Privacy Policy
How the International Waterbike Regatta processes your personal data under the EU General Data Protection Regulation (GDPR).
Last updated: 30 August 2026
1. Controller
International Waterbike Regatta Vienna
Rennweg 89b, 1030 Vienna, Austria
Email: iwr2028.support@gmail.com
Phone: +43 677 61514373
For any question about this policy or about your rights, write to the email address above.
2. Visiting this website
This website is hosted by Vercel Inc. When you open a page, your browser transmits technical data that the hosting provider records in server log files: IP address, date and time of the request, the page requested, referrer, browser type and operating system. This is necessary to deliver the site and to keep it secure and stable, and is based on our legitimate interest under Art. 6(1)(f) GDPR. We do not use analytics, tracking or advertising cookies on this website.
3. The event app
Team registration, check-in and the live results run in a separate web app at iwr-2028.web.app. Everything described from section 4 onwards refers to that app. Schedule, results and general event information can be viewed there without an account; only registration requires one.
4. What data we process
| Category | Data |
|---|---|
| Account | Name, email address, password (stored only as a hash by our processor), or your Google account identity if you sign in with Google |
| Registration | Date of birth, nationality, phone number, T-shirt size, dietary preference |
| Emergency contact | Name, phone number, relationship to you |
| Health information | Allergies and health notes you enter voluntarily (see section 6) |
| Team | Team name, country, university or institution, your role in the team, verification status |
| Declarations | Which participant declarations you accepted, and when |
| Event operations | Check-in timestamp, your personal check-in QR code, race results attributed to your team |
If you are under 18 on the first day of the event, we additionally record that a parent or legal guardian has consented to your participation.
5. Purposes and legal bases
- Organising and running the event, managing your registration and check-in — Art. 6(1)(b) GDPR, performance of a contract and steps taken prior to it.
- Safety, emergency response and rescue, including the emergency contact you provide — Art. 6(1)(d) and (f) GDPR, vital interests and our legitimate interest in running a safe water-sports event.
- Photographs, video and the live broadcast — Art. 6(1)(a) GDPR, your consent, and § 78 of the Austrian Copyright Act.
- Health information — Art. 9(2)(a) GDPR, your explicit consent.
- Publishing results and start lists (name, team, placement) — Art. 6(1)(b) and (f) GDPR; publishing results is inherent to a public competition.
6. Health information
Allergies and health notes are health data within the meaning of Art. 9 GDPR and enjoy special protection. Providing them is entirely voluntary and is not a condition of taking part. If you do provide them, we ask for your separate explicit consent in the app, and we use them for two purposes only: catering, and enabling appropriate first aid or medical assistance during the event.
Access is limited to those members of the organising team who need the information for those purposes, and to emergency and rescue services in an emergency. You can withdraw this consent at any time with future effect by emailing us or by clearing the field in the app; the data is then deleted.
7. Photography, video and livestream
The event is recorded and broadcast publicly. With your consent, recordings may be used for the live broadcast on Twitch, on social media including Instagram and TikTok, on the official event website, in press coverage, in the official aftermovie and in future promotional material for the regatta.
You may withdraw this consent for future use at any time by emailing us. Withdrawal does not affect the lawfulness of use before the withdrawal, and a live broadcast cannot be retrospectively edited or recalled once it has been transmitted.
8. Recipients and processors
We do not sell your data and we do not pass it on for advertising purposes. It is accessible to:
- Google Ireland Limited as our processor, for the app's database, authentication and hosting (Firebase). Data is stored in the EU, in the
europe-west1region. - Vercel Inc. as our processor, for hosting this website. Transfers to the USA are covered by the EU standard contractual clauses and the EU-US Data Privacy Framework.
- Authorised members of the organising team and race officials, limited to what their task requires.
- Your team captain, who can see the registration status of the members of their own team.
- Emergency and rescue services, in an emergency.
9. How long we keep it
We keep registration data for as long as it is needed for the purposes of the event, and delete or anonymise it within a reasonable period afterwards, unless a longer retention period is required by law. Results and placements remain published as part of the sporting record of the event. You can delete most of your own data yourself at any time by leaving your team or deleting your registration in the app.
10. Is providing data mandatory?
The fields marked as required are necessary in order to register you; without them we cannot accept your participation. Health information is voluntary. Consent to photography, video and the livestream is voluntary in the legal sense, but as the entire event is broadcast publicly, participation is not possible without it — you may of course attend as a visitor.
11. Your rights
You have the right to access your data, to rectification, to erasure, to restriction of processing, to data portability, and to object to processing based on our legitimate interests. Where processing is based on your consent, you may withdraw that consent at any time with future effect, without affecting the lawfulness of processing carried out beforehand.
To exercise any of these rights, contact iwr2028.support@gmail.com.
You also have the right to lodge a complaint with the supervisory authority:
Österreichische Datenschutzbehörde
Barichgasse 40–42, 1030 Vienna, Austria
dsb@dsb.gv.at · dsb.gv.at
12. Storage on your device
The app stores data on your device that is strictly necessary for it to work: your login session, and a local copy of event data so the app still opens when you are offline. This is not used for tracking and requires no consent. You can remove it at any time by signing out and clearing the site data in your browser.
13. Changes to this policy
We may update this policy when the event, the app or the legal situation changes. The current version is always available at this address.