HYROX Sweden

Privacy policy

HYROX Sweden

PRIVACY POLICY HYROX.COM

1. Scope of the processing of personal data

You can rely on the protection and security of your personal data: The protection of your privacy when

processing personal data is an important concern for Upsolut Sports GmbH ("Upsolut", "we", "us"),

which we take into account in all our business processes. With this data protection notice, we would

therefore like to take this opportunity to explain to you the basic rules of our handling of personal data -

which naturally takes place in compliance with the applicable European and national data protection

regulations. We collect and use our users' personal data only to the extent necessary to provide a

functional website and our content and services. The collection and use of our users' personal data

only takes place regularly with the user's consent. An exception applies in cases where prior consent

cannot be obtained for factual reasons and the processing of the data is permitted by law.

This privacy policy applies to all English-language pages of the hyrox.com domain. The privacy policy

for the German-language pages can be found at https://hyroxdach.com/privacy-policy/

2. Legal basis for the processing of personal data

Insofar as we obtain the consent of the data subject for the processing of personal data, Article 6 (1)

(a) EU General Data Protection Regulation (“GDPR”) serves as the legal basis for the processing of

personal data.

When processing personal data that is necessary for the performance of a contract to which the data

subject is a party, Article 6 (1) (b) GDPR serves as the legal basis. This also applies to processing

operations that are necessary to carry out pre-contractual measures.

Insofar as the processing of personal data is necessary to fulfill a legal obligation to which our

company is subject, Article 6 (1) (c) GDPR serves as the legal basis.

In the event that vital interests of the data subject or another natural person require the processing of

personal data, Article 6 (1) (d) GDPR serves as the legal basis.

If the processing is necessary to safeguard a legitimate interest of our company or a third party and if

the interests, fundamental rights and freedoms of the data subject do not outweigh the former interest,

Article 6 (1) (f) GDPR serves as the legal basis for the processing.

3. Purpose of data processing

When you visit our website, your browser transmits certain data to our web server for technical

reasons. We use this technical access information to constantly improve the attractiveness and

usability of our website and its content and to identify possible technical problems with our website. In

addition, we store this data for a limited period of time to safeguard our legitimate interests in order to

be able to trace it back to personal data in the event of unauthorized access or attempted access to

our servers. You can find out what information this is in detail on the following pages.

We use so-called "cookies" on our website. You can find details about this in our cookie policy in

section 5 below.

In addition to automatically collected data, we also process data that you have provided to us

voluntarily, e.g., by contacting us or using other online forms.

#1239836v4<DMS>

4. Description and scope of data processing

Each time our website is accessed, our system automatically collects data and information from the

computer system of the accessing computer. This data is recorded in the form of logs.

The following data is collected:

● Visited website

● Time at the time of access

● Amount of data sent in bytes

● Source/reference from which you reached the page

● Browser used

● Operating system used

● IP address used

This data is not merged with other data sources.

We use the logs to make the website and its functions available to you. We use the collected data to

optimize our website and to ensure the security of our IT systems. We use logs as part of our

legitimate interest in the provision and ongoing development of our website. The legal basis is Article 6

(1) (f) GDPR.

a) Online presence in social media

We maintain online presences within social networks in order to communicate with the interested

parties and users active there and to inform them about our events and news. In this context, we

integrate external services or content by linking them to our website. If you use such a service (click on

the link and open the platform) or if third-party content is displayed to you, communication data (such

as IP addresses or general device information) will be exchanged between you and the respective

provider for technical reasons.

In addition, it is possible that the provider of the respective external services or content collects

personal data about you - for example by means of corresponding cookies - and then processes it for

its own purposes. We have configured services or content from providers that are known to process

data for their own purposes to the best of our knowledge and belief in such a way that either

communication for purposes other than displaying the content or services on our website does not

take place or communication only takes place when you actively decide to use the external service.

However, as we generally or to a large extent have no influence on the data collected by third parties

and its processing by them, we cannot provide any binding information on the purpose and scope of

the processing of your data.

Further information on the purpose and scope of the collection and processing of your data by the

providers of the corresponding external services as well as information on the data protection notices

of the respective providers of the external services or content integrated by us can be found via the

following links:

Google Maps:

Privacy Notice = policies.google.com/privacy

Cookie Policy = policies.google.com/technologies/types

Facebook respective Meta:

Data protection notice = www.facebook.com/business/gdpr

#1239836v4<DMS>

YouTube:

Privacy Policy = https://policies.google.com/technologies/product-privacy?hl=de&gl=de

Cookie Policy = https://policies.google.com/technologies/cookies?hl=de

(1) Facebook fan page

Upsolut operates an online presence on Facebook, a so-called Facebook fan page by Meta Platforms

Inc. The following additional reports on data processing activities apply to visits to our fan page.

We are jointly responsible with Meta for the operation of our Facebook fan page in accordance with

Article 26 GDPR. To this end, Meta has concluded an agreement with us to determine who fulfills

which obligations with regard to data privacy. This agreement can be accessed here. According to this

agreement, Meta is primarily responsible for providing the data subject with information about the joint

processing and enabling them to exercise their data protection rights. Irrespective of this, we hereby

inform you about your visit to our fan page and thus provide you with the information required under

data protection law.

You can find general information on data privacy on Meta here.

You can reach the entity at Meta responsible for us at:

Facebook Ireland Ltd.

4 Grand Canal Square,

Grand Canal Harbour,

Dublin 2, Ireland

You can reach Meta online here .

You can contact Meta's data protection officer at

https://www.facebook.com/help/contact/540977946302970

Our contact details and the contact details of our data protection officer can be found in this data

privacy notice under section 9.

Collection and storage of personal data as well as type and purpose and their use:

(a) Data collected by Meta on Facebook:

If you are a Facebook user, Meta collects the data described in the Facebook data policy under "What

types of information do we collect?". If you are not a Facebook user, cookies with identifiers, small text

files, may still be stored in your browser to enable tracking of your user behavior.

As a rule, user data is also processed by Meta for market research and advertising purposes when

you visit Facebook. Complex user profiles are created based on user behavior (including when visiting

our fan page), which Meta can use to display personalized advertisements to visitors inside and

outside of Facebook. You can also find more information on this in the Facebook data policy.

If you do not agree to this, you can object here (opt-out).

(b) Data used by us ("Page Insights") and legal basis:

Meta provides us with statistics and usage data that we can use to analyze the use of our fan page

(so-called "Page Insights"). This enables us to continuously improve our offer on Facebook. As the

operator, we do not make any decisions regarding the processing of Insights data and all other

information resulting from Article 13 GDPR, such as the storage duration of cookies on user end

#1239836v4<DMS>

devices. The primary controller under the GDPR for the processing of Insights data is Meta. In this

regard, we also refer to the agreement on joint controllership pursuant to Article 26 GDPR that Meta

has concluded with us and to the obligations assumed by Meta under this agreement.

As the page administrator, we have no other way of evaluating user behavior on our fan page, not

even via user tracking. In principle, it is also not possible for us to identify visitors to our fan page on

the basis of page insights. In particular, in accordance with the agreement with Meta, we have no right

to demand that Meta disclose individual visitor data. Identification is only possible for us if we can

assign individual profile pictures to "Like" information for the page; however, this is only possible if our

fan page has been marked with "Like" by the corresponding visitor and the "Like" information is set to

"public".

You can find out what information Meta uses to create Page Insights here.

The operation of the Facebook fan page and the use of page insights serves our legitimate interest in

an effective external presentation and communication with our interested parties. This interest justifies

the operation of the page both in relation to the legitimate interests of Facebook users and in relation

to visitors to our fan page who do not have a Facebook account. The legal basis is therefore Article 6

(1) (f) GDPR.

(2) Instagram

Upsolut has an online presence on Instagram. Instagram is an audio-visual platform by Meta that

allows users to share photos and videos and also distribute them on other social networks.

You can reach the entity at Meta responsible for us at:

Facebook Ireland Ltd.

4 Grand Canal Square,

Grand Canal Harbour,

Dublin 2, Ireland

You can reach Meta online here.

You can contact Meta's data protection officer at

https://www.facebook.com/help/contact/540977946302970.

Further information and the applicable data protection provisions of Instagram can be found at

https://help.instagram.com/155833707900388 and https://www.instagram.com/about/legal/privacy/.

(a) Data collected by Meta on Instagram:

If you are an Instagram user, Meta collects the data described in the Instagram Data Policy under

"What types of information do we collect?". If you are not an Instagram user, cookies with identifiers,

small text files, may still be stored in your browser, which enable so-called tracking of your user

behavior.

As a rule, user data is also processed by Meta for market research and advertising purposes when

you visit Instagram. Complex user profiles are created based on user behavior (including when visiting

our Instagram), which Meta can use to display personalized advertisements to the visitor inside and

outside of Instagram. You can also find more information on this in the Instagram data policy.

#1239836v4<DMS>

(b) Data used by us ("Page Insights") and legal basis:

Meta provides us with statistics and usage data that we can use to analyze the use of our Instagram

page (so-called "page insights"). This enables us to continuously improve our offer on Instagram. As

the operator, we do not make any decisions regarding the processing of Insights data and all other

information resulting from Article 13 GDPR, such as the storage duration of cookies on user end

devices. The primary controller under the GDPR for the processing of Insights data is Meta.

As the site administrator, we have no other way of evaluating user behavior on our Instagram page,

not even via user tracking. It is also generally not possible for us to identify visitors to our Instagram

page based on page insights. In particular, in accordance with the agreement with Meta, we have no

right to demand that Meta disclose individual visitor data. In addition to any personal data transmitted

directly to us by users, we can see information about the user's profile, likes and posts, depending on

the user's privacy settings.

The operation of the Instagram page serves our legitimate interest in an effective external presentation

and communication with our interested parties. This interest justifies the operation of the page both in

relation to the legitimate interests of Instagram users and in relation to visitors to our fan page who do

not have an Instagram account. The legal basis is therefore Article 6 (1) (f) GDPR.

(3) LinkedIn

Upsolut has a profile on LinkedIn. LinkedIn is a social network and online platform for professionals,

specialists and managers.

We are jointly responsible with LinkedIn for the use of Page Insights when operating our LinkedIn

profile in accordance with Article 26 GDPR. To this end, LinkedIn has concluded an agreement with us

to determine who fulfills which obligations with regard to data protection. This agreement can be

accessed here. LinkedIn is therefore primarily responsible for providing the data subject with

information about the joint processing and enabling them to exercise their data protection rights.

Irrespective of this, we hereby inform you about your visit to our profile and thus provide you with the

information required under data protection law.

You can reach LinkedIn at:

LinkedIn Ireland Unlimited Company

Wilton Place,

Dublin 2, Ireland

You can reach LinkedIn online here.

You can contact LinkedIn's data protection officer at

https://www.linkedin.com/help/linkedin/ask/TSO-DPO

Further information and the applicable data protection provisions of LinkedIn may be retrieved under

https://www.linkedin.com/legal/privacy-policy.

(a) Data collected by LinkedIn

If you are a LinkedIn user, LinkedIn collects the data described in the LinkedIn data policy under

"Information we collect". For members who are not logged in to LinkedIn, a LinkedIn cookie is not set

so that identification is not possible. For more information, see the LinkedIn cookie policy at

https://www.linkedin.com/legal/cookie-policy.

#1239836v4<DMS>

As a rule, user data is also processed by LinkedIn for market research and advertising purposes when

you visit LinkedIn. Complex user profiles are created based on user behavior (including when visiting

our LinkedIn profile), which LinkedIn can use to display personalized advertisements to visitors inside

and outside LinkedIn. You can also find more information on this in the LinkedIn privacy policy.

(b) Data used by us and legal basis

LinkedIn provides us with statistics and usage data that we can use to analyze the use of our LinkedIn

page (so-called "Page Insights"). This enables us to continuously improve our offer on LinkedIn. As

the operator, we do not make any decisions regarding the processing of Insights data and all other

information resulting from Article 13 GDPR, such as the storage duration of cookies on user end

devices. The primary controller under the GDPR for the processing of Insights data is LinkedIn. In this

regard, we also refer to the agreement on joint controllership pursuant to Article 26 GDPR that

LinkedIn has concluded with us and to the obligations assumed by LinkedIn under this agreement.

As the page administrator, we have no other way of evaluating user behavior on our LinkedIn page,

not even via user tracking. It is also generally not possible for us to identify visitors to our LinkedIn

page using Page Insights. In particular, in accordance with the agreement with LinkedIn, we have no

right to demand that LinkedIn disclose individual visitor data. In addition to any personal data

transmitted directly to us by users, we can see information about the user's profile, likes and posts,

depending on the user's privacy settings.

You can see what information LinkedIn uses to create Page Insights here.

The operation of the LinkedIn profile and the use of Page Insights serves our legitimate interest in an

effective external presentation and communication with our interested parties. This interest justifies the

operation of the page both in relation to the legitimate interests of LinkedIn users and in relation to

visitors to our profile who do not have a LinkedIn account. The legal basis is therefore Article 6 (1) (f)

GDPR.

(4) YouTube

Upsolut operates a profile on YouTube. YouTube is a video platform of Google Ireland Limited

("Google").

You can reach Google at:

Google Ireland Limited,

Gordon House,

4 Barrow St,

Dublin, D04 E5W5,

Ireland

You can access YouTube online here.

You can contact Google's data protection officer at

https://support.google.com/policies/answer/9581826?hl=en&visit_id=638372814579525128-28747987

44&rd=1

Further information and the applicable data protection provisions of Google may be retrieved under

https://policies.google.com/privacy?hl=en.

#1239836v4<DMS>

(a) Data collected by Google on YouTube

By using YouTube, your personal data will be collected, transferred, stored, disclosed and used by

Google and transferred to, stored and used in the United States, Ireland and any other country in

which Google does business, regardless of your place of residence. It is transferred to companies

affiliated with Google and to other trustworthy companies or persons who process it on behalf of

Google.

Google processes your voluntarily entered data such as name and user name, e-mail address and

telephone number. Google also processes the content that you create, upload or receive from others

when using the services. This includes, for example, photos and videos that you save, documents and

spreadsheets that you create and comments that you write on YouTube videos.

On the other hand, Google also analyzes the content you share to determine which topics you are

interested in, stores and processes confidential messages that you send directly to other users and

can determine your location using GPS data, information on wireless networks or your IP address in

order to send you advertising or other content.

Google may use analysis tools such as Google Analytics for evaluation purposes. We have no

influence on the use of such tools by Google and have not been informed of such potential use. If tools

of this type are used by Google for our YouTube channel, we have neither commissioned this nor

supported it in any other way. The data obtained from the analysis is also not made available. Only

certain subscriber profiles can be viewed by us via our account. Furthermore, we have no way of

preventing or disabling the use of such tools on your YouTube channel.

Finally, Google also receives information when you view content, for example, even if you have not

created an account. This so-called "log data" may include the IP address, the browser type, the

operating system, information about the previously accessed website and the pages you accessed,

your location, your mobile phone provider, the end device you use (including device ID and application

ID), the search terms you used and cookie information.

You have the option of restricting the processing of your data in the general settings of your Google

account. In addition to these tools, Google also offers specific data protection settings for YouTube.

You can find out more about this in Google’s guide to data protection in Google products:

https://policies.google.com/privacy?hl=en-US.

(b) Data used by us and legal basis

Google provides us with statistics and usage data that we can use to analyze the use of our YouTube

channel (so-called "channel analytics"). This enables us to continuously improve our offering on

YouTube. As the operator, we do not make any decisions regarding the processing of analytics data

and all other information resulting from Article 13 GDPR, such as the storage duration of cookies on

user end devices. The primary controller under the GDPR for the processing of analytics data is

Google.

As the site administrator, we have no other way of evaluating user behavior on our YouTube channel,

not even via user tracking. It is also generally not possible for us to identify visitors to our YouTube

channel using channel analytics. In addition to any personal data transmitted directly to us by users,

depending on the user's privacy settings, we can see information about their profile, their interaction

(e.g. likes or dislikes), their saved and shared videos, their comments and their own videos.

You can see what information Google uses to create channel analytics here.

#1239836v4<DMS>

The operation of the YouTube channel and the use of channel analytics serve our legitimate interest in

an effective external presentation and communication with our interested parties. This interest justifies

the operation of the site both in relation to the legitimate interests of YouTube and Google users and in

relation to visitors to our profile who do not have a YouTube or Google account. The legal basis is

therefore Article 6 (1) (f) GDPR.

b) External services and content on our website

(1) Google Analytics

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Ltd, 4

Barrow St, Grand Canal Dock, Dublin 4, D04 V4X7, Ireland, ("Google").

Google Analytics 4 uses "cookies", which are text files placed on your computer, to help the website

analyze how users use the site. The following data is processed for this purpose:

● Pages accessed

● Your behavior on the pages (e.g. length of stay, clicks, scrolling behavior)

● Your approximate location (country and city)

● Your IP address (in abbreviated form, so that no clear assignment is possible)

● Technical information such as browser, internet provider, end device and screen resolution

● Source of origin of your visit (i.e. via which website or advertising medium you came to us)

In principle, your data will be processed in the EU if it is still personal. For the exceptional cases in

which personal data is transferred to the USA, Google has submitted to the EU-US Data Privacy

Framework, https://www.dataprivacyframework.gov/s/. The personal data transmitted by your browser

as part of Google Analytics will not be merged with other Google data.

When Google Analytics 4 is used, the IP is truncated by default, thus excluding any direct personal

reference. If the data collected about you is therefore personally identifiable, it is immediately excluded

and the personal data is deleted immediately.

We use Google Analytics to analyze and regularly improve the use of our website. We can use the

statistics obtained to improve our offer and make it more interesting for you as a user. The legal basis

for the processing of your data and the storage of cookies by Google Analytics 4 is your consent in

accordance with Article 6 (1) (a) GDPR. You can withdraw or amend this consent at any time at

https://hyrox.com/privacy-policy/#consent-change. You can also prevent Google from collecting the

data generated by the cookie and relating to your use of the website (including your IP address) and

from processing this data by Google by downloading and installing the browser plug-in available at the

following link: https://tools.google.com/dlpage/gaoptout?hl=en.

(2) Google Maps

We use Google Maps (API) from Google on our website. Google Maps is a web service for displaying

interactive (land) maps in order to visualize geographical information. By using this service, you can

see our location and make it easier for you to find us.

By using Google Maps, information about the use of this website, including your IP address and the

(start) address entered as part of the route planner function, may be transmitted to Google. When you

visit our website and you have consented to the use of Google Maps, your browser establishes a

#1239836v4<DMS>

direct connection with Google's servers. The map content is transmitted by Google directly to your

browser, which integrates it into the website.

We have no influence on the scope of the data processed by Google. To the best of our knowledge,

this is at least the following data:

● Date and time of the visit to the website in question,

● Internet address or URL of the website accessed,

● IP address, (start) address entered during route planning.

In principle, your data will be processed in the EU if it is still personal. For the exceptional cases in

which personal data is transferred to the USA, Google has submitted to the EU-US Data Privacy

Framework, https://www.dataprivacyframework.gov/s/. The personal data transmitted by your browser

in the context of Google Maps will not be merged with other Google data.

The legal basis for the processing of personal data is your consent in accordance with Article 6 (1) (a)

GDPR, which you have given on our website. You can withdraw or amend this consent at any time at

https://hyrox.com/privacy-policy/#consent-change.

Further information on the purpose and scope of data collection and its processing by the plug-in

provider can be found in the provider's privacy policy. There you will also find further information on

your rights in this regard and setting options to protect your privacy:

http://www.google.de/intl/de/policies/privacy .

(3) TikTok Pixel

We use the TikTok Pixel on our website. The TikTok Pixel is a TikTok advertiser tool from TikTok

Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland ("TikTok"). The TikTok Pixel is a

code that enables us to understand and track the activities of visitors to our website. The TikTok pixel

collects and processes information about visitors to our website or the devices they use. The data

collected via the TikTok Pixel is used to target our advertisements and to improve ad delivery and

personalized advertising. For this purpose, the data collected on our website using the TikTok pixel is

transmitted to TikTok. Some of this data is information that is stored on the device you are using. In

addition, the TikTok Pixel also uses cookies to store information on the device you are using. Such

storage of information by the TikTok Pixel or access to information that is already stored on your

device only takes place with your consent.

The legal basis for the processing of personal data is therefore your consent pursuant to Article 6 (1)

(a) GDPR. You can withdraw or amend this consent at any time at

https://hyrox.com/privacy-policy/#consent-change.

You can find more information on data protection by TikTok in TikTok's privacy policy at

https://www.tiktok.com/legal/page/eea/privacy-policy/en.

(4) Event booking and event photography

An event booking form is available on our website, which can be used for the electronic booking of

events and event photography. If a user makes use of this option, the data entered in the input mask

(name, e-mail address, date of birth, billing address, gender, name and telephone number of an

emergency contact and the registration number) will be transmitted to us and our processors and

stored. In addition, you can optionally indicate how you heard about us and whether you are a member

of a fitness studio or a partner studio. Apart from the information you enter in the respective input

screen, no other data is recorded.

#1239836v4<DMS>

In connection with the event booking, we pass on the data you enter to our processors TicketSocket,

Vivenu and Stripe. For events that take place by January 31, 2024, TicketSocket, Inc. based at 2901

W. Coast Highway, Newport Beach, CA 92663, USA ("TicketSocket") will make the event bookings for

us and issue the tickets for the booked event. For all events from January 1, 2024, our processor

Vivenu GmbH, based in Kesselstraße 3, 40221 Düsseldorf, Germany, will do this. In January 2024, we

will use both processors side by side. Payment for the booking is processed by our processor Stripe

Payments Europe Ltd, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland ("Stripe"). We

have concluded a contract data processing agreement with TicketSocket and Vivenu.

The data will only be used to process the booking, i.e. the processing of the personal data from the

input mask is used solely to process the booking, process the payment, carry out the event, compile

statistics on the event and event photography. When you make a booking, you will receive important

information about the event you have booked via a distribution list by email. We use the same

processor for this as for sending the newsletter (Active Campaign). If you no longer wish to receive

this information, you can unsubscribe from this mailing list at any time by clicking on "Unsubscribe" in

the respective newsletter or by sending an email to dach@hyrox.com. We compile the statistics using

our processor Fanalist, based at Kerkstraat 54, 1191JD, Ouderkerk aan de Amstel, Netherlands. The

event photography is carried out by our contract data processor Sportograf Digitial Solutions GmbH,

based in Aachen, Süsterfeldstr. 170. In the case of an event booking together with event photography,

your personal data will be processed to fulfill the contract with you in accordance with Article 6 (1) (b)

GDPR, otherwise in accordance with Article 6 (1) (a) GDPR, in which case you can withdraw your

consent at any time by sending an e-mail to dach@hyrox.com with effect for the future.

If you have agreed to receive a newsletter as part of the booking, we will also process the data for this

purpose. The legal basis for this processing is your consent (Article 6 (1) (a) GDPR). You can withdraw

this consent at any time with effect for the future by sending an email to dach@hyrox.com. Further

information on the processing of your data for the receipt of a newsletter can be found in the

"Newsletter" section below.

The data will be deleted by us as soon as it is no longer required for the purpose for which it was

collected. For the personal data from the input mask of the event booking form and those sent by

e-mail, this is the case when the respective event that the customer has booked has ended.

TicketSocket is a provider based in the USA, which is why, as far as we are aware, your

above-mentioned data may be transferred to the USA. With the Schrems II decision of the European

Court of Justice (C-311/18), the previously existing adequacy decision for data transfers to the USA,

the so-called Privacy Shield Agreement, was declared invalid. The European Court of Justice found

that the USA does not ensure an adequate level of data protection. In particular, there is a risk that

personal data is subject to access by US authorities for control and monitoring purposes and that no

effective legal remedies are available. The transfer to as well as the processing and/or storage of

personal data by TicketSocket is therefore based on the standard contractual clauses of the European

Commission pursuant to Article 46 (2) (c) GDPR. We have also concluded a data processing

agreement with TicketSocket. Where necessary, additional technical and organizational measures are

taken if an adequate level of data protection cannot otherwise be guaranteed.

(5) Newsletter

You can register for a newsletter on our website. We use the platform of our processor

ActiveCampaign LLC to send the newsletter. Active Campaign is an offer from ActiveCampaign, LLC,

150 N. Michigan Ave Suite 1230, Chicago, IL, US, USA ("Active Campaign"). If a user makes use of

this option, the data entered in the input mask will be transmitted to us and Active Campaign and

stored. Apart from the information you enter in the respective input mask (name and e-mail address),

no other data is recorded.

#1239836v4<DMS>

In connection with the registration for the newsletter, we pass on the data to Active Campaign, which

sends the newsletter on our behalf. The data will not be passed on to third parties in this context. The

The data is used for the registration and sending of the newsletter, i.e. the processing of the personal

data from the input mask serves us solely for this purpose. Before you are added to the list, you must

confirm your registration by clicking on a link in a confirmation e-mail (double opt-in).

The newsletters contain a so-called "web-beacon", i.e. a pixel-sized file that is retrieved from the

Active Campaign server when the newsletter is opened. As part of this retrieval, technical information,

such as information about the browser and your system, as well as your IP address and time of

retrieval, is initially collected. This information is used for the technical improvement of the services

based on the technical data or the target groups and their reading behavior based on their retrieval

locations (which can be determined with the help of the IP address) or the access times.

The statistical surveys also include determining whether the newsletters are opened, when they are

opened and which links are clicked. For technical reasons, this information can be assigned to

individual newsletter recipients. However, it is neither our intention nor that of Active Campaign to

observe individual users. The evaluations serve us much more to recognize the reading habits of our

users and to adapt our content to them or to send different content according to the interests of our

users.

The legal basis for the processing of personal data is your consent pursuant to Article 6 (1) (a) GDPR.

If you no longer wish to receive this information, you can withdraw your consent at any time by clicking

on "Unsubscribe" in the respective newsletter or by sending an email to dach@hyrox.com and

unsubscribing from this mailing list. We will then delete your data from our system immediately. Please

note that it may take 1-2 working days for the withdrawal to be noted everywhere in the system. During

this period, it is possible that you will receive further newsletters.

In principle, your data will be processed in the EU if it is still personal. For the exceptional cases in

which personal data is transferred to the USA, Active Campaign has submitted to the EU-US Data

Privacy Framework, https://www.dataprivacyframework.gov/s/. The personal data transmitted by your

browser as part of Active Campaign will not be merged with other Active Campaign data.

We have also concluded an data processing agreement with Active Campaign. You can view this at

https://www.activecampaign.com/legal/dpa. Where necessary, additional technical and organizational

measures are taken if an adequate level of data protection cannot otherwise be guaranteed.

(6) Ranking

Our website contains a ranking of the results of past events and a leaderboard. These results are

recorded by us and our processor MIKA Timing GmbH, Kürtener Str. 11B, 51465 Bergisch Gladbach,

Germany for all our events. In this ranking, the athletes are ranked according to their results. For this

purpose, the name, start number, gym, age group, nationality and times are processed. Apart from this

data, no other data is processed for the ranking. No data will be passed on to third parties in this

context.

The legal basis for the processing of your data is your consent in accordance with Article 6 (1) (a)

GDPR. You can withdraw this consent at any time with effect for the future by sending an email to

dach@hyrox.com. Please state your name, the event and your starter number in this email so that we

can delete your data. We will then remove you from the ranking immediately. Otherwise, this data will

be deleted as soon as it is no longer required for the purpose for which it was collected.

#1239836v4<DMS>

(7) YouTube

We use the YouTube.com platform to post our own videos and make them publicly accessible.

YouTube is a service provided by a third party not affiliated with us, namely Google Ireland Limited,

Gordon House, Barrow Street, Dublin, D04 E5W5, Ireland ("YouTube").

Some of our Internet pages contain links or links to YouTube content. In general, we are not

responsible for the content of linked websites. However, in the event that you follow a link to YouTube,

we would like to point out that YouTube stores the data of its users (e.g. personal information, IP

address) in accordance with its own data usage guidelines and uses it for business purposes.

We also directly integrate videos stored on YouTube on some of our websites. With this integration,

content from the YouTube website is displayed in parts of a browser window. However, the YouTube

videos are only called up by clicking on them separately. This technique is also known as "framing".

When you call up a (sub)page of our website on which YouTube videos are integrated in this form, a

connection to the YouTube servers is established and the content is displayed on the website by

notifying your browser.

The integration of YouTube content only takes place in "extended data protection mode". This is

provided by YouTube itself and ensures that YouTube does not initially store any cookies on your

device. However, when the relevant pages are accessed, the IP address and the other data mentioned

in section 4 are transmitted and thus, in particular, which of our Internet pages you have visited.

However, this information cannot be assigned to you unless you have logged in to YouTube or another

Google service (e.g. Gmail) before accessing the page or are permanently logged in.

In principle, your data will be processed in the EU if it is still personal. For the exceptional cases in

which personal data is transferred to the USA, Google has submitted to the EU-US Data Privacy

Framework, https://www.dataprivacyframework.gov/s/. The personal data transmitted by your browser

to Google will not be merged with other Google data.

The legal basis for the processing of personal data is your consent in accordance with Article 6 (1) (a)

GDPR, which you have given on our website. You can withdraw or amend this consent at any time at

https://hyrox.com/privacy-policy/#consent-change.

As soon as you start the playback of an embedded video by clicking on it, YouTube only stores

cookies on your device through the extended data protection mode, which do not contain any

personally identifiable data, unless you are currently logged in to a Google service. These cookies can

be prevented by making the appropriate browser settings and extensions.

Address and link to YouTube's privacy policy: https://www.youtube.com/static?gl=GB&template=terms.

(8) Vimeo

We use the provider Vimeo, operated by Vimeo, Inc., 555 West 18th Street, New York, New York

10011 ("vimeo"), to integrate videos into our website.

When you access videos via vimeo on our website, a connection is established to the vimeo servers in

the USA. As a result, certain information is transmitted to vimeo, regardless of whether you have a

vimeo account or not. This can be, for example

● Your IP address

● Your browser information, e.g. language settings

● Cookie information about already set vimeo cookies

#1239836v4<DMS>

● Information about the website from which you are accessing vimeo's site

Insofar as vimeo offers the use of certain additional functions, such as rating or sharing videos, these

functions are offered exclusively by vimeo and the respective third-party providers. You should check

their privacy policies carefully before using the respective functions. We have no knowledge of the

content of the data collected by vimeo or third-party providers and have no influence on their use. This

will transmit to the vimeo server which of our Internet pages you have visited. If you are logged in to

vimeo as a member, vimeo assigns this information to your personal user account. When you use the

plugin, e.g. by clicking the start button of a video, this information is also assigned to your user

account. You can prevent this assignment by logging out of your vimeo user account before using our

website and deleting the corresponding cookies from vimeo.

vimeo processes personal data in the USA and relies, among other things, on the so-called standard

contractual clauses of the European Commission, further information on this can be found at

https://vimeo.com/privacy#international_data_transfers_and_certain_user_rights in section "14.2

GDPR (EEA Users)".

vimeo may share your data with third parties. These are, for example, affiliated companies, business

partners and advertising partners, who in turn use tracking technologies on the vimeo website.

Further information on data processing and information on data protection by vimeo can be found at

https://vimeo.com/privacy and in the cookie policy at https://vimeo.com/cookie_policy.

The legal basis for the processing of personal data is your consent pursuant to Article 6 (1) (a) GDPR,

which you give by clicking on the video.

5. Cookies and similar technologies

Cookies and similar technologies are used when you visit our website. Cookies are small files that

your browser automatically creates and that are stored on your end device (laptop, tablet, smartphone,

etc.) when you visit our website and you consent to the cookies in accordance with our cookie banner,

or they are technically necessary cookies. Information is stored in a cookie that results in each case in

connection with the specific end device used. However, this does not mean that we gain knowledge of

your identity. We use the following types of cookies

a) Essential cookies

Essential cookies are required for the basic functionality of the website. They only contain technically

necessary services. You cannot object to these services. We use the following essential cookies use:

Name of the cookie Intended use Storage

duration

real_cookie_banner* Storage of the user's consent settings 365 days

real_cookie_banner*-tcf Storage of the user's consent settings 365 days

real:cookie_banner-test Storage of the user's consent settings 365 days

The data processed by essential cookies are necessary for the functioning of our website, i.e. our

legitimate interests pursuant to Article 6 (1) (f) GDPR.

b) Statistical cookies

We also use statistical cookies from Google Analytics to record and analyze the use of our website.

Details on the data processed can be found in section 4 of this privacy policy. The following

performance cookies can be set for the functions of Google Analytics:

#1239836v4<DMS>

Name of

the cookie

Provider Intended use Storage

duratio

n

_ga Google

Tag

Manager

Contains a randomly generated user ID. Google Analytics can

use this ID to recognize returning users on this website and

merge the data from previous visits.

2 years

_gid Google

Tag

Manager

Contains a randomly generated user ID. Google Analytics can

use this ID to recognize returning users on this website and

merge the data from previous visits.

24

hours

_gat_UA-1

17035483-

1

Google

Tag

Manager

Certain data is only sent to Google Analytics a maximum of

once per minute. The cookie has a lifespan of one minute. As

long as it is set, certain data transmissions are prevented.

1

minute

_gcl_au Google

Tag

Manager

Used by Google Tag Manager to display the actions of users

who visit the website after viewing or clicking on an ad.

3

months

c) Marketing cookies

Marketing cookies are used by us and third parties to record the behaviour of individual users, to

analyze the collected data and, for example, to display personalized advertising. These services allow

us to track users across multiple websites. The following marketing cookies are used on our website:

Name of

the cookie

Provider Intended use Storage

duration

uid_tt_ss TikTok Used by TikTok to recognize TikTok users. 2 months

cmpl_token TikTok Used by TikTok to recognize TikTok users. 2 months

store-count

ry-code

TikTok Used by TikTok to recognize TikTok users. 1 year

passport_c

srf_token_

default

TikTok Used by TikTok to recognize TikTok users. 2 months

uid_tt TikTok Used by TikTok to recognize TikTok users. 2 months

sid_guard TikTok Used by TikTok to recognize TikTok users. 1 year

passport_a

uth_status

TikTok Used by TikTok to recognize TikTok users. 1 month

passport_c

srf_token

TikTok Used by TikTok to recognize TikTok users. 2 months

cookie-con

sent

TikTok Used by TikTok to recognize TikTok users. 13 months

msToken TikTok Used by TikTok to recognize TikTok users. 1 hour

tt_webid_v

2

TikTok Used by TikTok to recognize TikTok users. 1 year

passport_a

uth_status_

ss

TikTok Used by TikTok to recognize TikTok users. 1 month

sessionid TikTok Used by TikTok to recognize TikTok users. 2 months

tt_webid TikTok Used by TikTok to recognize TikTok users. 1 year

ssid_ucp_

v1

TikTok Used by TikTok to recognize TikTok users. 2 months

* TikTok Used by TikTok to recognize TikTok users. 10 hours

Functional, performance and marketing cookies are only set if you have consented to their storage.

You can manage the cookies set on our website with your consent at any time and have the option to

change the acceptance or rejection of cookies. The changes will take effect immediately. If you change

your settings and reject cookies, certain functions and features of our website may not work as

intended.

#1239836v4<DMS>

Any use of cookies that is not absolutely technically necessary constitutes data processing that is only

permitted with your express and active consent in accordance with Article 6 (1) (a) GDPR. This applies

in particular to the use of functional, performance and marketing cookies. In addition, we only pass on

your personal data processed by cookies to third parties if you have given your express consent in

accordance with Article 6 (1) (a) GDPR.

6. Data erasure and storage duration

Personal data will be deleted or blocked as soon as the purpose of storage no longer applies. Storage

may also be necessary if this has been provided for by the European or national legislator in EU

regulations, laws or other provisions to which the controller is subject. The data will also be blocked or

deleted if a storage period prescribed by the aforementioned standards expires, unless there is a need

for further storage of the data for the conclusion or fulfillment of a contract. We anonymize data stored

for technical reasons after 24 hours and delete it after 7 days at the latest.

7. Possibility of objection and removal

The user has the option to withdraw their consent to the processing of personal data at any time (see

also Rights of data subjects). If the user contacts us by email, they can object to the storage of their

personal data at any time. In such a case, the conversation cannot be continued.

The collection of data for the provision of the website and the storage of data in log files is absolutely

necessary for the operation of the website. Consequently, the user has no option to object.

8. Rights of the data subjects

If your personal data is processed, you are a data subject within the meaning of the GDPR and you

have the following rights vis-à-vis the controller:

● Right to information about your personal data stored by us (Article 15 GDPR);

● Right to rectification, erasure or restriction of processing of your personal data (Article 16 - 18

GDPR);

● Right to object to processing that serves our legitimate interest, a public interest or profiling,

unless we can demonstrate compelling legitimate grounds for the processing that outweigh

your interests, rights and freedoms, or the processing serves to assert, exercise or defend

legal claims (Article 21 GDPR);

● Right to data portability (Article 20 GDPR);

● Right to lodge a complaint with a supervisory authority (Article 77 GDPR)

Responsible supervisory authority:

Der Hamburgische Beauftragte für Datenschutz und Informationssicherheit

Ludwig-Erhard-Str. 22

20459 Hamburg

Telephone: +49 (0)040-42854-4040

Email: mailbox@datenschutz.hamburg.de;

● Right to withdraw your consent to the collection, processing and use of your personal data at

any time with effect for the future. You can find more information on this in the respective

sections above, where data processing based on your consent is described (Article 7 (3

GDPR).

If you wish to exercise your rights, you can, for example, address your request to the data protection

officer named below.

#1239836v4<DMS>

9. Name and address of the controller

The controller within the meaning of the General Data Protection Regulation and other national data

protection laws of the member states as well as other data protection regulations is the:

Upsolut Sports GmbH

Bahrenfelder Straße 322

22765 Hamburg

Website: www.hyrox.com

The controller’s data protection officer is

Maja Janzen

Upsolut Sports GmbH

Bahrenfelder Straße 322

22765 Hamburg

E: datenschutzbeauftragter@hyrox.com