Privacy

1. Controller

2. Two roles — who is responsible for what

For Colourmatch's own pages (home page, product pages, waiting list, accounts in the Portal), Colourmatch is the controller within the meaning of Art. 4 (7) GDPR.

For the data of a specific competition — entries, routine music, start lists, results — the organising club or federation is the controller. Colourmatch processes this data on its behalf on the basis of an agreement under Art. 28 GDPR (data processing agreement). Anyone requesting access, rectification or erasure regarding an entry contacts the organiser; the contact details are on the respective event page. A request addressed to Colourmatch is forwarded to the organiser without delay.

3. Principle & data minimisation

We process personal data only to the extent necessary to operate these pages and to organise the competitions. This website uses no cookies, no tracking and no analytics or advertising services.

4. Accessing the website (server log files)

When the pages are accessed, our hosting provider processes technically necessary access data (including IP address, time, page accessed, browser type) to deliver and secure the website. The legal basis is our legitimate interest in secure, trouble-free operation (Art. 6 (1) (f) GDPR).

Hosting: Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. A data processing agreement is in place with Vercel; the transfer to the USA is safeguarded by the EU standard contractual clauses.

Protecting the forms against misuse: So that programs cannot flood the entry form, the additional forms and the waiting list with mass entries, we count how many entries arrive from one internet connection per hour and per day. For this we do not store the IP address, only a hash value derived from it together with the number of entries, kept separately from the details entered. It is deleted after three days at the latest. The legal basis is our legitimate interest in preventing misuse (Art. 6 (1) (f) GDPR).

5. Entering a competition

Via the entry form we collect the information required for the entry: the gymnast's first and last name, year of birth, club, a contact email address for queries and, where applicable, the chosen apparatus. The purpose is the organisation and running of the competition.

The legal basis is the performance of the participation relationship or pre-contractual measures (Art. 6 (1) (b) GDPR) and our legitimate interest in orderly competition organisation (Art. 6 (1) (f) GDPR). Entries are usually submitted by the entering club or the parents or legal guardians.

The information is intended exclusively for competition management and is not publicly visible. Before the event, only entry numbers and club names are published; gymnasts' names only with the official start list, results only after release by competition management.

Some organisers collect further information via additional forms (such as proof documents or file uploads). The organiser, as controller, determines what these are; the answers and files, like entries, are intended for the organiser only.

Erasure: The organiser can remove its competition from the platform completely at any time. Independently of this, the platform deletes entries, answers to additional forms including uploaded files, routine music and individual score sheets automatically no later than 90 days after the last competition day.

6. Routine music

One music file per apparatus can be uploaded for an entry. The files are kept in a non-public storage area and are delivered only to the organiser and its competition software; retrieval runs via short-lived, signed addresses that are issued only after the authorisation has been checked. The controller is the organiser (section 2). The files are deleted with the competition — automatically no later than 90 days after the last competition day, earlier if the organiser removes it from the platform; anyone who deletes their Portal account deletes their files with it.

7. Account in the coach and club portal

An account with an email address and password is created for the Portal. Stored are the email address, a hash of the password (no plain text), optionally name and phone number, the club details (name, contact address, optionally phone, postal address, contact person) and the self-maintained details of gymnasts (name, year of birth). The legal basis is the performance of the user relationship (Art. 6 (1) (b) GDPR). The account can be deleted by the user in the Portal at any time and exported as a file; deleted gymnasts are kept in a recycle bin for 30 days and are then removed permanently and automatically.

The contact address held in the club profile is passed to the organiser of a competition with every entry. They need it to reach the entering club — schedule, questions, missing music — and keep it there, under their own responsibility, as that club's contact; they must not use it for advertising (clause 4.5 of our terms of use). It only goes to organisers your club has actually entered. How long it stays there is set out in section 10.

8. Early access waiting list

If you join the waiting list, we store your email address to inform you about the availability of Kür. The legal basis is your consent (Art. 6 (1) (a) GDPR). You can withdraw it at any time with effect for the future — an informal message to kontakt@kuer.app is sufficient. We store the address until withdrawal, at the latest until the end of the early access programme.

9. Map on the event page (OpenStreetMap)

On a competition's event page, the “Venue & directions” section shows a map of the hall. Your browser loads the map tiles directly from the servers of the OpenStreetMap Foundation (St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom); once per address, it is also translated into coordinates via the Nominatim service of the same foundation. In doing so, the foundation receives your IP address. An adequacy decision of the EU Commission exists for the United Kingdom. The legal basis is our legitimate interest in clear directions (Art. 6 (1) (f) GDPR); the map loads only when this section is opened. The buttons “Plan route” and “Open Street View” lead to Google Maps — you leave our page only when you click.

10. Recipients and retention period

We use the following processors; an agreement under Art. 28 GDPR is in place with each of them. The only further recipients are the organisers you enter with: they receive the entry and your club's contact address (section 7). Beyond that there are none — data is not sold and not passed on for advertising purposes. An organiser deletes an entering club's contact address once it is no longer needed for their competitions, at the latest 24 months after that club's last entry with them.

• Supabase Inc., USA — database, accounts, file storage, server functions. The data of this project is located in the EU region Frankfurt (eu-central-1).
• Vercel Inc., USA — delivery of the pages.
• Resend, Inc., USA — sending of entry confirmations and account emails. The recipient address and the content of the message are transmitted.

Access to entry data is technically restricted to the organiser and its competition software and is logged; public visitors cannot read it.

Retention period:

• Access data of the hosting provider: according to its specifications, at most 30 days.
• Counters against mass entries (hash value of the connection): after three days at the latest.
• Entries, answers to additional forms including files, routine music and individual score sheets: automatically no later than 90 days after the last competition day — earlier if the organiser removes the competition from the platform or requests erasure (then without delay, at the latest within 14 days).
• Event page, start lists and results lists: until the organiser removes the competition from the platform — they are the competition archive for which the organiser is responsible and which it has deliberately published.
• Portal accounts: until deleted by the user.
• Waiting list addresses: until withdrawal, at the latest until the end of the early access programme.
• Log of retrievals of entry data: it contains no entry content (only account, time, competition, number) and is kept to demonstrate access control.

11. Transfer to the USA

The providers named have their registered offices in the USA. Competition and entry data is stored in the European Union; access from the USA cannot be ruled out during operation and maintenance, however, and content is transferred to the USA when emails are sent.

The basis is the standard contractual clauses of the European Commission (Implementing Decision (EU) 2021/914, Art. 46 (2) (c) GDPR), which have been agreed with all three providers. Vercel Inc. and Resend, Inc. are additionally certified under the EU-US Data Privacy Framework, for which an adequacy decision of the Commission of 10 July 2023 exists. Despite these guarantees, the USA does not have a level of protection fully equivalent to European law; in particular, access by US authorities cannot be ruled out.

12. Encryption

For security reasons, this site uses TLS encryption. You can recognise an encrypted connection by the “https://” in the address bar and the lock symbol in the browser.

13. Your rights

You have the following rights towards us regarding your personal data:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent given, with effect for the future (Art. 7 (3) GDPR)

Contact kontakt@kuer.app for this.

14. Right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the Independent Centre for Data Protection Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel (datenschutzzentrum.de).

As of 19 September 2026 · Legal notice