The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the member states, as well as other data protection regulations, is:

City of Mainz
Office of Finance, Public Enterprises, and Sports
City Hall Große Bleiche
Große Bleiche 46/Löwenhofstraße 1
55116 Mainz

Phone: 06131 12-4219
Email: sportabteilungstadt.mainzde

Data Protection Officer
Stadthaus Große Bleiche
Große Bleiche 46/Löwenhofstraße 1
55116 Mainz

Phone: 06131 12-2216
Email: datenschutzstadt.mainzde

Privacy Policy of the State Capital of Mainz (opens in a new tab)

1. Description and Scope of Data Processing
   We collaborate with race|result Timing BW GmbH under a data processing agreement. A link on our website leads directly to this company’s registration form. Here, participants can register for the Drei-Brücken-Lauf by providing their personal data.
   The following data is collected during the registration process:
   first name, last name, address, phone number, email address, gender, year of birth, bank account details for direct debit, club, country, date and time of registration.
2. Legal basis for data processing during registration
   The legal basis for processing the data is Article 6(1)(b) of the GDPR.
3. Purpose of data processing
   Registration establishes a contractual relationship with the controller. The data collected is necessary for the fulfillment of this contract. The collection of this data may be required by law (e.g., tax regulations), result from contractual provisions (e.g., information about the contractual partner), or be necessary for the proper performance of the contract (e.g., year of birth and gender for classification into age or starting groups).
4. Duration of storage
   The data of the top-ranked men and women will be stored for 20 years by the Sports Department of the State Capital of Mainz for statistical purposes. All other data will be deleted by our data processor after the end of the contract term in 2026.
   This applies to data collected during the registration process for the fulfillment of a contract or for the implementation of pre-contractual measures once the data is no longer necessary for the execution of the contract. Even after the contract has been concluded, there may still be a need to store the contractual partner’s personal data in order to comply with contractual or legal obligations.
5. Right to Object and Right to Erasure
   As a participant, you have the option to cancel your registration at any time. You may have the data stored about you modified at any time. If the data is necessary for the performance of a contract or for the implementation of pre-contractual measures, early deletion of the data is only possible to the extent that no contractual or legal obligations preclude such deletion.

1. Description and Scope of Data Processing
   During the Three Bridges Run, times are recorded at various points (start and finish) and electronically assigned to the participating runner via a transponder. From this data set, split times are calculated for the participants, and results lists are generated. This data is published online during and after the event (see also Section IV, No. 1). A list of registered participants is published during the registration phase.
2. Legal basis for data processing in connection with the publication of timing data
   The legal basis for the processing of the data is Art. 6(1)(b) GDPR.
   The legal basis for the publication of the results after the end of the event is Art. 6(1)(a) GDPR.
3. Purpose of data processing
   The processing of timing data and the resulting lists of results serves to fulfill the contractually agreed service. The publication of the data serves the purpose of comparing participants with one another, as is typical in competitions.
4. Duration of storage
   This data will be deleted at the participant’s request.
5. Right to object and request deletion
   The participant may at any time request that their name be deleted from the publicly accessible results list after the event has ended.

1. Description and Scope of Data Processing
   When paying registration fees, participants may use the following external payment service providers by selecting the respective payment system:
   •Payment by direct debit
   The personal data transmitted to the external payment service provider generally includes first name, last name, company name, address, gender, email address, IP address, phone number, and bank details (IBAN and BIC), which are necessary to process the payment in the selected form. Personal data related to the respective order is also necessary for the fulfillment of the purchase contract.
   In this context, please refer to the privacy policy (opens in a new tab) of the selected payment service provider, race|result Timing BW GmbH.
2. Legal basis for data processing
   The legal basis for the processing of the data is Art. 6(1)(b) GDPR. For other personal data processed by the payment service providers, the respective privacy policy of the service provider applies.
3. Purpose of data processing
   The transmission of data is intended in particular for identity verification, payment administration, and fraud prevention. The data controller will transmit personal data to the payment service provider in particular when there is a legitimate interest in the transmission. For other personal data processed by the payment service providers, the respective privacy policy of the service provider applies.
4. Duration of storage
   Information regarding a completed payment will be deleted after the regular statute of limitations of three years following the end of the event has expired. For other personal data processed by the payment service providers, the respective privacy policy of the service provider applies.
5. Right to object and right to erasure No data for
   which a right to object exists is stored by the controller. For other personal data processed by payment service providers, the respective privacy policy of the service provider applies.

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller (the City of Mainz):

1. Right of access
   You may request confirmation from the controller as to whether personal data concerning you is being processed by us. If such processing is taking place, you may request the following information from the controller:
   (1) the purposes for which the personal data is being processed;
   (2) the categories of personal data being processed;
   (3) the recipients or categories of recipients to whom the personal data concerning you have been or will be disclosed;
   (4) the planned duration of storage of the personal data concerning you or, if specific details are not available, the criteria for determining the storage period;
   (5) the existence of a right to rectification or erasure of the personal data concerning you, a right to restriction of processing by the controller, or a right to object to such processing;
   (6) the existence of a right to lodge a complaint with a supervisory authority;
   (7) all available information regarding the origin of the data, if the personal data is not collected from the data subject;
   You have the right to request information regarding whether the personal data concerning you is transferred to a third country or to an international organization. In this context, you may request to be informed of the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.
2. Right to Rectification
   You have the right to request rectification and/or completion from the controller if the personal data concerning you that is being processed is inaccurate or incomplete. The controller must carry out the rectification without undue delay.
3. Right to Restriction of Processing
   Under the following conditions, you may request the restriction of processing of the personal data concerning you:
   (1) if you contest the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy of the personal data;
   (2) the processing is unlawful and you oppose the erasure of the personal data and instead request the restriction of the use of the personal data;
   (3) the controller no longer needs the personal data for the purposes of the processing, but you require it for the establishment, exercise, or defense of legal claims; or
   (4) if you have objected to the processing pursuant to Article 21(1) of the GDPR and it has not yet been determined whether the legitimate grounds of the controller override your grounds.
   If the processing of your personal data has been restricted, such data—apart from its storage—may only be processed with your consent or for the establishment, exercise, or defense of legal claims, or to protect the rights of another natural or legal person, or for reasons of a substantial public interest of the Union or a Member State. If processing has been restricted in accordance with the above conditions, you will be informed by the controller before the restriction is lifted.
4. Right to Erasure
   a) Obligation to Erase
   You may request that the controller erase your personal data without undue delay, and the controller is obligated to erase such data without undue delay if any of the following grounds apply:
   (1) the personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed;
   (2) you withdraw your consent on which the processing was based pursuant to Art. 6(1)(a) or Art. 9(2)(a) of the GDPR, and there is no other legal basis for the processing;
   (3) you object to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) of the GDPR;
   (4) the personal data concerning you has been unlawfully processed;
   (5) the erasure of the personal data concerning you is necessary to comply with a legal obligation under Union law or the law of the Member States to which the controller is subject;
   (6) the personal data concerning you was collected in relation to information society services offered pursuant to Article 8(1) of the GDPR.
   b) Notification to third parties
   If the controller has made the personal data concerning you public and is obliged to erase it pursuant to Article 17(1) of the GDPR, the controller shall, taking into account available technology and the cost of implementation, take reasonable measures, including technical measures, to inform controllers processing the personal data that you, as the data subject, have requested the erasure of all links to such personal data or of copies or replications of such personal data.
   c) Exceptions
   The right to erasure does not apply where the processing is
   necessary: (1) for the exercise of the right of freedom
   of expression and information; (2) for compliance with a legal obligation which requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
   (3) for reasons of public interest in the area of public health pursuant to Art. 9(2)(h) and (i) and Art. 9(3) of the GDPR;
   (4) for archiving purposes in the public interest, scientific or historical research purposes, or for statistical purposes pursuant to Article 89(1) of the GDPR, insofar as the right referred to in section (a) is likely to render impossible or seriously impair the achievement of the objectives of such processing; or
   (5) for the establishment, exercise, or defense of legal claims.
5. Right to be informed
   If you have exercised your right to rectification, erasure, or restriction of processing against the controller, the controller is obligated to notify all recipients to whom your personal data has been disclosed of such rectification, erasure, or restriction of processing, unless this proves impossible or involves disproportionate effort. You have the right to be informed by the controller about these recipients.
6. Right to Data Portability
   You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used, and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to whom the personal data was provided, provided
   that (1) the processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) of the GDPR or on a contract pursuant to Art. 6(1)(b) of the GDPR, and
   (2) the processing is carried out by automated means.
   In exercising this right, you also have the right to have the personal data concerning you transmitted directly from one controller to another controller, to the extent that this is technically feasible. The rights and freedoms of others must not be adversely affected by this.
   The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
7. Right to Object
   You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is carried out pursuant to Article 6(1)(e) or (f) of the GDPR.
   The controller will no longer process the personal data concerning you unless it can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.
8. Right to Withdraw Consent
   You have the right to withdraw your consent to the processing of your personal data at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to withdrawal.
9. Right to lodge a complaint with a supervisory authority
   Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.
   The supervisory authority to which the complaint was submitted shall inform the complainant of the status and results of the complaint, including the possibility of a judicial remedy under Article 78 of the GDPR:
   The State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate
   Prof. Dr. Dieter Kugelmann
   Hintere Bleiche 34
   55116 Mainz
   Phone: +49 6131 208-2449
   Fax: +49 6131 208-2497
   Website: https://www.datenschutz.rlp.de (opens in a new tab)
   Email: poststelledatenschutz.rlpde

The participant agrees that photographs taken in connection with his or her participation (e.g., of the city, partners, and sponsors), video recordings (e.g., of the city, partners, and sponsors), and interviews may be stored, shared, distributed, and published in radio, television, print media, books, and photomechanical reproductions, including for advertising purposes (e.g., use of the images on posters and flyers, including in future years; sharing of the images with sponsors, etc.) without any claim to compensation.