GDPR

Information on the Processing of Participants’ Personal Data

This notice explains to participants in the Grizzlyman races, including the KODIÁČEK children’s triathlon, and to their legal guardians how we process their personal data. It is based on Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, the “GDPR”) and Czech Act No. 110/2019 Coll., on Personal Data Processing.

1. Data Controller

The race is organised, and participants’ personal data are processed, by the following joint controllers (the “Controller”):

  • SK K2 z.s., Company ID (IČO) 22691600, registered office at Palkovice 158, 739 41 Palkovice, Czech Republic,
  • Česká asociace adventure outdoor extreme sport z.s. (ČAES), Company ID (IČO) 47815647, address Slovenská 6/7, 747 06 Opava – Kylešovice, P.O. Box 10, Czech Republic.

The point of contact for all questions about personal data and for exercising participants’ rights is info@grizzlyman.cz.

2. Personal Data We Process

  • first name and surname, sex, date of birth (or year of birth),
  • phone number and e-mail address,
  • club/team, place of residence and other details provided in the registration form,
  • birth number (Czech personal identification number), only for accident insurance purposes (section 3 h),
  • entry fee payment details,
  • race data: race number, times, splits, ranking and GPS tracker position,
  • photos and video footage taken during the race.

Participants are responsible for ensuring that the data they provide are accurate, truthful and up to date.

3. Purposes and Legal Bases

a) Registration, Organisation and Administration of the Race

We process personal data for registration, participant records, start administration, and the organisation and evaluation of the race. The legal basis is the performance of the contract for participation in the race (Article 6(1)(b) GDPR).

b) Category Assignment

We use date of birth and sex to assign participants to the appropriate category under the race information. The legal basis is the performance of the contract.

c) Publication of Start Lists and Results

First name, surname, year of birth where applicable, club/team, finish time, ranking and other results data are published in the start list and results.

Results are published as a historical, statistical and sporting record of the event and remain publicly available without time limit, including after the race.

The legal basis is the Controller’s legitimate interest in documenting, archiving and presenting the sporting event and its results (Article 6(1)(f) GDPR).

Participants acknowledge that:

  • publication of results is an integral part of a sporting competition,
  • the race cannot be properly evaluated without published results,
  • once published, results may be further shared by third parties (e.g. media or sports databases), which the Controller cannot control.

d) Objection to Publication of Results

Participants may object to the publication of their data in the results by e-mail to info@grizzlyman.cz. The Controller assesses each objection individually.

Results form a complete and verifiable record of a sporting competition, so the Controller’s legitimate interest in keeping them usually prevails. The Controller is not obliged to change or remove an official result (ranking and time) where this would compromise the integrity, reliability, transparency or historical value of the results.

In justified cases, the Controller will limit the display of certain data, for example by shortening the name or hiding the year of birth.

e) GPS Tracking

During the race, participants carry a GPS tracker. We process location data to ensure participants’ safety, check that the course is followed and evaluate the race. The legal basis is the performance of the contract.

Participants’ positions are also shown publicly in real time via the Follow Me service (follow.me.cz), so that fans and support crews can follow the race. The legal basis is the Controller’s legitimate interest in presenting the race.

f) Photos and Video

During the race, the Controller and photographers it commissions take photos and video footage in which participants may appear. This material is published on the race website and in its photo gallery, on social media and on YouTube (including live streams), and is used to promote the race and its partners, for example on posters.

The legal basis is the Controller’s legitimate interest in documenting and promoting the event (Article 6(1)(f) GDPR) and, for news reporting, Section 89 of Act No. 89/2012 Coll., the Czech Civil Code.

Participants may object to the use of their photos or footage for promotion by e-mail to info@grizzlyman.cz. From receipt of the objection, the Controller will no longer use them for promotion.

g) Health Protection and Emergencies

The phone number may be used in an emergency, in particular to communicate with the emergency services or medical staff if a participant is injured or their health is at risk.

The legal basis is the protection of the participant’s vital interests (Article 6(1)(d) GDPR).

h) Birth Number and Voluntary Accident Insurance

The birth number is processed solely to arrange voluntary accident insurance for the duration of the race, to the extent required by the relevant insurance company.

A birth number may only be used with the consent of its holder (Section 13c of Act No. 133/2000 Coll., on Population Register and Birth Numbers). By providing their birth number during registration, participants consent to its use for this purpose (Article 6(1)(a) GDPR).

The birth number is not published and is disclosed only to the insurance company, which acts as an independent controller. It is kept only for as long as strictly necessary for insurance purposes and related legal obligations.

Participants may decline the insurance and withdraw their consent by e-mail to info@grizzlyman.cz no later than before the start of the race. In that case, the insurance will not be arranged and the birth number will not be passed to the insurance company.

Participants acknowledge that if they decline the insurance, they bear all risks associated with taking part in the race themselves.

i) Accounting

We process entry fee payment details to comply with accounting and tax legislation (Article 6(1)(c) GDPR).

j) Storage and Security

Personal data are stored electronically in a secure cloud environment provided by Google (Google Cloud Platform), which acts as a processor.

The Controller has concluded an appropriate data processing agreement with this processor and has adopted technical and organisational measures to protect personal data against unauthorised access, loss or misuse.

Where personal data are transferred outside the European Union, this is done in accordance with the GDPR, in particular on the basis of a European Commission adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses.

4. Recipients

Personal data may be disclosed, to the extent necessary, to the following recipients:

  • the B7ID registration system (b7id.cz), where registration data are stored,
  • On line system s.r.o. (onlinesystem.cz) – timing, start lists and results,
  • Follow Me (follow.me.cz) – GPS tracking and live tracking display,
  • Google – cloud storage, registration forms for the KODIÁČEK race and YouTube,
  • the insurance company – only for participants for whom accident insurance is arranged,
  • photographers commissioned by the Controller,
  • emergency services and medical staff in the event of an emergency.

5. Retention Period

  • registration and contact data: for as long as necessary to organise and evaluate the race and to handle any claims,
  • birth number: only for as long as necessary for insurance purposes,
  • accounting records: for the period required by accounting and tax legislation,
  • results, photos and video: without time limit as a historical record of the sporting event, subject to the right to object (sections 3 d and 3 f).

6. Obligation to Provide Data

Providing the data marked as mandatory during registration is necessary to take part in the race; registration cannot be completed without them. The birth number is used only to arrange insurance (section 3 h).

7. Children and Minors

Children, for example in the KODIÁČEK race, are registered by their legal guardians. The legal guardian provides the child’s personal data and their own contact details and exercises the rights listed in section 8 on the child’s behalf.

8. Participants’ Rights

Participants have the right to:

  • access their personal data,
  • have inaccurate data rectified,
  • have their data erased, subject to the limitations in section 3 d,
  • restrict processing,
  • data portability for data processed on the basis of a contract or consent,
  • object to processing based on the Controller’s legitimate interest,
  • withdraw consent to the processing of their birth number (section 3 h),
  • lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, uoou.gov.cz).

Rights can be exercised by e-mail to info@grizzlyman.cz. The Controller will respond without undue delay and within one month at the latest.

No automated decision-making or profiling takes place.

9. Effective Date

This notice is effective from 30 September 2026.