It also details how the IOC processes personal data that it receives from other organisations, or via cookies and similar technologies that are integrated into another organisation’s digital properties for the benefit of the IOC.
- In addition, if you have created an account on services offered by Paris 2024, we may share with Paris 2024 the data we collect about you when you engage with our Services. We share such data with Paris 2024 on the basis of Paris 2024’s legitimate interest to better understand its fans and personalise its services, products and communications.
Who are we?
The IOC is a private, not-for-profit, international organisation recognised to be of public interest by the Swiss authorities and constituted in the form of a Swiss law association, having its registered office in Maison Olympique (Olympic House) 1007 Lausanne, Switzerland. The mission of the IOC is to promote Olympism throughout the world, to lead the Olympic Movement and to ensure the regular celebration of the Olympic Games. To learn more about the IOC, its goals and activities, please consult the Olympic Charterand the IOC Principles.
The Foundation manages the Olympic Museum and the Olympic Studies Centre in Lausanne, Switzerland.
An OCOG is responsible for organising an edition of the Olympic Games and Paralympic Games. Each OCOG is based in the territory in which its respective Olympic and Paralympic Games shall be hosted.
When we refer to “you” or “your” we mean those individuals whose data we collect through the Services, or whose data we receive from other organisations that we work with.
Our role in the processing of personal data
1- Data collected via the Services
The IOC is the data controller of data that is collected through the Services except:
where the privacy information (which includes information about cookies) provided in relation to the Services states otherwise;
where the Services relate to the Olympic Museum (in particular https://olympics.com/museum, https://museumshop.olympics.com), the Olympic Studies Centre (in particular https://olympics.com/ioc/olympic-studies-centre, https://library.olympics.com/) and other activities of the Foundation. In which case, your personal data will be processed by the IOC and the Foundation for the purposes detailed in Annex 2, acting as joint controllers; or
2- Data collected via third-party sites and services
Where the IOC receives information that has been collected by other organisations, the IOC is a data controller of the data it receives. This applies to personal data that is collected via websites and other digital services owned or operated by:
- OCOGs, and
- other commercial organisations that are permitted to sell and promote Olympic-themed digital services or to use the Olympic Properties.
See paragraph 3 “Collection of data through third parties” in the section “What information do we collect?” (below) as well as Annex 3 for more details.
What information do we collect?
1. Information that you provide to us
You provide us with information, including personal data, when you use the Services. In particular, when you register for the Services and create a user account, communicate with us, request,use or otherwise interact with a service or other initiative that we provide, complete certain transactions or subscribe to B2B Services or B2C Services, promotional communications or media alerts. “B2B Services” means those Services that are online professional services and business resources. “B2C Services” means Services that are engagement and information services.
a) Registration data
Our content is generally available via the Services without registration. However, certain professional services, business resources and event registration services as well as certain personalisation options, transactions, functionalities or activities (e.g. games, contests, sweepstakes, newsletters, and e-commerce,…) that are offered through the Services may require that you register with us and provide certain information about yourself.
If you create a user account, you will be asked to provide personal data such as your email address, place of residence, age information, and password. You may be able to use this account for all Services, although user accounts for B2B Services are different to those accounts created for B2C Services. Certain Services, like Athlete 365 (https://olympics.com/athlete365/), are focused on athletes and we may ask you to provide information about the sports you practice, your team or your participation in the Olympic Games or Youth Olympic Games.
b) Data necessary to provide you certain Services
Certain Services require that you provide information about yourself. This is the case, for instance, in respect of:
- the B2B Services that we make available to other Olympic Movement stakeholders, or
- the Services that enable you to register for or apply for accreditation to the Olympic Games, Youth Olympic Games or other events organised by us, as well as the Services through which you may book travel and accommodation related to these events.
You may also need to provide your information in order to use the Services through which you can procure goods or services from us or participate in any game, contest, sweepstake or other fan engagement opportunity.
In these different situations and where necessary we will inform you more specifically about the information we need to collect in order to provide you with the requested goods or services and of any other conditions applicable to the processing of this personal data. The information needed will vary depending on the nature of the Services. It may include information such as: first name, last name, business organisation, job title, physical address, phone number, nationality, travel and accommodation details, passport or ID card number, credit card information, height and weight information, size of garments or shoes, allergies and food habits.
c) Communications data
If you communicate with us and/or request any information or service from us, we will use your account information and any other information you may provide us with (such as email address, phone number, and the content of your communication or request) in order to respond to you.
2. Information that is collected through cookies and similar technologies
We use automatic tracking mechanisms like cookies and similar technologies to collect certain data while you are browsing our Services, or when you visit the sites or services of other organisations that we work with. A cookie is a small file, stored on your browser or computer hard drive, which is used to collect data about your interactions with websites and other digital properties. For example, information about your device (browser type, operating system, language, unique device identifier), network connections (Internet Service Provider, IP address, time zone), browsing history including date and time and pages visited, as well as general location such as your city and country.
You can disable cookies (except those cookies that are strictly necessary) or manage cookies using the cookies settings available on each of the websites or other digital properties through which the cookies are set. You can also manage cookies by configuring the functionalities of your internet browser.
3. Collection of data through third parties
You can register with us by using the information of an account you hold with a third party such as Facebook, Google, Twitter and Apple. If you choose this option, you authorise these organisations to provide us with some of the personal data they hold about you so that we can use it to create your user account with us. The personal data shared with us will depend on the third-party services that you use to register with us and on the scope of the information you allow those third parties to share, but typically it includes your first name and last name, user name, phone number, unique identifiers and access tokens, e-mail address, date of birth and preferences (e.g. pages you have favourited or saved).
In some scenarios we authorise third parties to launch and operate Olympic-themed digital services or to feature Olympic Properties within their websites or other digital services. For example, the Olympic Shop operated by Fanatics, Inc. and its affiliates under authorisation of the IOC and OCOGs (see, for instance, the EU version of the Olympic Shop here https://shop.olympics.com/en/). These third parties may share information that they collect about you with us, for example your first and last name or unique identifier, your email address, your stated marketing preferences and data about the webpages you visit and the Olympic-branded products that you purchase. In such cases, the sharing of information with us will be specified in, and carried out in accordance with, the privacy and cookie policies issued by these third parties.
OCOGs, in particular Paris 2024 and the Milano Cortina Organising Committee of Olympic and Paralympic Games, share the personal data of their users with the IOC. In such cases, their sharing of personal data with the IOC will be specified in, and carried out in accordance with, the privacy and cookie policies issued by each of the relevant OCOGs.
4. Information manifestly made public
Content offered on our Services may include information manifestly made public such as competitions and results, biographies about Olympians and other athletes, coaches and other persons involved in the Olympic Games, Youth Olympic Games and other major sports competitions, who are newsworthy and whose stories contribute to the mission of the IOC and the Olympic Movement. This information was disclosed by athletes and other concerned persons in the context of their participation in Olympic Games, Youth Olympic Games and other sports competitions, interviews and other media events, media publications or through other means and was compiled by us, in cooperation with International Federations, National Olympic Committees, Organising Committees for the Olympic Games and Youth Olympic Games and other Olympic Movement stakeholders.
How do we use the information we collect?
We use the information we collect about you and your use of the Services and, where relevant, your use of third party sites and services, to:
a) facilitate your use of the Services, enable your registration and authentication, and manage your user account;
b) maintain and develop the Services;
c) gather statistics to help diagnose problems, enhance your experience of the Services and improve the quality of the Services;
d) ensure the security of the Services and make sure that the Services are used in compliance with our Terms of Service and applicable laws;
e) carry out fan and audience analysis and to offer a personalised experience. By analysing your interaction with our Services (including the communications we send to you) and your interaction with third-party sites, services and advertising (where allowed by those third parties’ privacy policies and terms of services), we are better able to suggest to you content or offers, and to determine when and how you might like us to show content to you. As part of this analysis, we create user profiles and may combine the data we hold about you with the data we receive from other organisations. For information on the data we receive from third parties see the paragraph above entitled “Collection of data through third parties”;
f) allow you to participate in any game, contest, sweepstake or other fan engagement opportunity which we make available through the Services or through other organisations that we work with, and for the purposes of administering these initiatives (assessing and confirming the eligibility of participants, awarding prizes to the winners etc.);
g) provide you goods, services, information, or content that you have requested;
h) communicate with you, including by answering your questions and requests, sending you communications related to your user account and our Terms of Service and, if you have opted-in or where the law otherwise permits, send you promotional communications (including by email and other electronic channels) about the Services, our activities and the activities of the Olympic Movement and its partners, while offering you the possibility to opt-out from such communications at any time; and
i) show and measure advertisements on the Services, on third-party services like Google, Facebook, YouTube and Twitter and on the sites and services of other organisations that we work with. If you are a user of the third-party sites and services mentioned in this paragraph (i) as well as a user of our Services, we may, by sharing information with those third parties, serve advertisements to you (or people with a similar profile to you) via their sites and services.
Who do we share your information with?
1. Information that is made publicly available
We make certain personal data publicly available via the Services or through third party sites and services. For example:
- where the nature of the Services demand it. Services such as online games, contests, or sweepstakes may involve the publication of personal data, such as game play data in league tables or winner announcements; and
- where the Services feature news stories and other editorial content about, biographies and sports competition results of, Olympians, other athletes, coaches or other persons whose activities are relevant to the IOC’s mission.
2. The IOC, the Foundation and OCOGs
3. Our service providers
We rely on a network of professional service providers who are working on our behalf and help us to operate, develop, secure, promote and measure the Services and our advertisements. The services provided by these organisations include, in particular:
a) customer data infrastructure, platform development services and general IT services;
b) hosting services;
c) cloud-based services for customer identity and access management;
d) customer services, customer relationship management and other communication and marketing services, such as gamification;
e) analytics, audience and advertising measurement services;
f) email communications and push notification services;
g) third party web and social media services through which we serve our advertisements; and
h) services to manage user access requests and cookie consents.
In some cases, the organisations we work with may act as data controllers of your personal data. For example, third parties that assist us with the serving of advertisements, and those third parties authorised to launch and operate Olympic-themed digital services or to use our brands. These third parties are typically governed by their own terms of service and privacy policies, which we strongly recommend you read.
4. Events-related services, contests, sweepstakes and other services
Our Services can be used to register for and participate in games, contests, sweepstakes or other fan engagement opportunities, or to apply for registration or accreditation to attend the Olympic Games or other events organised by us, or for booking travel and accommodation in relation to these events and services.
In certain situations, the provision of the services requested by you may require us to share your personal data with third parties (e.g. CarlsonWagonlits Travel and other travel or accommodation providers, organising committees, or governmental agencies,…). We may also share your information with third parties when some of the Services such as games, contests, sweepstakes or other fan engagement opportunities are available on third-party sites and services or where we engage a third party to assist us with prize fulfilment.
Other services that you request from us may also require that we share your information with third parties assisting us with the delivery of such services, such as Olympic Movement entities (International Federations, National Olympic Committees or OCOGs…), academic institutions, or other delivery partners. We will specify in the Terms of Service or other user-facing information the categories of third parties with whom your personal data may have to be shared and other conditions applicable to such sharing of information.
5. Offers and services from our partners
From time to time, we will offer you the possibility to receive services and communications (including communications related to products and services) from selected third parties, such as our commercial partners and other constituents of the Olympic Movement. In case you opt-in to such services or communications (or can otherwise lawfully receive communications from them), we will share your personal data with these organisations.
Upon your consent, we transfer your e-mail address to the International Paralympic Committee (“IPC”) for the purpose of promotional communications about the Paralympic Games, the Paralympic Movement and the related initiatives of IPC partners. The IPC will process your personal data as a separate data controller where you decide to subscribe to the IPC’s promotional communications. Should you wish to opt-out of the IPC’s promotional communications, please contact the IPC directly.
6. Legal disclosure
We reserve the right to disclose personal data we hold about you if we are required to do so under applicable laws or pursuant to any judicial or administrative process and, to the extent necessary, to investigate, prevent, or take actions in relation to unlawful activities or violation of our Terms of Service.
How do we protect your personal information?
1. Data security
We use technical and organisational measures to protect your personal data against the risks of damage, destruction, loss or unauthorised access, in accordance with applicable laws.
2. International transfer
We may process your personal data in a territory other than your place of residence. We adopt measures as required under applicable law to ensure your data will be given the relevant protection.
3. Age limitation
We will not knowingly collect personal data about users under 13 years old. Unless the Terms of Services state otherwise, the Services are intended for users who are of legal age for data protection purposes according to the laws of the territory in which they reside. You can learn more about our age requirements here: https://olympics.com/en/age-consent . If we become aware that a child below age has provided us with personal data, we will take steps to delete their personal data and close their account. If you become aware that your child has provided us with personal data without your consent, please contact us.
4. Data retention
Legal basis for processing your personal information and your rights
We mainly process your information to perform our obligations under the Terms of Service but, in certain cases, we rely on an alternative legal basis. We have detailed below the legal bases on which we process your personal data.
1. Contractual necessity
Contractual necessity applies where you (if you are of the required age to enter into a contract) accept our Terms of Service and justifies the following uses of personal data:
a) Providing the Services and personalising your experience of the Services by customising certain features based on your interests.
b) Letting you participate in any game, contest, sweepstake or other fan engagement opportunity which we make available through the Services.
c) Managing registration and user account.
d) Securing and developing the Services.
e) Communicating with you in relation to the Services.
f) Providing you goods, services, information, or content that you have requested.
g) Sharing data with selected third parties who may offer you their services.
h) Transferring, storing or processing your data outside Switzerland or the European Union, including within the United States of America and other countries.
i) Providing you with accreditation, accommodation, transport and other services or information which you have requested from us.
In these cases, you have the right to port your data.
We also process certain personal data based on your consent, which you can withdraw at any time, for the following activities:
a) Sending you marketing communications, including via digital means, where your consent is required.
b) Placing cookies, both via our Services and certain third-party sites and services, where your consent is required.
In these cases, you have the right to port your data and to withdraw your consent.
3. Legitimate interests
We also rely on our legitimate interests, especially for our users who may not be of age to enter into a contract, to provide secure and efficient Services that are consistent with our Terms of Service, and so that our visitors, partners and fans can receive high quality Services and enjoy Olympic-related content corresponding to their interests. Legitimate interests constitutes a legal basis for the following activities:
a) Making available through the Services publicly available information related to the Olympic Games, Youth Olympic Games, Olympians and other athletes, sports and news stories.
b) Providing the Services and personalising your experience of the Services by customising certain features based on your interests.
c) Managing registration and user accounts.
d) Securing and developing the Services.
e) Communicating with you in relation to the Services.
f) Providing you with the goods, services, information or content that you have requested.
g) Transferring, storing or processing your data outside Switzerland or the European Union, including to or within the United States of America and other countries.
h) Sending you marketing communications, including via emails, in cases where you can lawfully receive such communications
i) Carrying out fan and audience analysis and offering you a personalised experience. This includes our analysis of your interaction with our Services (including the communications we send to you), as well as your interaction with third-party sites, services and advertising.
j) Evaluating the performance of the Services as well as third-party sites and services.
k) Sharing data with other organisations who may offer and/or provide to you their services, and with OCOGs who may use this data to better understand their fans, evaluate the performance of the Services, personalise their services and products and communications and, to the extent legally allowed, send you direct marketing, including marketing related to their products, services and partners
l) Sharing your information with third parties including law enforcement authorities where we suspect unlawful activity.
In these cases, you have the right to object to the processing of your information or ask us to restrict such processing.
4. Compliance with our legal obligations
We may also invoke our legal obligations as a valid ground for sharing your information with judiciary or law enforcement authorities, if we are ever obliged to do so and according to applicable laws.
In such case, you have the right to object to the processing of your information or ask us to restrict such processing.
Your rights and how to exercise them
1. Your rights
You can exercise your rights of access to, rectification, deletion and portability of, your personal data, limitation and objection to its processing, as well as your right to not be the subject of decisions based solely on the automated processing of your personal data, where appropriate, before us. You also have the right to withdraw your consent at any given moment. We may require evidence of your identity before we are able to respond to your request. If you live outside the European Union, you may also have rights under applicable laws in such jurisdiction. Please contact us via the means described in paragraph (d) of section 2 (‘How to exercise your rights’) (below) if you have any questions in connection with exercising those rights. We reserve the right to decline a request where the legal conditions are met and in particular where the request made to us is manifestly unfounded or excessive.
2. How to exercise your right
a) Olympic ID user account details
To withdraw your consent, access or rectify your personal data, please log into your Olympic ID account and use the settings functionality to make adjustments to that account.
b) Unsubscribe from IOC marketing communications
To unsubscribe from IOC marketing communications, you can adjust your settings in your user account or click on the link displayed at the bottom of our marketing communications.
c) Requests that relate to ticketing
If you have a request that relates to ticketing, including how to update the login credentials that are needed to access your ticket(s), please contact the relevant OCOG.
d) Contact us
e) Data Protection Officer
You can contact our Data Protection Officer at the following address:
Data Protection Officer
International Olympic Committee
Maison Olympique (Olympic House)
Alternatively, you may use the IOC’s dedicated portal.
f) Lodge a complaint
In cases where the EU General Data Protection Regulation (“GDPR”) applies, you have the right to lodge a complaint with a European Union supervisory authority, in particular, in the territory where you live, place of work or place of the alleged infringement. Where the UK General Data Protection Regulation applies, you have the right to lodge a complaint with the UK’s Information Commissioner’s Office. Where other laws apply, you can contact us according to paragraph (d) above to lodge a complaint.
g) European Union representative
The IOC has appointed Olympic Broadcasting Services S.L. Calle Torrelaguna 75, Madrid, Spain as a European Union representative pursuant to Article 27 of the GDPR.
International Olympic Committee, Maison Olympique (Olympic House), 1007 Lausanne, Switzerland,
Olympic Foundation for Culture and Heritage, Quai d’Ouchy 1, 1006 Lausanne, Switzerland
ANNEX 1: List of our main service providers
IOC Television & Marketing Services SA (Switzerland)
Olympic Channel Services S.L. (European Union, Spain)
Amazon Web Services EMEA SARL (European Union)
FanHub Media Trading Pty Ltd (Australia)
COMMUNICATIONS AND MARKETING:
Salesforce.org EMEA Ltd/Salesforce.com Inc. (USA, European Union, Switzerland, Japan)
USER ACCESS REQUESTS AND COOKIE CONSENTS MANAGEMENT:
OneTrust (European Union, Germany, Switzerland)
CUSTOMER IDENTITY AND ACCESS MANAGEMENT:
SAP/Gigya (European Union, Switzerland)
Call Center Guys Inc (Canada)
MANAGEMENT AND PRODUCTION OF COMMUNICATIONS, SECURITY:
Microsoft Inc. (European Union, Switzerland)
ANNEX 2: Joint Control in Services
When the Services relate to the Olympic Museum or the Olympic Studies Centre, the IOC and Foundation act as joint controllers for the purposes of facilitating your use of the Services, enabling your registration and authentication, and managing your user account, and providing you goods, services, information, or content that you have requested.
For the Services that relate to the Olympic Museum or the Olympic Studies Centre, the data generated by cookies will be processed by the IOC and the Foundation, acting as joint controllers.
ANNEX 3: Activities involving the IOC and other organisations within the Olympic Movement
The IOC often works with other organisations within the Olympic Movement. In particular, the OCOGs that are each responsible for organising an edition of the Olympic Games or Youth Olympic Games, official marketing partners, rights-holding broadcasters, National Olympic Committees and international sports federations.
In the case of OCOGs, for example:
- the IOC may host the official website or manage the official app connected to an edition of the Olympic Games or Youth Olympic Games;
- the IOC may share certain of its IT resources (in particular, systems that support account creation and management) with an OCOG so that users can benefit from services that are jointly or independently provided by the IOC and OCOG; or
- the IOC and OCOGs may appoint the same third party to sell Olympic-related merchandise or services.
Where these activities entail the processing of personal data, we will provide additional information about the roles and responsibilities of each of the organisations involved, as required by applicable laws. Such information will be provided in this Annex 3 (as updated from time to time) or, for short-term activities, provided at the point of data collection.
1.Sharing of IT resources
To improve user experience, the IOC and Paris 2024 use common IT resources, in particular an identity and access management system. This system supports user account creation and management on the Services as well as on certain services offered by Paris 2024 via its www.Paris2024.org website and other Paris 2024 digital platforms, including Club 2024, Terre de Jeux, and Génération 2024 (the “Paris 2024 Services”).
Where you have created an account on the Paris 2024 Services, you will be able to create and access an Olympic ID account using the same credentials. And the same will apply where you have an Olympic ID account and subsequently create an account on the Paris 2024 Services. As a result, both Paris 2024 and the IOC will have access to (and will share between them), and are responsible for protecting, the personal data that you provide for the purpose of identity access and account management, in particular to avoid any account duplication and/or to ensure accuracy of the personal data related to a user account.
The IOC and Paris 2024 are joint controllers with respect to the processing of data in connection with the account creation and management mentioned above. In its role as joint controller, the IOC is responsible for maintaining the common IT resources that are used for such account creation and management.
The legal basis for the processing of personal data in connection with this activity is contractual necessity.
If you wish to exercise your rights as a data subject in respect of the above, you may contact the IOC through the IOC’s dedicated portal. For other questions about your account on the Paris 2024 Services (for example, questions about the availability of the services and login errors), please contact Paris 2024 at the address firstname.lastname@example.org
2.IOC’s collection of a marketing communications opt-in
The Services may feature a means by which you can opt in to receive marketing communications from one or more OCOGs. If you choose to opt in, the IOC will share your personal data with the relevant OCOG(s).
The OCOG(s) (each as an independent controller) use this data to send you marketing communications, including marketing related to their products, services and partners.
3.IOC’s onward transfer of data to OCOGs
In addition, if you have created an account on services offered by Paris 2024, we may share with Paris 2024 the data we collect about you when you engage with our Services.
Paris 2024 (as an independent controller) uses this data to better understand its fans, personalise its services and products and communications, carry out behavioural analysis and to analyse traffic performance.
The sharing of data described in this paragraph 3 with Paris 2024 is based on Paris 2024’s legitimate interest.