Privatumo politika

This policy explains which personal data we process when you use level-up-championship.com (in any of its languages), register and pay for the championship, write to us, or appear in photos from the championship.

1. Who is responsible for your data

Controller within the meaning of Art. 4(7) GDPR:

Mariana Vais
Straße des 18. Oktober 10
04103 Leipzig, Deutschland
Germany
Email: datenschutz@mvaismentor.com

Write to this address with any question about your data or to exercise your rights.

2. In short

• You can browse the site without registering. Without your consent we only store what the site needs in your browser: language, cart, payment status, scroll position after a menu click and your cookie choice.
• Visit statistics (Vercel), the Meta advertising pixel and Google Maps run only with your consent. You can change your choice at any time via “Cookie settings” in the site footer.
• To register for the championship we collect your name, email, phone number and Telegram handle. Card payments in the cart are handled by SumUp, advance bookings by Revolut; we never see your card details.
• We delete phone and Telegram 30 days after the championship, the email 6 months after it, and unfinished orders after 30 days. We keep the accounting record of a payment (name, nominations, amount, date) for 10 full calendar years after the year of payment, as tax law requires; if a payment dispute or tax audit is open, until it is over.
• Some providers (Vercel, Resend, Forward Email, Apple, Meta, Google and, where needed, SumUp and Revolut) may process data outside the EU, including in the USA; the safeguards are described in section 10.
• You have the right to access, rectification, erasure, restriction, data portability, objection and to lodge a complaint with a supervisory authority (sections 12 and 13).

3. Visiting the site and hosting

The site is hosted by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA). Its server functions run in a data centre in Frankfurt am Main; pages and files may be delivered through Vercel’s global network.

When you open a page, your browser automatically sends technical data: IP address, date and time of the request, the page address, the address of the page you came from, and the type and version of your browser and operating system. Vercel uses this data to deliver the page and keeps it briefly in technical logs for troubleshooting and protection against attacks — on our plan for 1 day, or for up to 30 days if we switch on Vercel’s extended log retention.

• Purpose: to show the site and keep it secure and stable.
• Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is a reliable and secure website.
• Vercel acts as our processor under a data processing agreement (Art. 28 GDPR). On transfers to the USA, see section 10.

4. Cookies and browser storage

Without your consent we only store in your browser what the site cannot work without or what a feature you actively use needs (§ 25(2) no. 2 TDDDG). Everything else requires your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR).

Vercel Web Analytics uses no cookies and stores nothing in your browser (section 5).

Your choice is stored only in your browser; we keep no separate consent log on our server. You can change or withdraw your consent at any time via “Cookie settings” in the site footer or on this page. Withdrawal takes effect for the future. If you withdraw “Marketing” consent, we delete Meta’s cookies and storage entries on our site and reload the page without the pixel; cookies on facebook.com can be deleted in your browser settings.

5. Visit statistics (Vercel Web Analytics) — only with consent

If you consent to “Statistics”, we count visits with Vercel Web Analytics, without cookies. The page address (without the parameters after “?”) and the site you came from are sent; Vercel derives an approximate location (country, region, city), device type, operating system and browser from your request. To tell visits apart, Vercel creates a hash from the request (a one-way code: the original data cannot be read back from it) and deletes it after 24 hours. We never see individual visitors, only aggregate statistics.

• Purpose: to understand which pages are visited and to improve the site.
• Legal basis: your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR).
• Processor: Vercel Inc., USA (section 10). The statistics are available to us for 12 months (24 months if we add Vercel’s extended analytics option); Vercel may keep the data longer.

6. Meta Pixel — only with consent

If you consent to “Marketing”, the site runs the Meta Pixel of Meta Platforms Ireland Limited (Block J, Serpentine Avenue, Dublin 4, Ireland). It reports to Meta every page of our site you open and, automatically, every click on a button or link. Each report contains the page address, the address of the previous page and the page’s metadata: its title, description and language and, if the page contains it, structured markup (for example Open Graph or Schema.org). For a click the pixel also sends the text of the button or link, its technical attributes (such as identifier, CSS classes and element type), the address the link or form leads to and, if the button or link sits inside a form, a list of that form’s fields (their names, types and placeholder texts and whether a field is empty), but not what you typed into them. Your browser also transmits your IP address, browser and device data (such as screen size and time zone) and the identifiers from the _fbp and _fbc cookies. If you have a Facebook or Instagram account, Meta may link this data to it.

• Purpose: to measure how well our ads on Facebook and Instagram work and to show them to people who have visited our site.
• Legal basis: your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR).
• Joint controllership: we and Meta Platforms Ireland are jointly responsible for collecting the data on our site and transmitting it to Meta (Art. 26 GDPR). The essence of the arrangement: we are responsible for implementing the pixel correctly, for this information and for your consent; Meta is responsible for the security of its products and for handling your rights regarding the data it has received. The agreement: Meta Controller Addendum. Meta carries out any further processing as an independent controller: Meta Privacy Policy.
• Meta Platforms Ireland may transfer data to its parent company Meta Platforms, Inc. in the USA on the basis of that company’s DPF certification and Standard Contractual Clauses (section 10).
• The pixel does not load on the payment-return and order-resume pages, so that order numbers do not reach Meta.

7. Google Maps — only after your click

On the home page a placeholder is shown instead of the map at first. Until you click “Show map” or allow “External media” in the settings, Google receives nothing. Once the map loads, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) receives your IP address, browser data, the address of our site and possibly existing Google cookies. Google processes this data as an independent controller and may transfer it to Google LLC in the USA on the basis of that company’s DPF certification and Standard Contractual Clauses (section 10): Google Privacy Policy.

• Purpose: to show where the championship takes place.
• Legal basis: your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR).

8. Registration and payment

What data and why

To register, you choose nominations and enter your first and last name, email, phone number and Telegram handle. We store them together with the chosen nominations, the amount, the site language, the order number, the order time and the payment status.

• Purpose: to arrange your participation, to contact you about the championship (organisation, schedule, changes), to run the championship and to handle payment claims.
• Legal basis: performance of a contract and steps prior to entering into it (Art. 6(1)(b) GDPR).
• All fields are required: without them we cannot accept your registration or contact you before and during the championship.
• Orders are stored in Vercel Blob, the storage of our processor Vercel (section 10).

Payment via SumUp

Card payments in the cart are handled by SumUp Limited (Block 8, Harcourt Centre, Charlotte Way, Dublin 2, Ireland) on its own page. You enter your card details directly with SumUp; we do not receive them. We pass SumUp only the amount, the order number and the nomination names, and SumUp tells us the payment status. SumUp processes payment data as an independent controller: SumUp Privacy Policy. Legal basis: Art. 6(1)(b) GDPR.

Advance booking via Revolut

The “Registration” button leads to a Revolut payment page where you can book a place at the championship in advance. The payment is handled by Revolut Bank UAB (Vilnius, Lithuania) on its own page; your card details and anything else you enter there go to Revolut, not to us. Revolut processes this data as an independent controller: Revolut Pay Checkout Privacy Notice. Revolut tells us the amount, the date and the payer details we need to match the booking (for example name and email). Legal basis: Art. 6(1)(b) GDPR. These payment records stay in our Revolut business account and our accounting for the tax retention periods (§ 147 AO).

Emails

We send emails through Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA), which acts as our processor:

• a payment confirmation — to you;
• a notification of a new paid registration with your contact details — to us;
• one reminder with a link to complete the payment, if the payment is declined or not completed within 15 minutes.

The reminder is sent once per order, and no more than once every 2 hours to the same address. Apart from these automatic emails, we only write to you about your participation (for example schedule changes) and about material changes to this policy; we send no newsletters or advertising. Legal basis: Art. 6(1)(b) GDPR (for the reminder: helping you complete a registration you started). Resend keeps copies of emails and delivery logs for a limited time (under Resend’s terms, 30 days).

To keep the interval between reminders and to stop anyone from flooding someone else’s address with them, we store a hash (SHA-256, a one-way code) of your email address with the time of the last reminder and normally delete it within a day after the 2-hour interval has passed. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is preventing abuse.

How long we keep it

• Unfinished orders (payment not started, not completed or declined) are deleted after 30 days.
• In paid orders, we delete phone and Telegram 30 days after the championship you registered for, and the email 6 months after it: until then, the bank can still dispute the payment. If a payment dispute or another claim is still open at that point, we suspend deletion of that order’s data until it is resolved (Art. 6(1)(f) GDPR; our legitimate interest is defending against claims).
• We keep the rest of a paid order (name, order number, nominations, amount, date, status and payment reference) as an accounting record for 10 full calendar years after the year of payment, as German tax law requires (§ 147 AO; Art. 6(1)(c) GDPR). If a tax audit is under way when the period ends, deletion is suspended until it is over (§ 147(3) AO).
• In the order store, deletion runs automatically once a week, so data is normally gone within 7 days after the stated period.
• Payment notifications (they contain name, email, phone and Telegram) are kept in our mailbox at the Forward Email service, which also forwards them to our Gmail mailbox (section 10). We delete them manually in both mailboxes, at the latest 6 months after the championship; section 11 explains how long a deleted email can still remain in the trash and the backup copies.

9. Photos and videos from the championship

At the championship we take photos and videos — mainly wide shots, the stage, the competitors’ work and the award ceremony. We publish them in the gallery on this site and on our Instagram to show the championship and to invite people to the next ones.

• Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is documenting and presenting the championship as a public event (taking § 23(1) no. 3 KUG into account). We use close-up portraits in advertising only with your consent (Art. 6(1)(a) GDPR).
• Photos and videos for the site are stored in Vercel Blob of our processor Vercel. Instagram is operated by Meta Platforms Ireland Limited, which processes published content as an independent controller under its own rules.
• Kept for: on the site, as long as the gallery of the respective championship is online; on Instagram, until we delete the post or you ask us to remove it.
• Don’t want to appear in a photo? Write to datenschutz@mvaismentor.com and tell us which photo it is — we will remove it promptly.

10. Recipients and transfers outside the EU

DPF is the European Commission’s adequacy decision for certified US companies (EU-US Data Privacy Framework, Decision (EU) 2023/1795); Vercel Inc., Plus Five Five, Inc., Meta Platforms, Inc. and Google LLC are certified under the DPF. SCC are the EU Standard Contractual Clauses (Decision (EU) 2021/914). Vercel and Resend process data in the USA under our contracts with them, which include SCC. Forward Email LLC is not certified under the DPF; it processes data in the USA under its data processing agreement, which incorporates the SCC (Module Two: controller to processor). Meta and Google receive the data in Ireland and transfer it to their US companies on the basis of their own DPF certification and SCC. Forward Email forwards emails to our mailboxes at Apple (iCloud Mail) and Google (Gmail), which these providers run under their own terms. Apple Inc. is not certified under the DPF; the mailbox is provided by Apple Distribution International Limited in Ireland, the data is generally stored by Apple Inc. in the USA, and Apple bases this transfer on SCC. You can request a copy of the safeguards in our contracts at datenschutz@mvaismentor.com.

Our IT service provider (a software developer in Germany) develops and maintains this site for us and can access the data stored in it where that is needed for maintenance. The provider acts as our processor under a data processing agreement (Art. 28 GDPR) and may use the data only on our instructions. Data may also go to our tax advisor and to public authorities where the law requires it. We do not sell your data.

11. When you write to us

If you write to us by email, on Telegram or on Instagram, we use your message and contact details to reply: Art. 6(1)(b) GDPR if it concerns taking part in the championship, otherwise Art. 6(1)(f) GDPR (our legitimate interest is answering enquiries). Emails to our addresses are received by the Forward Email service and kept for us in an encrypted mailbox on its servers in the USA. Forward Email also forwards them to our mailbox at Apple iCloud Mail (section 10). We delete the correspondence in both mailboxes once the matter is settled, unless the law requires business letters to be kept longer (up to 6 years, § 147 AO). A deleted email can remain in a mailbox’s trash for up to about 30 days, and in Forward Email’s backup copy until the next backup overwrites it; Apple and Google erase deleted emails from their systems under their own rules. Telegram and Instagram are separate services with their own privacy rules; our site only links to them and embeds no content from them.

12. Your rights

You have the right to:

• know which of your data we process and get a copy of it (Art. 15 GDPR);
• have inaccurate data corrected (Art. 16 GDPR);
• have your data erased (Art. 17 GDPR) or its processing restricted (Art. 18 GDPR);
• receive the data you gave us in a machine-readable format (Art. 20 GDPR);
• withdraw your consent at any time; this does not affect the lawfulness of processing before the withdrawal (Art. 7(3) GDPR). For cookies, use “Cookie settings” in the site footer;
• object to processing (Art. 21 GDPR, see section 13);
• lodge a complaint with a supervisory authority (Art. 77 GDPR). Our competent authority is the Sächsische Datenschutz- und Transparenzbeauftragte, Postfach 11 01 32, 01330 Dresden, Germany, post@sdtb.sachsen.de, www.datenschutz.sachsen.de. You can also contact a supervisory authority in the EU/EEA member state where you habitually live or work, or where the alleged infringement took place.

To exercise your rights, write to datenschutz@mvaismentor.com.

13. Right to object

Right to object (Art. 21 GDPR). Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR) — the technical logs of the site, the hash that spaces out reminders (section 8), photos and videos from the championship, replies to messages that do not concern taking part (section 11) and keeping data while a payment dispute or another claim is open — you can object to this at any time on grounds relating to your particular situation. We will then stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for the establishment, exercise or defence of legal claims. Send your objection to datenschutz@mvaismentor.com.

14. Automated decisions

We make no decisions based solely on automated processing and do no profiling within the meaning of Art. 22 GDPR.

15. Changes to this policy

We update this policy when our processing changes; the date of the current version is shown at the top of the page. We will inform already registered participants of material changes that affect them by email. The policy is available in Ukrainian, English and German.