This notice explains how your personal data is processed in connection with the 30th IHF Men’s Handball World Championship (hereinafter “MHWC 2027”) and informs you of your rights under applicable data protection law. 

To use the Event Management System (hereinafter the “EMS”), you only need to provide the data required to decide whether to grant accreditation and to enable you to use it, or the data that the German Handball Federation (DHB) is legally required to collect. Without this data, the DHB will generally be unable to consider and assess your accreditation application. Accreditation is issued by the DHB. 

1. Data Protection Officer and Data Controller  

Deutscher Handballbund e.V. (German Handball Federation) 

Willi-Daume-Haus  

Strobelallee 56 

D-44139 Dortmund 

Tel.: +49 231 91191-0  

E-Mail: info@dhb.de 

Web: www.dhb.de 

Registered office: Dortmund | Register court: Dortmund Local Court, VR 1761 

VAT identification number: DE124911817 

Data Protection Officer: Herr Dirk-Michael Mülot, Sachverständigenbüro Mülot GmbH, datenschutz@dhb.de  

2. Sources of Data and Categories of Data  

The DHB processes data received from applicants and accredited persons during the accreditation process. 

2.1 Basic Personal Data: 

• First name(s) and surname(s) 
• Date of birth 
• Gender 
• Email address 
• Mobile phone number 
• Nationality 
• Language 
• Portrait photograph 
• Arrival at the tournament 
• Departure from the tournament 
• Accreditation collection location 

2. Additional Data for Media Representatives  

• Home address 
• Identity document 
• Upload of identity document 
• Identity document number 
• Identity document expiry date 
• Visa requirement 
• Name of media organisation 
• Type of media organisation 
• Media organisation’s email address 
• Media organisation’s telephone number 
• Media organisation’s address 
• Type of media 
• Upload of press card or editorial assignment letter 
• Emergency contact: name 
• Emergency contact: telephone number 

3. Purposes and Legal Bases of Data Processing  

We process your personal data in accordance with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), NED-Info and other applicable legal provisions. Your personal data is processed solely for the purposes set out in this notice. 

3.1. Accreditation Procedure Including Registration 

The DHB processes and uses data collected during the accreditation process solely to handle your accreditation properly, decide whether to grant access rights and determine their scope, and monitor compliance with the corresponding restrictions. Processing is based on the DHB’s legitimate interest in the proper delivery of the event, particularly in ensuring the safety of event visitors and protecting property brought onto the premises (Article 6(1)(f) GDPR). 

Applicants and accredited persons have the right to object at any time to the above processing of their personal data on grounds relating to their particular situation. If an applicant or accredited person objects, the DHB will no longer process the data unless it can demonstrate compelling legitimate grounds for the processing that override the interests, rights and freedoms of the person concerned, or unless the processing is necessary for the establishment, exercise or defence of legal claims. 

Where accreditation is completed directly by an individual who has a contractual relationship with the DHB that can only be fulfilled if accreditation has been granted, the legal basis for accreditation is the contract between the parties (Article 6(1)(b) GDPR). 

Applicants and accredited persons have the right to object at any time to the above processing of their personal data on grounds relating to their particular situation. If an applicant or accredited person objects, the DHB will no longer process the data unless it can demonstrate legitimate grounds for the processing that override the interests, rights and freedoms of the person concerned, or unless the processing is necessary for the establishment, exercise or defence of legal claims. 

3.2. Allocation of Hotel Rooms and Transport 

Personal data is processed to allocate hotel rooms within the capacity reserved through the DHB and to arrange the teams’ required arrival and departure times for matches and training sessions. This processing is based on our legitimate interest in the proper delivery of the event under Article 6(1)(f) GDPR. 

3.3. Contact and Provision of Information 

To respond to your enquiries, including enquiries submitted via a feedback form, email or telephone, we process the following data on the basis of our legitimate interest under Article 6(1)(f) GDPR and store it until the enquiry has been resolved: first name and surname, email address, telephone number (optional), data specific to the service concerned, additional information (optional), and your message to us. 

For media representatives only: Contact details are also processed under Article 6(1)(f) GDPR to send emails containing important event information, such as news, media communications and press releases. 

3.4. Other Legitimate Interests 

Where necessary, the DHB processes data beyond the specific purposes of the accreditation procedure to protect its own legitimate interests or those of third parties under Article 6(1)(f) GDPR. Examples include:  

• Taking and publicly distributing photographs and audiovisual recordings of the events showing applicants and accredited persons in that capacity, and using these photographs and recordings commercially and non-commercially without restrictions as to time or territory, in any tangible form (particularly production and distribution on all digital and analogue storage media) or intangible form (particularly broadcasting, public communication and making them available, for example as downloads or streams), in all media and on all platforms, by the DHB, third parties designated by the DHB, other federations participating in the event where applicable, and the DHB’s partners; 
• Establishing and exercising legal claims and defending against legal disputes; 
• Ensuring IT security and IT operations. 

3.5. Processing for Public Purposes 

Where necessary, the DHB processes data for public purposes and transfers it to the competent authorities if this is necessary  

1. to comply with legal obligations imposed on the DHB (Article 6(1)(c) GDPR); 
2. to perform a task carried out in the public interest or in the exercise of official authority vested in the DHB and/or the respective venue or venue lessor (Article 6(1)(e) GDPR); or 
3. to avert threats to state or public security (Section 24(1), point 1, BDSG).  

Applicants and accredited persons have the right to object at any time, on grounds relating to their particular situation, to the above processing of their personal data under Article 6(1)(e) GDPR. If an applicant or accredited person objects, the DHB will no longer process the data unless it can demonstrate compelling legitimate grounds for the processing that override the interests, rights and freedoms of the person concerned, or unless the processing is necessary for the establishment, exercise or defence of legal claims. Processing to avert threats to state or public security takes place in particular as part of security vetting. 

3.6. Data Transfers for Security Vetting 

To ensure that the event runs safely and without disruption, staff may be subject to security vetting as part of their accreditation application. This is intended to prevent them from posing a risk to the event as a whole. 

For this purpose, the first name(s), surname(s) and date of birth of these persons are transmitted to the security authorities responsible for the respective venue. In consultation with the security authorities, additional data may also be transmitted, such as place of birth, name(s) at birth, former name(s), nationality, registered address, type of identity document, identity document number, photograph and/or gender. The DHB transfers the data on the instructions of the competent security authorities under Article 6(1)(c) GDPR or Section 24(1), point 1, BDSG. The transmitted data is checked against police databases. These databases contain, in particular, criminal convictions, but also ongoing and discontinued investigations and criminal proceedings that did not result in a court conviction. Please note that the information in these databases may be more extensive than that held in the German Federal Central Criminal Register (Bundeszentralregister). 

The security authority transmits its recommendation to the DHB on the legal basis and subject to the conditions of the police law applicable to the respective venue. The DHB receives only a recommendation regarding the person’s deployment. It does not receive any findings from the databases or any reasons for the recommendation. 

Security concerns and a corresponding recommendation may result in accreditation being refused. If the DHB refuses accreditation on the basis of findings by the security authority, the person concerned may contact the competent security authority. That authority will examine the person’s objections and, where appropriate, correct the notification sent to the DHB. 

Accreditation that has been granted may be revoked at any time, particularly if concerns arise as a result of facts that become known or occur subsequently 

4. Recipients or Categories of Recipients of Personal Data  

To fulfil our contractual and legal obligations in connection with MHWC 2027, your data is processed in part by organising committee staff, external service providers and authorities involved in the DHB’s activities. We also reserve the right to disclose your data to law enforcement authorities in accordance with the laws and regulations of the host country or countries in order to carry out the necessary security checks. 

Processors engaged by the DHB (Article 28 GDPR), other service providers and data recipients may also receive data for the purposes stated above. These may include companies providing event organisation, event security, printing and mailing, and IT services. 

Data relating to applicants and accredited persons is disclosed to recipients outside the DHB only if this is permitted or required by statutory provisions or official security vetting procedures. 

The accreditation portal is operated by mtms Solution GmbH, Nordstrasse 4, 5301 Eugendorf, Austria. In this context, mtms Solution GmbH processes personal data solely as a processor on behalf of the DHB under Article 28 GDPR. 

Personal data is disclosed to recipients outside the DHB only if this is permitted or required by statutory provisions or official security vetting procedures. Subject to these conditions, recipients may include, for example, those listed below. 

Your data will not be disclosed to third parties without your express consent and will be treated as strictly confidential. If you have given us consent to process personal data for the specific purposes stated above, such processing is lawful on the basis of that consent. You may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. Under Article 21(4), in conjunction with Article 21(1) and (2) GDPR, you have the right to object at any time to the processing of the personal data concerned. 

5. Data Transfers to a Non-EU Country or an International Organisation  

No data is transferred to countries outside the European Union (EU) or to third countries in connection with MHWC 2027. 

6. Data Retention Period 

Wir speichern Ihre Daten während der Dauer des Verarbeitungszwecks. Nach Wegfall des Verarbeitungszwecks werden personenbezogene Daten gelöscht. Es gibt verschiedene gesetzliche Aufbewahrungsfristen von bis zu zehn Jahren, während derer die Daten nicht gelöscht, sondern gespeichert werden. Es ist zudem möglich, dass Daten zum Zwecke der Geltendmachung, Erfüllung oder Abwehr von Rechtsansprüchen gespeichert werden. Nach Ablauf der gesetzlichen Aufbewahrungsfristen werden die Daten vollständig gelöscht. 

7. Data Protection Rights of Data Subjects  

Every data subject has the right of access under Article 15 GDPR, the right to rectification under Article 16 GDPR, the right to erasure under Article 17 GDPR, the right to restriction of processing under Article 18 GDPR, and the right to data portability under Article 20 GDPR. Under Article 21(1) GDPR, data subjects also have the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them. 

To exercise your rights as a data subject, simply send an email to datenschutz@dhb.de. 

You may also contact a supervisory authority to exercise your right to lodge a complaint. Please send enquiries concerning the exercise of your rights as a data subject by post or email, stating your full name, to the following address: 

State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia 

Postfach 20 04 44 

40102 Düsseldorf 

Tel.: +49 211 38424-0 

Mail: poststelle@ldi.nrw.de 

8. Voluntary Provision of Personal Data and Information Requirements  

As part of our business relationship, you must provide the personal data required to establish and conduct that relationship and to fulfil the associated contractual obligations, or the data that we are legally required to collect. Without this data, we cannot conclude or perform a contract. Where providing information is voluntary, this is indicated in the relevant data entry form. You may withdraw your consent to the processing of personal data at any time by post or email, with effect for the future. 

To exercise your right to object, simply send an email to datenschutz@dhb.de. 

9. Automated Decision Making and Profiling 

In accordance with Article 22 GDPR, we do not generally use decision making based solely on automated processing when establishing or conducting the business relationship. 

10. Prevailing Language  

This Privacy Notice was originally drafted in German. In the event of any discrepancy, ambiguity or conflict between the German version and this English translation or any other translation, the German version shall always prevail and be authoritative for interpretation.