IPC Privacy Policy
IPC CONNECT PORTAL
Thank you for your interest in using our IPC Connect Portal. The protection of personal data has top priority for us. Below you will find information about the processing of your personal data and about your rights when using our IPC Connect Portal.
1. Controller
International Paralympic Committee (IPC)
Dahlmannstraße 2
53113 Bonn, Germany
E-Mail: info@paralympic.org / privacy@paralympic.org
Phone: +49-228-2097-200
Fax: +49-228-2097-209
2. Data Protection Officer
Boris Reibach, LL.M.
Scheja & Partners GmbH & Co. KG
Adenauerallee 136
53113 Bonn, Germany
Phone: +49-228-227-226-0
Contact form: https://www.scheja-partners.de/en/contact/contact.html
3. Rights of the Data Subject
As data subject you have the following rights in accordance to the General Data Protection Regulation (GDPR) as far as the respective legal requirements are met:
Access: You have the right to obtain information about your personal data processed by us.
Rectification: You can obtain the rectification of inaccurate personal data concerning you. Furthermore, you can obtain the completion of incomplete personal data.
Erasure: In specific cases you can obtain the erasure of your personal data.
Restriction of processing: In specific cases you can obtain restriction of processing of your personal data.
Data portability: If you provided data to us based on a contract or your consent you can demand that you receive the data provided in a structured, commonly used and machine-readable format or that we transmit the data directly to another controller.
Right to object
Individual right to object
You have the right to object, on grounds relating to your particular situation, at any time to processing personal data
concerning you which is based on point (e) or (f) of Art. 6 sec. 1, including profiling based on those provisions. We will then no
longer process the personal data for those purposes unless we can demonstrate compelling legitimate grounds for the
processing which override your interests, rights and freedoms or the processing serves the establishment, exercise or defence
of legal claims.
Right to object to processing for direct marketing purposes
In some cases, we process your data for direct marketing. You have the right to object to the processing of your personal data
for those purposes at any time. This applies to profiling as far as it is associated with such direct marketing. If you object to the
processing for direct marketing purposes, your personal data will not be processed for those purposes any longer.
Withdrawal of consent: If you gave your consent to the processing of your personal data you can withdraw your consent at any time with future effect. The lawfulness of the processing of your personal data until your withdrawal will not be affected. In addition to the options stated under ‘enforcement of your rights’ you can explain your withdrawal according to the respective information concerning ‘exercising the right to object’ in the section ‘Services & Cookies’.
Enforcements of your rights: To exercise the aforementioned rights please contact privacy@paralympic.org or by post to the address stated under number 1. When doing so please make sure an unambiguous identification of yourself is possible.
Right of appeal: You have the right to lodge a complaint with a data protection supervisory authority, particularly one in the member state of your habitual residence, work place or the place of the suspected violation, if you are of the view that the processing of your personal data is unlawful.
The supervisory authority responsible for us is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2-4
40213 Düsseldorf, Germany
Phone: +49 211 38424-0
Fax: +49 211 38424-10 3.
3. What personal data we collect
We collect personal data directly from you, from your organisation, or from IPC member organisations, event organisers, or
third-party partners where necessary to provide Portal services.
For certain processes (e.g. event registration, accreditation, grant applications), some data fields are mandatory. Failure to
provide mandatory data may prevent participation or access to services. Other data fields are voluntary and provided at your
discretion.
3.1 Registration and profile data
Name, email address, phone number (if provided), job title/role, organisation, country, preferred language, user identifiers,
and role/permissions.
3.2 Member administration and Portal activity
Records of interactions with Portal features (e.g. submissions, approvals, workflows) and audit logs (timestamps of actions).
3.3 Technical and security data
Device and browser information, IP address, login timestamps, and security logs.
3.4 Grant applications and grant management data
Depending on the programme:
- Applicant identity and contact details
- Programme and narrative information
- Travel and identity-related data (e.g. date of birth, passport details)
- Financial and banking data for disbursement
- Supporting documents and uploads
- Special categories of personal data (e.g. disability or health information), where required
3.5 Event management data (registration, accreditation, travel, accommodation)
Depending on the event, we process:
- Registration details (mandatory for participation)
- Accreditation details (required for access control)
- Travel and logistics data
- Accommodation information
- Transport and accessibility requirements
- Visa support data
- Accessibility, dietary, and medical information (typically voluntary but may require consent)
- Payment information (where applicable)
Special categories of personal data (e.g. health or accessibility needs) is processed only where strictly necessary, typically
based on explicit consent, to ensure accessibility, safety, and inclusion.
4. Purposes of processing
We process personal data for the following purposes:
- To operate the Portal and provide access
- To manage membership and contact administration
- To ensure platform security and performance
- To administer grants and disbursements
- To plan, organise, and deliver events (including registration, accreditation, travel, accommodation, accessibility, and on-site services)
- To communicate operational and event-related information
5. Legal bases for processing
We rely on the following legal bases:
- Contract necessity (Art. 6 (1) (b) GDPR)
- Legitimate interests (Art. 6 (1) (f), 9 (2) (f) GDPR), our legitimate interests in this regard lie in the pursuit of the respective purpose
- Legal obligation (Art. 6 (1) (c) GDPR)
- Consent (Art. 6 (1) (a) GDPR and Art. 9 (2) (a) GDPR for special categories of personal data)
- § 25 (2) (2) TDDDG (Gesetz über den Datenschutz und den Schutz der Privatsphäre in der Telekommunikation und bei digitalen Diensten) regarding the storage of information in the end-user’s terminal equipment or access to information already stored in the terminal equipment
Where processing is based on consent, you may withdraw it at any time. Withdrawal may affect our ability to provide certain services (e.g. accessibility or catering arrangements). Where processing is required to perform a contract, you are obliged to provide the relevant personal data. Failure to do so may result in inability to access services or participate in IPC programmes or events.
6. Sharing and disclosure of personal data
6.1 Within IPC
Access is restricted to authorised personnel.
6.2 External recipients
We may share personal data with: IT service providers and hosting partners Local Organising Committees (LOCs) Accommodation providers (e.g. hotels) Transport and logistics providers Accreditation and event service providers IPC member organisations and programme partners These parties process data under contractual safeguards and only as necessary.
6.3 Public bodies and advisers
Where required by law or necessary for legal advice.
7. International transfers
Where personal data is transferred outside the EU/EEA, appropriate safeguards (e.g. Standard Contractual Clauses) are applied. You can obtain a copy of the specific safeguards we have in place to ensure an adequate level of data protection. Please use the contact information for the data controller provided in Section 1.
8. Retention of data
We retain personal data only as long as necessary for the relevant purposes and legal obligations. Examples include:
- Membership or programme data: up to 4 years after completion
- Event data: typically retained until event closure and post-event review
- Grant data: retained per IPC retention and audit requirements
- Technical and security logs: retained for defined security periods
Data is deleted or anonymised when no longer required.
You’re offline. This is a read only version of the page.
