Sportradar Single Sign-On (SSO) Privacy Notice

Published in May 10, 2023

1. Introduction

The Sportradar Group respects your privacy and is committed to protecting your personal data. This privacy notice (“Privacy Notice”) governs the Sportradar Group’s use of your personal data provided to us for the purpose of accessing our products and services.

The definition of personal data may vary from country to country. To ensure the protection of your personal data, we define it as any information that may directly or indirectly identify you.

2. Who we are and what we do

The Sportradar Group is made up of different legal entities. This Privacy Notice is issued on behalf of Sportradar AG (Feldlistrasse 2, CH-9000 St. Gallen, Switzerland, VAT identification number CHE-113.910.142 MWST) but in it we include information about the personal data processing within the different group companies – Sportradar subsidiaries and affiliates. In this Privacy Notice “Sportradar”, “our”, “we” or “us” refer to Sportradar AG and our subsidiaries and affiliates. Sportradar is the controller of your personal data under this Privacy Notice.

3. What personal data you provide to us and why

You may provide to us the below personal data as an employee, contractor or similar of a business partner who is in contact with Sportradar on behalf of the business partner:

• first name
• last name
• internal ID assigned to the business partner
• essential cookies
• IP address
• User ID
• User Agent String
• Account Information (such as username, email address, password, last date of password change, account information update, inactivity and similar)
• Login Information (such as login, logout, last login date, failed attempts to login, MFA and similar).

We process your personal data in order to perform our obligations under our agreement with our business partners, including:

• for user authentication purposes in order to access our products;
• for debugging purposes;
• for improvement of our services;
• for logs auditing purposes; and
• for fraud detection and prevention.

4. Lawful basis for processing

Sportradar’s lawful basis for processing your personal data is (i) the fulfillment of the contractual relationship with our business partners and (ii) our legitimate interests – debugging, improvement of our services, logs auditing and fraud detection and prevention (system security).

5. How we process your personal data

Sportradar processes your personal data in accordance with the below data protection principles:

• Lawfulness
When processing your personal data, we ensure that the processing is carried out in accordance with the applicable laws.

• Transparency
When processing your personal data, we strive to provide you with as much information as possible about the collection and processing of your personal data.

• Purpose Limitation
Your personal data is being processed for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with the original purpose.

• Data minimization
We only collect and/or process personal data which is strictly necessary for our services which include processing of personal data.

• Accuracy
We keep your personal data as accurate as possible and you may rectify your personal data at any time.

• Storage Limitation
We do not retain your personal data for longer than it is necessary. See also Section 6 (How long we keep your personal data) below.

• Integrity and Confidentiality
We use appropriate security measures to ensure the protection of your personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage.

6. How long we keep your personal data

Sportradar maintains robust data retention policies for the personal data we process. In instances where Sportradar is a “data controller”, we delete all data after the purposes for which it has been collected are fulfilled (including for the purposes of satisfying any legal requirements).

In any event, the necessity to retain data is assessed by each business unit within Sportradar (in liaison with our dedicated Privacy Team) and takes into account the legal and business purposes relevant to the processing of that data and whether we can achieve those purposes through other means, the applicable legal requirements, the amount, nature, and sensitivity of the personal data, and the potential risk of harm from unauthorised use or accidental disclosure of your personal data.

7. How we may disclose your personal data

Sportradar may disclose some of your personal data as follows:

• within the family of companies controlled by Sportradar for internal reasons, primarily for business and operational purposes, as well as to their subcontractors or other trusted third parties
• if we go through a business transition, such as a merger, acquisition by another company, or sale of all or a portion of our assets, your personal data will likely be among the assets transferred
• when legally required to do so (e.g., to cooperate with law enforcement investigations or other legal proceedings).

We may disclose certain personal data to vendors, contractors, or others who assist Sportradar in delivering the services.

8. International data transfers

If your personal data is collected within the EEA or United Kingdom and Switzerland and transferred to countries outside the EEA or United Kingdom and Switzerland in which applicable laws do not offer the same level of data protection, we ensure similar protection and put in place, for example, one of these safeguards:

• we will transfer your personal data to countries that have been found by the EEA or the United Kingdom to provide an adequate level of protection for personal data
• we will also use standard contractual clauses approved by the EEA and/or United Kingdom, together with any supplementary measures required, with our partners and suppliers that are based in countries outside the EEA or United Kingdom and Switzerland and take measures to ensure that our partners and suppliers provide an adequate level of data protection. These standard contractual clauses grant your personal data protection which is equivalent to the protection it has in the EEA, United Kingdom and Switzerland (as appropriate).

Should you require further information regarding the relevant data transfer safeguards that we have implemented, then please reach out to us as provided under Section 14 (How to contact us).

9. What data protection rights you have

You have the following data protection rights:

• Right to access (know)
You have the right to obtain from us a confirmation as to whether we process your personal data. Should we process your personal data, you have the right to request access to your personal data and to obtain further information regarding the processing of your personal data.

• Right to rectification (correction)
You have the right to have your personal data rectified in the event that it is inaccurate. You can also rectify some of your personal data by reviewing and changing the personal data from your account settings.

• Right to erasure (deletion)
Under certain circumstances, you have the right to request that we delete your personal data.

• Right to restriction of processing
Under certain circumstances, you have the right to restrict the processing of your personal data.

• Right to object to processing (right to opt out)
Under certain circumstances, you have the right to object to the processing of your personal data. You can exercise your right, by completing this form.

• Right to data portability
You have the right to obtain your personal data in a structured, commonly used, and machine-readable format and to have your personal data transferred to another controller, where technically feasible and insofar as the processing of your personal data is based on your consent or is necessary for the performance of a contract between us.

• Right not to be subject to a decision based solely on automated processing, including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

• Right to complain to a supervisory authority
Should you believe that we have violated any applicable data protection laws when processing your personal data, you have the right to file a complaint with the responsible Data Protection Authority.

• Right to withdraw consent
You may withdraw your consent to the processing of your personal data insofar as the processing is based on your consent. This does not apply if the processing of your personal data is required for the performance of a contract between us or if the processing is based on our legitimate interests.

You, or your authorized agent, can exercise your rights by submitting this form.

We reserve the right to refuse to give effect to a request to exercise any of the above data protection rights if we are unable to ascertain your identity.

The details of the lead Data Protection Authority that Sportradar AG is registered with are as follows:

Austrian Data Protection Authority
Österreichische Datenschutzbehörde
Barichgasse 40-42,
1030 Vienna
Austria
Telephone: +43 1 52 152-0
E-Mail: [email protected]

10. Security of your personal data

Sportradar has implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk involved in order to protect your personal data against a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, your personal data transmitted, stored, or otherwise processed. Our employees are required to keep personal data confidential.

11. Non-discrimination

We will not discriminate against you for exercising any of your rights. We will not:

• deny you goods or services
• charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties
• provide you a different level or quality of goods or service
• suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services

12. “Do Not Track” disclosure

Some browsers transmit Do Not Track (DNT) signals to websites. Sportradar does not currently alter, change, or respond to DNT requests or signals from these browsers. We will continue to monitor industry activity in this area and reassess our DNT practices as necessary. In the meantime, you can use the range of other tools we provide to control data collection and use.

13. How this Privacy Notice may change

This Privacy Notice was published in May 10, 2023. Please note that this Privacy Notice may be updated from time to time. We will place a prominent notice that will be visible to you when you access our platform.

14. How to contact us

Should you have any questions regarding the processing of your personal data or should you wish to exercise your rights under this Privacy Notice, please submit your request via this form or contact our Data Protection Officer by using the contact details provided below:

Mr. Stefano Celardo
Sportradar Media Services GmbH
Rothschildplatz 4, 1020 Vienna
Austria
Email: [email protected]

[APPLICABLE ONLY IF YOU ARE A RESIDENT OF THE STATE OF CALIFORNIA (CALIFORNIA CONSUMER)]

In addition to the methods available above for exercising any of your rights, please note that you can submit a verifiable request also by calling us at 1 888 297 1323 (toll-free).