Source: https://blackhorse-one.com/privacy/
Timestamp: 2019-04-21 00:13:32+00:00

Document:
All information relating to an identified or identifiable person (Art. 4 No. 1 GDPR). Information of an identified person can be e.g. the name or email address. However, personal data is also data in which the identity is not immediately apparent, but can be determined by combining one’s own or third-party information. All information that in some way allows inference to a person is relevant.
Any transaction in connection with personal data (Art. 4 No. 2 GDPR). This applies in particular to the collection, the organization, the ordering, the storage, the adaptation or modification, the reading, the inquiry, the use, the disclosure, transmission, dissemination or another form the provision, matching or linking, restriction, deletion or destruction of personal data.
Apple Inc., One Apple Park Way, Cupertino, California 95014, USA.
Twitter Inc., 1355 Market Street, Suite 900, San Francisco, California 94103 USA.
You can visit our websites without telling us who you are. By visiting our website your browser automatically transmits various data, see below “4. Data processing for the provision of websites / hosting providers”. This information is evaluated for purely statistical purposes and deleted after use.
Our services are reserved for visitors 16 years and older.
We only process personal data of our users as far as necessary to provide a functioning website, content and services (App in particular). The processing of personal data of our users takes place regularly with the consent of the user. only An exception applies in cases where prior consent can not be obtained for reasons of fact and the processing of the data is permitted by law.
Contract processors who process personal data for us, are contractly bound to us, in accordance with Art. 28 GDPR. The processors have been carefully selected, specifically mandated and bound by our instructions. States outside the European Union / the European Economic Area designates the GDPR as a third country and regulates the transfer separately according to Art. 44 to 49 GDPR. We partly use processors in third countries, they are named below. For the US, the EU Commission has determined the appropriateness of the local data protection level. Art. 44 (3) GDPR for the EU-US Privacy Shield (C (2016) 4176 final). Our US processors are certified thereafter.
We maintain current technical measures to ensure the protection of personal data. These are adapted to the current state of the art.
As far as we obtain the consent of the data subject for processing of personal data, Art. 6 (1) lit. a GDPR serves as the legal basis for the processing of personal data.
When processing personal data necessary for the performance of a contract to which the data subject is a party, Art. 6 (1) lit. b GDPR serves as legal basis. This also applies to processing operations that are necessary to carry out pre-contractual measures.
As far as processing of personal data is required to fulfill a legal obligation that is subject to our company, Art. 6 (1) lit. c GDPR serves as legal basis.
If processing is necessary to protect the legitimate interests of our company or a third party, and if the interest, fundamental rights and fundamental freedoms of the data subject do not prevail over the first interest, Art. 6 (1) lit. f GDPR serves as legal basis for processing.
Data may be stored if provided by the European or national legislator in EU regulations, laws or other regulations to which the controller is subject.
Blocking or deletion of the data also takes place when a storage period prescribed by the mentioned standards expires, unless there is a need for further storage of the data for a conclusion of the contract or a contract fulfillment.
To protect your personal information from unauthorized access, all communication of the app with the server takes place via an SSL-encrypted connection. SSL stands for Secure Sockets Layer. Data is stored according to industry standards in the SAP Cloud Platform or Amazon Web Services.
You have the right to ask for confirmation as to whether personal data related to you will be processed. If this is the case, under the conditions set out in Art. 15 GDPR you have the right to information about these personal data and to the information listed in detail in Art. 15 GDPR.
You have a right of rectification and / or completion to the responsible person if the personal data you process is incorrect or incomplete. The responsible person must make the correction without delay.
According to legal requirements in Germany, the storage takes place in particular for 6 years pursuant to § 257 Abs. 1 HGB (trading books, inventories, opening balance sheets, annual financial statements, trade letters, accounting documents, etc.) and for 10 years pursuant to § 147 Abs. 1 AO ( Books, records, management reports, accounting records, trade and business letters, tax documents, etc.).
If you plead your right of rectification, erasure or restriction of the processing against the controller, he / she is obliged to notify all recipients of the personal data concerning you of this correction or deletion of the data or limitation of processing, unless this proves impossible or involves disproportionate effort. You have a right to the person responsible to be informed about these recipients.
You have the right to demand the publication of the data concerning you in a structured, common and machine-readable format under the conditions listed in Art. 20 GDPR.
You have the right, for reasons arising from your particular situation, at any time against the processing of your personal data, which, pursuant to Art. 6 (1) lit. e or f GDPR takes an objection; this also applies to profiling based on these provisions. The controller will no longer process the personal data concerning you unless he can demonstrate compelling legitimate grounds for processing that outweigh your interests, rights and freedoms, or the processing is for the purpose of asserting, exercising or defending legal claims , In these cases, please contact the person responsible according to (1).
You have the right to revoke your data protection declaration of consent at any time with effect for the future (Article 7 (3) GDPR). The revocation of the consent shall not affect the legality of the processing carried out on the basis of the consent until the revocation.
Decisions that have a legal consequence or that significantly affect you must not be based exclusively on the automated processing of personal data – including profiling – (Article 22 GDPR). We do not use automated decision-making, including profiling, in relation to your personal information.
If you believe that the processing of personal data concerning you is contrary to the GDPR, you have the right to appeal to a supervisory authority in accordance with Art. 77 and 78 GDPR. You can assert this right with a supervisory authority in the EU Member State of your residence, place of work or place of alleged infringement.
We use Amazon Web Services (“AWS”) and SAP Cloud Platform to host the sites and the data necessary for the functionality of the apps. The data is physically stored in Germany and not transferred to third countries.
SAP Cloud Platform: The collected data is stored on the SAP Cloud Platform (SCP) systems, in the Europe / Red availability zone. SAP guarantees not to transfer the data outside of the availability zone. The rights to the data held belong to the contractor and not to SAP. Data storage of all personal data within the European Union is handled by SAP SE through the EU-U.S. Privacy Shield as well as contracts guaranteed under EU standard contractual clauses.
AWS: The collected data will be stored on the systems of Amazon Web Services (AWS), in the availability zone “Frankfurt / Germany”. AWS guarantees not to transfer the data outside of the availability zone (http://aws.amazon.com/agreement/ §3.2). The rights to the data held belong to the contractor and not to Amazon, see § 8.1 http://aws.amazon.com/en/agreement/. Data retention of all personal data within the European Union is provided by Amazon Web Services LLC through the EU-USS. Privacy Shield as well as contracts guaranteed under EU standard contractual clauses.
The data is stored in log files. A storage of this data together with other personal data of the user does not take place. However, in the case of an error in an interface query, we additionally log the ID (pseudonymous identification), the IP address and the HTTP request in question to allow for later error analysis and correction.
The legal basis for data collection is our legitimate interest in the efficient and secure provision of websites and apps in accordance with Art. Art. 6 para. 1 lit. f GDPR i.V.m. Art. 28 GDPR (conclusion of contract processing contract).
The hosting services we use are designed to provide infrastructure and platform services, computing capacity, disk space and database services, security and technical maintenance services we need to operate websites and apps.
The temporary storage of the IP address by the system is necessary to allow delivery of the websites to the computer of the user. To do this, the user’s IP address must be kept for the duration of the session. Storage in log files is done to ensure the functionality of the websites. In addition, the data is used to optimize the websites and to ensure the security of our information technology systems. An evaluation of the data for marketing purposes does not take place in this context. For these purposes, our legitimate interest in the processing of data according to Art. 6 (1) lit. f GDPR.
The data will be deleted as soon as it is no longer necessary for the purpose of its collection. Regarding the collection of the data for the provision of the websites, the data will be deleted when the respective session is ended. In the case of storing the data in log files, data will be deleted after no more than seven days. An additional storage is possible. In this case, the IP addresses of the users are deleted or alienated, so that an assignment of the calling client is no longer possible.
The collection and storage of the data in log files is essential for the operation of the websites. There is consequently no contradiction on the part of the user.
The user data collected through technically necessary cookies will not be used to create user profiles. For these purposes, our legitimate interest lies in the processing of personal data in accordance with Art. 6 (1) lit. f GDPR.
Downloading the app from the Apple App Store transmits the required information to Apple. These are in particular your username, Apple ID, e-mail address, time of download and the individual device code. We have no control over this data collection when downloading the app. We do not receive any personal information from you in this context.
Downloading the app from Google Play transmits the required information to Google. These are in particular your username, e-mail address, time of download and the individual device code. We have no control over this data collection when downloading the app. We do not receive any personal information from you in this context.
The legal basis for the processing of personal data is Art. 6 Abs. 1 lit. b GDPR.
The processing is done by Apple or Google to conclude the license agreement via the App.
The data collected by Apple is stored in accordance with commercial and tax regulations solely by Apple.
The data collected by Google is stored by Google only in accordance with the law and tax regulations.
After downloading an app in order to use the app a registration of a user account is required first.
The apps offer registered users the opportunity to submit marks as a dressage judge as a spectator at dressage events. When the user submits a mark, the following data is stored in a database: (1) user ID (2) time of the score and submission (3) score and rated combination (4) selected rating mode. The results are not included in the official final result, but are published as a summarized view of the audience in the apps, possibly on video walls and TV / stream broadcasts, on the event website and on our websites anonymized and averaged as a rule. No individual viewer results will be published.
Legal basis for the collection and use od the data is Art. 6 Abs. 1 lit. A und lit. b GDPR.
The user gives his consent. The processing is done to provide and deliver the functionality of the apps.
The data will be deleted from your device as soon as you uninstall the respective app.
The personal data on our servers will be deleted as soon as they are no longer necessary for the purpose of their collection. This is the case during the registration process for the performance of a contract or for the performance of pre-contractual measures if the data are no longer necessary for the performance of the contract. Even after the conclusion of the contract, there may be a need to store personal data of the contracting party in order to comply with contractual or legal obligations.
As a user you have the possibility to dissolve the registration by e-mail to the person in charge at any time. You can change the data stored about you at any time. For further information see below entitled “Rights of the data subject.” If the data is required to fulfill a contract or to carry out pre-contractual measures, premature deletion of the data is only possible, unless contractual or legal obligations preclude deletion.
In the apps, you can sign up to create a customer account or to register using the social plugin “Facebook Login”, which is operated by Facebook, as part of the so-called single sign-on technology, if you have a Facebook profile feature.
Only if you have given your explicit consent in the registration process pursuant to Art. 6 (1) lit. a GDPR grant, we receive when using “Facebook Login”, depending on your personal privacy settings on Facebook, the information stored in their profile general and publicly available information. This information includes the user ID, name, profile photo, age and gender, if applicable.
Legal basis for the use of Facebook login is Art. 6 Abs. 1 lit. a und lit. b GDPR.
The data will be deleted as soon as it is no longer necessary for the purpose of its collection. This is the case during the registration process for the performance of a contract or for the performance of pre-contractual measures if the data are no longer necessary for the performance of the contract. Even after the conclusion of the contract, there may be a need to store personal data of the contracting party in order to comply with contractual or legal obligations.
The given consent can be withdrawn at any time by a message to the responsible person.
In the apps, you can sign up to create a customer account or to register using the social plugin “Twitter Login”, which is operated by Twitter, as part of the so-called single sign-on technology, if you have a Twitter profile feature.
Only if you have given your explicit consent in the registration process pursuant to Art. 6 (1) lit. a GDPR grant, we receive when using “Twitter Login”, depending on your personal privacy settings on Twitter, the information stored in their profile general and publicly available information. This information includes the user ID, name, profile photo, age and gender, if applicable.
Legal basis for the use of Twitter login is Art. 6 Abs. 1 lit. a und lit. b GDPR.
In the apps, you can sign up to create a customer account or to register using the social plugin “Google Login”, which is operated by Google, as part of the so-called single sign-on technology, if you have a Google profile feature.
Only if you have given your explicit consent in the registration process pursuant to Art. 6 (1) lit. a GDPR grant, we receive when using “Google Login”, depending on your personal privacy settings on Google, the information stored in their profile general and publicly available information. This information includes the user ID, name, profile photo, age and gender, if applicable.
Legal basis for the use of Google login is Art. 6 Abs. 1 lit. a und lit. b GDPR.
If you are asked in our apps to provide additional data (name, address) for sending postal prices, you will be notified of this rule.
Legal basis for sending mail as a result of the sale of goods or services is Art. 6 Abs. 1 lit. A and lit. b GDPR.
The collection of the postal address serves to send prizes for an outstanding participation in an event. Prizes usually include autograph cards, signed fine art prints, event tickets or event mascots.
The data will be deleted as soon as it is no longer necessary for the purpose of its collection. The postal address of the user is stored accordingly until there is no registration (see below).
You can oppose the receipt of mail in the future according to Art. 21 Abs. 2, 3 GDPR.
Contact is possible via the provided e-mail address. In this case, the user’s personal data transmitted by e-mail will be stored.
The legal basis for the processing of the data is in the presence of a consent of the user Art. 6 Abs. 1 lit. a GDPR.
The user gives his consent. The processing of the personal data from the input mask serves us to process the contact.
The data will be deleted as soon as it is no longer necessary for the purpose of its collection. For the personal data from the input form of the contact form and those sent by e-mail, the data will be deleted when the respective conversation with the user has ended. The conversation ends when it can be safely deduced from the circumstances that the relevant facts have been finally clarified.
The user has the possibility at any time to revoke his consent to the processing of the personal data. If the user contacts us by e-mail, he may object to the storage of his personal data at any time. In such a case, the conversation can not continue. For more information see below “Rights of the data subject”.
The apps use “Crashlytics”, powered by Google. If an app crashes during use or if unexpected errors occur, specific information is sent to Crashlytics such as the device type, operating system version, the date and time of the error, the country from which the query takes place and the operating system language that has been set. Crashlytics will only be used by us without your IP address being recorded. For more information on Crashlytics privacy, please visit: https://fabric.io/terms.
Personal data may be transmitted to Google through the use of Crashlytics. Google acts as a service provider for us as part of a contract processing. Google also processes your data in the US and has submitted to the EU-US Privacy Shield. Further information on the EU-US Privacy Shield can be found at https://www.privacyshield.gov/EU-US Framework.
Processing is for the protection of the predominant legitimate interests of the person responsible, the purpose is mentioned below (Art. 6 Abs. 1 lit. f GDPR).
The processing takes place in order to detect and evaluate errors. The information gained is used to maintain and improve the apps.
The analysis data processed and stored with Crashlytics is automatically deleted after one year.
The apps use the “Answers.io” usage analysis service powered by Google. Answers.io can be used to collect and evaluate the interaction of app users with individual sub-pages or menu items. Answers.io records usage actions (such as clicking a menu item), device type, operating system version, app version, and event date, and sends it to Answers.io. Answers.io will only be used by us without your IP address. For more information on Answers.io privacy, please visit: https://fabric.io/terms.
Using Answers.io may transfer personal information to Google. Google acts as a service provider for us as part of order processing. Google also processes your data in the US and has submitted to the EU-US Privacy Shield. For more information on the EU-US Privacy Shield, visit https://www.privacyshield.gov/EU-US Framework.
Processing takes place in order to evaluate the use of the apps. The information gained thereby serves to improve and further develop the apps.
The analysis data processed and stored with Answers.io are automatically deleted after one year.
We use several features in our apps from Google Firebase (“Firebase”), a service provided by Google: (1) Firebase Authentication allows you to log in with Facebook, Google and email. (2) Firebase Cloud Messaging enables push notifications that inform you in particular about prices won or new events. The device ID of your device is used for this. (3) Firebase Analytics uses methods that allow you to analyze the use of the respective app, in particular what features of the app you access, how often you open the app or when the app is uninstalled. The data will only be collected anonymously and will not be linked to your other data stored on Google. The data collected on the use of our apps are transmitted to Google and stored there. If necessary, Google uses the advertising ID or Ad-ID of your device. Google will use the data collected to evaluate the use of our apps and to provide us with other services related to the use of the apps.
The legal basis for the processing of the data in the presence of a consent of the user is Art. 6 Abs. 1 lit. a GDPR.
The processing of the analysis data takes place in order to evaluate the use of the apps. The information gained thereby serves to improve and develop the apps.
The data will be deleted as soon as it is no longer necessary for the purpose of its collection. This is the case during the registration process for the performance of a contract or for the performance of pre-contractual measures if the data are no longer necessary for the performance of the contract. Even after the conclusion of the contract, there may be a need to store personal data of the contracting party in order to comply with contractual or legal obligations. The analysis data processed and stored with Firebase are automatically deleted after one year.
The given consent can be revoked at any time by a message to the responsible person.
The websites uses Google Analytics for the purpose of website analysis. Google Analytics uses methods that allow you to analyze the use of the websites, such as cookies. The automatically collected information about your use of these websites is usually transmitted to a Google server in the USA and stored there. By activating IP anonymisation on this website, the IP address will be shortened prior to transmission within the member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be sent to a Google server in the US and shortened there. The anonymized IP address provided by Google Analytics within the scope of Google Analytics will not be merged with other data provided by Google.
Legal basis fort he processing of the data is Art. 6 Abs. 1 lit. f GDPR.
The processing takes place in order to be able to record and evaluate the use of the websites. The information gained is used to maintain and improve the websites.
You can revoke your consent at any time with effect for the future by downloading and installing the browser plug-in available under the following link: http://tools.google.com/dlpage/gaoptout?hl=de. This prevents the collection of the data generated by the cookie and the data related to your use of the website (including your IP address) as well as the processing of this data by Google.

References: Art. 28
 Art. 44
 Art. 44
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 15
 Art. 15
 § 257
 § 147
 Art. 20
 Art. 6
 Art. 77
 §3
 § 8
 Art. 6
 Art. 28
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 21
 Art. 6
 Art. 6
 Art. 6