This e-Sports web portal ("Web Portal") is operated by the International Ice Hockey Federation (hereinafter "IIHF"). The protection of your personal data is very important to us. In this statement you will find information about how we handle your personal data when you use the web portal.
1. Responsible office and data protection officer
Responsible for the processing of personal data in connection with this web portal:
IIHF, Brandschenkestrasse 50, P.O. Box 1817, 8027 Zurich, Switzerland
You can also contact our data protection officer at firstname.lastname@example.org at any time if you have questions about data protection.
Our service provider eSport Studio (eSport Studio GmbH & Co.KG, Ganghoferstr. 68, 80339 Munich, Germany) is responsible for gaming operation and is the owner of the NGL software tools, which form the basis of the developed web portal esports.iihf.com.
2. Collection and use of technical data when using the web portal
If you use this web portal without otherwise (e.g. by registering) transmitting data to us, we only collect technically necessary data that is automatically transmitted to our server by your browser (e.g. browser type/browser version, operating system used, referrer URL, pages called up, length of stay, IP address, date and time of the request) or that is required by technically necessary or functional cookies.
Insofar as these data are personal data, we process them on the basis of our legitimate interest in providing you with a functioning and secure web portal (Art. 6 Par. 1 lit. f GDPR). We process this personal data as long as it is necessary for a functioning web portal. We do not merge this data with other data sources. We reserve the right to check this data subsequently if we become aware of concrete indications of illegal use.
3. Collection and use of personal data
a) Registration & tournament participation
If you register as a player on the web portal in order to participate in virtual ice hockey events, tournaments and similar events via the web portal or to undertake other activities that require registration, we process the following personal data: e-mail address, user name, display name (publicly viewable), gamer tag (individual identification on the game console used, e.g. xbox live gamertag), password, date of birth, zip code, your team name, game results and details of the game (line-up, time, playing time) as well as screenshots of the game.
We process this data in order to enable you to access the web portal and participate in tournaments and similar events (Art. 6 para. 1 lit. b GDPR). This also includes validation of your e-mail address to ensure that it works.
We process your personal data until you have deleted your player account on the web portal. Beyond that, we only store your personal data for the purpose of asserting or defending against legal claims or as long as there are legal obligations to store it.
For IT security purposes, we also process technical information on your use of the web portal, for example IP address and time of registration on the web portal. We delete this information 18 months after the respective registration on the web portal.
b) Optional data in the player account
Optionally, you can enter the following additional categories of personal data about you in your player account on the web portal, so that you are better recognized in the player network and contact can be established by other players. Detailed information about which data you can optionally enter voluntarily can be found in your player account:
- Publicly viewable additional data: First Name Last Name, Profile Picture, Gender (through avatar or profile picture), Team Name Console and Social Media Profile IDs,
- Other data not publicly available: postal address, telephone number and nationality.
By entering these additional data, you give your consent for us to process them (Art. 6 para. 1 lit. a GDPR). You may change, update or delete your data in your player account on the web portal at any time.
We will only process your personal data as long as you store them on the web portal and do not delete them, i.e. revoke your consent. Furthermore, we only store personal data for the purpose of asserting or defending against legal claims or as long as legal obligations to store such data exist.
c) Technical operation of the web portal
In order for you to be able to use the web portal and for it to function technically, we process the device type and operating system of your end device, IP address (IP address of the accessing client), timestamp (time of access), method (http method of access), status (http status code, e.g. "request successful" or "requested file not found"), path (paths that were accessed), referrer URL (the previously visited page) and client (information on the client with which the access was made).
We process this data to enable you to technically access the web portal and to enable you to participate in tournaments and similar events (Art. 6 para. 1 lit. b GDPR).
We process your personal data as long as this is necessary for your login session or participation in a tournament / similar activity. In addition, we only store your personal data for the purpose of asserting or defending against legal claims or for as long as legal obligations to store such data exist.
d) Match reporting
- Match coverage without recordings
We process your first and last name, your display or user name, your team name and match results, such as goals scored by you, for the purposes of match reporting on the web portal, our website (www.iihf.com) or our social media presence. We may also share this information with the press so that they can use it to report about us and our tournaments. This may be live coverage or post-match reporting. We do not always process all of the above-mentioned data about you.
We process the data on the basis of our rectified interest in reporting on the e-Sports events we organise and our e-Sports division in general (Art. 6 para. 1 lit. f GDPR).
We process this personal data as long as there is a public interest in reporting.
- Match reporting with recordings
We process recordings (photo, video and sound recordings) of you and your games (collectively: "recordings") as part of game coverage on the web portal, our website (www.iihf.com) or our social media presence for the purposes of game coverage. We may also share recordings with the press for their use in reporting about us and our tournaments. This may be live coverage or post-match coverage.
We process data from public events on the basis of our rectified interest in reporting on the e-Sports events we organise and in reporting our e-Sports division in general (Art. 6 par. 1 letter f GDPR).
In some cases we may only publish the recordings with your consent (Art. 6 para. 1 lit. a GDPR). If this is the case, we will inform you separately and obtain your consent. This consent can be revoked at any time in the future. However, your consent is irrevocable in the case of multi-person images (e.g. group photos that have already been used for reporting purposes), unless a balance of interests is clearly in your favour.
We process this personal data as long as there is a public interest in the reporting and you have not (as far as possible) revoked your consent.
We process the following personal data to provide you with information about current and future tournaments and similar events: E-mail address (if you are notified by e-mail), and display or user name (to address you personally in the message).
We process your data in connection with notifications that specifically concern the tournament or event in which you are interested, have registered or are already participating ("tournament notifications"), in order to ensure the smooth running of the tournament (Art. 6 para. 1 lit. b GDPR). You will only receive notifications informing you about upcoming tournaments, events or generally about our activities if you agree to receive them (Art. 6 para. 1 lit. a GDPR). You can unsubscribe at any time using the link at the end of the e-mail notifications, directly via your player account on the web portal or by sending us a message.
We process your data in connection with tournament notifications as long as this is necessary for your participation in the tournament. Otherwise, we will process your personal data for this purpose as long as you indicate an interest in our notifications or until you revoke your consent. Furthermore, we only store personal data for the purpose of asserting or defending against legal claims or as long as there are legal obligations to store such data.
4. Cookies and similar technologies
a) What are cookies and similar technologies?
b) Which cookies are used on the web portal?
We process "technical" personal data in the form of your usage data such as your cookie ID, the type of your terminal device, your operating system and your browser type with the help of cookies from the provider eSport Studio GmbH & Co.KG.
c) How long do the cookies remain on my end device?
The cookies remain stored on your terminal device for between three (3) minutes and one (1) year. However, you can delete cookies at any time via the browser settings. Please note, however, that you must do this separately for each terminal device and that the cookies will be set again the next time you visit / log in to the web portal.
5. Integration of third party services and content
a) If necessary, we shall set up a special interest group within our online offer based on our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our online offer within the meaning of Art. 6 para. 1 lit. f. GDPR) content or service offers from third parties in order to integrate their content and services, such as videos (hereinafter uniformly referred to as "content").
b) This always presupposes that the third-party providers of these contents are aware of the IP address of the users, as without the IP address they would not be able to send the contents to their browsers. The IP address is therefore necessary for the display of this content. We make every effort to use only such content whose respective providers use the IP address only to deliver the content. Third party providers may also use so-called pixel tags (invisible graphics, also known as "web beacons") for statistical or marketing purposes. The "pixel tags" can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user's device and may contain, among other things, technical information on the browser and operating system, referring web pages, visiting time and other details on the use of our online offer, as well as being able to be linked to such information from other sources.
(c) This may include
- a) YouTube
We have partly integrated YouTube videos into our online offer, which are stored on http://www.YouTube.com and can be played directly from our website. We would like to draw attention to our offers and make them more interesting for you. The legal basis is Art. 6 para. 1 p. 1 lit. f GDPR.
The videos are all integrated in the "extended data protection mode", i.e. no data about you as a user is transferred to YouTube if you do not play the videos. Only when you play the videos will the data mentioned under b) be transmitted. We have no influence on this data transfer.
By visiting the website, YouTube receives the information that you have called up the corresponding subpage of our website. In addition, the data mentioned under 4.a) (1) of this declaration is transmitted. This happens regardless of whether YouTube provides a user account through which you are logged in or whether no user account exists. If you are logged in at Google, your data will be assigned directly to your account. If you don't want the assignment to your profile on YouTube, you have to log out before activating the button. YouTube stores your data as user profiles and uses them for the purposes of advertising, market research and/or the design of its website to meet your needs. Such an evaluation is carried out in particular (even for users who are not logged in) to provide needs-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, whereby you must contact YouTube to exercise this right.
- b) Twitch TV
6. Use of Matomo (formerly Piwik)
a) We use the open source software tool Matomo (formerly Piwik) on our website to analyse the surfing behaviour of our users and to improve our website. By evaluating the data obtained, we are able to compile information on the use of the individual components of our website. This helps us to constantly improve our website and its user-friendliness. The legal basis for the use of Matomo is Art. 6 para. 1 p. 1 lit. f GDPR.
b) The software sets a cookie on the user's computer (for cookies see already above under 4.a) (2) (3)). If individual pages of our website are called up, the following data are stored:
- Two bytes of the IP address of the calling system of the user
- The accessed website
- The website from which the user has reached the accessed website (referrer)
- The subpages that are called from the called web page
- The time spent on the website
- The frequency of visiting the website
Your visit to this website is currently recorded by the web analytics. Click here, so that your visit is no longer recorded.
d) The software runs exclusively on the servers of our website in Germany. A storage of the personal data of the users only takes place there. The data will not be passed on to third parties. The software is set up in such a way that the IP addresses are not stored completely, but 2 bytes of the IP address are masked (e.g.: 192.168.xxx.xxx). In this way, it is no longer possible to assign the shortened IP address to the calling computer.
e) The program Matomo is an open source project. Information of the third party provider about data protection can be found at http://matomo.org/privacy/policy.
7. Use of Google Analytics
b) The IP address transmitted by your browser within the framework of Google Analytics is not combined with other data from Google.
d) This website uses Google Analytics with the extension "_anonymizeIp()". This allows IP addresses to be further processed in a shortened form, thus excluding the possibility of personal references. If the data collected about you contains a personal reference, this is immediately excluded and the personal data is immediately deleted.
e) We use Google Analytics to analyse and regularly improve the use of our website. We can use the statistics obtained to improve our offer and make it more interesting for you as a user. For the exceptional cases in which personal data is transferred to the USA, Google has subjected itself to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework. The legal basis for the use of Google Analytics is Art. 6 para. 1 p. 1 lit. f GDPR.
Your visit to this website is currently being tracked by Web Analytics. Click here so that your visit is no longer recorded.
8. Online presence in social media
We may maintain online presences within social networks (Facebook Pages etc.) and platforms in order to communicate with the customers and users active there and to inform you about our services. When accessing the respective networks and platforms, the terms and conditions and data processing guidelines of their respective operators apply.
We point out that user data may be processed outside the European Union. This can result in risks for the users, because the enforcement of the users' rights could be made more difficult. With regard to US providers certified under the Privacy Shield, we would like to point out that they thereby undertake to comply with the data protection standards of the EU. You can view a current certificate for Facebook here: https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active
Furthermore, user data is generally processed for market research and advertising purposes. For example, user profiles can be created from the user behaviour and the resulting interests of the users. The user profiles can in turn be used, for example, to place advertisements within and outside the platforms that presumably correspond to the interests of the users. For these purposes, cookies are usually stored on the users' computers, in which the usage behaviour and interests of the users are stored. Furthermore, data may also be stored in the user profiles regardless of the devices used by the users (especially if the users are members of the respective platforms and are logged in to them).
The processing of users' personal data is based on our legitimate interests in effective user information and communication/interaction with users in accordance with Art. 6 Para. 1 lit. f. GDPR. If the users are asked by the respective platform providers to give their consent, e.g. with the help of a checkbox, to the data processing described above, the legal basis for the processing is Art. 6 para. 1 lit. a., Art. 7 GDPR.
For a detailed presentation of the respective processing and the possibilities of objection (opt-out), we refer to the information provided by the providers linked below.
OptOut: https://www.facebook.com/settings?tab=ads or http://www.youronlinechoices.com
9. Data transfer
Our service provider eSport Studio supports us as a contract processor in providing the web portal. We have carefully selected eSport Studio and other service providers who support us in or in connection with the provision of the web portal and concluded an order processing agreement with the service providers.
10. Your rights
You have the following legal rights vis-à-vis IIHF with regard to the personal data concerning you, provided that the respective requirements are met. You can find further information about your rights and the relevant requirements on the website of the EU Commission at https://ec.europa.eu/info/law/law-topic/data-protection/reform/rights-citizens_de.
a) Right to information
As a data subject, you have the right to request confirmation as to whether we are processing personal data concerning you. If this is the case, you have the right to be informed about this personal data and to receive further information, e.g. the purposes of processing, the recipients and the planned duration of storage or the criteria for determining the duration.
(b) Right of rectification and completion
As a data subject, you have the right to request that incorrect personal data be corrected immediately. Taking into account the purposes of the processing, you have the right to request the completion of incomplete personal data.
c) Right of deletion ("right to be forgotten")
As the person concerned, you may have the right to have your personal data deleted. This is the case, for example, if your personal data are no longer necessary for the original purposes, if you have revoked your declaration of consent under data protection law or if the personal data have been processed unlawfully.
d) Right to limit processing
As a data subject, you have the right to limit processing in the cases provided for by law.
e) Right to data transferability
As a data subject, you have the right, in the cases prescribed by law, to receive the personal data concerning you in a structured, common and machine-readable format.
f) Right of objection
As a data subject, you have the right to object at any time, on grounds relating to your particular situation, to the processing of certain personal data concerning you.
In the case of direct marketing, you as a data subject have the right to object at any time, for reasons relating to your particular situation, to the processing of personal data concerning you for the purposes of such marketing, including profiling, insofar as it is linked to such direct marketing.
g) Right to withdraw your consent to data protection
You can revoke your consent to the processing of your personal data at any time with effect for the future. However, the legality of the processing carried out until the revocation is not affected by this.
h) Right to complain to a data protection authority
You have the right to complain to a supervisory authority, in particular in the Member State of your residence, place of employment or place of the alleged infringement, if you consider that the processing of personal data relating to you is in breach of the GDPR.