Privacy Policy

1. Data Controller

The controller responsible for processing personal data in connection with this website and the UP THE HILL event is:

albside e.V.
Eisentalstraße 11
72459 Albstadt
Germany

Represented by the board of directors, in particular its Chair, Sven Schairer.

Email: info@upthehill.run
Website: https://upthehill.run

2. General Information on Data Processing

We process personal data only to the extent necessary to provide our website, communicate with you, organise and run our events, or fulfil legal obligations.

Personal data means any information relating to an identified or identifiable natural person. This includes, for example, names, addresses, email addresses, dates of birth, race numbers, results data, IP addresses, photographs and video recordings.

Processing is based in particular on:

Article 6(1)(a) GDPR, where consent has been given;
Article 6(1)(b) GDPR, where processing is necessary to take steps prior to entering into a contract or to perform a participation contract;
Article 6(1)(c) GDPR, where we are subject to a legal obligation;
Article 6(1)(d) GDPR, where processing is necessary to protect vital interests;
Article 6(1)(f) GDPR, where processing is necessary for our legitimate interests or those of a third party, unless these are overridden by the interests or fundamental rights of the data subject.

3. Hosting and Website Provision

Our website is hosted by an external hosting provider. When you access the website, the hosting provider processes connection data that is technically necessary.

This may include, in particular:

the IP address of the device accessing the website;
the date and time of access;
the page or file accessed;
the previously visited page or referrer URL;
the amount of data transferred;
the browser used and its version;
the operating system;
the device type;
messages relating to successful or failed access attempts.

This data is processed in server log files. Processing is necessary to make the website technically available, ensure its stability and security, detect errors, and prevent attacks or abusive access.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure, reliable and uninterrupted operation of the website.

Where required, we have entered into a data processing agreement with the hosting provider.

Server log data is retained only for as long as necessary for the purposes stated above. It may be retained for longer if there are specific indications of unlawful use or if the data is needed to investigate a security incident.

4. Encrypted Connection

This website uses SSL or TLS encryption. This protects data transmitted between your browser and our server against access by third parties.

You can generally recognise an encrypted connection by the padlock symbol in your browser and a website address beginning with “https://”.

5. Cookies and Similar Technologies

Our website may use cookies and similar storage technologies. Cookies are small files that are stored on or read from your device.

Technically necessary cookies are used where required to provide the website, enable navigation and security features, or store your privacy choices.

For technically necessary functions, information is stored on or accessed from your device on the basis of Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG). Any subsequent processing of personal data is based on Article 6(1)(f) GDPR, where applicable.

Cookies and similar technologies that are not technically necessary are used only after you have given the relevant consent. The legal bases are Section 25(1) TDDDG and Article 6(1)(a) GDPR.

You can withdraw or adjust your consent at any time with effect for the future through the settings of the consent tool used on this website. This does not affect the lawfulness of processing carried out before you withdraw your consent.

You can also delete or block cookies through your browser settings. Disabling cookies entirely may restrict certain website functions.

6. Consent Management

Where this website uses a consent or cookie management system, it serves to obtain and document legally required consent and store your selected settings.

The following data may be processed in particular:

the time you make your selection;
your consent choices and refusals;
a technical identifier;
information about the browser used;
a shortened or complete IP address, where technically necessary.

The legal basis is Article 6(1)(c) GDPR in conjunction with the applicable data protection accountability requirements. Where storing your selection is technically necessary, this is also based on Section 25(2) TDDDG.

This information is retained for as long as necessary to demonstrate legally compliant consent management.

7. Contacting Us

If you contact us by email, through a contact form or by other means, we process the data you provide.

This may include, in particular:

your name;
your email address;
your telephone number;
the content and time of your message;
any other information you provide voluntarily.

We process this data to handle and respond to your enquiry.

If your enquiry relates to a registration, an existing entry or another contract, the legal basis is Article 6(1)(b) GDPR.

For general enquiries, processing is based on Article 6(1)(f) GDPR. Our legitimate interest is handling enquiries appropriately and communicating reliably.

Enquiries are deleted once they have been fully dealt with, provided there are no statutory retention obligations or legitimate reasons for retaining them further. Messages relevant to contracts or billing may be retained for longer in accordance with statutory retention periods.

8. Registration for UP THE HILL

Registration for our races takes place through an external registration and timing system, in particular RACE RESULT.

When you access the registration portal or a registration form embedded on our website, the privacy information of the respective service provider also applies.

The following data may be processed during registration in particular:

first and last name;
gender or classification category;
date of birth and age group;
address and place of residence;
nationality;
email address and telephone number;
club or team;
selected race;
additional services ordered;
competition licence or sports association details, where required;
payment and billing data;
registration and payment status;
consents and declarations;
emergency contact details, if requested;
any other data provided voluntarily.

We process this data to handle registrations, manage race entries, process payments, create start and participant lists, provide timing, run the event, calculate rankings and display results, and communicate important event information.

The legal basis is Article 6(1)(b) GDPR. Where data is processed or retained to meet legal obligations, the legal basis is Article 6(1)(c) GDPR.

We process optional additional information on the basis of consent under Article 6(1)(a) GDPR or, where applicable, a legitimate interest under Article 6(1)(f) GDPR.

You must provide the required mandatory information to register and participate. Without this information, it may not be possible to conclude a participation contract or classify your results correctly.

9. RACE RESULT, Timing and Results Services

We use RACE RESULT or systems provided by RACE RESULT for registration, participant management, race number allocation, timing and the display of results.

The data required to run the race and calculate its results is exchanged between us, the timing service provider and the technical systems used.

The following data may be processed during the event in particular:

name;
year of birth or age group;
gender or classification category;
club or team;
nationality;
race number;
race and distance;
start, split and finish times;
placing and classification;
status, such as started, finished, did not start or did not finish;
timing and transponder data.

Processing is necessary to fulfil the participation contract and run the sporting event. The legal basis is Article 6(1)(b) GDPR.

Where RACE RESULT processes data on our behalf, a data processing agreement is in place. Where RACE RESULT or other service providers process data for their own purposes, their privacy information also applies.

10. Payment Processing

Entry fees may be paid through the registration portal and the payment service providers integrated into it.

Depending on the payment method selected, the following data may be transmitted to the respective payment service provider in particular:

name;
billing address;
email address;
payment amount;
booking or transaction number;
selected payment method;
bank account, card or other payment details.

We generally receive only the payment information needed to allocate and confirm a payment. Complete card details or login credentials are usually processed directly by the payment service provider.

The legal basis for processing is Article 6(1)(b) GDPR. Where statutory retention obligations apply, further storage is based on Article 6(1)(c) GDPR.

The privacy information of the respective payment service provider also applies to its processing activities.

11. Registration, Start and Participant Lists

Registration, start or participant lists may be published to organise the event and ensure it is conducted transparently.

These lists may include the following information in particular:

first and last name;
club or team;
nationality;
age group or classification category;
selected distance;
race number;
registration status.

Where publication is necessary to run the race and inform participants, it is based on Article 6(1)(b) GDPR. In other cases, it is based on Article 6(1)(f) GDPR.

Our legitimate interests are transparent organisation, the identification of starters and the customary presentation of a sporting event.

Unnecessary contact details, addresses, complete dates of birth and payment information are not published in publicly accessible lists.

12. Results Lists, Rankings and Course Records

After the event, we publish results lists, rankings, course records and, where applicable, historical results archives.

These may include, in particular:

first and last name;
race number;
club or team;
nationality;
age group or classification category;
race and distance;
split and finish times;
placings;
result status;
event year.

Publication forms part of running the sporting event and reporting its results. The legal bases are Article 6(1)(b) and Article 6(1)(f) GDPR.

Our legitimate interests are providing a verifiable record of the sporting competition, presenting records and maintaining a historical overview of results.

Due to their historical and documentary nature, results lists and course records may generally be stored and published on a long-term or permanent basis. Legitimate objections and particular personal circumstances are assessed individually.

13. Reporting to Sports Associations and Ranking Systems

Where a race is recognised for external series, association classifications, qualifications or ranking systems, the necessary results and participant data may be transmitted to the relevant organisations.

This may include, for example, classifications associated with ITRA, the UTMB Index, cups or championships.

Only the information required for the respective classification is transmitted, in particular:

name;
year of birth or age group;
gender or classification category;
nationality;
race;
time;
placing.

Processing and transmission are based on Article 6(1)(b) GDPR where the classification forms part of the selected race.

In other cases, they are based on consent under Article 6(1)(a) GDPR or our legitimate interest in the sporting classification and recognition of the event under Article 6(1)(f) GDPR.

The privacy policy of the respective association or platform operator applies to any subsequent independent processing.

14. Participants Under the Age of 18

When a minor is registered, we also process the data of the person with parental responsibility or the person authorised to register them. This may include, in particular, their name, contact details and confirmation of the minor’s eligibility to participate.

Processing is carried out to verify and handle the registration and protect the minor, on the basis of Article 6(1)(b) GDPR and, where necessary, Article 6(1)(c) or (f) GDPR.

The person completing the registration is responsible for ensuring that they are authorised to transmit the minor’s data and make the required declarations.

15. Flex-Ticket and Voucher Codes

If a Flex-Ticket or a similar rebooking option is used, we process the necessary booking and contact data to verify eligibility, document non-participation or rebooking, and provide a voucher code for the next event.

The following data may be processed in particular:

name;
email address;
the distance originally booked;
the entry fee paid;
booking number;
Flex-Ticket status;
the voucher code issued.

The legal basis is Article 6(1)(b) GDPR. The data is retained for as long as necessary to complete the rebooking and fulfil statutory retention obligations.

16. Event-Related Communication

We use the contact details provided during registration to send you necessary information about the event you have entered.

This includes, for example:

registration and payment confirmations;
schedule changes;
race bib collection information;
safety and mandatory equipment information;
course changes;
cut-off times;
organisational information;
short-notice updates due to weather conditions or hazards;
information about results or post-event follow-up;
information about processing a Flex-Ticket.

This communication forms part of the performance of the contract. The legal basis is Article 6(1)(b) GDPR.

Receiving event-related information does not constitute general consent to receive advertising.

17. Newsletter

17.1 Subscription and Data Processed

You can subscribe to the UP THE HILL newsletter on our website. We use “The Newsletter Plugin”, installed within our WordPress website, to manage subscriptions and send newsletters.

When you subscribe to the newsletter, we process:

your first name;
your last name;
your email address;
the date and time of subscription;
the date and time of confirmation;
your consent and unsubscribe status;
where applicable, the IP address used when subscribing and confirming;
technical sending, delivery and error data.

Your first and last name are used in particular to address you personally in the newsletter.

Newsletter and subscription data is processed within our WordPress installation or its associated database. The plugin provides the technical functions for subscribing, confirming, managing subscriptions, unsubscribing and sending newsletters.

17.2 Double Opt-In Procedure

Subscriptions use a double opt-in procedure.

After you submit the subscription form, a confirmation email is sent to the address provided. Your subscription is activated only once you have clicked the confirmation link in that email.

This procedure helps ensure that the email address provided belongs to the person subscribing and enables us to demonstrate that consent has been given.

The legal basis for sending the newsletter is Article 6(1)(a) GDPR. Subscription and confirmation records are also kept on the basis of Article 6(1)(c) and (f) GDPR.

Our legitimate interest is demonstrating that valid consent has been given and preventing abusive subscriptions.

If you do not confirm your subscription within the specified period, the provisionally stored data is deleted unless legitimate security or evidentiary reasons require its retention.

17.3 Newsletter Content

The newsletter includes information in particular about:

UP THE HILL and events organised by albside e.V.;
registration opening dates and available race entries;
courses, schedules and organisational updates;
results, recaps, photographs and videos;
partners, sponsors and event-related offers;
other news about the association and its events.

Consent to receive the newsletter is voluntary and is not a condition of registering for or participating in an event.

17.4 No Individual Tracking

We do not analyse newsletter opens or link clicks on an individual basis.

Technically necessary data may be processed to send the newsletter, detect delivery errors and ensure that the newsletter functions correctly. This data is not used to create individual interest or usage profiles of subscribers.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is sending newsletters securely and reliably.

17.5 Delivery and Technical Service Providers

Our hosting provider, mail server operator or a separate email delivery service provider may be used for the technical delivery of emails.

The data necessary for sending emails is processed, in particular:

email address;
name, where used to address you personally;
sender and recipient details;
newsletter content;
technical sending, delivery and error data.

Where a service provider processes data exclusively on our behalf, it is bound by a contract in accordance with Article 28 GDPR.

17.6 Unsubscribing and Withdrawing Consent

You can withdraw your consent to receive the newsletter at any time with effect for the future. Every newsletter contains an unsubscribe link for this purpose.

Alternatively, you can withdraw your consent by emailing:

info@upthehill.run

After you unsubscribe, your email address is removed from the active newsletter mailing list or blocked from receiving further newsletters.

Withdrawal applies only to the newsletter. It does not affect your event registration or necessary event-related messages.

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

17.7 Retention Period

Newsletter data is generally retained for as long as your subscription remains active.

After you unsubscribe or withdraw your consent, your data is deleted from the active newsletter mailing list or blocked from use for further newsletters.

Data required to demonstrate the consent originally given may be retained until the applicable statutory limitation periods have expired. During this period, it is no longer used to send newsletters.

Technical sending and error data is deleted once it is no longer needed for proper delivery and the necessary records.

Statutory retention obligations and retention for the establishment, exercise or defence of legal claims remain unaffected.

18. Photographs and Video Recordings at the Event

Photographs and video recordings may be taken at UP THE HILL by us or by people acting on our behalf. These recordings are used to document and report on the event and for the public relations activities of the association and the event.

They may be published or shared in particular:

on upthehill.run and albside.de;
on social networks;
in press releases and media reports;
in event recaps;
in printed event and association publications;
with partners and sponsors in connection with reporting on the event.

For general views, recordings of event activities and recordings in which individuals are not the main focus, processing is based on Article 6(1)(f) GDPR.

Our legitimate interests are documentation, reporting and public relations for the association and the event.

For targeted individual photographs or recordings, interviews or particularly prominent depictions, we obtain consent under Article 6(1)(a) GDPR where required.

You can withdraw consent at any time with effect for the future. Where publication is based on legitimate interests, you can object on grounds relating to your particular situation.

Withdrawal or objection generally applies to future uses. Printed publications usually cannot be recalled. Complete removal of content that has been copied or redistributed by third parties cannot always be guaranteed either.

If you do not wish to be photographed or recorded for particular personal reasons, please contact the organising team or the person taking the photographs or recordings, preferably before the event or directly on site. We will take legitimate concerns into account to the extent organisationally and legally possible.

19. YouTube Videos

Videos from the YouTube platform may be embedded on our website.

The provider for users in the European Economic Area is generally:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

Where possible, we use privacy-enhanced mode through the domain youtube-nocookie.com.

Nevertheless, data may be transmitted to Google or YouTube when an embedded video is loaded or played. This may include, in particular, your IP address, browser and device information, referrer data and information about your use of the video.

If you are logged in to Google or YouTube at the same time, Google may be able to associate the visit with your user account.

Where a YouTube video is loaded only after consent has been given, processing is based on Article 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time with effect for the future through the website’s privacy settings.

When you use Google services, processing outside the European Union or the European Economic Area, particularly in the USA, cannot be ruled out. Google states that it uses the transfer mechanisms provided for by law for this purpose.

You can find further information in Google’s privacy policy:

https://policies.google.com/privacy

20. Google Services for Course and Aid Station Information

Certain course features, particularly interactive elevation profiles or aid station information, may retrieve data from published Google spreadsheets or similar Google services.

Retrieving this content may establish a connection to Google servers. The following data may be processed in particular:

IP address;
browser and device information;
the time of retrieval;
the page accessed;
referrer information.

The provider for users in the European Economic Area is generally:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

Where content is retrieved only after consent has been given, the legal bases are Article 6(1)(a) GDPR and Section 25(1) TDDDG.

Where data is retrieved without accessing your device and solely to provide a technically necessary course feature that you have explicitly requested, processing may be based on Article 6(1)(f) GDPR. Our legitimate interest is presenting current and reliable course-related information.

Processing in third countries, particularly in the USA, cannot be ruled out.

You can find further information in Google’s privacy policy:

https://policies.google.com/privacy

21. External Links and Social Networks

Our website contains links to external websites and social networks, in particular:

Facebook;
Instagram;
Strava;
YouTube;
partners and sponsors;
sports associations and ranking systems;
course and mapping platforms.

For standard links, a connection to the respective provider is generally established only when you click the link.

From that point onwards, the operator of the external website is responsible for the data processing that takes place there. We have no influence over external providers’ content, privacy measures or retention periods.

Please therefore refer to the privacy information of the service you access.

22. Association and Partner Communication

Where contact persons’ details are processed in connection with an enquiry, cooperation, partnership or sponsorship arrangement, this is done to initiate, carry out and maintain the respective collaboration.

The legal basis is Article 6(1)(b) GDPR where a contract with the data subject exists or is being initiated.

For contact persons at a company or organisation, processing is generally based on Article 6(1)(f) GDPR. Our legitimate interest is efficient business and organisational communication.

23. Recipients of Personal Data

We transmit personal data only where there is a legal basis for doing so or where transmission is necessary to fulfil our duties.

Recipients or categories of recipients may include, in particular:

hosting and IT service providers;
providers of registration and timing systems;
payment service providers;
people responsible for timing and event organisation;
volunteers, where access is necessary;
sports associations, series organisers and ranking organisations;
newsletter and communication service providers;
photography, video and media service providers;
tax advisers, accounting service providers and banks;
authorities and public bodies where required by law;
legal advisers and insurers where there is a legitimate reason.

Service providers generally receive only the data they need for their respective tasks.

Where they act as processors, they are bound by a contract in accordance with Article 28 GDPR.

24. Data Transfers to Third Countries

Some services we use or link to may process personal data outside the European Union and the European Economic Area.

Such transfers take place only where the legal requirements are met.

Possible bases include, in particular:

an adequacy decision by the European Commission;
valid certification under the EU-US Data Privacy Framework;
appropriate safeguards under Article 46 GDPR;
EU Standard Contractual Clauses;
explicit consent;
another exception provided for by law.

Where data is processed in countries without a level of data protection comparable to that of the European Union, there may be a risk, despite contractual and technical safeguards, that authorities can access the data and that data subjects’ rights can be enforced only to a limited extent.

25. Retention Periods

We retain personal data only for as long as necessary for the respective purpose or as required by statutory retention obligations.

The following criteria apply in particular:

server log data is deleted once the period required for technical and security purposes has expired;
contact enquiries are deleted once they have been dealt with, unless further retention is necessary;
contract, booking and payment data is retained in accordance with commercial and tax law obligations;
registration data is retained to run and administer the event and handle potential claims;
results lists, rankings and course records may be retained on a long-term basis for the purpose of documenting sporting history;
records of consent may be retained until the relevant limitation periods have expired;
photographs and video recordings are retained for as long as they are needed for documentation and public relations, or until there are legitimate grounds for deletion;
Flex-Ticket data is retained until processing has been completed and subsequently in accordance with legal obligations;
newsletter data is generally retained until you unsubscribe.

Where processing is based on consent, we delete the relevant data after consent is withdrawn, unless another legal basis or statutory retention obligation applies.

26. Obligation to Provide Data

There is generally no legal obligation to provide personal data when using the website.

However, to register and participate, you must provide the information necessary to conclude and perform the participation contract, organise the event safely, provide timing and process payments.

Without this data, we may not be able to offer registration or participation.

Subscribing to the newsletter is voluntary.

27. Automated Decisions and Profiling

We generally do not carry out decision-making based solely on automated processing, including profiling, within the meaning of Article 22 GDPR.

Automated technical processes, such as allocation to age groups, rankings or pricing tiers, serve to run the event and do not produce any further legal or similarly significant effects.

28. Your Rights as a Data Subject

Subject to the applicable legal requirements, data subjects have the following rights in particular:

Access under Article 15 GDPR: You can request information about the personal data we process about you.
Rectification under Article 16 GDPR: You can request the correction of inaccurate data and the completion of incomplete data.
Erasure under Article 17 GDPR: You can request the deletion of personal data where the legal requirements are met.
Restriction under Article 18 GDPR: You can request the restriction of processing where the legal requirements are met.
Data portability under Article 20 GDPR: You can receive certain data in a structured, commonly used and machine-readable format or request its transfer.
Objection under Article 21 GDPR: You can object to processing based on Article 6(1)(e) or (f) GDPR on grounds relating to your particular situation.
Withdrawal of consent: You can withdraw consent at any time with effect for the future.
Complaint under Article 77 GDPR: You can lodge a complaint with a data protection supervisory authority.

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

To exercise your rights, simply send a message to:

info@upthehill.run

To prevent unauthorised disclosure, we may request appropriate proof of identity.

The right to erasure is not absolute. Statutory retention obligations, overriding legitimate interests, the establishment or defence of legal claims, and statutory exceptions may prevent deletion.

29. Objecting to Processing Based on Legitimate Interests

Where personal data is processed on the basis of Article 6(1)(f) GDPR, Article 21 GDPR gives you the right to object to processing at any time on grounds relating to your particular situation.

We will then stop processing the relevant data unless we can demonstrate compelling legitimate grounds that override the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defence of legal claims.

If personal data is processed for direct marketing, you can object to that processing at any time without giving a reason.

You can send objections to:

info@upthehill.run

30. Right to Lodge a Complaint with a Supervisory Authority

Data subjects have the right to lodge a complaint with a data protection supervisory authority.

The authority generally responsible for Baden-Württemberg is:

The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg

You can find current contact details and further information at:

https://www.baden-wuerttemberg.datenschutz.de

You can also lodge a complaint with another competent data protection supervisory authority.

31. Data Security

We take appropriate technical and organisational measures to protect personal data against loss, alteration, unauthorised access and other misuse.

These security measures are reviewed and adapted in line with technological developments and the relevant risks.

However, completely risk-free data transmission over the internet cannot be guaranteed.

32. Changes to This Privacy Policy

We reserve the right to update this privacy policy if legal requirements, our website, the services we use or event procedures change.

The version published on this website at the relevant time applies.

Last updated: September 2026