Data processing

Agreement on the processing of personal data on behalf of a controller

between

and

§ 1 Subject matter and duration

1. The processor operates the online platform “Kür” for the controller: the event page and online entry, the collection of routine music and additional forms, competition planning in Kür Event Manager, and the publication of entry lists, start lists and results. In doing so it processes personal data on behalf of the controller.

2. Not covered by this agreement is the Kür App, which the controller installs on its own devices. The data processed there on competition day (scores, start lists, music) remains under the controller’s control; the processor has no access to it. Where the controller transfers data from the app to the platform (publication, backup), this agreement applies to the transferred data.

3. The agreement applies for the term of the platform terms of use and ends with them.

§ 2 Nature, purpose and scope of the processing

1. Purposes: receiving and managing competition entries, entries of judges and other officials, routine music files and answers to additional forms; presenting the event page; publishing entry lists, start lists and results in accordance with § 6(2); sending entry confirmations; handing the planning state over to the controller’s Kür App; backing up competition states.

2. Nature of the processing: collection, storage, transmission to the controller, publication, erasure.

§ 3 Categories of data subjects

• Participants (gymnasts), predominantly minors
• Persons with parental responsibility and persons making entries (coaches, representatives of the entering clubs)
• Judges and other officials entered for a competition
• Staff of the controller with platform access

§ 4 Categories of personal data

• Name, year of birth, club, country, competition category and choice of apparatus of the participants, and the wish to be published with a short name only
• Name, club, country and email address of entered officials, for judges also their qualification
• Contact details of the person making the entry (email address)
• Contact details of the entering club (email address; at its request also telephone, address and contact person), so that the controller can reach the club about its competition
• Routine music files (per participant and apparatus)
• Answers to the controller’s additional forms, including uploaded files
• Consent records of the persons with parental responsibility (time of the declaration)
• Start lists, results and scoring documents, insofar as the controller transfers them to the platform
• Account and login data of portal users (email address, password stored only as a hash)

Special categories under Art. 9 GDPR are, as planned, not processed. The controller ensures that no health data or other Art. 9 data is recorded in free-text fields.

§ 5 Obligations of the processor

1. Processing only on documented instructions from the controller (Art. 28(3)(a)). The controller’s use of the platform functions counts as an instruction.

2. Confidentiality: persons with access to data are bound to confidentiality.

3. Technical and organisational measures in accordance with Annex 1; material changes are notified to the controller, and the level of protection may not be reduced.

4. Support for the controller with data subject rights (Art. 12–23), with the security of processing (Art. 32) and with notification obligations (Art. 33, 34).

5. Notification of any personal data breach to the controller without undue delay, at the latest within 48 hours of becoming aware of it, with the information under Art. 33(3).

6. After the end of the service: erasure or return of all data processed on behalf of the controller, at the controller’s choice (§ 8), unless there is a statutory retention obligation.

7. Evidence and audit rights: the processor provides all information necessary for demonstrating compliance under Art. 28(3)(h). Audits are carried out primarily by way of information and existing evidence (e.g. the access log, audit reports of the sub-processors); on-site audits after reasonable advance notice.

§ 6 Obligations of the controller

1. The controller is responsible for the lawfulness of the processing, in particular for obtaining any necessary consent from persons with parental responsibility (the platform records the consent with the entry; whether it is sufficient in substance is the organiser’s responsibility).

2. The controller decides whether to open the event page and the online entry and whether to publish the start list and the results. While the online entry is open, the event page shows an entry list in shortened form (Annex 1, section 3); full names and results are published by the platform only after an express step by the controller.

3. For each event page the controller provides its own mandatory information (legal notice, privacy notice); the online entry can only be opened once this is complete.

§ 7 Sub-processors

1. The controller approves the sub-processors listed in Annex 2 (general authorisation under Art. 28(2), second sentence).

2. The processor gives notice of intended changes at least 30 days in advance in text form. The controller may object for an important reason relating to data protection; if no agreement is reached, it may terminate for cause.

3. A contract under Art. 28(4) exists with every sub-processor.

§ 8 Erasure and return

1. The controller can remove its competition data from the platform itself (“Take offline” — removes entries, start lists, publications, competition states, scoring documents and the music and document files of this competition). If the controller’s access is blocked (for example because of late payment), this self-service route is not available; erasure is then carried out by the processor on request without undue delay, at the latest within 14 days of receipt of the request. The right to erasure under Art. 17 GDPR is not affected by a block.

2. Independently of this, the processor erases entries, answers to additional forms including uploaded files, routine music and individual score sheets of a competition automatically at the latest 90 days after its last competition day (Annex 1, section 6). Content published by the controller (event page, start lists, result lists) remains until it takes the competition offline.

3. When the agreement ends, the processor erases all remaining data processed on behalf of the controller within 30 days of the end of the agreement, unless the controller has requested its return (data export) beforehand.

4. Excluded from erasure is evidence data that the processor keeps to fulfil its own legal obligations (e.g. the log of entry data retrievals, which contains no entry content).

§ 9 Liability, final provisions

1. Liability is governed by Art. 82 GDPR; otherwise by the provisions of the main contract.

2. Amendments and additions require text form.

3. German law applies.

4. The agreement is concluded electronically (Art. 28(9) GDPR). Conclusion consists of the controller’s consent when creating its organiser account and the provision of this version by the processor. The time of consent, the version and the controller’s details are stored and provided to the controller as evidence on request; no handwritten signature is required.

Annex 1 — Technical and organisational measures

The measures describe the state as at the version date. The processor notifies material changes; the level of protection is not reduced (§ 5(3)).

1. Login and accounts

• Every person signs in with their own account. Passwords need at least 12 characters with upper- and lower-case letters and digits; when set, they are checked against known password leaks, and affected passwords are rejected.
• Two-factor sign-in with an authenticator app is available for every account.
• A new email address only takes effect once both the old and the new address have confirmed the change.
• Sign-in, registration and email sending are limited against mass attempts.

2. Access and separation of organisers

• Every organiser sees and edits only the data of its own competitions. This separation is enforced by the database itself, not merely by the user interface.
• Persons making entries only see their own entries. Entry data cannot be retrieved publicly; the controller and its Kür App receive it through retrievals that check the authorisation and return only the necessary details.
• Every device on which the controller activates the Kür App receives its own access, restricted to that controller; it lapses when the device is signed out.
• The processor’s internal administrative data (customer accounts, licences, logs) is not accessible to platform users.

3. Publication

• While the online entry is open, the event page shows, besides the invitation, the entry counts and, per category, an entry list with abbreviated first name, surname, club and country.
• Full names only appear with the start list, results only once the controller releases them. Anyone who chooses “Publish short name only” when entering appears there, too, only with the initial of the first name.

4. Logging

• Every retrieval of entry data by the controller or its Kür App is logged: who, when, which competition, how many records. The log contains no entry content, survives the deletion of the retrieving account, cannot be changed by platform users and is deleted after 365 days.

5. Transmission and storage

• All connections are encrypted (TLS).
• Database, accounts and files are located in the EU (Frankfurt am Main). The server functions of Kür Event Manager also run there.
• Routine music and files from additional forms are kept in non-public storage areas. They can only be retrieved via time-limited links issued after an authorisation check.

6. Erasure

• The controller can take a competition completely off the platform itself at any time — with entries, publications, backups, music and documents.
• Entries, answers to additional forms including files, routine music and individual score sheets are erased automatically at the latest 90 days after the last competition day; every erasure run is logged. Published content remains until the competition is taken offline (§ 8(2)).
• Portal users can delete their account themselves and export their data as a file (Art. 15, 17, 20 GDPR). Deleting the account removes open entries, profile, club, athlete records and music files. Entries an organiser has already taken over remain there as its competition records, as do the club contact details transmitted with them (section 4.5 of the terms of use).
• Items deleted from the athlete records stay in the bin for 30 days and are then permanently removed.

7. Availability and integrity

• Competition day does not depend on the platform: the Kür App works locally and without internet; an outage of the platform does not stop a running competition.
• Updates of the Kür App are digitally signed and checked before installation.

8. Data minimisation

• Online entry is possible without an account; only what is needed for the entry is collected.
• Device accesses carry no real names and no reachable email addresses.

Annex 2 — Sub-processors

Changes to this list are announced 30 days in advance under § 7; the current list is kept publicly accessible.

Annex 3 — Transfers to third countries

1. Competition and entry data is stored in the European Union (Supabase, Frankfurt am Main). Data reaches the USA insofar as the providers named in Annex 2 have their seat there and can access data in the course of their service, and also when published content (entry lists, start lists, results) is delivered worldwide and when emails are sent (the content of the respective email).

2. Appropriate safeguards under Art. 46(2)(c) GDPR exist for each of these transfers: the European Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914), agreed in the data processing agreements linked in Annex 2. Vercel Inc. and Resend, Inc. are additionally certified under the EU-US Data Privacy Framework; for certified companies there is an adequacy decision of the Commission of 10/07/2023. If the adequacy decision lapses, the standard contractual clauses continue to support the transfer.

3. The processor has checked the sub-processors’ agreements for these safeguards. The controller can inspect them at any time through the links in Annex 2.

4. Entry data, music files, answers to additional forms and competition states are stored exclusively in the EU, and the server functions with which the controller edits them in Kür Event Manager run there. Entry confirmations contain only the details of the respective entry and are sent only to the person who made it.

Version of 12/10/2026 · Terms of use · Privacy · Legal notice