Version 1.0 of 01.01.2020

This Privacy Statement explains the collection and further processing of personal data by LCAS for itself and for the event organisers on whose behalf it acts, unless such processing is covered by other privacy statements, arises from the circumstances or is determined by law, as applicable. The term "personal data" refers to any information relating to an identified or identifiable person.

1. BRIEF OVERVIEW

LCAS mainly processes personal data of athletes in competitions of various event organisers that engage it to perform registration management and other services. LCAS does this on behalf of these event organisers and offers them additional services, some of which are owned by LCAS itself.

However, LCAS also operates services in its own name, with which athletes can hold a non-public account or profile that serves as an archive of their results in various competitions and enables athletes and coachs to access their registrations with the various event organisers online.

The present Privacy Statement covers both types of processing: the data processing performed by the event organisers, insofar as LCAS administers it, as well as the data processing performed by LCAS itself.

2. SUMMARY: DATA PROCESSING BY LCAS AND EVENT ORGANISERS

LCAS's core service consists of performing the administering athletes registrations for mass sporting events in lifesaving sports. In addition, LCAS offers organisers a variety of services, such as processing registrations (online), administering athletes data and a results service. This also includes sending out newsletters and other information in the name of the organisers, publishing starting lists and rankings, results and information about the individual athletes, and other services.

LCAS does not conduct these events and is not a contracting party of the athletes in this regard. Instead, that is the role of the individual event organisers that engage LCAS to administer the participants and data or other services. For every organiser and event, LCAS keeps a database in which it stores the participants' details, their results at the respective event, and the results of prior stagings of the same event series, if available, and other data for performing the services. The respective organisers are responsible for these databases and the associated data processing; they can request that LCAS provide these data at any time, and they can also access these data online upon request. In this respect, LCAS acts as their processor. LCAS does not know what the organisers do with the data apart from LCAS, nor is it involved in such activities. Furthermore, as this Privacy Statement provides no information in this regard, the websites and other sources of information of the event organisers should be consulted.

At the same time, LCAS performs the following data processing of its own:

• LCAS operates the application "LCAS for Athletes" in its own name (available together with accounts and profiles via https://www.lcas.ch). Via this application, every athlete can set up an account that is independent of the individual events and through which he can maintain and publish a profile and in which his participation (including results) in individual events is recorded. The "LCAS for Athletes' account is also used to give athletes online access to registrations and to administer their master data and settings. Athletes normally make the accounts (and the event participation recorded therein) publicly available for others with an LCAS account, which means that they can be searched and queried by third parties (in this case, the account is displayed as a profile).
• LCAS also uses "LCAS for Athletes" to prepopulate the athlete's master data and inputs that are already known to it in connection with registrations for new events and to calculate starting-position availabilities and performance-class divisions, which requires access to data from prior events in which the athlete participated. For this reason, registering for an event requires that these data be entered in the "LCAS" system in advance, even if no account or profile is set up by the athlete. In this case, "LCAS" serves only as a LCAS-internal archive that LCAS needs in order to provide its services to the event organisers. However, if an athlete later opts to have an account in "LCAS for Athletes", the information contained in the archive is transferred to his account, and he is given online access to it. The athlete can choose whether or not to make his account publicly available (and thus displayed as a profile that can be called up by others with an LCAS account). This can be changed online at any time via the "LCAS for Athletes" account.

With an account on LCAS, the athlete is given the option to adjust his privacy settings (newsletter delivery, display of photo links in the rankings, inclusion of social media platforms, etc.) regarding the data processing by the event organisers and LCAS at any time. Athletes may adjust these settings themselves online via a LCAS account and thus adjust their data as well. If an athlete does not have a LCAS account, his default privacy settings will specify the minimum data processing. He can adjust these settings by setting up an account or by contacting LCAS.

Event registration is normally done online via LCAS by the sports clubs. The persons or clubs making these multiple registrations act in the name and on behalf of the individual athletes. At any rate, the registration results in a corresponding entry in LCAS. If an entry cannot be assigned to an account, the data are stored in LCAS – together with the athlete's master data and inputs – for internal archiving purposes without an account. LCAS needs these data to provide its services to the event organisers (e.g., for starting-block calculations based on participation in prior events), as well as to transfer the data into the athlete's account if he decides to set one up at a later date. An additional advantage that this offers the athlete is that he himself can thus manage his privacy settings (particularly the various consents) online.

3. CONTROLLERS, CONTACT INFORMATION

Regarding the collecting and processing of personal data related to the individual events for which LCAS provides services, the respective event organiser acts as controller. The individual organisers may be contacted via LCAS (search for event, then select contact). The organisers engage LCAS to process the data related to these events insofar as the organisers utilise its systems and services (the organisers themselves are responsible for any data processing performed on their own systems or on third-party systems).

4. COLLECTING, PROCESSING AND USING PERSONAL DATA

4.1 DATA SUBJECTS

On its own behalf and on behalf of the organisers of the respective events and other providers of products and services, LCAS collects and processes personal data pertaining to:

• athletes (for LCAS and event organisers);
• recipients of newsletters(for LCAS);
• persons who communicate with LCAS via e-mail, telephone or otherwise, such as via the contact form on the website (for LCAS, event organisers and other providers);
• persons who contribute content for the websites, apps or other channels owned by LCAS (for LCAS);
• persons permitted to access the athletes data on behalf of the event organisers (for LCAS).

4.2 DATA SOURCES

The personal data are generally collected from the respective persons themselves, for instance, by an athlete registering for an event and opening a LCAS account or registering for a newsletter. However, they may also be collected via third parties, for instance when an athlete is registered by a sports club or the event organiser and an entry is established in his name (in which case, LCAS assumes that these third parties are authorised by the data subject to do this for him as an athlete; otherwise, the data subject may have his information and consents pertaining to the data applications corrected after the fact or may correct and manage them himself by using LCAS, or he may close the account or profile, as applicable).

4.3 COLLECTED DATA

Event organisers collect the following categories of data, in particular, via LCAS:

• Athletes personal data and contact information (master data), such as salutation, first name, last name, sex, birthday, nationality *);
• Athletes data related to the registration for, participation in and holding of the respective event (event data), such as events for which a person has registered, data related to timing and results (including ranking), race status, age and performance categories, starting number, licence-related information, event-specific data (such as the team at the event etc.);
• Any data from prior years if the athlete has participated in this event previously (transferred from the event data).

LCAS collects the following categories of data, in particular, for its own purpose:

• Master data, LCAS ID
• Athletes data related to their accounts on LCAS, particularly their user name, password andd email adddress (only in encrypted form);
• Information for connecting to other LCAS accounts (e.g., friends);
• Events for which the athlete has registered, together with any results and age and performance classes (times), as well as the other information collected for LCAS's event organisers that the athlete himself can manage via "LCAS for Athletes", all of which is based, in each case, on the event data.

LCAS also collects:

• Data pertaining to event organisers, particularly contact details, information regarding their function, requests for quotes, users of event organisers with remote access.

4.4 CHILDREN

If children (under 16 years of age) actively participate in events, their data, too, are generally processed to the same extent as the data of other athletes and users. These data are normally collected via the parents or legal guardians, as applicable, or (with their consent) via a sports club, school etc. If an event organiser requests that its data be returned by LCAS, data pertaining to children are only be transferred to the event organiser upon express request (or a corresponding agreement).

4.5 EXCHANGE BETWEEN LCAS AND EVENT ORGANISERS

If the registration for an event is completed via the "Online Registration", LCAS carries this out in the name of the event organiser (the participation agreement is made directly with the event organiser) but uses the athlete's data already existing in LCAS and required for the registration. These data are thus disclosed to the event organiser in accordance with data protection laws (and they henceforth continue to be processed by LCAS, but now as processor for the event organiser).

If adjustments are made to the master data as part of the registration or of the event, as applicable, LCAS restores them to their LCAS database so that LCAS database remains up-to-date. Conversely, athletes can use "LCAS for Athletes" to manage data and settings regarding individual events (e.g., consents), for purposes of which LCAS must also technically store and match these data in LCAS. However, LCAS's databases and those of the event organisers are kept separately.

If an athlete is registered for or has taken part in an event and has a LCAS account, LCAS imports (in its own name) from each athlete and from the respective event organiser the (published) event information, the athlete's category and his results, if and as soon as they are available. This information is stored independently in LCAS and by the event organiser. If the athlete has a public (only for registrated users visible) LCAS account, the details are also available to the public in the form of a LCAS profile. If he only has a LCAS account, then only he can call them up.

As a rule, the same procedure is followed even if a registration is completed by sending the information to LCAS or via an event organiser. In this case, LCAS will attempt to identify the registered athlete in its database and enter his participation in LCAS. If this results in misattributions or a linking fails to be made, this is corrected upon notification. If a LCAS account does not yet exist, then for registrations not made via the "Online Registration", LCAS will make an entry but will store these data only for the purpose of enabling the subsequent setup of an account (and the recording of events participated in under such account) and of managing or issuing, as applicable, of the necessary authorisations for additional services provided by the event organiser. The athlete may open an account at any time and view these data and modify them via LCAS. It is impossible to register without a LCAS entry. LCAS requires this to administer the data it stores for the individual athletes, to give the athletes access to these data, and to calculate starting position availabilities and performance-class divisions for event organisers as needed based on an athlete's history (e.g., to determine the best starting sector for an athlete to start in based on his prior results).

5. PURPOSE OF PROCESSING PERSONAL DATA

5.1 PURPOSE OF COLLECTING AND PROCESSING OF PERSONAL DATA BY LCAS

Insofar as LCAS collects and processes personal data as a controller, it does so to the extent permitted by applicable law, particularly (but not exclusively) for the following purposes:

• For purposes of contracting for and providing services for athletes, particularly LCAS account, for the setup, maintenance and updating of the LCAS account (including data from events), for the account management and access control and for providing data at the time of registration for an event in order to give the athlete online access to the data from his individual registrations (including the administration of his consents), for publishing the LCAS profile and the associated search feature
• To calculate performance figures for additional events based on an athlete's results history (e.g., the best starting block for an athlete to start from based on his prior performance) and to provide these figures to the respective event organisers
• For the operation, security, maintenance and further development of the website, services, products and systems of LCAS
• For statistical evaluations, analyses and documentation, reports and public relations work
• For individual communication with users of LCAS's services, e.g., enquiries and complaints and responding to same
• For other purposes, where a legal duty requires the processing or where these purposes were evident or appropriate based on the circumstances at the time of data collection.

5.2 PURPOSE OF COLLECTING AND PROCESSING OF PERSONAL DATA BY THE RESPECTIVE EVENT ORGANISERS

The respective event organisers for which LCAS acts as a processor collect and process data to the extent permitted by applicable law, particularly (but not exclusively) for the following purposes:

• For conducting events, particularly for organising the registration, finish times, for starting-number processes (such as creating starting and ranking lists, assigning starting blocks to the events, team-building), performing other event-related services (e.g. diplomas), statistical evaluations, etc.
• For purposes of supporting LCAS's services, particularly matching registration data with existing LCAS accounts and transmitting data regarding events attended (especially results, category etc.) to LCAS for import into the LCAS accounts
• Communication with athletes and users regarding events (e.g., welcome and results text messages, information from the event organisers, making contact in case of emergency, answering questions and requests), for delivering starting times and starting numbers, as well as results to the athletes, for participant advertising, as well as for mailings and marketing by the event organiser and third parties
• In connection with advertising and marketing, particularly sending out advertising for sponsors, advertising customers and the event organisers themselves
• For purposes of fulfilling the applicable legal requirements and internal rules of the event organiser, pursuing and implementing various rights, asserting and defending against legal claims and complaints, combating abuse, and for purposes of legal investigations or proceedings related to answering enquiries from the authorities
• For statistical evaluations, analyses and documentation, reports and public relations
• For other purposes, where a legal duty requires the processing or where these purposes were evident or appropriate based on the circumstances at the time of data collection

5.3 AUTOMATED INDIVIDUAL DECISIONS

Generally, LCAS and the event organisers (insofar as they have delegated the processing of personal data to LCAS) do not take any automated individual decisions that have legal or similar significant effects on the data subject.

However, to the extent the creation of ranking lists based on the timing at an event is deemed as such, the data subject is informed, in accordance with the legal duty to provide information, that the ranking lists are created based on the data subject's times as measured by LCAS's systems, with the fastest time generally yielding the best ranking. Different provisions are possible in this area and are implemented according to the specifications of the event organisers or approved associations (whose regulations are declared binding by the event organiser). If penalty points, disqualifications or other factors are to be included, this is always done through human intervention, normally by involving a person who is designated by the event organiser but may also be provided by an approved association, and thus not exclusively automatically.

Furthermore, for starting-number processes, e.g., the assignment of starting blocks, the athletes performance classes are sometimes determined automatically (based on their prior performance). This is necessary for purposes of implementing the event organiser's agreement. These are not individual decisions; if athletes are not satisfied with an assignment, they can contact LCAS to the attention of the respective event organiser.

5.4 LEGAL BASES OF DATA PROCESSING

LCAS, in its role as controller, processes the aforementioned personal data on the following legal bases:

• Conclusion and fulfilment of LCAS's agreements with event organisers, athletes and the users of LCAS's products and services
• Compliance with legal requirements by LCAS
• Consent of the athletes (directly or via their authorised representatives), newsletter, any other opt-ins within an LCAS accounnt (administration of these consents is possible online via LCAS)
• Consent of persons with whom permanent cookies are used
• Consent of employees (via the event organisers) for whom event organisers establish an account for the purpose of remote access
• Berechtigte Interessen von LCAS und anderer:
• Operation of the website and other systems of LCAS
• Implementation, evaluation and documentation of the event, as well as future events
• Information provided to the public and interested groups
• Maintenance and secure and efficient organisation of the business, including a secure and effective operation and the successful continuing development, and enhancement of new services, as well as of the website
• Sound business management and development
• Interest in preventing fraud, abuse, crimes and other offences, as well as in the investigation of such offences and other inappropriate conduct, handling of legal complaints, claims and other actions against LCAS, involvement in legal proceedings and cooperation with the authorities, and otherwise asserting, exercising and defending legal claims.

The event organisers have LCAS, in its role as processor, process the aforementioned personal data based on the following legal grounds in each instance:

• Conclusion and fulfilment of the event participation agreements with the athletes
• Compliance with legal requirements on the part of the event organisers
• Consent of the athletes (directly or via their authorised representatives), particularly for newsletters and advertising opt-ins, as well as any other opt-ins related to an event (e.g., photo and video links), as specified by the respective event organiser (administration of these consents is possible online via LCAS)
• Legitimate interests of the event organisers and other parties:
• Implementation, evaluation and documentation of the event, as well as future events
• Information provided to the public and interested groups
• Carrying out advertising, marketing and public relations work
• Maintenance and secure and efficient organisation of the business, including a secure and effective operation and the successful continuing development, and enhancement of new services, as well as of the website
• Sound business management and development
• Interest in preventing fraud, abuse, crimes and other offences, as well as in the investigation of such offences and other inappropriate conduct, handling of legal complaints, claims and other actions against LCAS, involvement in legal proceedings and cooperation with the authorities, and otherwise asserting, exercising and defending legal claims

6. DATA DISCLOSURE AND DATA TRANSFER ABROAD

The personal data processed by LCAS on its own behalf and on behalf of the event organisers may be transferred to the following categories of recipients to the extent permitted by applicable data protection law:

• To LCAS or the respective event organiser, as applicable (mutual exchange of the data kept by both parties, e.g., template for event registrations generated from LCAS, and transfer of the results to LCAS for storage therein; exchange of athletes' data regarding their registrations, which can be administered from within LCAS, e.g., event-specific consents)
• Photo services and other providers, as well as other organisers
• Associations, clubs, schools, other approved sports associations and sports organisations
• Parents, respectively legal guardians and representatives of the athletes
• Local, national and foreign authorities
• Media organisations
• Processors (including IT service providers, payment service providers, providers for the transmission of text messages, providers for combating fraud, advertising partners, website analysis services)
• Advertising customers and sponsors
• The public, including visitors to LCAS's website and particularly the LCAS database and the LCAS search feature
• Other parties to potential or actual legal proceedings

The information accessible on LCAS's website is available worldwide. In this case, LCAS, respectively the event organisers, do not take any additional precautions regarding data privacy but rely, insofar as an international disclosure of personal data within the meaning of the law has even occurred, on the exception of consent, or of the initiation and execution of an agreement, or the justification that the data were published by the data subject himself.

Furthermore, the data subjects have to assume that their personal data may otherwise be transferred to any country in the world, particularly to all countries in which the respective event organisers are located or process their data or in which LCAS's service providers are located:

• If data are sent to an event organiser or another provider in the Online Shop (particularly the Online Registration), then this party, as the client of LCAS or contractual partner of the customer, as the case may be, has sole responsibility for data privacy, and it is assumed that the data subject agrees to the transmission from LCAS to this party, even without taking special precautions to protect the data on the part of LCAS, respectively the exception of initiation and execution of an agreement applies. This is true even if an athlete is registered for an event organiser's event other than via the Online Shop (i.e., the "Online Registration") and event organisers thereby gain access to the athlete's data, even from within countries lacking adequate data protection. LCAS is under no obligation to warrant or ensure that these event organisers comply with data protection

7. DATA RETENTION

Unless otherwise provided by law, LCAS generally stores the personal data processed as part of the service on its own behalf and for event organisers with no specific time limit unless reasons exist for earlier deletion. This is the case if the data are no longer needed or if LCAS or the event organiser, as the case may be, is required to delete such data. The results of an event are stored permanently, however, the information on which they are based, in the same manner as the additional event-specific information, are stored for up to ten years in connection with the setup of the follow-on event and subsequently deleted, unless otherwise agreed with the event organiser.

The LCAS accounts are kept indefinitely. If an athlete terminates his LCAS account, all data in LCAS are deleted except for the person's master data in LCAS (ID, first name, last name, sex, date of birth, nationality). However, the data included in (otherwise available) starting and ranking lists generally remain available even after the termination of the LCAS account, unless their deletion is expressly requested by the athlete.

8. RIGHTS OF THE ATHLETE, THE USER AND OTHER DATA SUBJECTS

An athlete with an account can view and modify all information concerning him in LCAS account via LCAS's website (although a change of name, sex or birthday must be cleared by LCAS as these data are used to identify a person; likewise, the combination of multiple LCAS accounts must be cleared by LCAS). A LCAS account may be opened by any athlete himself at any time. A person who no longer has his access data to LCAS can obtain them from LCAS.

Every data subject has a right to be informed about his data and can request information about them and demand that they be corrected. Moreover, every data subject has the right to request the deletion and restriction of the use of his personal data by LCAS or the event organiser and to refuse such processing of his personal data. If the processing of the personal data is based on a consent, the consent may be revoked by the data subject at any time.

9. CHANGES TO THE PRIVACY STATEMENT

LCAS may modify the present Privacy Statement on its own behalf or on behalf of an event organiser in consultation with the same at any time without prior notice or announcement. The current version published on the website https://www.lcas.ch shall apply.

If the Privacy Statement is part of an agreement with athletes, users or another data subject, then, in the event of an update, LCAS may inform them of such update via e-mail or other appropriate means. If no objection is raised within 30 days, then the new Privacy Statement is deemed accepted. If an objection is raised, LCAS may terminate the agreement in whole or in part for good cause and without notice or restrict or adjust the services it provides to the data subject in order to appropriately address his withholding of acceptance.