Privacy policy

Last updated: October 2026

This English version is provided for convenience. The German version is legally binding.

This privacy policy explains which personal data we process when you use our website cologne-timing.de or contact us, for what purposes, and what rights you have. Personal data is any information relating to an identified or identifiable person, such as a name, email address or IP address.

1. Controller

cologne timing GmbH
Oskar-Jäger-Straße 173, Building K1
50825 Cologne
Germany
Phone: +49 221 50294660
Email: This email address is being protected from spambots. You need JavaScript enabled to view it.

Represented by its Managing Director, Holger Wesseln. Further details can be found in our Legal Notice.

2. Data protection officer

We are not legally required to appoint a data protection officer. For all data protection questions, please use the contact details given in section 1.

3. Legal bases

We process personal data under the General Data Protection Regulation (GDPR). Depending on the purpose, we rely on the following legal bases:

• Art. 6(1)(a) GDPR: you have given your consent.
• Art. 6(1)(b) GDPR: processing is necessary to perform a contract with you or to take steps prior to entering into a contract.
• Art. 6(1)(c) GDPR: we are legally obliged to process the data, for example under tax and commercial retention rules.
• Art. 6(1)(f) GDPR: processing is necessary for our legitimate interests and your interests do not override them. We state the specific interest in each section.

Where we store or access information on your device (for example through cookies), the legal basis is Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG), i.e. your consent. This does not apply to storage that is strictly necessary to provide a service you have explicitly requested (Section 25(2) no. 2 TDDDG).

4. Retention

We store personal data only for as long as necessary for the respective purpose and delete it afterwards, unless statutory retention periods apply. Under German commercial and tax law (Section 257 HGB, Section 147 AO), relevant records are generally kept for six to ten years. More specific periods are stated in the individual sections.

5. Recipients and transfers to third countries

We use external service providers, for example for hosting, support and payment processing. Where they process data on our behalf, we have concluded a data processing agreement with them under Art. 28 GDPR. Beyond that, we only disclose data where a legal basis permits it, for example to public authorities under statutory obligations.

Some providers are based in the USA or transfer data there. The European Commission has adopted an adequacy decision for US companies certified under the EU-US Data Privacy Framework (DPF). For recipients without this certification, transfers are based on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). The providers concerned are named in the individual sections.

6. Hosting and server log files

Our website is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. Each time you visit the website, the server automatically processes information transmitted by your browser: IP address, date and time of access, page requested, referrer URL, browser type and version, and operating system.

We need this data to deliver the website, ensure its stability and security, and detect attacks. The legal basis is Art. 6(1)(f) GDPR. Log files are only stored for as long as necessary for these purposes and are then deleted or anonymised. We have a data processing agreement with IONOS.

7. TLS encryption

This website uses TLS encryption. You can recognise an encrypted connection by "https://" in your browser's address bar. When encryption is active, data you send to us cannot be read by third parties.

8. Cookies

We only use technically necessary cookies, for example for session management and language selection. The legal basis is Section 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR; our legitimate interest is providing the website in a technically sound manner. We do not use cookies for analytics or advertising purposes.

9. Contacting us

If you contact us by email, phone or via a contact form, we process your details (for example name, email address, phone number and the content of your enquiry) to handle your request. The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract or its preparation, otherwise Art. 6(1)(f) GDPR; our legitimate interest is responding to your enquiry.

We delete the data once your request has been fully dealt with and no statutory retention obligations apply.

10. Support requests via Zendesk

We handle requests sent to This email address is being protected from spambots. You need JavaScript enabled to view it. and other support requests using the ticket system Zendesk. The provider is Zendesk, Inc., 181 Fremont Street, 17th Floor, San Francisco, CA 94105, USA. Your contact details and the content of your message are stored in Zendesk.

If your request concerns your participation in an event, we handle it on behalf of the respective event organiser (see section 11). For other requests, the legal basis is Art. 6(1)(b) GDPR where they concern a contract with us, otherwise Art. 6(1)(f) GDPR; our legitimate interest is handling requests quickly and traceably. Zendesk, Inc. is certified under the DPF. We have a data processing agreement with Zendesk. Provider's privacy notice: zendesk.com.

11. Event registration and results lists

For event registration, timing and the publication of results we use the race result software provided by race result AG, Joseph-von-Fraunhofer-Straße 11, 76327 Pfinztal, Germany. Registration pages and results lists may be provided on separate subdomains (for example anmeldung.cologne-timing.de or ergebnisse.cologne-timing.de) or embedded in this website. When embedded content is loaded, your browser connects to race result AG servers and transmits your IP address.

The controller for participant data is the respective event organiser. We process this data on the organiser's behalf and in accordance with their instructions. The exception is the collection of entry fees by SEPA direct debit, for which we are the controller (see section 12). Please refer to the organiser's privacy policy, linked on the registration page, for details on which data is collected, for what purpose and for how long it is stored.

Results lists usually show name, bib number, club or team, age group and times achieved. The legal basis and any right to object are set out in the organiser's terms of participation and privacy policy.

12. Payment processing

Payments via PayPal and Stripe

We process payments via PayPal and Stripe on behalf of the respective event organiser (see section 11). Payment data is transmitted to the payment provider you choose:

• PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Privacy notice: paypal.com
• Stripe (for example for card payments): Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Privacy notice: stripe.com

The payment providers are themselves responsible for their own processing, for example for fraud prevention.

SEPA direct debit

Entry fees paid by SEPA direct debit are collected in our own name using our creditor identifier. We are the controller for this processing. For this purpose we process the account holder's name, IBAN, BIC, mandate reference, date of the mandate and amount, as well as name, email address and the event concerned. We transmit the direct debit data for collection to our bank, VR Bank eG Bergisch Gladbach-Leverkusen, Hauptstraße 186, 51465 Bergisch Gladbach, Germany.

If a direct debit is returned, for example due to insufficient funds or an objection, we additionally process this data to inform you and to claim the outstanding amount. To handle returned debits we use the database application Airtable provided by Formagrid Inc. (Airtable), 1 Front Street, Floor 28, San Francisco, USA. Transfers to the USA are covered by the safeguards described in section 5. We send email notifications via the email delivery service SMTP2GO provided by SMTP2GO, Inc., 1710 Keller Parkway #2093, Keller, Texas 75248, USA. Emails are sent via servers in the EU; any access from the USA is covered by the safeguards described in section 5. We have data processing agreements with both providers.

For these emails we record whether they were delivered and opened and whether links in them were clicked. For this purpose the emails contain an invisible tracking pixel, and links are routed via SMTP2GO servers. When you open an email or click a link, the time, your IP address and technical information about your email client are transmitted to SMTP2GO and shown to us. This serves as proof that you were informed about the returned debit. The legal basis is Art. 6(1)(f) GDPR. You may object to this at any time (see section 19). If you disable automatic image loading in your email client, opening is not recorded.

The legal basis is Art. 6(1)(b) GDPR (execution of the direct debit mandate you granted) and, for handling returned debits, Art. 6(1)(f) GDPR; our legitimate interest is recovering outstanding payments. We delete data on returned debits once the matter has been settled. Accounting and mandate records are retained in accordance with statutory retention periods (Art. 6(1)(c) GDPR, Section 147 AO, Section 257 HGB).

13. Process automation with Make

We use the Make platform to automate internal processes, for example passing registration, payment and contact data between our systems. The provider is Celonis, Inc., One World Trade Center, 70th Floor, New York, NY 10007, USA. Processing takes place on servers in the EU. Any access from the USA is covered by the safeguards described in section 5. Where participant data is processed, this is done on behalf of the event organiser (see section 11) or, for direct debit collection, under our own responsibility (see section 12). For our own business processes, the legal basis is Art. 6(1)(b) GDPR where processing serves the performance of a contract, otherwise Art. 6(1)(f) GDPR; our legitimate interest is efficient and reliable processes. We have a data processing agreement with the provider.

14. OpenStreetMap

To display maps, for example of event locations and directions, we embed map material from OpenStreetMap, operated by the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. When a map loads, your browser retrieves map data from OpenStreetMap Foundation servers and transmits your IP address and technical data. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a clear presentation of locations. Transfers to the United Kingdom are based on the European Commission's adequacy decision (Art. 45 GDPR). More information: osmfoundation.org/wiki/Privacy_Policy.

15. Adobe Fonts

To display fonts consistently, we use Adobe Fonts provided by Adobe Systems Software Ireland Limited, 4–6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland. When you open a page, your browser loads the fonts from Adobe servers, which transmits your IP address to Adobe. According to Adobe, no cookies are set in the process. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a consistent appearance of our website. Data may be transferred to Adobe Inc. in the USA; Adobe Inc. is certified under the DPF. More information: adobe.com.

16. SiteLock security seal

As part of our hosting package with IONOS, our website is regularly scanned for malware and vulnerabilities by the SiteLock service. The corresponding seal is shown in the footer. The seal is loaded from servers of SiteLock LLC, Scottsdale, Arizona, USA, which transmits your IP address to SiteLock. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is making the security scanning of our website visible.

17. Job applications

If you apply for a job with us, we process your application documents and contact details in order to decide on establishing an employment relationship. The legal basis is Art. 6(1)(b) GDPR. Access is limited to those involved in the selection process.

To prepare the selection, we use the AI service Claude provided by Anthropic, PBC, San Francisco, USA, to summarise application documents and prepare them for those involved in the process. Decisions on whom to invite for an interview or to hire are made exclusively by people. No automated decision-making within the meaning of Art. 22 GDPR takes place. Anthropic processes the data on our behalf; we have a data processing agreement with Anthropic. Transfers to the USA are covered by the safeguards described in section 5. According to the provider's contractual commitments, the data is not used to train AI models.

If no employment relationship results, we delete your data six months after the end of the process. This retention serves to defend against possible claims, for example under the German General Equal Treatment Act (Art. 6(1)(f) GDPR). Longer storage only takes place with your consent, for example for a talent pool.

18. Our social media profiles

We maintain profiles on the following platforms:

• Facebook: facebook.com/colognetiming
• Instagram: instagram.com/cologne.timing
• LinkedIn: linkedin.com/company/cologne-timing
• YouTube: youtube.com/@colognetiming3345

On our website, these profiles are only linked. No data is transmitted until you click a link.

When you visit our profiles, the platform operators also process your data for their own purposes, such as advertising and usage analysis, in some cases even if you do not have an account. We have no influence on this. We operate these profiles to communicate with interested parties and provide information about our services (Art. 6(1)(f) GDPR).

Facebook and Instagram are operated by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. We are jointly responsible with Meta for page statistics ("Insights") (Art. 26 GDPR). The relevant agreement is available at facebook.com/legal/terms/page_controller_addendum. You can exercise your rights most effectively directly with Meta. Privacy notices: facebook.com/privacy/policy and privacycenter.instagram.com/policy.

LinkedIn is operated by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. Here too, we are jointly responsible with LinkedIn for page statistics (Art. 26 GDPR). The relevant agreement is available at legal.linkedin.com/pages-joint-controller-addendum. Data may be transferred to LinkedIn Corporation in the USA; such transfers are covered by the safeguards described in section 5. Privacy policy: linkedin.com/legal/privacy-policy.

YouTube is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy notice: policies.google.com/privacy.

Meta Platforms, Inc. and Google LLC are certified under the DPF.

19. Your rights

Under the GDPR you have the following rights:

• Access to the data we hold about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR); processing carried out before withdrawal remains lawful

To exercise these rights, please use the contact details in section 1.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

Right to object under Art. 21 GDPR

Where we process your data on the basis of Art. 6(1)(f) GDPR (legitimate interests), you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

You may object at any time, without giving reasons, to the processing of your data for direct marketing. We will then no longer use your data for this purpose.

20. Changes

We update this privacy policy when our website, our service providers or the legal situation change. The version published here applies.