PRIVACY POLICY

This e-Sports web portal ("Web Portal") is operated by the International Ice Hockey Federation (hereinafter "IIHF"). The protection of your personal data is very important to us. In this statement you will find information about how we handle your personal data when you use the web portal.

1. Responsible office and data protection officer

Responsible for the processing of personal data in connection with this web portal:

IIHF, Brandschenkestrasse 50, P.O. Box 1817, 8027 Zurich, Switzerland

You can also contact our data protection officer at support@esports.iihf.com at any time if you have questions about data protection.

Our service provider eSport Studio (eSport Studio GmbH & Co.KG, Ganghoferstr. 68, 80339 Munich, Germany) is responsible for gaming operation and is the owner of the NGL software tools, which form the basis of the developed web portal esports.iihf.com.

2. Collection and use of technical data when using the web portal

If you use this web portal without otherwise (e.g. by registering) transmitting data to us, we only collect technically necessary data that is automatically transmitted to our server by your browser (e.g. browser type/browser version, operating system used, referrer URL, pages called up, length of stay, IP address, date and time of the request) or that is required by technically necessary or functional cookies.

Insofar as these data are personal data, we process them on the basis of our legitimate interest in providing you with a functioning and secure web portal (Art. 6 Par. 1 lit. f GDPR). We process this personal data as long as it is necessary for a functioning web portal. We do not merge this data with other data sources. We reserve the right to check this data subsequently if we become aware of concrete indications of illegal use.

3. Collection and use of personal data

a) Registration & tournament participation

If you register as a player on the web portal in order to participate in virtual ice hockey events, tournaments and similar events via the web portal or to undertake other activities that require registration, we process the following personal data: e-mail address, user name, display name (publicly viewable), gamer tag (individual identification on the game console used, e.g. xbox live gamertag), password, date of birth, zip code, your team name, game results and details of the game (line-up, time, playing time) as well as screenshots of the game.

We process this data in order to enable you to access the web portal and participate in tournaments and similar events (Art. 6 para. 1 lit. b GDPR). This also includes validation of your e-mail address to ensure that it works.

We process your personal data until you have deleted your player account on the web portal. Beyond that, we only store your personal data for the purpose of asserting or defending against legal claims or as long as there are legal obligations to store it.

For IT security purposes, we also process technical information on your use of the web portal, for example IP address and time of registration on the web portal. We delete this information 18 months after the respective registration on the web portal.

b) Optional data in the player account

Optionally, you can enter the following additional categories of personal data about you in your player account on the web portal, so that you are better recognized in the player network and contact can be established by other players. Detailed information about which data you can optionally enter voluntarily can be found in your player account:

- Publicly viewable additional data: First Name Last Name, Profile Picture, Gender (through avatar or profile picture), Team Name Console and Social Media Profile IDs,

- Other data not publicly available: postal address, telephone number and nationality.

By entering these additional data, you give your consent for us to process them (Art. 6 para. 1 lit. a GDPR). You may change, update or delete your data in your player account on the web portal at any time.

We will only process your personal data as long as you store them on the web portal and do not delete them, i.e. revoke your consent.  Furthermore, we only store personal data for the purpose of asserting or defending against legal claims or as long as legal obligations to store such data exist.

c) Technical operation of the web portal

In order for you to be able to use the web portal and for it to function technically, we process the device type and operating system of your end device, IP address (IP address of the accessing client), timestamp (time of access), method (http method of access), status (http status code, e.g. "request successful" or "requested file not found"), path (paths that were accessed), referrer URL (the previously visited page) and client (information on the client with which the access was made).

We process this data to enable you to technically access the web portal and to enable you to participate in tournaments and similar events (Art. 6 para. 1 lit. b GDPR).

We process your personal data as long as this is necessary for your login session or participation in a tournament / similar activity. In addition, we only store your personal data for the purpose of asserting or defending against legal claims or for as long as legal obligations to store such data exist.

d) Match reporting

- Match coverage without recordings

We process your first and last name, your display or user name, your team name and match results, such as goals scored by you, for the purposes of match reporting on the web portal, our website (www.iihf.com) or our social media presence. We may also share this information with the press so that they can use it to report about us and our tournaments. This may be live coverage or post-match reporting. We do not always process all of the above-mentioned data about you.

We process the data on the basis of our rectified interest in reporting on the e-Sports events we organise and our e-Sports division in general (Art. 6 para. 1 lit. f GDPR).

We process this personal data as long as there is a public interest in reporting.

- Match reporting with recordings

We process recordings (photo, video and sound recordings) of you and your games (collectively: "recordings") as part of game coverage on the web portal, our website (www.iihf.com) or our social media presence for the purposes of game coverage. We may also share recordings with the press for their use in reporting about us and our tournaments. This may be live coverage or post-match coverage.

We process data from public events on the basis of our rectified interest in reporting on the e-Sports events we organise and in reporting our e-Sports division in general (Art. 6 par. 1 letter f GDPR).

In some cases we may only publish the recordings with your consent (Art. 6 para. 1 lit. a GDPR). If this is the case, we will inform you separately and obtain your consent. This consent can be revoked at any time in the future. However, your consent is irrevocable in the case of multi-person images (e.g. group photos that have already been used for reporting purposes), unless a balance of interests is clearly in your favour.

We process this personal data as long as there is a public interest in the reporting and you have not (as far as possible) revoked your consent.

e) Notifications

We process the following personal data to provide you with information about current and future tournaments and similar events: E-mail address (if you are notified by e-mail), and display or user name (to address you personally in the message).

We process your data in connection with notifications that specifically concern the tournament or event in which you are interested, have registered or are already participating ("tournament notifications"), in order to ensure the smooth running of the tournament (Art. 6 para. 1 lit. b GDPR). You will only receive notifications informing you about upcoming tournaments, events or generally about our activities if you agree to receive them (Art. 6 para. 1 lit. a GDPR). You can unsubscribe at any time using the link at the end of the e-mail notifications, directly via your player account on the web portal or by sending us a message.

We process your data in connection with tournament notifications as long as this is necessary for your participation in the tournament. Otherwise, we will process your personal data for this purpose as long as you indicate an interest in our notifications or until you revoke your consent. Furthermore, we only store personal data for the purpose of asserting or defending against legal claims or as long as there are legal obligations to store such data.

4. Cookies and similar technologies

We use cookies on our site. These are small files that are automatically created by your browser and stored on your end device (laptop, tablet, smartphone or similar) when you visit our site. Cookies do not cause any damage to your end device and do not contain any viruses, Trojans or other malware.

Information is stored in the cookie that is related to the specific end device used. However, this does not mean that we gain direct knowledge of your identity.

The use of cookies serves, on the one hand, to make the use of our offer more pleasant for you. We use so-called session cookies to recognise that you have already visited individual pages of our website. These are automatically deleted after you leave our site.

In addition, we also use temporary cookies to optimise user-friendliness, which are stored on your end device for a certain fixed period of time. If you visit our site again to use our services, it is automatically recognised that you have already been to our site and which entries and settings you have made so that you do not have to enter them again.

On the other hand, we use cookies to ensure the delivery of this website by means of a CDN ("Content Delivery Network"). All requests are routed through servers operated by Imperva, 3400 Bridge Parkway, Suite 200 Redwood Shores, CA 94065, and aggregated into statistics that cannot be disabled. According to Imperva, the collected raw data is deleted within 4 hours, at the latest after 3 days. Here (https://www.imperva.com/trust-center/privacy-statement/) you can find information about the data collected there and about security & data protection at Imperva.

The data processed by cookies is necessary for the aforementioned purposes to protect our legitimate interests as well as those of third parties in accordance with Art. 6 (1) p. 1 lit. F  EU  Data Protection Regulation Most browsers accept cookies automatically. However, you can configure your browser so that no cookies are stored on your computer or a notice always appears before a new cookie is created The complete deactivation of cookies may, however, mean that you cannot use all the functions of our website.

5. Integration of third party services and content

a) If necessary, we shall set up a special interest group within our online offer based on our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our online offer within the meaning of Art. 6 para. 1 lit. f. GDPR) content or service offers from third parties in order to integrate their content and services, such as videos (hereinafter uniformly referred to as "content").

b) This always presupposes that the third-party providers of these contents are aware of the IP address of the users, as without the IP address they would not be able to send the contents to their browsers. The IP address is therefore necessary for the display of this content. We make every effort to use only such content whose respective providers use the IP address only to deliver the content. Third party providers may also use so-called pixel tags (invisible graphics, also known as "web beacons") for statistical or marketing purposes. The "pixel tags" can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user's device and may contain, among other things, technical information on the browser and operating system, referring web pages, visiting time and other details on the use of our online offer, as well as being able to be linked to such information from other sources.

(c) This may include

- a) YouTube

We have partly integrated YouTube videos into our online offer, which are stored on http://www.YouTube.com and can be played directly from our website. We would like to draw attention to our offers and make them more interesting for you. The legal basis is Art. 6 para. 1 p. 1 lit. f GDPR.

The videos are all integrated in the "extended data protection mode", i.e. no data about you as a user is transferred to YouTube if you do not play the videos. Only when you play the videos will the data mentioned under b) be transmitted. We have no influence on this data transfer.

By visiting the website, YouTube receives the information that you have called up the corresponding subpage of our website. In addition, the data mentioned under 4.a) (1) of this declaration is transmitted. This happens regardless of whether YouTube provides a user account through which you are logged in or whether no user account exists. If you are logged in at Google, your data will be assigned directly to your account. If you don't want the assignment to your profile on YouTube, you have to log out before activating the button. YouTube stores your data as user profiles and uses them for the purposes of advertising, market research and/or the design of its website to meet your needs. Such an evaluation is carried out in particular (even for users who are not logged in) to provide needs-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, whereby you must contact YouTube to exercise this right.

For more information on the purpose and scope of data processing by YouTube, please see the Privacy Policy. There you will also find further information on your rights and setting options to protect your privacy: https://www.google.de/intl/de/policies/privacy. Google also processes your personal data in the USA and has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework .

- b) Twitch TV

On our pages are plugins from Twitch TV (Twitch Interactive, Inc., 225 Bush Street, 9 th Floor, San Francisco, CA 94104, USA) integrated. Privacy policy: https://www.twitch.tv/p/legal/privacy-policy/ If you do not want Twitch to associate your visit to our site with your Twitch TV account, please log out of your Twitch TV account first.

6. Use of Amazon Web Services (AWS)

We host our website with AWS. The provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, 1855 Luxembourg (hereinafter: AWS).

When you visit our website, your personal data is processed on the servers of AWS. In the process, personal data may also be transmitted to the parent company of AWS in the USA. The data transfer to the USA is based on the EU standard contractual clauses. Details can be found here:

https://aws.amazon.com/de/blogs/security/aws-gdpr-data-processing-addendum/.

For more information, please see the AWS privacy policy: https://aws.amazon.com/de/privacy/?nc1=f_pr.

The use of AWS is based on Art. 6 para. 1 lit. f EU-DATA PROTECTION REGULATION. We have a legitimate interest in ensuring that our website is presented as reliably as possible. Insofar as a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a EU-DATA PROTECTION REGULATION; the consent can be revoked at any time.

Conclusion of an order processing contract We have concluded an order processing contract with AWS. This is a contract required by data protection law, which ensures that AWS only processes the personal data of our website visitors in accordance with our instructions and in compliance with the EU Data Protection Regulation.

7. Use of Matomo (formerly Piwik)

a) We use the open source software tool Matomo (formerly Piwik) on our website to analyse the surfing behaviour of our users and to improve our website. By evaluating the data obtained, we are able to compile information on the use of the individual components of our website. This helps us to constantly improve our website and its user-friendliness. The legal basis for the use of Matomo is Art. 6 para. 1 p. 1 lit. f GDPR.

b) The software sets a cookie on the user's computer (for cookies see already above under 4.a) (2) (3)). If individual pages of our website are called up, the following data are stored:

- Two bytes of the IP address of the calling system of the user

- The accessed website

- The website from which the user has reached the accessed website (referrer)

- The subpages that are called from the called web page

- The time spent on the website

- The frequency of visiting the website

c) Cookies are stored on the user's computer and are transmitted by the user to our site. Therefore you as a user have full control over the use of cookies. By changing the settings in your internet browser, you can deactivate or restrict the transmission of cookies. Already stored cookies can be deleted at any time. This can also be done automatically. If cookies for our website are deactivated, it may not be possible to use all the functions of the website to their full extent. It is also possible to prevent the use of Matomo by removing the following check mark and thus activate the opt-out plug-in:

  Your visit to this website is currently recorded by the web analytics. Click here, so that your visit is no longer recorded.

d) The software runs exclusively on the servers of our website in Germany. A storage of the personal data of the users only takes place there. The data will not be passed on to third parties. The software is set up in such a way that the IP addresses are not stored completely, but 2 bytes of the IP address are masked (e.g.: 192.168.xxx.xxx). In this way, it is no longer possible to assign the shortened IP address to the calling computer.

e) The program Matomo is an open source project. Information of the third party provider about data protection can be found at http://matomo.org/privacy/policy.

8. Use of Google Analytics

a) This website also uses Google Analytics, a web analysis service of Google Inc. ("Google"). Google Analytics also uses cookies (for cookies, see above under 4.a) (2) (3)), text files that are stored on your computer and which enable an analysis of your use of the website. The information generated by the cookie about your use of this website is usually transferred to a Google server in the USA and stored there. However, if IP anonymisation is activated on this website, your IP address will be shortened by Google within member states of the European Union or in other signatory states to the Agreement on the European Economic Area before this happens. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage.

b) The IP address transmitted by your browser within the framework of Google Analytics is not combined with other data from Google.

c) You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) to Google and the processing of this data by Google by downloading and installing the browser plug-in available under the following link: http://tools.google.com/dlpage/gaoptout?hl=de.

d) This website uses Google Analytics with the extension "_anonymizeIp()". This allows IP addresses to be further processed in a shortened form, thus excluding the possibility of personal references. If the data collected about you contains a personal reference, this is immediately excluded and the personal data is immediately deleted.

e) We use Google Analytics to analyse and regularly improve the use of our website. We can use the statistics obtained to improve our offer and make it more interesting for you as a user. For the exceptional cases in which personal data is transferred to the USA, Google has subjected itself to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework. The legal basis for the use of Google Analytics is Art. 6 para. 1 p. 1 lit. f GDPR.

f) Information from the third party provider: Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Terms of use: https://www.google.com/analytics/terms/de.html, overview of data protection: https://policies.google.com/technologies/partner-sites?hl=de , and the data protection declaration: https://policies.google.com/privacy?hl=de&gl=de .

Your visit to this website is currently being tracked by Web Analytics. Click here so that your visit is no longer recorded.

9. Online presence in social media

We may maintain online presences within social networks (Facebook Pages etc.) and platforms in order to communicate with the customers and users active there and to inform you about our services. When accessing the respective networks and platforms, the terms and conditions and data processing guidelines of their respective operators apply.

Unless otherwise stated in our privacy policy, we process the data of users, provided that they communicate with us within the social networks and platforms, e.g. write articles on our online presences or send us messages.

We point out that user data may be processed outside the European Union. This can result in risks for the users, because the enforcement of the users' rights could be made more difficult. With regard to US providers certified under the Privacy Shield, we would like to point out that they thereby undertake to comply with the data protection standards of the EU. You can view a current certificate for Facebook here: https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active

Furthermore, user data is generally processed for market research and advertising purposes. For example, user profiles can be created from the user behaviour and the resulting interests of the users. The user profiles can in turn be used, for example, to place advertisements within and outside the platforms that presumably correspond to the interests of the users. For these purposes, cookies are usually stored on the users' computers, in which the usage behaviour and interests of the users are stored. Furthermore, data may also be stored in the user profiles regardless of the devices used by the users (especially if the users are members of the respective platforms and are logged in to them).

The processing of users' personal data is based on our legitimate interests in effective user information and communication/interaction with users in accordance with Art. 6 Para. 1 lit. f. GDPR. If the users are asked by the respective platform providers to give their consent, e.g. with the help of a checkbox, to the data processing described above, the legal basis for the processing is Art. 6 para. 1 lit. a., Art. 7 GDPR.

For a detailed presentation of the respective processing and the possibilities of objection (opt-out), we refer to the information provided by the providers linked below.

Also in the case of requests for information and the assertion of user rights, we would like to point out that these can most effectively be asserted with the providers. Only the providers have access to the data of the users and can directly take appropriate measures and provide information. Should you still need help, you can contact us. Agreement with Facebook (Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) on joint processing of personal data: https://www.facebook.com/legal/terms/page_controller_addendum Privacy Policy: https://www.facebook.com/about/privacy/,

OptOut: https://www.facebook.com/settings?tab=ads or http://www.youronlinechoices.com

10. Data transfer

Our service provider eSport Studio supports us as a contract processor in providing the web portal. We have carefully selected eSport Studio and other service providers who support us in or in connection with the provision of the web portal and concluded an order processing agreement with the service providers.

11. Your rights

You have the following legal rights vis-à-vis IIHF with regard to the personal data concerning you, provided that the respective requirements are met. You can find further information about your rights and the relevant requirements on the website of the EU Commission at https://ec.europa.eu/info/law/law-topic/data-protection/reform/rights-citizens_de.

a) Right to information

As a data subject, you have the right to request confirmation as to whether we are processing personal data concerning you. If this is the case, you have the right to be informed about this personal data and to receive further information, e.g. the purposes of processing, the recipients and the planned duration of storage or the criteria for determining the duration.

(b) Right of rectification and completion

As a data subject, you have the right to request that incorrect personal data be corrected immediately. Taking into account the purposes of the processing, you have the right to request the completion of incomplete personal data.

c) Right of deletion ("right to be forgotten")

As the person concerned, you may have the right to have your personal data deleted. This is the case, for example, if your personal data are no longer necessary for the original purposes, if you have revoked your declaration of consent under data protection law or if the personal data have been processed unlawfully.

d) Right to limit processing

As a data subject, you have the right to limit processing in the cases provided for by law.

e) Right to data transferability

As a data subject, you have the right, in the cases prescribed by law, to receive the personal data concerning you in a structured, common and machine-readable format.

f) Right of objection

As a data subject, you have the right to object at any time, on grounds relating to your particular situation, to the processing of certain personal data concerning you.

In the case of direct marketing, you as a data subject have the right to object at any time, for reasons relating to your particular situation, to the processing of personal data concerning you for the purposes of such marketing, including profiling, insofar as it is linked to such direct marketing.

g) Right to withdraw your consent to data protection

You can revoke your consent to the processing of your personal data at any time with effect for the future. However, the legality of the processing carried out until the revocation is not affected by this.

h) Right to complain to a data protection authority

You have the right to complain to a supervisory authority, in particular in the Member State of your residence, place of employment or place of the alleged infringement, if you consider that the processing of personal data relating to you is in breach of the GDPR.

12. Amendments

Our privacy policy may change from time to time. This includes further developments due to changes in our business as well as adjustments due to a changed legal situation and/or due to the implementation of new technologies or services on the web portal. Corresponding updates of the data protection declaration will be published by us on this page. In case of significant changes we will point this out accordingly. If you have any further questions that our privacy policy could not answer, please write an e-mail to the following address: support@esports.iihf.com