PERSONAL DATA PROCESSING POLICY (GDPR)
for the website https://test.carpcup.app

This Personal Data Processing Policy (hereinafter referred to as the "Policy") bindingly and transparently governs the scope, purpose, and legal framework of the processing of personal data of participants (in particular anglers, competitors, team members, and referees) within the organization, registration, and live evaluation of the fishing competition JABLONICKÝ KAPOR for the current annual edition 0000.

Article I.
Basic Provisions and the Status of the Controller vs. the Processor

CONTROLLER: In relation to all personal data collected, processed, and retained for the purposes of organizing and evaluating this competition, the Organizing Committee of the competition / the Organizer acts exclusively in the capacity and with the full legal liability of the Controller (the entity that determines the purposes and means of the processing). The contact e-mail address of the Organizer for the exercise of the rights of data subjects is: (hereinafter referred to as the "Controller").

PROCESSOR AND SUB-PROCESSOR: The Controller does not utilize its own IT infrastructure to manage the event, but utilizes a specialized cloud software service (SaaS) CarpCup. The provider of this software and IT infrastructure is MIBO-SPRINGS s. r. o. (Company ID: 57 573 361), which acts exclusively in the limited capacity of a technical Processor in relation to the data processed on this domain. The data is not physically stored on the Processor's own hardware, but through a certified sub-processor, WebSupport, s.r.o. (Company ID: 36 421 928), which provides secure hosting and database storage. Both technology companies process data strictly and exclusively based on the Controller's instructions and store it on servers located within the European Union.

Article II.
Purposes, Legal Bases, and the Principle of Pseudonymization (Privacy by Design)

The Controller processes personal data (identification data, age, team name, catch weight, and visual likeness) for the following purposes, whereby, for the purpose of privacy protection, it implements two strictly separated data display regimes:

Registration of participants and generation of internal PDF documents:
For the purposes of valid registration for the competition, identity verification, preparation of starting lists, printing of attendance/GDPR sheets, diplomas, and mandatory sheets for authorities (e.g., the Slovak Anglers Union), the Controller processes full identification data (full first and last name, team name). This full, non-anonymized data is processed exclusively within the non-public (password-protected) administrative interface of the Controller and serves solely for the generation of closed internal PDF files.
Legal basis: Performance of a contract – competition rules (Art. 6(1)(b) GDPR) and the legitimate interest of the Controller in organizing the event.

Publication of results on the public website (Strict pseudonymization):
In accordance with the principles of data protection by design (Privacy by Design) and data protection by default (Privacy by Default), the software on the public domain https://test.carpcup.app automatically applies strict data pseudonymization. Website visitors, the general public, and live results are exclusively shown abbreviated forms of names (first name and the initial of the last name, e.g., "Boris J."), the team name, and catch statistics.
Legal basis: Legitimate interest of the Controller in the transparent publication of the course of the sporting event and the competitor's consent.

Publication of catch photographs with faces (UGC):
An integral part of the fair-play rules of the JABLONICKÝ KAPOR event is the transparent photo documentation of catches. These photographs, capturing the catch along with the visual likeness (face) of the angler, are immediately uploaded to the system and published on the public website https://test.carpcup.app.
Legal basis: Explicit, freely given, and voluntary consent of the data subject granted by signature directly on the attendance sheet prior to the commencement of fishing (Art. 6(1)(a) GDPR).

Article III.
Special Provisions for the Protection of Minors (Under 16 Years of Age)

Given the fact that minors (children) may also actively participate in the fishing competition, the Controller applies a strict regime for their protection in accordance with Article 8 of the GDPR.

If a competition participant is under 16 years of age (on the day of the competition), any processing of their personal data, generation of PDF sheets, and primarily the publication of their visual likeness with a catch on the public website https://test.carpcup.app, is lawful and permissible exclusively on the basis of explicit and demonstrable consent granted by their present legal representative (parent).

The legal representative is obliged to personally grant consent during registration and hand-sign the attendance/GDPR sheet directly next to the name of the minor participant. The legal representative has the right to withdraw this consent on behalf of the child at any time.

Article IV.
Retention Period, Process of Erasure of Photographs from FTP, and Technological Backups

Data expiration and archive: Unless otherwise agreed with the software provider for the annual edition 0000 (paid annual archive), the entire platform at the address https://test.carpcup.app and all data contained therein (databases, team profiles, uploaded photographs) shall be irretrievably destroyed within 72 hours following the official conclusion of the competition JABLONICKÝ KAPOR. In the case of a paid archive, the data is published on the website for exactly one (1) year and subsequently permanently erased. The Controller bears exclusive liability for the retention of off-line PDF documents.

Critical process for exercising the right to erasure of a photograph (Right to be forgotten from FTP):
If a competitor (or legal representative) requests the Controller via e-mail at or verbally via a referee to erase their photograph from the website, the process takes place in two necessary steps:
a) The Controller shall immediately hide/delete the respective catch within its Client Interface, whereby the photograph promptly disappears from the public front-end of the website https://test.carpcup.app.
b) Since the Controller, for security reasons, does not possess access to the deep FTP storage, it holds a strict contractual and notification obligation to immediately contact the technical Processor (MIBO-SPRINGS s. r. o.) and provide it with the exact address (URL) of the given image. The Processor shall subsequently execute a manual and permanent physical erasure of the subject photograph directly from the FTP server, thereby preventing its availability via a so-called direct link.

TECHNOLOGICAL EXCEPTION FOR HOSTING BACKUPS (Backups):
The data subject (angler) explicitly acknowledges and accepts the fact that to ensure cyber security, protection against downtimes, data loss, and ransomware attacks (Disaster Recovery), the sub-processor (WebSupport, s.r.o.) operates comprehensive, automatic, and strongly encrypted backups of the entire server environment. For this technological reason, any erased data (even following the exercise of the right to erasure of a photograph, or after the total termination of the website within 72 hours) will continue to exist transiently in these passive and offline backups for a period of 14 to 30 calendar days until they are automatically overwritten and permanently destroyed by the server's retention cycle. During this protective period, this data is not accessed, is not processed for other purposes, is not publicly visible, and its temporary technological existence in encrypted backups is not deemed a breach of the GDPR or the data subject's right to be forgotten.

Article V.
Data Flows from Forms and the Carp Cup Cup Competition

Contact form: Any messages sent from the website https://test.carpcup.app are not stored by the Processor in the web database. They are routed directly (via SMTP) to the e-mail of the Controller: .

Transfer to the Competition: If a participant grants a voluntary separate consent (Double Opt-in) during registration, they consent to the transfer of data regarding their heaviest catch (abbreviated name, team name, weight, and photograph) to the Processor, MIBO-SPRINGS s. r. o., which, subsequent to the transfer, acting as a new Controller, will incorporate them into the pan-European Hall of Fame on the website carpcup.app and, following their strict anonymization, utilize them for AI training.

Article VI.
Rights of Data Subjects and Contacts

Every data subject holds the following rights vis-à-vis the Controller (Organizer):

Right of access to their personal data.

Right to rectification of inaccurate or incomplete data.

Right to restriction of processing and right to data portability.

Right to withdraw granted consent at any time and free of charge, and the Right to erasure, which is subject to the precise procedure and technological exception defined in Article IV of this Policy.

For the exercise of all the aforementioned rights, as well as for any inquiries regarding privacy protection at this event, the exclusive contact e-mail of the Controller shall be used: . Technical Processors are not authorized to handle direct requests from anglers without the cooperation of the Organizer.
If a data subject believes that unlawful processing of their personal data is occurring, they have the right to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (www.dataprotection.gov.sk).

This Policy shall enter into force and effect at the moment of its publication on the website https://test.carpcup.app.