the data provided during registration is race result Timing BW GmbH (Nachtigallenweg 19, D-71032 Böblingen, Germany), which assists us with the collection of registration data. Our service provider n plus sport GmbH (Großherzog-Friedrich-Str. 100, D-66121 Saarbrücken, Germany) is also the recipient of the data you provide within the registration process in order to later create evaluations and statistics for us on the results of individual countries, branches and various groups of people. In addition, our service provider n plus sport GmbH (Großherzog-Friedrich-Str. 100, 66121 Saarbrücken) is the recipient of the data you provide in connection with any queries directed to info@bauhaus-challenge.eu.

3. Cookies

On our website, we use cookies that are absolutely necessary for the operation of the website, such as session cookies, which are only stored for the visit to the website and serve exclusively to display the website. Therefore, we do not ask for your consent for the use of cookies. A cookie is a small text file that is sent by the respective servers when a website is visited and is temporarily stored on the user's hard drive.

The cookies we use are necessary for the provision of our website or a function of the website requested by you or for the fulfilment of our legal obligations. The legal basis for the use of cookies is § 25 para. 2 no. 2 TTDSG. We process the personal data obtained with the help of these types of cookies and similar technologies either on the basis of our legitimate interests in providing our website and functions requested by you according to Art. 6 para. 1 page 1 lit. f GDPR or to fulfil a legal obligation based on Art. 6 para. 1 page 1 lit. c GDPR. You can view the storage period of the cookies in your browser settings.

4. Publication of results

We publish results of the BAUHAUS Corporate Challenge Europe on our website. We use the following data to display the list of results:

• First name and surname or name abbreviation or pseudonym
• completed kilometres
• Country of your BAUHAUS company
• Branch number of your BAUHAUS company.

Some of the results we publish do not refer to an individual person but to a group (e.g. the result of all participants of a branch or a country). Persons who have achieved the best result overall or the best result from a group are displayed on the leader board with their first and last name or name abbreviation or pseudonym in connection with the result. Furthermore, if you have registered with your first and last name and not with a name abbreviation or pseudonym, it is possible that other people who are also participating in BAUHAUS Corporate Challenge Europe can search for you on our website and view your result. A corresponding list in PDF format is not available for download on our website.

The legal basis for publishing personal data as part of BAUHAUS Corporate Challenge Europe results and enabling the search function is Art. 6 para. 1 page 1 lit. b GDPR for the performance of the contract with you within the context of your participation and Art. 6 para. 1 page 1 lit. f GDPR. Our legitimate interests lie in the publication of participants' results in order to make the results and the overall progress in the Challenge recognisable and the associated presentation of BAUHAUS as a company participating in the BAUHAUS Corporate Challenge Europe. Personal data as part of published results will be automatically removed from the website three months after the end of the BAUHAUS Corporate Challenge Europe. In addition, the website with the results is particularly technically protected by a password so that third parties cannot access the list of results.

Furthermore, we display the results of the BAUHAUS Corporate Challenge Europe in a leader board. The technical integration of the leaderboard is carried out with the help of the service provider/sub-processor Quevita AG, Industriestrasse 78, CH-4600 Olten, which receives the data processed through the use of the search function. 

At https://my.raceresult.com/277920/results, you have the option to print a certificate from the results list using the name or pseudonym you registered with. Please note that for technical reasons it is not possible for everyone to download only their own certificate of their own result, which is why we recommend that you use a name abbreviation or pseudonym instead of your first and last name as part of the registration process for data protection reasons, if you do not want others to be able to download your result with your first and last name.

Quevita AG (Industriestrasse 78, CH-4600 Olten) utilizes the services of the sub-processor DigitalOcean LLC (101 6th Ave New York, NY 10013 - servers in Frankfurt am Main) to provide services to our processor. The data is primarily stored in Germany/Europe. For data transfers outside the EU and the EEA, Quevita AG has entered into EU Standard Contractual Clauses with DigitalOcean LLC, which can be accessed at the following URL: https://www.digitalocean.com/legal/data-processing-agreement

V. Information on data processing in the "BAUHAUS CCE" app

Using the app for the BAUHAUS Corporate Challenge Europe ("BCCE"), you can participate in the BAUHAUS Corporate Challenge Europe. This app records the distances you have covered and displays your results as well as the results of other participants in the BAUHAUS Corporate Challenge Europe. Within this section, we provide information about the data processing that takes place in the app.

1. Log files

When you use the BCCE app, information is automatically sent to us (log files). These include:

• Type Phone / Telefontyp
• Operating system of the phone
• App version number
• Battery level

This data is processed to enable and facilitate the use of the app. In addition, the data is evaluated in anonymised and aggregated form and used in the interest of system security and the technical administration of the network infrastructure. We reserve the right to subsequently review the log data if there is a justified suspicion of unlawful use based on specific indications. These previously described data processing operations are carried out on the basis of our legitimate interests in providing our app offer in a secure manner and in evaluating the use of our app and based on Art. 6 para. 1 page 1 lit. f GDPR. Our legitimate interest is that we want to provide you with the most secure app possible and better understand how you use it so that we can tailor our app offering to you even better.

The storage period of the data described above is usually seven days from the collection of the data. In exceptional cases, the data is stored to clarify suspected cases of unlawful use until the suspicion has been clarified.

The recipient of the personal data contained in log files for the technical provision is the service provider and sub-processor Quevita AG. Quevita AG utilizes the services of DigitalOcean LLC (servers in Frankfurt am Main) to provide these services. The data is primarily stored in Germany/Europe. For data transfers outside the EU and the EEA, Quevita AG has entered into the new EU Standard Contractual Clauses with DigitalOcean LLC, which can be accessed at the following URL: https://www.digitalocean.com/legal/data-processing-agreement

2. Participation in the challenge via the app

The email sent to you after registering on the website will contain a link with a unique key that the app will use to recognise you and create a link between the information you provided when registering on the website and your use of the app. Please note that you can download the app, but you will not be able to access the challenge without the individual access key. To obtain the access key, you must register via the official website. Only then will you receive the confirmation email with the access key. After clicking the link, you will either be redirected to the place where you can download the BCCE app on your device, or if you have already installed the app, you will be redirected to the BCCE app.

When you open the app, you will be asked to verify your registration in the app by confirming your details (first name and surname or name abbreviation or pseudonym and start number). Using the app, we do not process all the data you provided during registration on the website, but the individual key assigned to you, first name and surname or name abbreviation or pseudonym, as well as the start number and its locations and the routes you cover as part of the challenge.

If you want to start completing a route intended for the challenge, you can switch on the recording of your location within the BCCE app and switch it off again at the end. The app keeps track of the total kilometres travelled using the GPS geodata whenever you separately activate the recording of your location for the challenge on your smartphone.

The legal basis for data processing is the fulfilment of the participation agreement pursuant Art. 6 para. 1 page 1 lit. b GDPR.

The data will be deleted three months after the end of BAUHAUS Corporate Challenge Europe.

The accumulated kilometres as well as the overall progress, can be seen on the results list and the leader board within the app. Furthermore, it is possible that other people who are also participating in the BAUHAUS Corporate Challenge Europe can search for you in this app and view your result if you have registered with your first and last name and not with a name abbreviation or pseudonym. A corresponding list as a PDF is not available for download.

The legal basis for publishing personal data as part of Corporate Challenge Europe results and enabling the search function is Art. 6 para. 1 page 1 lit. f GDPR. Our legitimate interests lie in the publication of participants' results in order to make the results and the overall progress in the Challenge recognisable and the associated presentation of BAUHAUS as a company participating in the BAUHAUS Corporate Challenge Europe. The personal data as part of published results will be removed from the website three months after the end of the BAUHAUS Corporate Challenge Europe.

We operate the BCCE app with the help of Quevita AG, Switzerland, the recipient of the data depending on the data provided during registration as well as the consecutive, automatically assigned number and the key, which are processed through the use of the app. For data transfers outside the EU and the EEA, Quevita AG has entered into EU Standard Contractual Clauses with DigitalOcean LLC (Server in Frankfurt), which can be accessed at the following URL: https://www.digitalocean.com/legal/data-processing-agreement.

Our service provider and order processor pursuant to Art. 28 GDPR n plus sport GmbH (Großherzog-Friedrich-Str. 100, D-66121 Saarbrücken, Germany) is the recipient of the results obtained from you in order to prepare evaluations and statistics on the results of individual countries, branches and various groups of persons for us.

VI. Information on the evaluation of results and compilation of statistics

Within this bullet point, we provide information about the data processing that takes place outside the app and the website within the context of the evaluation of results and the creation of statistics.

Outside of the BCCE app and our BAUHAUS Corporate Challenge Europe website, we evaluate the results of the Challenge and create various statistics. For this purpose, we use your result, the country and the branch number of the BAUHAUS company for which you work in order to be able to carry out group-specific evaluations. We carry out the evaluation and compilation of statistics on the basis of Art. 6 para. 1 page 1 lit. f GDPR. Our legitimate interests lie in the evaluation and finding of correlations and the creation of meaningful statistics that are displayed to the participating persons. The recipient of the personal data used in the evaluation and creation of statistics is our service provider n plus sport GmbH (Großherzog-Friedrich-Str. 100, D-66121 Saarbrücken, Germany), which carries out the evaluation and creation of statistics.

We store personal data as part of evaluations and statistics for a period of three months after the end of BAUHAUS Corporate Challenge Europe. After that, they will be deleted automatically.

As at: 06/2024