Yarmill is an application accessible on the website https://yarmill.com. It is a web and mobile application developed and managed by us, the company Yarmill, s.r.o., company ID 06990258, with its registered office at Lublaňská 267/12, Vinohrady, 120 00 Prague 2, incorporated under the laws of the Czech Republic, registered in the commercial register kept by Municipal Court in Prague under file No. C 292640.
The application serves as a sports diary. Athletes can enter data about their training sessions, sport-related facts, current status and other training-related data into the application. The application may also be used by coaches and organizations, who can create plans, analyses and customize their athletes' training sessions to the maximum extent possible.
Since the application will be used by other legal entities (for example, sports associations) that have entered into a contract with us and have granted you permission to use our application, we will be in the position of both a data controller and a data processor. The data controller is the entity that determines the purposes and means of the processing of personal data, i.e., determines what will happen to the personal data, decides how long it will be stored and primarily handles your rights. A processor is an entity that processes personal data of data subjects for other controllers on their instructions.
If you do not understand terms used in the field of data protection, we recommend you to check the https://uoou.gov.cz/urad/nejdulezitejsi-pojmy.
Yarmill as a Personal Data Controller
As data controller, we would like to inform you of the following in this policy:
- what personal data we will process about you;
- how we use personal data we collect and on what legal basis;
- who has access to your personal data;
- for how long we will process your personal data;
- under what reasons we send you emails;
- how we process personal data on the basis of your consent to the processing of personal data;
- what rights you have in relation to the protection of your personal data. If you have any questions, please feel free to email us at hello@yarmill.com.
1.0What Personal Data We Will Process About You
The following personal data will be processed in the application:
- Personal data related to your device on which you use the application. In connection with your use of the application, we may process personal data related to your device, such as user ID, device data, information about errors and crashes of the application, data stored when you use the application, and other information related to the technical operation of the application.
- Personal data you provide to us. This is your personal data that you provide to us when you communicate with us. In particular, it is data that you enter into the application when you register or that you enter when you use the application. This may include, but is not limited to, the following categories of personal data:
- identification data - first name, last name;
- gender and date of birth data;
- contact details - email address, telephone number;
- data that you enter into your training diary, such as data about activities you have done, heart rate, body measurements, training plan, photos and other documents that can be entered into the application, attendance, results of races or matches, information about performance, functional tests, including so-called special categories of personal data and other data that may vary according to the type of sport you do.
- Data we receive from external parties. Our application also allows you to link data from other applications, such as smartwatches or other measuring devices, publicly available databases of sports results, etc.
2.0How We Use the Information Obtained and on What Legal Basis
- We use your device-related data for the purposes of ensuring the functionality of the application, including providing support, troubleshooting any issues, and sharing this data with analytics tools that help us with application functionality. The legal basis for this processing is our legitimate interest under Article 6(1)(f) GDPR. The legitimate interest consists of improving the stability and functionality of the application or to ensure data security. When we provide you with support and resolve any problems, we will do so on the basis of a mutual contractual relationship and the legal basis for processing will be Article 6(1)(b) GDPR.
- We use the data you provide to us to ensure the functioning of the application as well as for our own analytical and statistical activities so that we can continuously improve the application and adapt it to the requirements you expect from the application. We may also use the data to protect our own claims and interests. The processing in this case is again based on our legitimate interest according to Article 6(1)(f) GDPR, which consists of creating our own analyses, ensuring the functionality of the application and security, including improving the functionalities offered by the application and the entire project.
- We also use the data you provide when using the application for the purposes of registering and offering services, functionalities and ensuring the accessibility of the application. The legal basis for this processing is the necessity for the performance of the contract according to Article 6(1)(b) GDPR. Without providing the data in the registration form, it is not possible to use the application and its functions. In the event that your personal data is classified as special categories of personal data, the legal basis for processing will be your explicit consent according to Article 9(2)(a) GDPR, whereby we will use the special categories of personal data for the performance of a contractual obligation and purposes based on our legitimate interest as set out above.
- We may also use your email address to send you commercial communications and to communicate news about the application. Please see section 5 of this policy below for more information.
- We use the data we collect from external parties for the purposes of tailoring the application to your needs, evaluating larger analyses, and combining the data with other data you enter within the application. We will only ever use data for these purposes when you have given us your consent to process your personal data in accordance with Article 6(1)(a) GDPR for each external entity separately. You have the option to refuse further sharing of this data at any time, directly in the application settings. Further information regarding consent can be found in section 6 of this policy.
- The application may also use third-party services to help us optimize the look of the application, ensure its operation and make improvements. For this purpose, we will process personal data either on the basis of our legitimate interest under Article 6(1)(f) GDPR, which is to ensure the improvement of the application, or on the basis of your consent under Article 6(1)(a). Before processing on the basis of consent, we will explicitly request this consent from you and communicate all essential elements. Your personal data will only be processed for the purposes set out above. However, it should be noted that these are only the purposes set by us as data controllers. As you often do sport under a specific organisation (sports association), other purposes may be determined by that organisation.
The application is primarily intended for persons over the age of 15. However, athletes under the age of 15 can also use the application. In this case, a legal representative is needed to give consent for the use of the application.
3.0Who Has Access to Your Personal Data
In order to ensure the functionality of the application, some data may be sent to other recipients of personal data. Recipient means any external entity to which the data is sent, and which further handles the data, whether as a controller or processor of personal data.
If we transfer data to other recipients, we always do so on the basis of sufficient legal safeguards or mutual agreements. Providers may vary from sport to sport.
As there is a mobile and web version of our application, the list of recipients also differs. The breakdowns are as follows:
| Name of the recipient | Reason for handover | Safeguards |
|---|---|---|
| Microsoft Corporation | Data storage and backup. | If you are from the EU, we will mainly use storage facilities in the EU. If you are not from the EU or personal data of an EU citizen is transferred outside the EU, this transfer is governed by standard contractual clauses. We also comply with all security rules and standards that Microsoft establishes and adheres to. |
| Google Ireland Limited (Google Analytics) | Analyzing and ensuring the functionality of the application. | The company is located in the EU. |
| Functional Software Inc. (Sentry application) | Ensuring the functioning and operation of the application. | Data is transferred under standard contractual clauses. |
| Name of the recipient | Reason for handover | Safeguards |
|---|---|---|
| Microsoft Corporation | Data storage and backup. | If you are from the EU, we will mainly use storage facilities in the EU. If you are not from the EU or personal data of an EU citizen is transferred outside the EU, this transfer is governed by standard contractual clauses. We also comply with all security rules and standards that Microsoft establishes and adheres to. |
| Google Ireland Limited (Firebase services) | Analysis, ensuring the functionality of the application and informing about errors in the application. | The company is located in the EU. |
| Apple Inc. | Ensuring the functioning and operation of the application, including basic analyses. | Only anonymised data is sent. |
Whether you use the mobile or web application, the recipients of your personal data are as follows:
- Coaches
- Persons who have right to view your data.
- The administrators of the application of a specific sports organization (associations) or our company who work with your training plans and the information you provide. The reason for transfer in this is that you work for the sports organization and the organization has purchased a license from us to use the application, or the several organizations have mutually agreed to share data between them. If you are interested in knowing to whom the data is transferred in your case, please do not hesitate to contact us at hello@yarmill.com.
4.0For How Long We Will Process Your Personal Data
As data controllers, we will only process your personal data for as long as there is a purpose for processing it. The retention period will vary, with many variables affecting the length of retention. The criteria used to determine the retention period include:
- Have you provided us with data for the purpose of keeping a sports diary or creating an account by registration in application? We will retain personal information for as long as you use the application, or as long as required by your sports organisation and us for analysis purposes.
- Do you expect us to keep the data for as long as you instruct us to delete it? We will delete the data at your request.
- Have you given your consent to the processing of your personal data? If yes, we will only process the data for the period of consent provided.
- Are we subject to legal, contractual or similar obligations to retain the data? Examples include laws governing mandatory data retention, government regulations to retain data related to investigations or data that must be retained for litigation purposes.
5.0Did You Receive an E-mail From Us?
When you register for our application, you enter your e-mail address. We use this not only to fulfil our mutual contractual obligations, but also to send you information about news in our application or interesting facts about the area you are interested in and about which you enter your data into the application.
Law stipulates that this e-mail sent is considered as a business (commercial) message. Since you are our user who have registered via our website and have downloaded our application to your mobile device, if applicable, we will send e-mails on the basis of so-called direct marketing. You have the option to refuse the sending of commercial communications at any time, either by replying to the e-mail from which the communication was sent to you, or in the settings of your user account in the application. At the same time, you can choose not to receive commercial communications when you register.
However, not all e-mails you receive from us may be commercial communications. If, for example, there is a change to this privacy policy, or if there are facts that may affect the use of the application, we will inform you by e-mail and this e-mail is not considered as business (commercial) message, or we will inform you via the application itself.
6.0Consent to Data Sharing
When you log in to the application, you will be asked to consent to the processing of specific categories of personal data. The reason for this is that the application is largely built on the processing of such data, so it cannot be fully used without your consent. The reason why consent is generally obtained when registering for the application is that entering special categories of personal data is at your own will and you can do so at any time during the use of the application. The purpose of this will be, among other things, to ensure the correct functioning of the application and the possible management and correction of errors in the application. You give your consent for the duration of your use of the application. You have the right to withdraw your consent at any time, but in this case the functionalities of the application may no longer be available.
In the settings of the application, you can choose whether to use data from external applications, such as smartwatch applications, other measurement tools or public data containing race results. We currently work with several companies and organizations that provide this information, and you can find an overview of these external entities in your profile settings. This may include information about your location, health, and other areas that a particular application provides.
In your profile settings, you can also choose which companies and organizations you consent to share data with. By clicking the "Link" button, you are giving explicit consent to store data in our application. We will then work with the data further, provide you with outputs from the data, etc. We will store the data in our application for as long as you have enabled linking to a specific application or public database. You can also opt out of data sharing in the settings of individual application providers, which should include an option to disable sharing with our application. Withdrawal of consent does not affect the lawfulness of processing based on consent that was given prior to withdrawal.
It may also be the case that data sharing is required by the sports organisation under which you play sport. In this case, we will also ask you for your consent to share the data in the application. However, we will provide consent for the individual sports organisations that are the data controllers for this specific purpose. You must therefore contact these data controllers with any requests.
7.0What Rights You Have in Relation to the Protection of Your Personal Data
You have the following rights in relation to our processing of your personal data (i.e., where we act as data controller):
- the right to access your personal data;
- the right to rectification;
- the right to erasure ("right to be forgotten");
- the right to restriction of data processing;
- the right to object to processing;
- the right to data portability;
- the right to withdraw consent;
- the right to file a complaint with respect to personal data processing. Your rights are explained below to give you a clearer idea of their content.
The right of access means that you can ask us at any time to confirm whether or not the personal data concerning you are being processed and, if so, for what purposes, to what extent, to whom they are disclosed, how long we will process them, whether you have the right to rectification, erasure, restriction of processing or to object, where we obtained the personal data and whether automated decision-making, including possible profiling, is taking place on the basis of the processing of your personal data. You also have the right to obtain a copy of your personal data, the first provision of which is free of charge, and we may charge a reasonable administrative fee of CZK 5,000 for any further provision. You can see most of the personal data we process in the application, but if you have a specific query about, for example, the processing time, please do not hesitate to contact us.
The right to rectification means that you can ask us to correct or complete your personal data at any time should it be inaccurate or incomplete. The right to rectification of personal data is also provided in the application itself, where you can edit the data you have entered.
The right to erasure means that we must erase your personal data if (i) it is no longer necessary for the purposes for which it was collected or otherwise processed, (ii) the processing is unlawful, (iii) you object to the processing and there are no overriding legitimate grounds for the processing, (iv) this is required of us based on a legal duty, or (v) in relation to personal data for which you have given consent to the processing, you withdraw that consent.
The right to restriction of data processing means that until we have resolved any disputed issues regarding the processing of your personal data, we may not process your personal data other than by storing it and, where appropriate, using it only with your consent or for the establishment, exercise or defence of legal claims.
The right to object means that you can object to us processing your personal data for direct marketing purposes or for legitimate interest, including profiling based on our legitimate interest. If you object to processing for direct marketing purposes, your personal data will no longer be processed for these purposes. If you object to processing based on other grounds, we will evaluate the objection and then tell you whether we have complied with the objection and will no longer process your data, or that the objection was not justified and processing will continue. In any event, processing will be restricted until the objection is resolved.
The right to data portability means that you have the right to obtain personal data relating to you which you have provided to us on the basis of consent or a contract and which is also processed by automated means, in a structured, commonly used and machine-readable format, and the right to have that personal data transmitted directly to another controller where technically feasible.
The right to withdraw consent means that you have the possibility at any time to withdraw the consent you have given us to process your personal data for the specific purposes for which consent is required. Withdrawal of consent does not affect the lawfulness of processing based on consent given prior to withdrawal.
If you have a comment or complaint about data protection or a question about the person responsible for data protection in our company or exercise any of your rights, please contact us at hello@yarmill.com.
Our activities are also supervised by the Office for Personal Data Protection, to whom you can file a complaint if you are dissatisfied. You can find out more on the website of the Office (https://uoou.gov.cz).
Yarmill as a Personal Data Processor
As mentioned above, we act in a dual position as a data controller and a data processor. How we handle data as a data controller is set out above in this policy.
However, our application is used by various sports organisations, sports associations and other entities that sponsor certain areas of sport, employ specific athletes or associate them. The application is also used by coaches who can enter training plans into the application, monitor their performance, etc. The application serves as a sports diary not only for you, but also for many external entities with which you cooperate.
In these cases, the specific sports organisation/coach/association determines the scope of permissions, the way the application is used and the purposes for which the data in the application will be used. We only act as so-called data processors and only do with the data what the data controllers instruct us to do. Our relationship is governed by a processing agreement, and we do not use the data for anything other than the purposes they specify.
You can therefore find out why personal data is processed, how long it is retained or on what legal basis from these data controllers. You must also exercise the rights that you have as a data subject in relation to these purposes with the specific data controllers. We will, of course, cooperate with all controllers and if you contact us with a request for the processing of a right, we will do everything in our power to forward the request to the controller and comply with your request.
Changes of the Policy
This Policy may be amended from time to time. We will post any changes to the Privacy Policy at https://yarmill.com/legal/archive and will notify you in more detail if there are significant changes (for some services, we may notify you of policy changes by e-mail). We archive previous versions of this policy for you to access in the future.