Data Privacy Policy

This Privacy Policy informs you about the processing of your personal data in connection with the use of this website and the functionalities provided for this purpose, such as the opportunity to contact us.

1. Controller and Data Protection Officer

This website is operated by onGRID Sports Technology GmbH, with its business address at Neue Grünstraße 17, 10179 Berlin, Germany (” onGRID”). onGRID is responsible for the processing of your personal data. For any questions, consulting@datenschutzexperte.de can be contacted by email.

2. **Categories of Personal Data, Purpose of Data Processing, Legal Basis, and Data

Retention per onGRID’s Services Available on its Website**

2.1 Website Visit

2.1.1 Log Data

onGRID processes log data, such as your IP address, including details of website requests (date, time, status, data transferred, browser type/version, and referrer URL). onGRID stores this data in a log file every time the website is visited. Without further information from an Internet service provider, onGRID is generally unable to assign log data to individual persons.

2.1.2 Cookies

onGRID sets cookies to enhance website functionality and ease of use. Cookies store certain settings and data for exchange with our system via your browser. Some cookies are deleted after the session ends, while persistent cookies remain on your device for future use. Usage data collected by cookies is not merged with personal data. You can prevent the storage of cookies by adjusting your browser settings.

2.1.3 Purpose of Data Processing

Your personal data is processed to enable website use and to prevent or correct malfunctions. The legal basis for this processing is an agreement concerning the website’s use and onGRID’s legitimate interest in ensuring trouble-free operation (Art. 6 para. 1 b) and Art. 6 para. 1 f) GDPR).

2.1.4 Data Retention

Log data is deleted as soon as it is no longer needed.

2.1.5 Cookie Retention

Cookies used on onGRID’s website are deleted after 30 days.

2.1.6 Google Analytics and Social Media Plugins

Further information on these services can be found in Section 4. The legal and processing purposes of these services are described there, and more information on the deletion of cookies is available via links provided under Section 4.

2.2 User Registration and Event Registration

2.2.1 Categories of Data

When you register for a User Account on onGRID, the following data is processed: first and last name, address, telephone number, email address, driver license data, emergency contact and password. Once you are registered, you provide onGRID with your role, i.e. whether you register as race driver , team manager , race organizer , legal guardian of a minor , and/or vehicle owner ; subject to your role, you provide onGRID with your race license which then enables you to register for races and/or series. In addition you provide us with your language, social links, nationality and when relevant invoice data, such as your bank account information. You may also upload a picture of yourself and enter your personal address. onGRID processes all this personal data about when you register for and create a User Account. In order to create an account, onGRID uses the double opt-in method: This means that we send you an email to the email address entered in which we ask you to confirm your registration. Registered users have the option, at any time and if necessary, to change or delete the data they provide at registration, however, in such case you may no longer be able to participate in onGRID services.

2.2.2 Purpose and Legal Basis

If you register for a User Account, onGRID processes your data to provide its services. The legal basis is Art. 6 para. 1 b) GDPR. If you upload a picture containing sensitive personal data (e.g., ethnicity, religion, or biometric data), the legal basis for processing this data is your consent under Art. 6 para. 1 a) and Art. 9 para. 2 a) GDPR. If you enter your bank account information, then the legal basis for this is your consent pursuant to Art. 6 para. 1a) GDPR.

The main purpose of onGRID is to enable digital race and event organization. If you use your User Account to register for and participate in races and/or other events organized by third party race organizers and / or event organizers, then your personal data uploaded to your User Account is transferred to these third-party race /event organizers to enable your participation in their races/events, which in addition to entry into races/events, your personal data may be processed for invoicing, list creation, race result management, as well as publication of such results and similar/related use cases. The personal data transferred may encompass all details contained in your User Account. The legal basis for this transfer is your registration for this race/event, subject to Art. 6 para. 1b) GDPR. Please note that third party race/event organizers may process your personal data subject to their own data privacy information as well as terms and conditions.

From time to time, personal data in event registrations may, for example, contain typos and/or abbreviations not generally known, and the event organizer then needs to fix those typos and/clear these abbreviations; the event organizer is permitted to edit data entries and the user will receive a notification with which he/she can reject or accept the edit.

2.2.3 Data Retention

Personal data processed based on your consent is retained until you withdraw your consent.

onGRID retains your personal data pertaining to event registrations for a duration of 3 years and deletes it thereafter. In addition, your history of events you participated in is retained in your user account for the same duration.

Event organizers receive personal data including all updates and access to registrations only during an event. Once the event is over, the event organizer no longer receives access. However, your registration for and participation in an event likely requires the event organizer to process your personal data subject to its own privacy regime and retention requirements. If you wish to receive information on how your personal data is handled by an event organizer, please contact the respective event organizer directly.

2.3 Contact Form

2.3.1 Categories of Data

When you contact us via the contact form, onGRID collects your first and last name, email address, company name, and request. If provided, your phone number is also collected.

2.3.2 Purpose and Legal Basis

Your personal data is processed to answer your inquiry. The legal basis is Art. 6 para. 1 b) GDPR, or Art. 6 para. 1 a) GDPR if consent is given for additional details.

2.3.3 Data Retention

Your personal data is deleted once your inquiry is resolved.

2.4 Chat

2.4.1

The following categories of data are processed by onGRID when you create a Chat or being invited to join one: Log data as described in section 2.1.1, first and last name, e-mail address, event information, Chat message content shared, images and graphics uploaded as an avatar, information transmitted via QR-Code are collected by onGRID if you create, use and/or being invited to a Chat.

2.4.2

We use a third-party service provider to enable the Chat function, i.e. to enable chat message exchanges as well as avatars for a more personable communication and user experience with other Chat participants. Your personal data is hosted in data centers in the EU. We have entered into a data processing agreement in accordance with Art 28 GDPR with [SPB1] our third-party service provider. QR codes are used to enable easy invitation sharing and participation. The provision of the Chat functionality is based on Art. 6 para. 1 b) GDPR, i.e., a user agreement entered with you when you registered on our website for a User Account (see 2.2.2). The creation of an avatar is based on your consent pursuant to Art. 6 para 1a) GDPR, which you provide when you upload a picture (see 2.2.2) or use certain avatar creation features. We also process your personal data for trouble-shooting purposes, ensure security and improve user experiences in accordance with Art. 6 para. 1 f) GDPR based on our legitimate interest for a trouble-free operation of our website and its functionalities.

2.4.3

onGRID retains Chat messages for 6 months and deletes them thereafter; User Account data is retained as set out in 2.2.3. Avatar data we process based on a consent you have provided to us will be retained until you withdraw your consent.

2.5 Invitation- Functionality

2.5.1

Legal guardian: The following categories of data are processed by onGRID when you are being invited to register with onGRID as a legal guardian: In addition to Log data described in 2.1.1, your name, phone number, email, date of birth, address, and digital signature are processed by onGRID.
Ward: The following categories of personal data are processed by onGRID when you are being invited by your legal guardian as his/her ward: In addition to Log data described in 2.1.1, your name, phone number, email, date of birth, driving license, racing license, emergency contact and address are processed by onGRID.
Vehicle Owner: The following categories of data are processed by onGRID when you are invited to become vehicle owner of newly registered car: In addition to Log data described in 2.1.1 and your User Account data described in 2.2.1, name, phone number, email, date of birth, address, emergency contact are processed by onGRID.
Team Manager: The following categories of data are processed by onGRID when you are invited to become Team Manager of a certain team registered with onGRID: In addition to Log data described in 2.1.1 and your User Account data described in 2.2.1, name, phone number, email, date of birth, address, emergency contact are processed by onGRID. Team Driver: The following categories of data are processed by onGRID when you are invited to become Team Driver of a certain team registered with onGRID: In addition to Log data described in 2.1.1 and your User Account data described in 2.2.1, name, phone number, email, date of birth, driving license, racing license, emergency contact and address are processed by onGRID.

2.5.2

The legal basis to process personal data set out above by sending an invitation is Art. 6 para. 1B) GDPR, i.e., the user agreement. The invitee is free in accepting or declining such invitation and thus the processing is based on consent pursuant to Art 6 para. 1 a) GDPR. 3

2.5.3

onGRID retains personal data as set out in 2.2.3. Consent provided by accepting an invitation is retained until it is withdrawn.

2.6 Push Notifications

2.6.1

onGRID processes the following categories of data when push notifications are sent: a unique device identifier, i.e. a token, to help target notifications to the specific user. In addition, onGRID processes the users preferences for receiving push notifications; this can be, for example, results, race director decisions, live news sent by an organizer, as well as penalties.

2.6.2

The legal basis to process personal data for push notifications is the user’s consent to receive them, Art 6 para. 1 a) GDPR, which can be withdrawn at any time with effect for the future. If you no longer wish to receive push notification, then please push notifications can be turned off from android and ios application setting find onGRID application and turn off push notification; click on the link contained at the bottom of the notification that reads “unsubscribe” or email consulting@datenschutzexperte.de.

2.6.3

Your data is processed for push notification until you have withdrawn your consent. Push notifications for specific events are only sent during this event and not thereafter.

2.7 Datadog

2.7.1

onGRID uses datadog, a service provided by Datadog,Inc., with its business address at 6208th Ave., 45th Floor, New York, NY 10018, USA, for monitoring, analytics and optimizing the performance, availability and security of our platform. Datadog enables us to collect real-time metrics, logs, and security related data to maintain stable and secure operations, such as:

Server and infrastructure metrics (CPU usage, memory load), Log data as set out in 2.1.1, application data (API usage, performance metrics), security related events (e.g., log in attempts).

2.7.2

The legal basis for this processing is our legitimate interest in trouble-free operations pursuant to Art. 6 para. 1 f) GDPR.

2.7.3

Logs and metrics are retained only as long as they are necessary for their respective purpose. Data is deleted automatically [please insert what the setting is – e.g., 30 days?], unless a longer retention period is justified for security and auditing purposes.

3. Transfer and Recipient of Your Personal Data

3.1 Data Storage

Except as described in Section 4, all information obtained from your website visit is stored on servers within the European Union.

3.2 Employees and Service Providers

onGRID’s employees responsible for website administration, maintenance, and development may access your data. IT service providers may also access your data during maintenance. Data is not transferred to third parties without your consent unless legally required.

3.3 Data Transfer

If you use your User Account to register for and participate in races and/or events organized by third party race organizers and/or event organizers, then your personal data uploaded to your User Account is transferred to these third-party race/event organizers as described in section 2.2.3 above. Please note that third party race/event organizers may process your personal data subject to their own data privacy information as well as terms and conditions. From time to time, these third-party race/event organizers may be located outside the EU in third countries which may not provide an adequate level of data privacy. In such cases and if you nevertheless register for a race / event with a race/event organizer in such third country, your personal data will be transferred to such race organizer as it is necessary for the performance of a contract (race/event participation) between you and the race/event organizer based on Art 49 (1) lit. b) GDPR.

3.4 Chat Messages

Chat messages are not shared with external third parties.

3.5 Invitation - Functionality

As described in section 2.5, the invitation functionality is meant to be used in relation to onGRID users. Invitations shall not be sent to individuals not yet registered with onGRID.

3.6 Push Notification

Your personal data is used for push notification so long until you withdraw your consent/unsubscribe from the notification list.

As described in section 2.5, the invitation functionality is meant to be used in relation to onGRID users. Invitations shall not [SPB1] be sent to individuals not yet registered with onGRID.

3.7 Datadog

Datadog acts as our data processor under Art. 28 GDPR, and a data processing agreement has been concluded into which EU standard contractual clauses are incorporated. If you wish to receive a copy of these EU standard contractual clauses, please contact consulting@datenschutzexperte.de.

4. Google Analytics and Google AdSense

4.1 Google Analytics

onGRID uses Google Analytics to analyze website usage. Cookies collect information such as browser type/version, operating system, referrer URL, and IP address. This information is sent to Google servers in the U.S. and used for reports and optimizing the website. Your IP address is anonymized, and you can opt-out of Google Analytics via browser add-ons.

4.2 Google AdSense

Google AdSense places ads on the website using cookies and web beacons. Data, including your IP address is transferred to Google servers in the U.S. You can prevent cookies from being stored by adjusting your browser settings.

5. Statutory and Contractual Requirements

Providing personal data is optional, but certain services (e.g., blocking cookies) may not function fully without it.

6. Websites of Third Parties

This website may contain hyperlinks to third-party websites. onGRID is not responsible for the content or privacy practices of third-party websites.

7. Amendment of this Data Privacy Policy

onGRID reserves the right to amend this policy at any time. The current version is available on the website.

8. Your Rights

You have the right to access, correct, or delete your personal data, restrict its processing, and request data portability. You can object to processing based on onGRID’s legitimate interest. Complaints can be directed to regulatory authorities or to onGRID at data@myongrid.com.