Privacy Policy

Who We Are

Thank you for visiting our website www.superweit.com. The SUPER!WEIT event is organised by Schwarzwald Super! e.V. Schwarzwald Super! e.V. takes data protection very seriously. Below you will find detailed information about how we handle your data.

Name and address of the Data Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection legislation of the Member States, as well as other data protection provisions, is:

Schwarzwald Super! e.V.
Schwarzwaldstr. 212
D-79117 Freiburg, Germany
Phone: DE (Null)176 47758400
Email: hallo@superweit.com
Website: www.superweit.com

Description and Scope of Data Processing

Each time our website is accessed, our system automatically collects data and information from the accessing computer. The following data is collected:

This data is stored in the log files of our system.

Hosting: This website is hosted on servers operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The aforementioned server log files are processed as part of the hosting service. A data processing agreement pursuant to Art. 28 GDPR has been concluded with Hetzner. Further information: Hetzner Privacy Policy.

Legal Basis

The legal basis for the temporary storage of data and log files is the legitimate interest of Schwarzwald Super! e.V. (Art. 6(1)(f) GDPR).

Purpose of Data Processing

The temporary storage of the IP address by the system is necessary to enable the delivery of the website to the user’s device. For this purpose, the user’s IP address must be stored for the duration of the session.

Storage in log files is carried out to ensure the functionality of the website. The data also serves to optimise the website and to ensure the security of our information technology systems. The data is not evaluated for marketing purposes in this context.

These purposes also constitute our legitimate interest in data processing pursuant to Art. 6(1)(f) GDPR.

Cookies

This website does not set any analytics or tracking cookies. Our web analytics service GoatCounter operates entirely without cookies. No cookies are set when using our forms (contact, newsletter) either. Technically necessary cookies are set only by the ticket shop (pretix) and the participants’ area; for details see the respective sections.

Should we use further cookies in the future, we will inform you in advance and, where required, obtain your consent.

You can manage or block cookies at any time in your browser settings.

Web Analytics (GoatCounter)

We use GoatCounter, a privacy-friendly web analytics service. GoatCounter does not set any cookies and does not create personal user profiles.

Data collected: Page views, scroll depth (anonymised), clicks on certain form actions. IP addresses are hashed by GoatCounter and are not stored in plain text.

Legal basis: Legitimate interest in analysing website usage (Art. 6(1)(f) GDPR).

Opt-out: If your browser sends the “Do-Not-Track” signal, GoatCounter will not collect any data.

Further information: GoatCounter Privacy Policy.

Newsletter

Purpose

The email address you provide will be processed by Schwarzwald Super! e.V. for the purpose of sending the subscribed newsletter.

Newsletter registration uses a double opt-in process: after entering your email address, you will receive a confirmation email containing a unique confirmation link (valid for 48 hours). Only after clicking this link will your email address be added to our mailing list. Confirmation tokens are stored exclusively in our server’s working memory on a temporary basis and are automatically deleted upon expiry.

Legal Basis

The processing of your email address is based on your consent pursuant to Art. 6(1)(a) GDPR. You have the right to withdraw your consent at any time free of charge. To withdraw your consent, please click the unsubscribe link in the respective newsletter or contact Schwarzwald Super! e.V. (contact details above).

After unsubscribing from the newsletter, your declaration of consent will continue to be stored on the basis of legitimate interests (Art. 6(1)(f) GDPR). The legitimate interests of Schwarzwald Super! e.V. consist in the necessary documentation of your consent for evidentiary purposes.

Storage / Deletion

Your unsubscription from the newsletter is automatically recorded in the newsletter database. This entry ensures that you will no longer receive any further newsletters from the time of your unsubscription. Final deletion of your data takes place within three months from the date of your unsubscription, unless statutory retention obligations prevent deletion.

Recipients

For sending newsletter emails, we use the service Mailjet SAS, 13-13bis Rue de l’Aubrac, 75012 Paris, France (Sinch Group). A data processing agreement pursuant to Art. 28 GDPR has been concluded with Mailjet. As part of the newsletter registration, your email address is transmitted to Mailjet and stored in a contact list. Further information: Mailjet Privacy Policy.

Contact Enquiries via Form or Email

Purpose

When you contact us via the contact form or email, we collect and process your name, your email address and the subject of your enquiry. The purpose of data processing is to respond to your contact request.

Legal Basis

Data processing is based on the legitimate interest of Schwarzwald Super! e.V. in communicating with website users (Art. 6(1)(f) GDPR).

Storage / Deletion

Schwarzwald Super! e.V. will delete or anonymise your personal data as soon as it is no longer required for the purposes for which it was collected and processed, and provided that no other legal obligations require further storage.

Recipients

For forwarding contact form messages, we use the service Mailjet SAS, 13-13bis Rue de l’Aubrac, 75012 Paris, France (Sinch Group). As part of the contact form, your name, email address and message are transmitted to Mailjet for forwarding. Further information: Mailjet Privacy Policy.

Spam and Bot Protection

Our forms use technical protective measures against automated access (so-called honeypot fields and timestamp validation). No personal data is collected or stored in this process. Legal basis: Legitimate interest in preventing misuse (Art. 6(1)(f) GDPR).

Registration and Ticket Purchase (pretix)

For event registration and ticket purchase, we embed features and content from the service pretix, provided by pretix GmbH, Berthold-Mogel-Straße 1, 69126 Heidelberg, Germany, on our registration pages. Part of this is our ticket shop, which is included through a JavaScript widget. If you try to purchase a ticket, pretix will use a technically necessary cookie to make your purchase process possible and to remember which tickets are in your cart. This cookie will only be set once you start interacting with the pretix widget. pretix does not store any IP addresses, browser information or other unnecessary meta data beyond the timeframe of your transaction.

Personal data entered during the ticket purchase (e.g. name, email address, postal address, payment data) is processed by pretix as an independent controller or data processor.

Legal basis: Performance of a contract (Art. 6(1)(b) GDPR) and technically necessary cookies (§ 25(2) no. 2 TDDDG); for retaining payment records, Art. 6(1)(c) GDPR in conjunction with § 147 of the German Fiscal Code, AO.

Further information: pretix Privacy Policy.

Note: This section applies from the start of ticket sales.

Participants’ Area (Online Access)

For registered participants we provide a personal online area, accessed via an individual access link. There we process the details required to run the event and to perform the contract – for example your planned start time, your chosen check-in slot or an emergency contact.

When you log in to the participants’ area, a technically necessary session cookie is set. It is used solely for authentication and has no analytics or tracking function.

The participants’ area also links to an optional event chat group on the Signal messenger (Signal Messenger LLC). Joining is voluntary; Signal’s privacy policy applies only once you join.

You can optionally store your Instagram name in the participants’ area. By saving it you consent to being tagged in Instagram posts of our event account (@superweit) (Art. 6(1)(a) GDPR). You can delete the name there at any time, withdrawing your consent with effect for the future. Instagram is operated by Meta; this involves transfers of data to the USA – for details see the Social Media Channels of the Organiser section.

Legal basis: Performance of a contract (Art. 6(1)(b) GDPR), your consent for the optionally stored Instagram name (Art. 6(1)(a) GDPR), and technically necessary cookies (§ 25(2) no. 2 TDDDG).

Emergency Contact – Information for the Nominated Contact Person

Participants can give us the name and mobile number of a person we may call in an emergency during the event – online in the participants’ area and/or in handwriting on the Participant Declaration that is handed in at check-in. If you have been nominated as a contact person: we received these details from the participant, not from you (Art. 14 GDPR). We ask participants to tell their contact person about this and to point them to this section.

We use the details solely in order to reach you in an emergency. The legal basis is our legitimate interest in being able to reach a person the participant trusts (Art. 6(1)(f) GDPR); in an emergency itself, the protection of vital interests (Art. 6(1)(d) GDPR). We do not pass the details on. We delete the online entry by 31 December 2026 and redact the field on the paper form by the same date (see Storage Duration below).

You have the rights set out in this privacy policy. In particular, you may object to the storage at any time – an informal email to hallo@superweit.com is enough.

GPS Tracking During the Event

For time recording and validation of the route ridden, participants are issued a GPS device at check-in which transmits location data during the event. We process the position data of the device, its identifier and its assignment to you.

During the event the location data is shown on a tracking page operated by our service provider Follow My Challenge S.A.R.L. (France). That page is publicly accessible and can be found via search engines. It shows your first and last name, your start number, your gender, your age and your current position.

Right to object – not appearing publicly: You may object to the public display of your position at any time (Art. 21(1) GDPR). An informal message to hallo@superweit.com is enough; on site, a word at check-in will do just as well. We will then hide you from the public tracking page. Time recording and route validation are unaffected, as they are necessary for carrying out the event.

Legal basis: For time recording and route validation, performance of a contract (Art. 6(1)(b) GDPR). For the public display on the tracking page, our legitimate interest in an event that fellow riders, relatives and the public can follow (Art. 6(1)(f) GDPR) – subject to the right to object described above.

Participant Declaration and Liability Waiver (Check-in)

At check-in, participants hand in the signed Participant Declaration and Liability Waiver on paper. On that form we process the declarations made in the document and the details entered or ticked – for example your name, start number, date and signature, your decision on photo and video recordings, any objection to the public display on the tracking page and, where given, a handwritten emergency contact. At check-in the team also starts a handover record, which is attached to the declaration and initially kept together with it; on that sheet we record the tracker identifier, the receipt number, the method of payment of the deposit, the team’s verification notes (including how it read the boxes you ticked) and any remarks, and the initials, date and time of issue. We check your identity document by sight only; we do not make a copy of it.

Purpose and legal basis: Performance of the participation contract (Art. 6(1)(b) GDPR) and our legitimate interest in being able to prove the declarations made and to defend against claims (Art. 6(1)(f) GDPR). Art. 6(1)(a) GDPR applies to the consent to recordings; we keep the record of that consent on the basis of Art. 6(1)(c) in conjunction with Art. 7(1) GDPR (alternatively Art. 6(1)(f) GDPR). For the declaration on health fitness made on the paper form we rely on Art. 9(2)(f) GDPR (establishment, exercise or defence of legal claims).

Required or voluntary: Submission of the signed declaration is provided for in Terms and Conditions § 3(3); without it we cannot issue start documents. Your decision on photo and video recordings, any objection to the public display on the tracking page and giving an emergency contact are voluntary.

Safekeeping: We keep the paper forms in a locked cabinet. We do not scan them into cloud services and do not pass them on to third parties unless this is necessary to establish, exercise or defend legal claims (for example to lawyers, courts or an insurer) or required under tax law. For the periods, see Storage Duration below.

Uploads in the Participants’ Area

In the participants’ area you can optionally upload your own photos and videos of the event. The files are stored on our server in Germany (Hetzner) in a non-public area to which only the organising team has access. Nothing is published automatically; we review every use ourselves.

Data processed: the files including the metadata they contain (e.g. time of recording, camera model, where applicable the place of recording), plus file name, size and checksum; for the assignment, your first and last name, your email address, your start number and the internal identifier of your ticket; the record of your permission (time, text version, language and a pseudonymous identifier of your login session). We store the files unchanged.

Purpose and legal basis: By ticking the box when uploading, you allow us to use your recordings for the event and our club – on superweit.com, on the club website schwarzwald-super.de, in our newsletter, in our own print media and on the organiser’s social media channels (e.g. Instagram, Strava), including edited or cropped, and also for future editions. In doing so you grant us a non-exclusive, free-of-charge right of use (§ 31 of the German Copyright Act, UrhG), which remains in effect until you withdraw it. The legal basis for the processing is your consent (Art. 6(1)(a) GDPR); it expressly also covers recordings that allow conclusions to be drawn about your health, such as visible exhaustion (Art. 9(2)(a) GDPR). Uploading is voluntary. We keep the record of your permission in order to be able to prove it (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR, alternatively Art. 6(1)(f) GDPR).

Other people in your recordings: By uploading, you confirm that you took the material yourself or are allowed to pass it on to us, and that people recognisably shown agree, children only with their parents’ consent. We process images of other people on the basis of our legitimate interest in reviewing the recordings and documenting the event (Art. 6(1)(f) GDPR). They are published only under the conditions of the Event Photos and Videos section – people in the foreground therefore only with their own consent – and minors only with the consent of their parents or guardians.

Recipients: In the case of publication, the operators of the platforms named (for Instagram and Strava see the Social Media Channels of the Organiser section) and our newsletter service provider. We are notified of new uploads by an internal email containing assignment details (without your email address) and the file names; for how it is sent, see the Recipients and Data Processors section. We do not sell recordings and do not pass them on to the press or other third parties without your separate consent.

Withdrawal: You may withdraw your permission at any time without giving reasons, in text form (e.g. by email to hallo@superweit.com), with effect for the future; the withdrawal ends both the consent and the right of use for future uses. We then delete your uploaded files without undue delay and take down publications of your recordings as far as we can reach them; print media already distributed and copies taken over by third parties cannot be recalled by us. In temporary storage and backups of our server, the deleted files remain for up to seven days; we do not use them there. The lawfulness of the processing carried out up to the withdrawal remains unaffected (Art. 7(3) sentence 2 GDPR).

Storage period: We store uploaded files until you withdraw your permission – by way of exception to the other details in the participants’ area, also beyond 31 December 2026. We keep the record of your permission, together with the assignment and file details, for as long as we store files from you or recordings are published, plus three years.

Event Photos and Videos

During the event, we or people commissioned by us take photo and video recordings.

Overview shots (start, checkpoints, finish, impressions along the route) in which no individual person is in the foreground are published by us on superweit.com, on the club website schwarzwald-super.de, in our newsletter, in our own print media and on the organiser’s social media channels (e.g. Instagram, Strava). The legal basis is our legitimate interest in documenting the event and reporting on it, including announcing future editions (Art. 6(1)(f) GDPR); § 23(1) no. 3 of the German Art Copyright Act (KUG) applies to the publication.

Right to object: You may object to the publication of overview shots at any time on grounds relating to your particular situation (Art. 21(1) GDPR). An informal message to hallo@superweit.com is enough.

Recordings in which you are recognisably in the foreground are published by us – where applicable together with your first and last name and start number – on the same channels only if you have consented on the Participant Declaration that you hand in at check-in (Art. 6(1)(a) GDPR). That consent also covers recordings which allow conclusions to be drawn about your health (e.g. exhaustion, injury, medical attention), religion or origin (Art. 9(2)(a) GDPR). It is voluntary; participation does not depend on it.

Withdrawal: You may withdraw your consent at any time without giving reasons, in text form (e.g. by email to hallo@superweit.com), with effect for the future. Recordings in which you are recognisable and shown essentially alone are removed from our publications without undue delay. In the case of recordings showing you together with other people, we make you unrecognisable without undue delay (e.g. by pixelation) or remove the recording. Print media already distributed and copies taken over by third parties cannot be recalled by us. The lawfulness of the processing carried out up to the withdrawal remains unaffected (Art. 7(3) sentence 2 GDPR). The procedure is also governed by Terms and Conditions § 10(6).

Recipients: The operators of the platforms named (for Instagram and Strava see the following section) and our newsletter service provider. We do not sell recordings and do not pass them on to the press or other third parties without your separate consent.

Storage period: Published recordings remain online until you withdraw your consent or object. Beyond that, we keep recordings of the event in an internal, non-public club archive in order to document the history of the club and its events; the legal basis is our legitimate interest in that documentation (Art. 6(1)(f) GDPR). We keep the recordings for as long as this documentation purpose exists. Recordings in which you are recognisable are removed at your request. We keep the record of your consent for as long as recordings are published, plus three years.

Social Media Channels of the Organiser (Instagram, Strava)

We operate the Instagram account @superweit with Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland, as well as further social media channels of the organiser (e.g. Strava). Recordings and tags that we publish there are processed by the operators under their own responsibility; this may involve transfers of data to third countries, in particular the USA. Meta is certified under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023, Art. 45 GDPR). The privacy notices of Instagram and Strava apply in addition.

We publish recognisable recordings of individual people, and tags identifying them, there only with their consent (see the Event Photos and Videos section, and the Participants’ Area section for the Instagram name).

Recipients and Data Processors

To provide our services, we work with the following service providers with whom data processing agreements pursuant to Art. 28 GDPR have been concluded:

In addition, for the purpose of Live Tracking we transmit your first and last name, your start number, your gender, your age and the identifier of your GPS device to Follow My Challenge S.A.R.L., 7 Chemin des Araignées, 24290 Montignac-Lascaux, France. Follow My Challenge processes this data under its own responsibility; its privacy policy applies in addition.

Tracker deposit: You lodge the deposit for the GPS tracker at check-in, in cash or by PayPal. If you pay by PayPal, PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, processes the payment data under its own responsibility; we receive the name, the PayPal email address, the amount and the payment reference. If you return the tracker by post, we process the sender details, the tracking number, the date of receipt and the day on which you notified us that you abandoned the ride. If we refund the deposit by bank transfer, we process your bank details for that purpose; the transfer is carried out by our bank. The legal basis is the handling of the deposit as part of the participation contract (Art. 6(1)(b) GDPR). We keep the records of the deposit in order to comply with retention obligations under tax law (Art. 6(1)(c) GDPR in conjunction with § 147 of the German Fiscal Code, AO).

Tax adviser: Where required under tax law, we pass payment records from ticket purchases and records of the tracker deposit on to our tax adviser, who processes them under their own responsibility.

Authorities: If the police or public order authorities, in connection with a violation of the German Road Traffic Regulations (StVO) during the event, request information as to which person took part under a given start number, we transmit the name and contact details insofar as we are legally obliged to do so (Art. 6(1)(c) GDPR).

No data is transferred to third countries outside the EU/EEA – with the exception of publications on the organiser’s social media channels (Instagram, Strava; see that section).

Storage Duration

Server Log Files

Server log files are stored for a maximum of 30 days and then automatically deleted.

Participants with Ticket Purchase

In the event of a ticket purchase, data is stored for the purpose of carrying out the event and deleted after the expiry of tax and commercial law retention periods (typically eight years for payment records, § 147 AO).

Participants’ Area

The details stored in the participants’ area (e.g. start time, check-in slot, emergency contact) and the access links are stored until 31 December 2026 and deleted afterwards. An optionally stored Instagram name is, by way of exception, kept until you withdraw it – including beyond 31 December 2026, so that we can match it again for a future edition. Photos and videos that you upload in the participants’ area, and the record of your permission, are likewise kept beyond 31 December 2026; the periods are set out in the Uploads in the Participants’ Area section.

GPS Tracking

We store the assignment between you and the device, and the note of whether you have lodged the deposit and had it refunded, in our participant records until 31 December 2026 and delete them afterwards. The location data itself is stored by Follow My Challenge; its privacy policy does not state a fixed retention period. We keep records of the lodging and refund of the deposit – receipts, the handover record and the list signed on return, as well as bank transfer and PayPal records – for eight years under § 147 of the German Fiscal Code (AO), i.e. until 31 December 2034.

Participant Declaration and Liability Waiver (Paper)

We keep the document handed in at check-in until 31 December 2029 (standard limitation period, §§ 195, 199 of the German Civil Code, BGB), and in the case of pending legal disputes until those are concluded; the handover record attached to it also serves as a record of the deposit and is kept until 31 December 2034 (§ 147 AO). Any photo and video consent given in it we keep as a record for as long as recordings are published, plus three years. We redact the emergency contact field by 31 December 2026, or separate it off and destroy it. After 31 December 2029, for sheets carrying a consent we keep only the consent part and redact the remaining details. We destroy the handover record after 31 December 2034.

Your Rights in Connection with Data Processing

The General Data Protection Regulation (EU Regulation 2016/679) grants you certain rights as a data subject, which we outline below.

Withdrawal of Consent

In the event that Schwarzwald Super! e.V. stores and processes personal data on the basis of your consent, you are entitled to withdraw your consent at any time. However, this does not affect the lawfulness of the processing carried out prior to the withdrawal.

Right of Access

You may request information about the origin, categories, storage duration, recipients, purpose and manner of processing of personal data held about you by Schwarzwald Super! e.V.

Right to Rectification and Erasure

If Schwarzwald Super! e.V. processes data about you that is inaccurate or incomplete, you may request its rectification or completion. You may also request the erasure of unlawfully processed data.

Right to Restriction of Processing

If it is unclear whether the data processed about you is inaccurate or incomplete, or whether it is being processed unlawfully, you may request the restriction of the processing of your data until the matter is finally clarified.

Right to Object

Even if the data about you is accurate and complete and is being lawfully processed by Schwarzwald Super! e.V., you may object to the processing of this data. However, this is only possible in special situations that you must justify.

Right to Data Portability

You may receive the data processed about you by Schwarzwald Super! e.V. in a machine-readable format, or instruct Schwarzwald Super! e.V. to transmit this data directly to a third party of your choice, provided this is technically feasible.

Right to Lodge a Complaint

You have the right to lodge a complaint with the competent data protection supervisory authority if you believe that the processing of your personal data infringes the General Data Protection Regulation.

Competent supervisory authority:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
www.baden-wuerttemberg.datenschutz.de

Contact for Data Subject Rights

To exercise the aforementioned rights, please contact us in writing (by post or email) at:

Schwarzwald Super! e.V.
Schwarzwaldstr. 212
D-79117 Freiburg, Germany
Email: hallo@superweit.com

Third-Party Websites

This privacy policy does not apply to third-party websites that are not operated or controlled by us. We recommend that you read the privacy notices on their websites to find out how they handle your personal data.

General

We reserve the right to amend this privacy policy at any time in compliance with applicable data protection regulations. Please visit this page regularly to stay informed about any changes.

If you have any questions about this privacy policy, please contact us at hallo@superweit.com.

Last updated: October 2026