Terms for data processing.

1. Scope and roles

Processor VAT identification number: ATU57394867

These terms apply where a user of the Gold · Performancelab processes personal data relating to other individuals and determines the purposes and essential means of that processing. In that situation, the user is the controller for the purposes of the GDPR and Alexander Keck e.U., as operator of schwimmtrainer.at, acts as processor.

If a user processes only their own data, these Data Processing Terms do not apply to that processing.

The name PerformanceHub refers to the public profiles and offers area of the platform. The shared branding as the schwimmtrainer.at ecosystem does not, by itself, change the controller/processor roles or extend the processing instructions relating to protected PerformanceLab records. The public presentation of a coach does not automatically authorise publication of private athlete data.

2. Subject matter, duration, nature and purpose

The subject matter is the technical provision of the Gold · Performancelab, including storage, organisation, display and filtering; group- and event-related trend analysis in the Performance Monitor; user-requested server-side PDF report generation with immediate download and no permanent storage of the generated report file; freely configurable test batteries; assignment of several persons to competitions and test sessions; test-session and competition planning; management of coach-defined personal and group target/development corridors; and the deletion and export tools provided within the platform. Processing generally continues for the period during which the Performancelab is used and thereafter only to the extent required by an agreed transition period, technical safeguarding, a legal obligation or the permissible preservation of legal claims.

3. Categories of data subjects and data

Data subjects may include, in particular, athletes, trainers, coaches, instructors and other persons who are coached or assigned within an organisation. The data processed may include basic personal data, contact details, club or organisation data, para classifications, competition and planning data, appointments, goals including personal and group target corridors, notes, body and performance data, measurements from swimming and athletic diagnostics, and derived side-to-side asymmetries and strength ratios. Some data may constitute special categories of personal data, in particular health data under Article 9 GDPR.

4. Processing on documented instructions

schwimmtrainer.at processes data entered by the controller only to provide the agreed functions and in accordance with the controller’s documented instructions. Use of the platform functions, in particular entering, modifying, assigning, planning, evaluating and deleting data, constitutes documented instructions to that extent. If the processor considers an instruction to infringe data protection law, it will inform the controller insofar as legally permitted.

5. Obligations of the controller

The controller is responsible for ensuring that the processing is lawful, that data subjects are properly informed and, where required, that valid consent or another legal basis — including an exception under Article 9(2) GDPR — is available. Where minors are involved, the applicable requirements relating to representation and information must also be observed. The controller also determines the necessary deletion periods and access permissions within its organisational sphere.

6. Confidentiality and technical organisation

The operator ensures that persons authorised to process personal data are bound by confidentiality obligations and implements appropriate technical and organisational measures to protect platform data against unauthorised access, loss, manipulation and unlawful disclosure. These measures include, in particular, account-based access controls, server-side permission checks, protected sessions, CSRF protection for write operations and logical separation of data by user account. The measures are further developed in line with risk and the state of the art.

7. Sub-processors

The production system is hosted by World4You Internet Services GmbH, Wolfgang-Pauli-Straße 2, BT3, 4020 Linz, Austria Additional technical service providers may be used where necessary for delivery of the platform service and where data protection requirements are met. Material changes to sub-processors will be announced in an appropriate manner; where legally required, the controller will be given an opportunity to object on compelling data-protection grounds.

The map and geocoding services used for “Find” are used exclusively for location data intended to be public for profiles, offers and events. Athlete, test, competition or diagnostic data stored in the Gold · Performancelab are not transmitted to these map services.

Persönliche Lesefreigaben für volljährige Athleten

The processor also technically supports individually instructed read-only access for athletes aged 18 or over. Each invitation is tied to a single coach-controlled athlete record and a verified email mailbox, with an expiring invitation link, a passwordless one-time access code and documented acceptance steps. This email check does not establish legal identity or age. The controller must verify that the intended recipient is authorised, that suitable Articles 6 and 9 GDPR grounds exist, and that any pre-existing records of minors are handled lawfully. The shared athlete view excludes other people’s data and private coach notes. Either party can revoke future access. Revocation does not itself delete the controller’s source records, and does not remove the controller’s obligations to respond to requests by the data subject.

For documented platform security incidents, the operator can temporarily suspend a controller or athlete account through a logged administrative process, without deleting the underlying training records. The event and review notes are restricted to authorised operator staff. Suspension also blocks ongoing authenticated sessions. A reinstatement restores account access once the concern is resolved. Such measures do not relieve controllers of their duties under the GDPR, and any affected access, billing, contractual or deletion requests must be considered separately.

Individual athlete/guardian PDF download

The processor supports on-demand reporting by athletes and authorised legal guardians solely within an active, individual read permission approved by the controller. It uses the existing local A4 landscape PDF reporting engine and the individual’s selected data categories and period. Coach-internal comments, unrelated individuals and group records are not released. Athletes’ optional private motivation targets remain separately stored. The created report is delivered as an authenticated download without permanent report-file retention on the server. These technical functions do not transfer controller responsibilities or authorise additional disclosure to third parties.

Assistance on documented instructions

Where assistance concerns personal data entered by the Gold customer as controller, operator access must be limited to the documented support request and a separate, revocable permission covering a defined area and period. The purpose and actions are logged, and support access does not permit the operator to use athlete data for other purposes. Restoring fictitious example profiles is only performed for the requesting account and does not constitute a cross-customer data transfer.

8. Assistance with data subject rights and data protection obligations

Within the scope of the information and platform functionality available to it, schwimmtrainer.at assists the controller with requests for access, rectification, erasure, restriction and data portability, and with relevant obligations concerning personal data breaches, data protection impact assessments and prior consultation. Requests may be sent to office@schwimmtrainer.at.

9. Personal data breaches

If schwimmtrainer.at becomes aware of a personal data breach affecting the controller’s data, it will inform the controller without undue delay where required under Article 33(2) GDPR and provide the available information for further assessment.

10. Return and deletion

The controller can delete data using the functions provided. After processing ends, personal data will be deleted in accordance with the agreed product and deletion logic or, where technically offered, returned, unless a legal obligation or other permissible legal basis requires continued storage.

11. Evidence and audits

schwimmtrainer.at will provide, to an appropriate extent, the information required to demonstrate compliance. Where required by Article 28 GDPR, reviews or audits may be carried out by prior arrangement, subject to appropriate safeguards for confidentiality, security and the rights of other users.

12. Incorporation into the user agreement

These terms form part of the Terms and Conditions / Terms of Use where a Gold user uses the Performancelab to process personal data of other persons. In all other respects, the Terms and Conditions / Terms of Use and the Privacy Notice.

After the controller independently verifies parental responsibility, a minor’s legal guardian may be invited to a strictly read-only view of that child’s data. The controller must document the verification, ensure a lawful basis for disclosure including any Article 9 GDPR exception for health data, and promptly revoke access when authority ends. Adult athlete self-planning is stored separately from controller-defined benchmarks, tests and goals. Access permissions and invitations can be revoked; this is not an instruction to erase underlying controller records.