Privacy Policy

iRewind AG (iRewind, we, us or our) is a company organized under the laws of Switzerland, with its registered office at Wiesenstrasse 10, 8008 Zurich, Switzerland, registered with the UID/IDE n° CHF-368.672.763.

iRewind respects the privacy of the persons (the end-user, or you, your) using personalized video solutions (iRewind service). This privacy policy (the Privacy Policy) describes how we collect and process personal data for the event organizers (the organizers) on whose behalf we act. It also describes how we collect and process personal data on our behalf. Such processing may also be covered by other privacy statements, it may arise from the circumstances or it can be determined by law. Either of these options may apply.

It also describes the choices the end-users can make about our use of their personal data, the measures we take to protect the personal data and how the end-users can contact us about our privacy practices.

This version of the Privacy Policy is effective as of May 1, 2019.

The words defined in section 15 of this Privacy Policy shall have the meaning set forth in said section for all purposes of this Privacy Policy, unless the context otherwise commands.

1. IREWIND SERVICES AND COLLECTION AND PROCESSING OF PERSONAL DATA IN SHORT

1.1 iRewind services

We operate a personalized video solution under the brand “iRewind” (iRewind service), which consists of automatically capturing, editing and instantly delivering personalized videos. For instance, we may capture and create personalized videos and photos of the participants at a sports event or at a music festival.

End-users in iRewind-enabled events or locations are identified using radio-frequency tags, manual triggering, motion detection, audio detection, facial detection and self-registration and are filmed by iRewind cameras installed in certain areas (filmed areas).

The videos are then automatically edited by iRewind and uploaded and stored on a cloud server controlled by iRewind.

The videos generated by iRewind may be published on various media and in various ways, namely:

• On the event organizer’s website.

In that case, unless otherwise requested by the event organizer, all video clips are generally publicly available without login. Thus, all persons consulting the dedicated page on the organizer’s website may access the videos captured at the event and certain related data (such as the name of the participants, the fact that they participated in an event, their category, ranking etc.). The videos may generally be searched by using the search tool integrated in the organizer’s webpage;

• On iRewind’s website (irewind.com). The functioning is the same as described in the precedent paragraph;
• On either the organizer’ website, iRewind’s website or any dedicated website by using a deeplink. The end-user receives an email or a text message with the link. In that case, only the persons having the deeplink may access the video. A login is as a rule not required.

1.2 Our relationship with event organizers

We generally deploy iRewind services at events or at venues on behalf of event organizers and sponsors or owners or managers of the venue (the organizers). When this is the case, we do not conduct these events and are not a contracting party of the end-users in this regard. Instead, the individual organizer is responsible for the administration of the end-user and the management of their personal data.

In conjunction with specific events we may receive metadata from the organizer, relating to participants of the event or visitors of a certain venue. The metadata may include an IDand further personal data such as the name, age, gender, email and phone number. In certain cases, we may collect this data directly from the end-user on behalf of the organizer.

We keep a database on a cloud-based server controlled by us where we storedata received from the organizer, the data we collected,the videos and other data we generate on a per-event basis. The respective organizers are responsible for these databases and the associated data processing; they can request that we provide this data at any time, and they can also access this data online upon request. If this is the case, we act as their processor.

1.3 Data we collect and process in our name

In some cases we collect and process personal data in our name (and not on behalf of an organizer). Namely in these instances:

• We collect and process Personal Data when someone visits the iRewind Website (see section 5.2 below);
• When we set-up an iRewind account. The “iRewind’ account is used to give event administrators online access to the data managed by us and settings (e.g., consents) for each event. The accounts (and the video recorded therein) are generally not publicly available, which means that they cannot be accessed by unauthorized third parties;
• We collect and process Personal Data via web services like google analytics and cookies.

These services as well as the other services are operated by us at our own responsibility.

The present Privacy Policy covers both types of processing: the data processing performed by the organizer, insofar as we administer it, as well as the data processing performed in our name.

2. SUMMARY OF THE RESPONSIBILITIES OF IREWIND AND THE ORGANIZER

2.1 When we process personal data on behalf of an organizer

When we collect and process personal data on behalf of an organizer (see section 1), the organizer will act as controller and we will act as a processor.

The organizers, as controllers, are the principal party for responsibilities such as determining the purposes and means of the processing of the personal data, collecting the end-users’ consent validly, managing consent-revoking, enabling the end-users’ rights (see section 12), including their right to access their personal data, etc.

As processor, our responsibilities are to:

• only process personal data on instructions from the organizer, and inform the organizer if we believe said instruction infringes on the law;
• obtain written permission from the organizer before engaging a subcontractor;
• upon request, delete or return all personal data to the organizer at the end of the service contract;
• take reasonable steps to secure data, such as encryption and pseudonymization, stability and uptime, backup and disaster recovery, and regular security testing;
• notify the organizer without undue delay upon learning of data breaches;
• restrict personal data transfer to a third country only if legal safeguards are obtained.

We are not responsible for the processing of personal data by the organizer performed on its own systems or for the processing of personal data on third-party systems.

The end-user must therefore read the organizer’s privacy policy carefully for further details in order to understand how his/her personal data will be collected and processed by the organizer.

2.2 When we process your personal data in our name

When we collect and process personal data in our name (see section 1), we will act as controller and will have the responsibilities such as determining the purposes and means of the processing of the personal data, collecting the end-users’ consent validly, managing consent-revoking, enabling the end-users’ rights (see section 12), including their right to access their personal data, etc.

3. SOURCE OF INFORMATION

We may obtain personal data relating to an end-user from various sources, namely:

• from the organizer and its partners (such as affiliated companies, subcontractors, sponsors and other service providers);
• from the end-user directly, for instance by his/her signing up for an iRewind account, during the registration process which we take care of on behalf of the organizer, or by posting content on his/her account;

4. LEGAL BASIS

The personal data are processed by us on the following basis:

• conclusion and fulfillment of the agreement between the organizer and the end-user (for the data processed on behalf of the organizer);
• conclusion and fulfillment of the agreement between us and the end-user (for the data processed in our name);
• the consent of the end-user;
• compliance with legal requirements;
• fulfillment of legitimate interests, such as the operation of iRewind services, the acquisition or sale of companies, as well as corporate transactions, preventing and/or combating fraud, abuse, handling claims or other actions against iRewind, participation in a legal proceedings and cooperation with authorities.

5.  DATA COLLECTED

5.1 Personal data received from the organizer or collected on its behalf

The organizer may transfer to us the following personal data. We may also collect such personal data for the organizer.

The personal data that are concerned may include:

• contact details (including the first name, last name, sex, gender, date of birth, nationality, address, e-mail address and mobile number);
• data relating to the end-user’s participation in and holding of the event (event data), such as a list of events for which the end-user has registered, data related to his or her results including ranking, race status, pictures and videos, age and performance categories, timing information, BIB number , and certain other event-specific data;
• data from prior years if the end-user has participated in this event previously;
• data related to newsletters and other services, such as opt-ins and opt-outs regarding the organizer’s newsletter and other services (including iRewind services);
• text messages and other communication between the end-user and the organizer;
• Location and identification information.
• iRewind services generally require the collection and processing of data from the end-user’s mobile device or other tracking devices to determine his/her actual location and to identify him/her. Location and identification are made by using radio-frequency tags, manual triggering, motion detection, audio detection, facial detection and self-registration;
• device identifiers and the data about the end-users’ devices, such as screen size, DOM local storage, plugins;
• data received from third parties, such as phone type, general location derived from IP address;

We may also collect the personal data directly from the end-user at the event on behalf of the organizer.

5.2 Personal data collected and processed in our name

With respect to the services we operate in our name (and not for an organizer), we collect the following personal data, i.e.:

Data provided by the end-user

• contact details (including the first name, last name, sex, gender, date of birth, nationality, address, e-mail address and mobile number);
• username, password and e-mail address when the end-user registers for an iRewind account and other profile information that the end-user provides for his/her user profile, such as first and last name, picture, mobile number and email address;
• all photos, videos, comments and materials posted by the end-user using iRewind services;
• all communication between the end-user and iRewind, such as service-related emails (for account verification, changes or updates to features of the application, technical and security notices for example).

Location and identification information

iRewind services generally require the collection and processing of data from the end-user’s mobile device or other tracking devices to determine his/her actual location and to identify him/her. Location and identification are made by using radio-frequency tags, manual triggering, motion detection, audio detection, facial detection and self-registration;

Information collected automatically

The following personal data are collected automatically when a person is consulting iRewind’s website, namely:

• the log information, such as the pages viewed, access times, IP address, HTTP headers, URL’s;
• data collected via cookies.

We may use cookies and similar technologies like pixels, web beacons, and local storage to collect information about how the end-users use iRewind and provide features to the end-users. We may ask advertisers or other partners to serve ads or services to the end-users’ devices, which may use cookies or similar technologies placed by us or the third party;

• analytics information.

We use third-party analytics tools (namely Google Analytics and Google Datastudio) to help us measure traffic and usage trends for iRewind’s service. These tools collect information sent by the end-user device or our service, including the web pages the end-user visits, add-ons, and other information that assists us in improving iRewind services. We collect and use this analytics information with analytics information from other users so that it cannot reasonably be used to identify any particular individual end-user;

• device identifiers and the data about the end-users’ devices, such as screens size, DOM local storage, plugins;
• data received from third parties, such as phone type, general location derived from IP address;
• metadata.
• Metadata is usually technical data that is associated with the end-users’ content. For example, metadata can describe how, when and whom a piece of an end-user’s content was collected and how that content is formatted.

6. PURPOSES FOR WHICH THE PERSONAL DATA ARE COLLECTED AND PROCESSED

6.1 Personal data collected and/or processed on behalf of the organizer

Insofar as we collect and process personal data on behalf of an organizer (i.e. as a processor), we do so to the extent permitted by applicable law, particularly (but not exclusively) for the following purposes:

• To provide, operate, maintain, protect and improve iRewind and to develop new services;
• To monitor metrics such as total number of visitors, traffic, and demographic patterns of end-users visiting iRewind’s website;
• To diagnose or fix any technology bug the end-user may be facing;
• For purposes of fulfilling the applicable legal requirements and our internal rules, pursuing and implementing various rights, asserting and defending against legal claims and complaints, combating abuse, and for purposes of legal investigations or proceedings related to answering enquiries from the authorities;
• For other purposes where a legal duty requires the processing or where these purposes were evident or appropriate based on the circumstances at the time of data collection;
• Other purposes, see the list in section 2.

We also may process your personal data for other purposes with your consent. This includes the purposes set forth in the organizer’s privacy policy for which you have given consent.

6.2 Personal data collected and processed in our name

Insofar as we collect and process personal data in our name (i.e. as a controller), we do so to the extent permitted by applicable law, particularly (but not exclusively) for the following purposes:

• To provide, operate, maintain, protect and improve iRewind and to develop new services;
• To save information so the end-user will not have to re-enter it during his/her visit or the next time he/she visits iRewind’s website or uses iRewind services;
• To offer tailored content, which could include online ads or other forms of marketing;
• To monitor metrics such as total number of visitors, traffic, and demographic patterns;
• To diagnose or fix any technology bug;
• To use the end-user’s e-mail address to send him/her our newsletter or provide him/her with some news relating to our service, such as letting him/her know about upcoming changes or improvements. We may also use the e-mail address to send the end-user information and news about the event organised by our trusted partner. The end-users may at all time unsubscribe from our newsletter by sending an e-mail to our data controller (hello@irewind.com);
• To serve ads when an end-user visits iRewind’s website via third party companies. These companies may use information (not including the end-user’s name, address, email address, or telephone number) about his/her visits to our website and other websites in order to provide him/her with relevant advertisements;
• For the linking of the end-user’s accounts to his/her respective profiles on social media platforms (e.g. Facebook)];
• For statistical evaluations, analyses and documentation, reports and public relations work;
• For individual communication with users of our services, e.g. enquiries and complaints and responding to same;
• For the sale or purchase of companies and other corporate transactions and the associated transfer of user data;
• For purposes of fulfilling the applicable legal requirements and our internal rules, pursuing and implementing various rights, asserting and defending against legal claims and complaints, combating abuse, and for purposes of legal investigations or proceedings related to answering enquiries from the authorities;
• For other purposes, where a legal duty requires the processing or where these purposes were evident or appropriate based on the circumstances at the time of data collection.

7. COMMUNICATION AND TRANSFER OF PERSONAL DATA

7.1 Personal data processed on behalf of the organizer

We may share personal data collected or processed on behalf of the organizers to the following categories of recipients to the extent permitted by the applicable data protection law:

• To the organizer, its affiliates and other third parties to whom the organizer instructs us to share the personal data;
• To other companies within the iRewind group. Affiliates may use this information to the same extent that we can. But we will make sure that these affiliates commit to complying with this Privacy Policy;
• To our service providers (including payment processors, cloud provider, IT service providers, providers for the transmission of text messages, providers for combating fraud, advertising partners, website analysis services);
• Our service providers will be given access to the end-users’ personal data as is reasonably necessary to provide the iRewind service under reasonable confidential terms;
• To local, national and foreign authorities, if it is required under law to do so or we reasonably believe that such release is necessary to comply with applicable legislation or respond to a court in order or to protect our rights and interests;
• To the end-user’s parents, respectively legal guardians and representatives, as the case may be.

Please consult the organizer’s privacy policy for more details regarding the recipient to whom we may share your personal data.

7.2 Personal data collected and processed in our name

We may share personal data to the following categories of recipients to the extent permitted by the applicable data protection law:

• To other companies within the iRewind group. Affiliates may use this information to the same extent that we can. But we will make sure that these affiliates commit to comply with this policy;
• To service providers (including payment processors, cloud provider, IT service providers for the transmission of text messages, providers for combating fraud, advertising partners, website analysis services). Our service providers will be given access to the end users’ personal data as is reasonably necessary to provide the iRewind service under reasonable confidential terms;
• To local, national and foreign authorities, if it is required under law to do so or we reasonably believe that such release is necessary to comply with applicable legislation or respond to a court in order or to protect our rights and interests;
• To the end-user’s parents, respectively legal guardians and representatives;
• To media organizations;
• To advertising customers and sponsors;
• To operators of social networks;
• To providers of tools for analyzing website usage, which may also use the data for their own purposes;
• To buyers or parties interested in acquiring iRewind or in other corporate transactions.

We may also share aggregated, non-personally identifiable information with any of our partners – like advertisers, connected sites, business partners, etc. For instance, we may gather and analyze data on your performance (e.g. your timing information at a sports event) and compile such data with similar data of other users and provide and sell such data to a business partner (e.g. a running shoes manufacturer).

8. STORAGE OF PERSONAL DATA

As a general rule, we use a cloud-based solution implying that your personal data will be processed and stored on the servers of our cloud service providers (Google Europe), which may be located in Switzerland and/or in the European Union. We may also process and store personal data in our own servers in Switzerland or in the servers we installed near the site where the videos are captured.

 9. DURATION OF STORAGE OF PERSONAL DATA

9.1 Personal data collected and processed on behalf of the organizer

Personal data received or processed on behalf of the organizers are retained as long as required to provide the services for which they have been collected.

Unless otherwise specified with the organizer, we further reserve the right to retain for an unlimited period of time information derived from your personal data in such way that you will no longer be identified or identifiable (pseudonymized data).

9.2 Personal data collected and processed in our name

We reserve the right to retain for an unlimited period of time information derived from your personal data in such way that you will no longer be identified or identifiable (pseudonymized data).

10. SECURITY

We use commercially reasonable safeguards to help keep the information collected through the iRewind service secure and, where a logging is required, take reasonable steps to verify the end-user’s identity before granting access to the end-user’s account. However, iRewind cannot ensure the security of any information the end-users transmit to iRewind or guarantee that information on the service may not be accessed, disclosed, altered, or destroyed.

11. CHILDREN (UNDER 16 YEARS)

The collection of personal data of children under 16 years old is permitted only with the valid consent of the person who has the parental authority. If you are under the age of 16 and do not have the consent of the legal parental authority on you, please do not provide any personal data.

If we learn that we have collected personal data of a child under 16 years old without the valid consent of the legal parental authority on him/her, we will remove the personal data unless otherwise agreed by the person having the legal authority.

12. THE RIGHTS OF END-USERS

12.1 The rights of end-users (in a nutshell)

With respect to the personal data we collect and process, the end-users concerned have the right to:

• Obtain a confirmation from us whether or not his/her personal data are being processed by iRewind and, if it is the case, to access to his/her personal data that we collected and/or processed (right of access);
• Obtain from us or the organizer the rectification and/or completeness of any inaccurate and/or incomplete personal data (right to rectification);
• Obtain from us or the organizer the erasure of personal data (right to erasure) when (i) the personal data is no longer necessary for the purposes for which it has been collected, (ii) the end-user exercises his/her right to oppose the processing concerned, or (iii) the processing is not legal. The right to erase cannot be asserted if iRewind must retain personal data in order to comply with a legal obligation or to exercise rights in court;
• Obtain from us or the organizer a restriction of the processing of personal data (right to restriction of processing) when (i) the end-user disputes the accuracy of the personal data for a period that allows iRewind to carry out the appropriate verifications, (ii) we do not need the personal data any longer but we are required by the end-user to defend a right in court, or (iii) when the end-user asserts his/her right to object, for the time required by iRewind to respond to such request. When such restriction is put in place, the personal data concerned can only be processed with the end-user’s consent or for the defense of a right in court;
• Receive his/her personal data that we collected in a structured, commonly used and machine-readable format, and have it transmitted by iRewind to another provider where it is technically possible (right to data portability) This is the case in member States of the European Union and the European Economic Area.;
• Request that we cease the processing of the personal data for reasons to the end-user’s particular situation (right to object);
• Withdraw his/her consent at any time;
• Lodge a complaint with the authority of the country in which the end-user’s habitual residence is located if he/she considers that the processing of his/her personal data by iRewind violates the applicable laws.

12.2 Assertion of rights

If an end-user wishes to assert his/her right, he/she shall contact us by sending us an e-mail to the contact person (see point 13 below).

Such request must contain the end-user’s name, last name and email address. iRewind may ask additional information if necessary, such as a photocopy of an identity card.

13. CONTACT

If you have any queries, comments or complaints regarding this Privacy Policy, please contact us at the following address:

Name:            iRewind AG

Address:        Wiesenstrasse 10

CH-8008 Switzerland

E-mail:          support@irewind.com

iRewind itself has not appointed a data protection officer as referred to in art. 37 GDPR, as none is required. Whether the organizers also have appointed one needs to be checked by the enquirer.

Regarding the personal data collected and processed by iRewind on behalf of an organizer, if you have any queries, comments or complaints, you may also contact the respective organizer directly.

14. CHANGES TO THIS PRIVACY POLICY

We may change this Privacy Policy from time to time by posting the updated version on our website and application. We will give you notice in case of material change in an appropriate manner, for example by posting a message on our website and application. We recommend you to regularly consult the page dedicated to this Privacy Policy. The date mentioned at the top of this Privacy Policy indicates when this Privacy Policy or any subsequent version of this Privacy Policy takes effect.

15. DEFINITIONS

Organizer means the clients of iRewind, who engage iRewind to provide iRewind services at certain events or in certain venues.

Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data, as defined in art. 4 Section 7 of the GDPR and the FADP, insofar as the respective provisions apply in the specific case.

Data protection law means the data protection law applicable, from time to time, including, where applicable, the GDPR and/or the FADP.

Data subject means any individual with respect to whom personal data is collected and/or processed.

End-user means an individual using iRewind services. The terms “you” and your” must be construed accordingly.

FADP means the Swiss Federal Act on Data Protection, as amended.

GDPR means the European regulation 2016/679, called the General Protection Data Regulation, as amended.

iRewind means iRewind AG, a company organized under the law of Switzerland, with its registered office at Wiesenstrasse 10, 8008 Zurich, Switzerland, registered with the UID/IDE n° CHF-368.672.763. The terms “we”, “us”, “our” used in this Privacy Policy refers to iRewind.

Privacy Policy means this privacy policy, which may be retrieved from the following link https://irewind.com/privacy-policy/, as amended from time to time.

iRewind services means the services offered by iRewind enabling end-users to capture, edit, view and share personalized video of their experience.

iRewind website means the website located at www.irewind.com.

Personal data means any information relating to an identified or identifiable natural person (data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.