PRIVACY STATEMENT MYLAPS SPORTS TECHNOLOGY
Version September 2022
Mylaps B.V. is an international sports technology company. In the course of ouractivities, we process personal data, both as data controller, and as data processor, on behalfof our business partners. Via this privacy statement, we:
1. inform you about our processing as data controller in accordance with applicable dataprotection laws and regulations, including the General Data Protection Regulation(GDPR).
2. In the second part of this privacy statement, we inform you about processing of datathat we perform as data processor, on behalf of our business partners, who qualify asdata controller.
Who are we?
We are Mylaps B.V., an international sports technology company that is registered in the
trade register under number 34053090. Our postal address is MYLAPS Headquarters,
Zuiderhoutlaan 4, 2012 PJ Haarlem, the Netherlands. For inquiries relating to your privacy,
you can reach us via e-mail at privacy@mylaps.com.
The Mylaps group includes Mylaps B.V., Mylaps Experience Lab B.V., Mylaps Event Timing
B.V., Mylaps US, Inc (Atlanta, GA, USA), Mylaps Japan KK (Tokyo, Japan), and Mylaps AsiaPacific (Sydney, Australia).
We have appointed a privacy officer. You can reach our data protection officer via e-mail at
privacy@mylaps.com. If you have any questions or concerns about this privacy statement or theprocessing of your personal data, please do not hesitate to contact us.
Legal grounds
We process personal data if (at least) one of the following lawful processing grounds applies:• the processing is allowed based on your consent;• the processing is necessary to perform or enter into a contract with you;• the processing is necessary to comply with our legal obligations; or• the processing is necessary for the purposes of a legitimate interest of us or of a third
party. We only rely on this lawful processing ground if the legitimate interest outweighs
your privacy rights and freedoms. In this case, you have the right to object on grounds
relating to your particular situation.
Where possible, the information about processing activities below includes information about
the specific lawful processing ground(s).
PART 1: PROCESSING ACTIVITIES AS DATA CONTROLLER
Which personal data we process about you as data controller and for which (legitimate)purposes, depends on which category of data subjects (for example individuals to whom the1personal data relate) you belong to. The below overview sets out per category of data subjects
which personal data we process, for which purpose(s) and on the basis of which legal ground.

1. Processing activities as data controller
Category of data subjects

Personal data

Processing purpose and legal
groundCustomers of the Mylaps web

Name, address, email address,

Purpose: to be able to ship theshop; directly via the internet

telephone number.

product ordered by the customer

shop or via de Speedhive Appof the web shop.

web shop

Legal ground:
GDPR:

article 6.1 (b)necessary

for

the

performance of a contract towhich the data subject is party or
in order to take steps at therequest of the data subject prior
to entering into a contract.
Customers of the Mylaps web

Name, address, email address.

shop.

Purpose: to be able to sendcommercial emails.
Legal ground: article 6.1 (a)GDPR: your consent.

Users of Mylaps services.

Name, email address, telephone

Purpose: User support.

number (if desired by user),

Legal ground: article 6.1 (b)GDPR:necessary

for

the

performance of a contract towhich the data subject is party or
in order to take steps at therequest of the data subject prior
to entering into a contract;
article 6.1 (f) GDPR: necessary
for the purposes of the legitimate
interests

pursuedbythecontroller or by a third party.
Suppliers.

Name,business

address,

Purpose: to be able to contact

businessemail

address,

suppliers.

telephone number.

Legal ground: article 6.1 (b)GDPR:necessary

for

the

performance of a contract towhich the data subject is party or
in order to take steps at therequest of the data subject prior
to entering into a contract;
article 6.1 (f) GDPR: necessary2

for the purposes of the legitimate
interests

pursuedbythecontroller or by a third party.

Irrespective of the category of data subjects, we process personal data as data controller:• to comply with legal obligations, for example to cooperate with competent authorities
or pursuant to tax or data protection laws and regulations;• in relation to business transactions, for example relating to a change in our corporate
structure (for example merges and acquisitions). This is mostly based on our legitimate
interest to enter into such transactions and related contracts;• for the protection of our employees, visitors, premises and belongings. This is mostly
based on legal obligations or a legitimate security interest; and• in relation to (the preparation of) legal proceedings. This is mostly based on a legitimate
interest to protect our legal position or the interest of other parties involved in such legal
proceedings.
Sources of personal data
We mostly obtain personal data directly from you.
We may however obtain your personal data from a different source, such as our contact person
at your organization, our suppliers and/or business partners. Please refer to part 2: Processing
activities as data processor, on behalf of our business partners.
Your rights
Pursuant to the GDPR, you have various rights with respect to your personal data, including:• right of access: the right to obtain a confirmation as to whether or not we process yourpersonal data, and if so, the right to access such personal data;• right to rectification: the right to have inaccurate personal data relating to you
rectified;• right to erasure (the right to be forgotten): the right to have personal data relating to
you deleted;• right to restriction of processing: the right to have the processing of personal data
relating to you restricted;• right to data portability: the right to have personal data relating to you transmitted toanother company in a structured, commonly used and machine-readable format;• right to objection to processing: the right to object to the processing of personal data
relating to you, on grounds relating to your particular situation; and• right to withdraw consent: if you have consented to the processing of your personaldata, you have the right to withdraw such consent. This does not affect the legality ofthe processing prior to the withdrawal.
You can send a request to exercise any of your rights in writing via privacy@mylaps.com related
to personal data we process as data controller. In general, we will respond within 30 days.
Applicable data protection laws prescribe various conditions, limitations and exceptions inrelation to the privacy rights set out above. We will determine on a case-by-case basis whether
3such conditions, limitations or exceptions apply.
If you send us a request to exercise your rights, we must verify your identity pursuant toapplicable data protection laws. Should you provide us with a passport copy for this purpose,
we kindly request you to delete all irrelevant personal data (such as the citizen service number)on the copy. Dutch citizens can use the 'KopieID-app' of the Dutch Government for this purpose(available in the Apple App Store and Google Play Store).
Complaints
If you have a complaint, we ask you to inform us via privacy@mylaps.com so we can try tosolve the issue together.
Further to the rights listed above, you have the right to lodge a complaint with the Dutch Data
Protection Authority (Autoriteit Persoonsgegevens). If you wish to do so, please note that theDutch Data Protection Authority will only handle your complaint if you have filed a complaint
with us first. If you live in a different EU Member State, you may also lodge a complaint withyour local data protection authority.
Recipients of personal dataYour personal data are accessible to persons within our organization who have a valid reason toaccess your personal data. Under circumstances, your personal data may also be shared withrecipients outside of our organization. This for instance includes our group companies, service
providers, competent authorities and governmental institutions, courts, banks and/or business
partners. If a recipient processes personal data as a 'processor' on our behalf, we will enter into
a data processing agreement.
International transfer of personal data
In principle, we do not share personal data with recipients outside of the European Economic
Area, the area where the GDPR applies directly. If there is any situation where we deviate fromthis principle, we will take the necessary measures to comply with the GDPR. This means suchinternational data transfers will take place if:• an adequacy decision from the European Commission applies to the recipient,meaning that the country of destination offers an adequate level of data protection;• appropriate safeguards have been put in place, such as binding corporate rules or adata transfer agreement on the basis of EU standard contractual clauses; or• a specific derogation applies on the basis of applicable data protection laws.
The countries for which adequacy decisions exist are listed on the website of the European
Commission. If your personal data are transferred pursuant to appropriate safeguards, you canrequest a copy as part of your right of access. Where appropriate, the same applies to specificderogations.
Personal data retention
We do not retain personal data for longer than necessary for the purpose(s) for which we havecollected personal data. Where applicable, we retain your personal data to comply with our legal
4

retention obligations. After a data retention period has expired, your personal data may persist
on backup or archival media for an additional period.
Mandatory provision
You may be required to provide your personal data to us because of a contractual or legal
obligation. We will inform you of such obligation(s) where this applies. If you fail to provide
us with your personal data even though this is mandatory pursuant to law or contract, we cannot
provide our services and may decide to terminate our relationship with you as an individual or
business.
CookiesPlease refer to our Cookie policy for more information about our use of cookies via
https://www.mylaps.com/cookiepolicy/.
ChildrenIn general we do not process personal data relating to children (below16 years). Should thishappen, however, we will try to obtain consent from the parent or legal representative of thechild where necessary. If you are a parent or legal representative of a child whose personal data
we process, please contact us if you require assistance with explaining the content of this privacy
statement.
Changes to this privacy statement
We may update this privacy statement from time to time. The most recent version of this privacy
statement is always published on our website: www.mylaps.com. If material changes are made,we will inform you thereof using contact details available to us.

PART 2: PROCESSING ACTIVITIES AS DATA PROCESSOR, ON BEHALF OF OUR
BUSINESS PARTNERS
Background
Under GDPR, it is the role of the data controller to inform you about the processing of yourpersonal data. In the cases described below, our business partners are the data controllers. Our
business partners are for example race track owners, event organizers, sports clubs and sports
federations. If you wish to use your data subject rights (for example deletion or access to yourdata), you should contact our business partner, in most cases the event organizer or the trackowner, because they are data controller and should be able to help you. Only in case this isunsuccessful, you can contact us directly via privacy@mylaps.com.
Although our business partners are data controller, we want to provide clarity to you aboutprocessing activities that we carry out on behalf of our business partners.
Our role
In general, our role is limited to the supply of hardware for time keeping to our business partners.
5For example a so-called BibTag (a small tag that allows the business partner to perform time
keeping at a mass event), or transponders (for tracks) which measures the time or lap times
through a connection with measure stations of the business partner. Our business partner's
measure stations connect the time or lap times to user accounts of users, participants or racers.
In most cases, this happens in IT systems of the business partner so the business partner is thetimekeeper who decides the purpose and the means of the processing of the lap time data, andtherefore qualifies as the data controller with its own obligations to comply with data protection
laws such as GDPR.
In most cases, we do not even qualify as data processor or data controller because we cannot
access your personal data and do not process your personal data collected via BibTags ortransponders.
Mylaps as data processor on behalf of the business partner
However, there are situations where we may qualify as data processor on behalf of the business
partner when we perform a service for the business partner (such as event organizers or trackowners). Although we have built services and systems with which event results, training results
or race times or split times can be stored and published, we technically only receive this datafrom the business partner (event organization or circuit owner) and process it on behalf of thebusiness partner.
For example, if you bought a transponder, this transponder sends the data to our business
partner's measure stations. The business partner (event organization or circuit owner) may
process the data itself and publish the data itself.
However, the business partner may also send the data to us, with the request to process the data
on behalf of the event organizer or circuit owner. Under GDPR, the latter is called 'data
processing' so we are data processor for this part. We do not process this data for ourselves, but
on behalf of the event organizer or circuit owner who has purchased the 'measure stations' fromus. Without the event organizer or circuit owner we would not technically be able to obtain datafrom the transponder and we do not obtain the data via a direct relationship with you.
Overview
Which personal data we process about you as data processor on behalf of our business partners
depends on which business partner and which service they use. The below overview sets out,
per category of data subject and per type of business partner, which personal data we process
on behalf of our business partners, for which purpose and on the basis of which legal ground.
Why publish results or times?
Business partners want to publish results, times and lap times with the usernames because many
participants, users and racers want to be able see their results, times or lap times with theirusername online or in an app. The business partner can publish this information derived fromthe business partner's measure stations and time tracking systems in their own environment,

6online or in their own app.
However, if the business partner does not have their own online environment or app available,
they can instruct us to connect to one of our services to publish for example results, times andlap times with usernames, on behalf of the business partner. In this case, we host and processthese personal data on behalf of the business partner as a data processor. Participants, users andracers can create an account and login with their account to view their times, lap times and othertraining results, which the business partner uploads.

OVERVIEW
2.

Processing as data processor on behalf of our business partners

Category ofType of businessdata

partnersubjects(= data

Personal data

Processing purpose andRetention period

legal groundcontroller)
Users of theTrackowners,Name,address,

Purpose: business partners

Data

Speedhive

event

organizers,

service.

sports/racing clubs,
racing series,

email

address,and users wish to track andbehalf of the user or onphone

number,publish results, event times

behalf of the businessdate, track name,

and

this

partner

sport federations

place

and

lap

platformapp,

because mosttimes,

type

lap

times.

On(iPhoneisstoredonindefinitely
users

of

Android app and website) you

and business partners

sports, account ID,

can find (live) results ofprefer this to be able totransponderID,

events and practice events.

retrieve

gender,training

You can set your practicetimes. If you wish to

results,

historicalevent

results as 'private' in youruse your data subject

results, live event

account on the website or inrights and change thisresults, photo or

the app. The apps only show

for

video

personal practice results.

shouldorder history, in-Legal ground: on behalf of thebusiness partner of theappbusiness partner: article 6.1

track or of your event

and(b) GDPR: necessary for the

because they are data

followed), in-app

performance of a contract tocontroller. In case thislinked videos.

which the data subject is a

is unsuccessful, youparty.

can contact us directly(optional),
connections(followers

yourself,youcontactthevia
privacy@mylaps.com.
Users of theMainly ice-skating

Name, gender, e-Purpose: business partners

Data

ProChip

rinks,

mail

address,and users wish to measure andbehalftimingother tracks.

phone number. In

publish times and lap times.

organizer indefinitely

the practice data

The user connects its ProChip

becausebase: split times,

with the business partner's

participants and event

account

ID,

ProChip timing system. The

organizers prefer thistransponder ID. In

business partner connects theto be able to retrievesystem

BMX

or

7

is

stored
of

on

event
most

the

data

times and lap times to user

historical times. If you

base: event results,

results

accounts that, in most cases,

wish to use your datasometimes

the

has

subjectrightsandcategory and sport

created in its own systems. Ifchange

this

for

type.

the business partner does not

yourself, you shouldhave its own systems, we may

contact the organizer

processof your event becausebybusiness

partner

personal

data

collected via the ProChip

they

are

data

timing system on behalf of thecontroller. In case thisbusiness partner.

is unsuccessful, you

Legal ground: on behalf of thecan contact us directly

business partner: article 6.1via(b) GDPR: necessary for theprivacy@mylaps.com.

performance of a contract towhich the data subject is aparty.
Participants

Running,Name, place ofPurpose: business partners

Dataof events that

triathlon and otherresidence,

result,andbehalfuse

active events in thepositionatcreate and publish event

organizer indefinitely

MylapsNetherlands,

andevent, finish time,

result for

because mostEvent

incidentally

in

split

times,

business partner's events. You

participants and event

Timingother countries anddistance, photo or

can choose to create anorganizers prefer thisservice.

IronMan Events invideo, member ofaccount to keep your data in

to be able to retrieve

Europe.

a team and specific

one account.

historical times. If you

categories such as

Legal ground: on behalf of thewish to use your data

professionalorbusiness partner: article 6.1

subjectrightsandamateurin(b) GDPR: necessary for thechangethisforsome cases gender

performance of a contract toyourself, you should

and age for results

which the data subject is acontact the organizer

per category.

party.

of your event because

thebiking,theandparticipants

wish

to

participants ofisstored
of

they

on

event

are

data

controller. In case thisis unsuccessful, you
can contact us directly
via
privacy@mylaps.com.
Participants

Running,biking,

Name,

age,

Purpose: business partners

Dataof events that

triathlon and othergender,finishandbehalfuse

active event, andtime, split times,

create and publish event

organizer indefinitely

Sporthive

partners using theposition,result for

becauseEvent

Mylaspcategory, photo or

business partner's events. You

participants and event

Results

Timing Service.

video.

can choose to create anorganizers prefer thisaccount to keep your data in

to be able to retrieve

one account. You can view,historical times. If you

buy and share personal photos

wish to use your data

the

Event

pace

service.

8participants

wish

to

participants ofisstored
of

on

event
most

and

subjectrightsandparticipation of the event.

videosof

yourchangethisforLegal ground: on behalf of the

yourself, you should

business partner: article 6.1

contact the organizer(b) GDPR: necessary for theof your event because

performance of a contract totheywhich the data subject is acontroller. In case thisparty.

is unsuccessful, you

are

data

can contact us directly
via
privacy@mylaps.com.
Participants

Event organizers.

Name, address, e-Purpose: Business partners

Dataof events thatmail

address,andbehalfuse

phone

number,register for events duringorganizer indefinitely

birth,

which you create an account.

becauseService provider Njuko SAS

participants and event

in

the

registration

date

service.

gender,ofemergency

participants

wish

to

is

stored
of

on

event
most

Francehandlestheorganizers prefer thisregistration

process.

Your

to be able to retrieve

Optional: expectedaccount allows you to change

historical times. If you

end time, payment

or edit your registration, forwish to use your data

information.

contact,

event.

exampletransferyoursubjectrightsandnon-EuropeanForregistration,

switchtochangethisforevents only, anddifferent distance or change

yourself, you should

only

privacy settings.

contact the organizer

Legal ground: on behalf of theof your event because

business partner: article 6.1they(b) GDPR: necessary for thecontroller. In case thisperformance of a contract tois unsuccessful, youwhich the data subject is acan contact us directly

party.

via

whererequired:ID

numbers.

a

are

data

privacy@mylaps.com.
Participants

Mainlyof events that(running) events.

use

the

small

Name, address, e-Purpose: business partners

Data

mail

address,andbehalfnumber,phone

participants

wish

to

is

stored
of

on

event

create and publish event

organizer indefinitely

birth,

result for

because mostevent,

business partner's events.

participants and event

date, Bib number,

Legal ground: on behalf of theorganizers prefer thisevent

result,business partner: article 6.1

to be able to retrieve

distance,time,(b) GDPR: necessary for thehistorical times. If you

category, optional:

performance of a contract towish to use your data

payment

which the data subject is asubjectrightsandinformation.

party.

changethisforEventKit

date

service.

gender,ofparticipants ofyourself, you should
contact the organizerof your event because
9

they

are

data

controller. In case thisis unsuccessful, you
can contact us directly
via
privacy@mylaps.com.
Users

who

Track

owners,Name,address,

Purpose: participants wish toDatacreatean

event

organizers,email

address,store

behalfsports clubs,

phone

number,related data in one central

organizer indefinitely

sport

track name, placeaccount. You can subscribe to

because mostand lap times, typethis account. You control

participants and eventof sports, accountwhat others can see in theorganizers prefer thisID,

transponder

privacy settings Your accountto be able to retrieveID,

gender,allows you to change privacy

historical times. If you

training

results,

settings

wish to use your dataaccount.

federations,running events.

their

sportsortiming

edit
for

your

is

stored
of

on

event

event results, live

registrations,examplesubjectrightsandevent

results,transfer your registration orchange

this

for

photo

(optional),

switch to a different distance.

yourself, you shouldorderhistory,

Legal ground: on behalf of thecontact the organizer

payment

business partner: article 6.1of your event because

information.

(b) GDPR: necessary for thetheyperformance of a contract tocontroller. In case thiswhich the data subject is a

is unsuccessful, youparty.

can contact us directly

are

data

via
privacy@mylaps.com.
Participants

Eventorganizers,

Name,

email

Purpose: business partners

Dataof events thattime keepers.

address,

phone

and

behalfuse the Event

number,Bib

App.

number,event

participants

wish

to

is

stored
of

on

event

create and publish event

organizer indefinitely

result for

becauseparticipants of

mostresults, times, split

business partner's events. You

participants and event

times,

location,can choose to create anorganizers prefer thisroute information,account to keep your data in

to be able to retrieve

GPS coordinates,

one account. For example:

historical times. If you

photo or video.

when you connect a Bib tag towish to use your data

your app, this information is

subjectrightsandstored in your account tochangethisforallow you to customize the

yourself, you should

experience. Service provider

contact the organizer

SportUnity in the Netherlandsof your event because

handles

they

10

the

EventApp

are

data

process.

controller. In case thisLegal ground: on behalf of theis unsuccessful, youbusiness partner: article 6.1

can contact us directly(b) GDPR: necessary for theviaperformance of a contract toprivacy@mylaps.com.

which the data subject is aparty.
Participants

Eventorganizers,of events thattimekeepers.

Name, number

Purpose: business partners

The business partner

and time on awish to offer a service todecidesuse

certain location infamilyretention period.

Hardloopconnection toparticipants in which they can

If you wish to use yourSupporter

where the video

share a supporting video withdata subject rights andservice.

screen is placed.

servicechangeandfriends

providerof

Triple

on

the

this

for

Double in the Netherlands toyourself, you should

support the participant via acontact the organizer

video that will be shown on aof your event because

video screen on the course.

they

We inform service provider

controller. In case thisTripletheis unsuccessful, youparticipant is near the video

can contact us directly

screen so Triple Double canviastart the supporting video.

privacy@mylaps.com.

Double

when

are

data

Legal ground: on behalf of thebusiness partner: article 6.1(b) GDPR: necessary for the
performance of a contract towhich the data subject is aparty.
Participants

Event

Event name, Bib

Purpose: business partners

Miro deletes uploadedof events thattimekeepers.

number, photo,wish to offer a service tophotosfacial recognition

participants

participants

RunnerTagbiometric templateparticipants can download a

immediately after thephotoderived fromphoto of themselves at thematching process.

service.

event photos

finish line or during the event.

(without names).

In order to be able to match a

Miro deletes templates

specificwithof specific participants

theimmediately after the

use

the

organizers,

with

which

participant
photos,specific

After the specificmanyparticipantbusiness partner, or we, userequested its

service provider Miro Gum

photo, only if

Agency in USA. We process

Mirodesired by theevent photos with faces anddownloaded photos ofuser: email

Bib numbers (on the photo)specific

address, twitterbut without names.

immediately after theaccount, facebook

We share these event photos

download.

account

with service provider Miro.

11

event

of

matching process.
deletesparticipants

During Miro's identification

Miroprocess, Miro uses theserecognition biometric

event

Bib

template derived fromnumbers but without names toevent photos (without

photoswithdeletesfacialretrieve specific participantnames) two years after

photosthe event.

upon

request:if

participants wish to downloada photo ofthemselves, theIf you wish to use yourparticipant connects with thedata subject rights andservice of Miro. Miro asks thechangeparticipant for its Bib number

yourself, you should

to retrieve the photo of thecontact the organizer

participant.

of your event because
they

are

for

data

If the Bib matching is notcontroller. In case thissuccessful, Miro has createdis unsuccessful, you

templates of all faces in thecan contact us directly

event photos (without names)

viaand Miro asks the specificprivacy@mylaps.com.

participant to upload a photoof themselves. Miro uses theuploaded photo to create a
templateofparticipants'

thespecific

face

and

matches this one templatewith the many templates ofthe other faces in the event
photos.
If there is a match between
the templates, Miro offers thephoto of the participant who
requested

its

photo

for

download

in

the

Miro

environment.
Legal ground: on behalf of thebusiness partner: article 6.1(b) GDPR: necessary for the
performance of a contract towhich the data subject is aparty.

12this