Privacy policy

Version of 16 October 2026. This policy applies to the IMAS regatta portal with its entry portal, regatta manager, public results, results app and interfaces.

1. Controller and data protection officer

IMAS Startanlagen und Maschinenbau GmbH
Meyerstraße 12a
14776 Brandenburg an der Havel, Germany
Phone: +49 (0) 3381 663617
E-mail: info@imas-sport.com

You can reach our data protection officer at datenschutz@imas-sport.com or at the postal address above marked "To the data protection officer".

2. Who is responsible for what

• We are responsible for your account, the sign-in, the portal's e-mails, the technical operation, the public results pages and the results app.
• The respective club or organizer is responsible for the data that clubs and organizers enter about other persons (athletes, crews, team leaders, referees, officials, bookings, competition results). We process this data on its behalf under the data processing agreement that is the annex to the terms of use. When a club submits an entry, the data of the entered persons goes to the organizer of the competition.
• The organizer of a competition decides on the publication of its start lists and results.

Requests about data for which a club or organizer is responsible are best sent to them. If you contact us, we forward the request.

3. Visiting the pages and server logs

With every request your browser or the app transmits technically necessary data: IP address, date and time, requested address, status code, amount of data transferred, the previously visited page as well as browser and operating system. We process it to deliver the pages, keep the operation secure, fend off attacks and find errors (Art. 6 (1) (f) GDPR). The logs are deleted after 90 days.

The portal runs at netcup GmbH, Karlsruhe, in a data centre in Germany; a data processing agreement with netcup is in place. We deliver fonts and all other parts of the pages ourselves; visiting the pages transmits no data to other providers, except for the functions named in no. 7, 10 and 11.

4. Account and sign-in

For an account we process name, e-mail address, optionally a phone number, the password (only as a hash), language and settings, the accepted version of the terms of use with its time, the time of the last sign-in, failed sign-in attempts and your notifications in the portal. The legal basis is the user agreement (Art. 6 (1) (b) GDPR). An account is not possible without these details.

IMAS administrators can sign in as a user for support ("sign in as"). This is logged with user id and time and visibly marked during the session (Art. 6 (1) (b) and (f) GDPR).

You can delete your account at any time on the account page. It is then anonymized immediately: name, e-mail address, phone number, password and settings are removed and memberships deleted.

5. Clubs, organizers and memberships

We process the data of clubs and organizers (name, address, federation, club number, billing e-mail, homepage, for organizers also contact and bank details of the competitions) as well as memberships, roles, invitations and membership requests with their messages (Art. 6 (1) (b) GDPR). A person becomes a member of a club on request, by invitation, or through an approval that the club or IMAS has stored in the portal (for example a confirmed e-mail address from the former entry portal or signing in with the club's federation credentials).

6. Athletes, entries and competitions (on behalf)

On behalf of clubs and organizers we process:

• athletes: name, gender, year of birth, licence or federation number, start permission, club, nation and origin of the record;
• entries, crews, exception and late entry requests with reasons and decisions;
• team leaders, referees, officials and helpers: name, contact details, function and duty times;
• camping and meal bookings and the cost statements for the clubs;
• on the competition day in the regatta manager: races, lanes, times, places, penalties and status with their change history.

Recipients are the organizer of the entered competitions and, for racing communities, the partner club for the released athletes. If the organizer uses the regatta manager as an app, a copy of the competition data is stored on its devices.

Import from the federation database. If a club imports its athletes from its federation's database (for example of the German Canoe Federation), a club manager enters the club's federation credentials. The portal signs in to the federation once, downloads the club's athlete list and signs out again. The password is not stored; the imported athletes are stored with their federation id.

7. Timing, display boards and devices

Organizers can create keys for timing systems, display boards and tool pages. We store the name of the key (often the name of the operator or device), when it was used, and the transmitted times and events (Art. 6 (1) (f) GDPR and on behalf of the organizer). Device receipts are deleted after 90 days. Installed RegattaManager Lite programs check their licence with the hardware id and the name of the computer.

8. Public start lists and results

When an organizer publishes start lists or results, we show them on the public results pages, as PDF, through the public interface and in the results app: name, club, nation, start or boat number, crew, times, place and status (for example "did not start"), in PDF lists depending on the organizer's template also year of birth and age class. We also provide the archive of the former results site results.imas-sport.com with the results published there. Search engines can find these pages.

The legal basis is Art. 6 (1) (f) GDPR: organizers, athletes, clubs, federations, the media and the public have a legitimate interest in documenting and reporting on sports competitions; publishing results is customary in competitive sport. Published results are kept permanently as sports documentation. You can object to the publication under Art. 21 GDPR (no. 14); we review this case by case together with the organizer.

9. E-mails

The portal sends e-mails to confirm the e-mail address, to reset the password, about invitations, requests, decisions and cost statements, and to confirm new organizers (Art. 6 (1) (b) GDPR). They are sent through the mail server of netcup GmbH in Germany. We log recipient, subject and time of sending and delete the log after 90 days (Art. 6 (1) (f) GDPR).

10. Protection against automated requests

The registration checks with an invisible field and a minimum time whether a human fills in the form; no data goes to third parties for this. If Cloudflare Turnstile is enabled in addition, the registration (and, where used, further forms such as the sign-in) loads a script from Cloudflare. Cloudflare processes your IP address, details about browser and device and your interaction with the check to tell humans from bots (Art. 6 (1) (f) GDPR, protection against abusive registrations and sign-in attempts). The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare is certified under the EU-US Data Privacy Framework; the European Commission's adequacy decision applies to the transfer to the USA (Art. 45 GDPR). More information: Cloudflare privacy policy.

11. Results app and notifications

The results app for Android and iOS works without an account. It stores favourites (clubs, athletes, boats, races) and the offline copy of the results on your device.

If you switch on notifications, the app sends a push token, platform, language and your favourites to the portal so that we can inform you about the start and result of your races. The legal basis is your consent (Art. 6 (1) (a) GDPR), which you withdraw by switching off notifications in the app or in the system settings. The messages are delivered by Google Firebase Cloud Messaging (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), on iOS devices through the Apple Push Notification service. Data may be transferred to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). We delete devices that have not reported for 180 days and invalid tokens.

Downloading the app from the Google Play Store or the Apple App Store is subject to the privacy terms of these providers.

12. Licence shop and portal fee

For the organizers' portal fee we process per competition the counted boats, the entry fees at the deadline, the invoice recipient, address, invoice addresses, VAT ID, invoice number and payment status as well as the account that pays or requests the invoice (Art. 6 (1) (b) GDPR). Payment and invoice are handled by Stripe as described below.

When organizers buy licences in the licence shop (for example for RegattaManager Lite), we process account, organization, purchased licences, payment status and, for activation, the hardware id and the name of the computer (Art. 6 (1) (b) GDPR). Payment is handled by Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland); Stripe processes the payment and billing data itself and may transfer data to Stripe, Inc. in the USA, which is certified under the EU-US Data Privacy Framework. We keep invoices and accounting records for the statutory periods (Art. 6 (1) (c) GDPR, § 147 German Fiscal Code, § 257 German Commercial Code).

13. Cookies and local storage

We only use technically necessary cookies and browser storage (§ 25 (2) no. 2 TDDDG); no consent is needed for this. We use no analytics, advertising or tracking tools.

• Sign-in cookie (.AspNetCore.Identity.Application): keeps you signed in; until you close the browser or, with "Remember me", for up to 14 days.
• Language cookie (.AspNetCore.Culture): the chosen language, one year.
• Protection cookie (.AspNetCore.Antiforgery…): protects forms against forged requests, until you close the browser.
• Local browser storage: the key of a competition on timing, display and tool pages until the end of the competition, and the chosen lane order of the timing page.

14. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw a consent at any time with effect for the future (Art. 7 (3)).

Right to object: where we process data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR), including to the publication of results. We then no longer process the data unless there are compelling legitimate grounds that override your interests.

You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg, Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany.

We make no automated decisions and create no profiles within the meaning of Art. 22 GDPR.

15. Retention periods

We keep personal data only as long as the respective purpose requires (periods confirmed on 10 October 2026):

• Registrations whose e-mail address was not confirmed: 30 days, then the account is anonymized.
• Accounts without sign-in: after three years you receive a notice by e-mail; if you do not sign in within 30 days, the account is anonymized.
• Rejected, revoked or expired membership requests and invitations: 6 months.
• Deleted athletes of a club: anonymized after 12 months unless they took part in a competition in the last 12 months.
• Deleted entries: deleted permanently 12 months after the end of the competition.
• Entries, crews and cost statements of finished competitions: 10 years as documentation for organizers and clubs; public results are kept as sports documentation.
• Uploaded documents of a competition: as long as the competition.
• Change log entries (audit): 3 years; they only contain ids, no names or e-mail addresses.
• Devices of the results app: 180 days after the device last reported.
• Technical logs, synchronization and device receipts, print jobs and mail send logs: 90 days.
• Invoices and accounting records: for the statutory retention periods.

16. Links to other providers

Links, for example to the map of a venue on OpenStreetMap or to the organizers' pages, only open external pages when you click them. The respective provider is responsible for their data processing.

17. Contact by e-mail

If you write to us, we process your details to answer your request (Art. 6 (1) (b) or (f) GDPR) and delete them when they are no longer needed for it and no retention obligation applies.

18. Changes

We adapt this privacy policy when the portal or the law changes. You can always find the current version at /datenschutz.