This Privacy Policy contains the details of the data processing activities on personal data and related information concerning the activities carried out by ExperiRace Zrt. (hereinafter: “ExperiRace”) as data controller, including its activities in relation of the performance of the agreement for the use and utilization of the service (hereinafter: “Service”) available on the website at www.experirace.com (hereinafter: “Website”).

ExperiRace creates, records, and transmits images, audio and video recordings (collectively hereinafter: “Recordings”) of people present at sports events (hereinafter: “Sports Event”), including competitors, fans and assistants, as a Service, and offers such Recordings for sale on its Website.

ExperiRace is entitled to amend this Privacy Policy at any time, which amendment shall be effective upon publication on the Website and shall apply to subsequent data processing.

The “GDPR” abbreviation referred to in the text refers to the Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

1. Name and contact information of data controller

name: ExperiRace Zártkörűen Működő Részvénytársaság

seat: 109 Szentjakab park, Mogyoród, 2146, Hungary;

company registry number registered by Company Registry Court of the Budapest Environs Regional Court: 13-10-042511;

representative: Krisztián Monostori Chief Executive Officer;

e-mail address: info@experirace.com

phone number: +36-70-5924792

2. Principles of data processing

In accordance with the requirements of good faith and fairness and the applicable laws, ExperiRace acts in cooperation with the user of the Service as the data subject (hereinafter: "Data Subject") (hereinafter ExperiRace and Data Subject jointly: "Parties") during data processing. ExperiRace only processes data defined by law or provided by the Data Subject, for the purposes defined below. ExperiRace retains the data of the Data Subject only as long as it is absolutely necessary to achieve the purpose, is suitable for achieving the purpose, or as long as it is made possible or mandatory by an agreement or legal regulation.

3. The purpose and legal basis of the data processing, the scope of the processed data and the retention period

The provision and transfer of personal data is voluntary. The Data Subject can give his consent electronically by checking the "checkbox" on the Website.

In case of using the Service, the provision of personal data is necessary to perform the agreement between the Parties and to use the Services. In case of failure to provide data, the Data Subject shall not be able to use the Services, or not to their full extent.

The provision of personal data and data processing made by ExperiRace shall serve the following purposes:

• in case of purchase on the Website, in order to identify the Data Subject and to conclude the agreement, it is necessary to provide the personal data of the Data Subject: name, username, email address, password, and in certain cases, bib number, a photo, providing additional personal data is optional and can be erased by the Data Subject at any time;
• in order to provide the Services by ExperiRace and to perform the agreement, it is necessary to provide the personal data of the Data Subject: the image and voice (video recording) of natural persons appearing at the Sports Event, and in some cases the email address of third parties tagged by the Data Subject;
• processing of the data of the Data Subject in order to make payments, invoicing and recovery of claims: name (invoicing name), email address, address (invoicing address), telephone number;
• for the purpose of establishing contact and providing information (including complaint handling), the Data Subject by providing his personal data makes his questions and requests available to ExperiRace, and enables ExperiRace to provide answers and information to the Data Subject at the provided contact information: name, email address, telephone number;
• in order to get newsletter, the Data Subject specifically subscribes to the ExperiRace newsletter by providing his data as follows: name, e-mail address;
• for the compliance with additional obligations stipulated by law.

The Data Subject is solely responsible for having an appropriate legal basis for the personal data provided by the Data Subject relating to other persons. ExperiRace excludes all liability in case of failure to do so.

The organizer of the Sports Event is solely responsible for the fact that the participants of the Sports Event received full information and declared that a Recording may be made of them during the Sports Event, and that they did not object to the making of the Recordings. The organizer of the Sports Event is solely responsible for having the appropriate legal basis which allows ExperiRace to lawfully prepare the Recordings at the Sports Event.

3.1.    Purchase and conclusion of agreement

In case of using the "Purchase" menu item of the Website, the Data Subject may enter his personal data and subsequently order the Service. The Data Subject is obliged to provide his personal data in order to be able to conclude an agreement with ExperiRace and to be able to use the Service.

Purpose of data processing:	Identification of the Data Subject and conclusion of the agreement
Legal basis of data processing:	Freely given consent of the Data Subject (Article 6 (1) point a) of GDPR) and preparation for the conclusion of the agreement (Article 6 (1) point b) of GDPR) as well as Section 13/A of Act CVIII of 2001 on certain issues of electronic commercial services and services related to the information society (hereinafter: "E-commerce Act")
Scope of processed data:	Full name of the Data Subject, email address, address, telephone number, possibly the photograph or other freely given data of the Data Subject, the freely chosen password of the Data Subject
Duration of data processing:	for the 5-year general limitation period under the Hungarian Civil Code

 

3.2.       Provision of Service

ExperiRace is entitled to process the personal data provided for the purpose of using the Service in order to perform the agreement.

Purpose of data processing:	Recording of the Data Subject's image and voice (video recording) in order to provide the Service and perform the agreement
Legal basis of data processing:	performance of the agreement (Article 6 (1) point b) of GDPR), furthermore Section 13/A. of the E-Commerce Act
Scope of processed data:	The bib number of the Data Subject, image, and voice (video recording) and the email address of third parties provided by the Data Subject
Duration of data processing:	for the 5-year general limitation period under the Hungarian Civil Code, and until the Data Subject's request for erasure or until erasure by ExperiRace, if further processing of the data is not justified

 

3.3.       Payment and invoicing

During the processing of payment in accordance with the agreement concluded for the use of the Service and the issuance of accounting documents required by law, the personal data of the Data Subject may also be recorded. In order to collect the Data Subject's outstanding debt to ExperiRace, ExperiRace may transfer the Data Subject's data necessary for claims management to a company registered in Hungary that deals with the management of outstanding debts on a commercial basis. The legal basis for this data processing is the Article 6 subsection (1) point f) of the GDPR-Regulation, i.e., the enforcement of the legitimate interest of ExperiRace.

Purpose of data processing:	performance of payment and invoice issuance related to the agreement
Legal basis of data processing:	data processing is necessary to perform the legal obligation of the data controller (Article 6 (1) point c) of GDPR), thus in taxation and accounting legislation, and in particular the compliance with the obligations stipulated in Section 169 of Act CXXVII of 2007 on Value Added Tax, as well as Section 13/A. of E-Commerce Act
Scope of processed data:	name of the Data Subject (invoicing name), address (invoicing address), email address (for issuing electronic invoices)
Duration of data processing:	for the 5-year general limitation period under the Hungarian Civil Code, also according to the governing legal provisions, as 8 years according to Section 169 of Act C of 2000 on accounting, and in the case of debt collection, data processing lasts until the debt is collected, or until it becomes impossible.

 

3.4.            Notifications, contact

In case of using the "Contact" menu item of the Website or the specified contact channels, the Data Subject may enter his personal data.

By freely providing personal data, the Data Subject allows his questions and requests to reach ExperiRace, and to receive answers and information through the contact details provided by him. ExperiRace is entitled to process the personal data provided for the purpose of contact until the Data Subject's consent is withdrawn or for the period prescribed by law. The withdrawal shall not affect the lawfulness of processing based on consent before its withdrawal. If further processing of the contact data is not justified, ExperiRace shall erase it immediately.

Purpose of data processing:	Informing and contacting the Data Subject
Legal basis of data processing:	Free consent of the Data Subject (Article 6 (1) point a) of GDPR)
Scope of processed data:	Full name, e-mail address, phone number of the Data Subject
Duration of data processing:	until the Data Subject's request for erasure or until erasure by ExperiRace, if further processing of the data is not justified, and in case of a consumer complaint, ExperiRace is obliged to keep the record of the complaint and a copy of the response for 3 (three) years, and to present it to the inspection authorities upon their request, on the basis of Act CLV of 1997 on consumer protection.

 

3.5. Sending newsletters, commercial promotions

By freely providing personal data, the Data Subject allows ExperiRace to notify the Data Subject of current Services, discounts, promotions, and other news through the contact details provided by the Data Subject. ExperiRace is entitled to process personal data provided for the purpose of sending newsletters and commercial promotions until the consent of the Data Subject is withdrawn. The withdrawal shall not affect the lawfulness of processing based on consent before its withdrawal. The Data Subject can unsubscribe from ExperiRace's newsletter at any time without giving any reason.

Purpose of data processing:	sending newsletters and marketing materials, personalizing advertising, redeeming coupons
Legal basis of data processing:	Freely given consent of the Data Subject (Article 6 (1) point a) of GDPR), Section 6 (1) of Act XLVIII of 2008 on the basic conditions of economic advertising
Scope of processed data:	Full name, phone number, e-mail address of the Data Subject
Duration of data processing:	until the withdrawal of the consent or request for erasure of the Data Subject, or until erasure by ExperiRace, if further processing of the data is not justified

 

3.6.       Statistical purposes

ExperiRace is entitled to use - for statistical purposes – such information which does not relate to an identified or identifiable natural person, as well as personal data that has been anonymized in a way that the Data Subject cannot or can no longer be identified. Such data is used and aggregated by ExperiRace for the preparation of statistics and for the development of the Website and the Service.

4. Data processing and data transmission

ExperiRace uses the following data processors:

• hosting service provider:

name: Google Cloud EMEA Limited

seat: Velasco, Clanwilliam Place, Dublin 2, Ireland

website: cloud.google.com

data processing task: hosting service, data storage

• payment:

name: Stripe Payments Europe, Limited

seat: The One Building 1 Grand Canal Street Lower Dublin 2 Co., Dublin, Ireland

website: www.stripe.com

data processing task: online payment processing

• invoicing:

name: Billingo Technologies Zrt.

seat: 6. Árbóc Street, Budapest, 1133, Hungary

website: www.billingo.hu

data processing task: invoicing

• accounting:

name: ZD+DZ Iroda Kft.

seat: 36. Gyár Street, Üllő, 2225, Hungary

data processing task: accounting tasks

• sending newsletter:

name: The Rocket Science Group, LLC d/b/a MailChimp

seat: 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA

website: www.mailchimp.com

data processing task: storage of the newsletter database and operation of the newsletter system

ExperiRace makes the data of the Data Subject available to third parties due to an official court or police request, copyright, property or other infringement or a reasonable suspicion of such infringement, or in other cases stipulated by law or official obligation. ExperiRace cannot be held responsible for such data transfer and the resulting consequences.

In addition, ExperiRace does not transfer personal data to third parties. Personal data shall not be transferred to countries that do not have the adequacy decision of the European Commission, or that do not otherwise ensure adequate protection of personal data. ExperiRace does not carry out automated decision-making or profiling in connection with data processing.

5. Rights of the Data Subject

The Data Subject has the right to request information free of charge about the processed personal data, the purpose, legal basis, duration of the data processing, the name, address (seat) of the person entitled to data controlling and data processing, and the activities related to the data processing, as well as who and how they can access the data, as well as about the rights of the Data Subject and legal remedies related to data processing.

The Data Subject may request ExperiRace regarding personal data:

• access to data: shall have the right to obtain from ExperiRace confirmation as to whether or not personal data concerning him are being processed and access to the personal data and the essential information regarding the processing.
• rectification of data: the Data Subject has the right to have ExperiRace rectify or amend inaccurate personal data concerning him without undue delay upon request,
• erasure of data: the Data Subject has the right to request that ExperiRace erase the personal data concerning the Data Subject without undue delay, and ExperiRace is obliged to erase the personal data concerning the Data Subject without undue delay.

The data does not need to be erased if the data processing is necessary for the purposes as follows:

• exercising the right of freedom of expression and information,
• compliance with a legal obligation under EU or member state law applicable to ExperiRace,
• for the establishment. exercise or defence of legal claims,
• for the archiving purpose in the public interest, scientific or historical research purposes or statistical purposes, if erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing;
• for reasons of public interest in the area of public health;
• restriction of data processing: the Data Subject shall have the right to obtain from ExperiRace restriction of processing if - among other things - the accuracy of the personal data is contested by the Data Subject, or ExperiRace no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise, or defence of legal claims;
• can object to the processing of personal data: the Data Subject has the right to object to the processing of his personal data at any time if the data processing is based on public interest or the data processing is necessary for the purposes of the legitimate interests pursued by ExperiRace or a third party, and
• may request the release of his personal data in a machine-readable format: the Data Subject is entitled to receive the personal data provided by him in a structured, commonly used, machine-readable format, and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided.

ExperiRace shall communicate any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal data have been disclosed unless this proves impossible or involves disproportionate effort. The data controller shall inform the Data Subject about those recipients if the Data Subject requests it.

If the data processing is based on consent, the Data Subject is entitled to withdraw his consent at any time.

ExperiRace shall provide information on action taken on a request the Data Subject without undue delay and in any event within 1 (one) month of receipt of the request. That period may be extended by 2 (two) further months where necessary, taking into account the complexity and number of the requests. ExperiRace shall inform the Data Subject of any such extension within 1 (one) month of receipt of the request, together with the reasons for the delay. Where the Data Subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the Data Subject. If ExperiRace does not take action on the request of the Data Subject, ExperiRace shall inform the Data Subject without delay and at the latest within 1 (one) month of receipt of the request of the reasons for not taking action.

The Data Subject can file a complaint regarding data processing at Hungarian National Authority for Data Protection and Freedom of Information (9-11. Falk Miksa Street, Budapest, 1055, Hungary; postal address: P.O.Box: 9, Budapest, 1363, Hungary; phone number: +36 (1) 391-1400; fax: +36 (1) 391-1410; e-mail: ugyfelszolgalat@naih.hu; website: www.naih.hu), furthermore, in case of violation of his rights, the Data Subject has the right to an effective judicial remedy.

6. Cookies

Data that are technically recorded during the operation of the Website: the data of the Data Subject's computer that is generated during the use of the Service and which is recorded by the ExperiRace system as an automatic result of the technical processes. The data that is automatically recorded is automatically logged by the system upon entry or exit without a separate statement or action from the Data Subject. These data cannot be combined with other user personal data - except in cases made mandatory by law. Only ExperiRace has access to the data.

In order to serve personalized content, ExperiRace places a small data package (so-called "cookie") on the computer of the Data Subject. The purpose of the cookie is to ensure the highest possible level of operation of the given page in order to increase the user experience (e.g., quick access to previously searched text). The Data Subject can erase the cookie from his own computer or set the browser to prohibit the use of cookies.

For the most frequently used browsers, the Data Subject can access the cookie management function via the link below:

Google Chrome:

https://support.google.com/accounts/answer/32050

Internet Explorer:

https://support.microsoft.com/en-us/topic/how-to-delete-cookie-files-in-internet-explorer-bca9446f-d873-78de-77ba-d42645fa52fc

Firefox:

https://support.mozilla.org/en-US/kb/clear-cookies-and-site-data-firefox

Safari:

https://support.apple.com/en-in/guide/safari/sfri11471/mac

By prohibiting the use of cookies, the Data Subject acknowledges that the given site does not function fully without cookies. No profiling is done on the basis of cookies.

Summary table of cookies used by ExperiRace:

cookie name	cookie type	purpose/function of data management by cookie	legal basis: 1. in the case of technically necessary cookies: legitimate interest, GDPR 6. (1) f); 2. in the case of technically unnecessary cookies: freely given consent, GDPR 6. (1) a)	duration of data processing (cookie life)
_ga	Google Analytics	Google Analytics-related cookie. It is used to distinguish users for statistical data.	Freely given consent	2 years
locale	Cookie used by ExperiRace (own cookie).	The cookie stores the language preference (language choice) of the users.	Legitimate interest	1 week

 

The webshop available on the Website operates on the Shopify platform, the information about the related cookies can be found here.

https://www.shopify.com/legal/cookies

ExperiRace uses the service of MailChimp for its e-mail campaigns. The list of related cookies can be viewed here:

https://mailchimp.com/legal/cookies/

7. Safety Measures

ExperiRace takes care of the security of the processing of personal data, and also takes the technical measures that ensure that the recorded, stored and managed personal data are protected, and shall make every effort in order to prevent their destruction, unauthorized use and unauthorized change.

ExperiRace applies specific security measures as follows:

• only persons with express authorization and who are bound by confidentiality can access personal data, the data can be seen by employees in the job positions as follows: project manager, newsletter editor, marketing assistant, system operator, system developer;
• access to personal data on computers/servers only with a username and password, in the case of data processed in electronic form, the use of a central authorization management system;
• computer system containing personal data equipped with virus protection;
• use of daily data backups and archiving to ensure the safety of digitally stored data;
• password-protected administrative interface,
• customizable authorizations for Data Subjects,
• use of software(s) to prevent ExperiRace's computer system/servers from being easily accessed via the Internet
• password protection on computing devices,
• password change at specified intervals,
• ExperiRace ensures that the installed systems can be restored in the event of a malfunction, as well as that a report is prepared on such errors.

In order to protect the data, the Data Subject cannot use an obvious login name or password, it is recommended to change them regularly, and the Data Subject must protect them from being known by third parties.

Effective: from 01.11.2023

ExperiRace Zrt.