1. Subject of the General Terms of Use
   1. These General Terms of Use (hereinafter: “General Terms“) govern the conditions and manner of using the software, i.e. the Elevien application as defined below (hereinafter: “Application“) as a service provided to the Owner or the User as defined below, by the company Elevien d.o.o. with its business seat in Osijek, Ulica kralja Zvonimira 5, OIB: 81460325089, or its related persons and/or any other person authorized by Elevien to contract the services of the Application (hereinafter: “Elevien“).
   2. These General Terms are binding for Elevien on the one hand and for the Owner or User who access the General Terms for the purpose of using the Application, on the other hand, and these General Terms form an integral part of the contract between the aforementioned parties.
2. Definitions
   1. Competition is a term that denotes:
      1. sports competition within the meaning of the Sports Act, or
      2. competition of sports teams or individual athletes that is not a sports competition in the sense of the Sports Act, i.e. any form of participation in competition for the purpose of achieving sports results, regardless of the number of participants or the fact of the participation of judges.
   2. Owner is a term that denotes any legal or physical person, including, but not limited to, an authorized sports federation or association (sports club), which acts as an organizer of the Competition with the help of the Application and which assumes obligations and responsibilities in the role of the Owner as further defined in these General Terms. For the avoidance of doubt, the national sports association should be considered the Owner for the purposes of these General Terms if it acts in the capacity of an organizer in accordance with the Sports Act.
   3. Application represents a software solution that serves as an application for the organization, judging and/or transmission of Competitions. For the avoidance of doubt, one function of the Application does not exclude others.
   4. The application enables the use of the following functions:
      1. documenting the Competition in digital form;
      2. digital storage of results and/or recordings of performances (the option of making videos and participating via video is not a requirement);
      3. printing of results in pdf and Excel formats for the needs of written documentation and distribution of results;
      4. review of recordings on a mobile phone during or after the competition;
      5. associating each performance with the assigned grade;
      6. review of recordings by selecting (filtering) according to individual competitor; and
      7. easy and free sharing of recordings to anyone interested in viewing via any digital communication channel.
   5. User is a term that denotes a natural person who is registering for accessing the Application either as (i) Gymnast, (ii) Judge, (iii) Recorder, (iv) Administrator and/or (v) any other a person who is registering for accessing the Application, i.e., Viewer.
   6. Competitor means the User who competes in the Competition and who has been designated as such by the Owner or Administrator in the Competition settings in the Application.
   7. Judge means the User who judges the Competition, i.e. enters the ratings for each Gymnast’s performance and who was designated as such by the Owner or Administrator in the Competition settings in the Application.
   8. Recorder means the User who has the authority to store on the Application videos of performances from the Competition and to remove from the Application videos that they themselves have stored, and which the Owner or Administrator has designated as such in the Competition settings in the Application.
   9. Administrator means the User who has the authority to change data about the Competition and the authority to change the authorizations of other categories of Users and who has been designated as such by the Owner in the Competition settings in the Application.
   10. The viewer means a User who is not a Gymnast, Judge, Recorder or Administrator.
   11. Terms are an act within the meaning of Article 28, paragraph 3 of the General Regulation on the Protection of Personal Data (GDPR) and which essentially regulate the relationship between the Owner as the Controller and Elevien as the Processor in relation to the processing of the Data Subject’s personal data via the Application – Terms of personal data processing through the Application (Appendix 1).
   12. Territory means the geographic locations in relation to which the right to use the Application is established for the Owner as determined by this Agreement, and it applies to the whole world.
   13. General Data Protection Regulation (GDPR) is the REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
   14. Applicable law means the law of the Republic of Croatia (as well as other supranational rules that are applicable in the legal order of the Republic of Croatia) which also includes, but for the purposes of these General Conditions, is not limited to the Governing Law for the processing of personal data.
   15. Governing law for the processing of personal data refers to the General Data Protection Regulation (GDPR) and the Act on the Implementation of the General Data Protection Regulation (Zakon o provedbi opće uredbe o zaštiti podataka), Official Gazette no. 42/2018.
   16. ZASP means the Law on Copyright and Related Rights (Zakon o autorskom i srodnim pravima, Official Gazette No. 111/2021) as well as all subsequent amendments to the said law to the extent that the provisions of any subsequent amendments to this law apply to the Agreement in question and if they do not conflict with the meaning of the provisions of this Agreement, i.e. with the sense of referring to the law in question in the context of this Agreement.
   17. Sports Act means the Sports Act (Zakon o sportu, Official Gazette No. 141/2022), as well as all subsequent amendments to the aforementioned law.
3. Functions and the methods of using the Application
   1. Elevien establishes for each Owner and User a non-exclusive, non-transferable, substantially and spatially limited right to use the Application worldwide, exclusively in the manner and in accordance with the provisions of these General Terms.
   2. Pursuant to the previous paragraph, the Owner exercises the right to use the Application for the purposes of organization, judging and/or transmission of the Competition, and, except for viewing the content uploaded to the Application to which he is authorized to access, has only the following powers, i.e. can only take the following actions:
      1. to start a new Competition and enter and change data about a started Competition;
      2. to enter and change information about Users who participate in the Competition in any way, including, but not limited to entering the personal information of Gymnasts and/or Judges, which at the same time gives these persons a corresponding access to the Competition;
      3. to upload videos from their own device to the Application and to download videos from the Application to their own device;
      4. to record a video of the Gymnast’s performance through the Application while storing it on their own device;
      5. to remove from the Application the videos of each individual performance by the Gymnast;
      6. to provide third parties with a link that enables access to the Application as a Viewer;
      7. to transfer some of their powers to Users, i.e. to appoint them as Administrators and/or Recorders.
   3. Each User exercises the right to use the Application exclusively through: (i) the right to view the content available on the Application, including but not limited to the recordings of the Competition to which it has access and the accompanying performance evaluations, (ii) the right to provide third parties with a link that enables access to the Application as a Viewer in relation to a Competition that User already has access to, (iii) the right to record videos through the Application with storing it on their own device, but at the same time User has no right to add new content in any way to the Application nor change the existing one in any way unless otherwise stated in these Terms.
   4. Regardless of the previous paragraph, certain categories of Users also have the following additional rights:
      1. A user who is a Gymnast has the right to enter and change data relating to themselves and the right to download videos of their own performances from the Application to their own device, both only in case when they are designated as a Gymnast in the Applications settings with their phone number;
      2. The User who is a Judge has the authority to judge, i.e. enter into the Application the evaluations of the Competitors’ performance;
      3. The user who is the Recorder has the right to enter and change data relating to Gymnasts, as well as the rights from point 3.2.3. and 3.2.4. in the full extent, and the right from point 3.2.5. only in relation to the videos that they themselves uploaded to the Application;
      4. A user who is an Administrator has the rights from point 3.2.1. to 3.2.7.
   5. If, as a result of the organization of the Competition, which includes the services of the Application, there is an obligation to pay any related costs, such costs shall be borne solely by the Owner.
   6. Elevien is obligated to enable technically correct functioning of the Application so that it supports:
      1. the function of accurate automatic calculation of final grades respecting all the rules prescribed by the International Gymnastics Federation (FIG);
      2. the function of displaying the results in pdf and/or excel format for the purpose of additionally documenting a Competition and distribution of the results through non-digital channels.
      3. the function of storing (uploading) high-quality videos of each individual performance accompanied by a final rating;
      4. the function of simple and free sharing of the sports competition to persons authorized by the Owner via any desired digital communication channel;
      5. the function of accessing the Competition during and after its holding, i.e. that the Application enables viewing of recordings “on demand”;
      6. recording function with any smartphone directly within the Application or outside it using the mobile phone camera and subsequent uploading of the footage from the mobile phone gallery.
   7. Deviating from the previous paragraph of this article, Elevien will not be responsible for any damage caused to the Owner or the User due to the technically incorrect functioning of the Application, if such malfunction is not the result of the intention or gross negligence of Elevien.
   8. In order to access the Application and have insight into the posted content, the Owner and/or User must register or create an account. By creating an account or using the Application in any way, each person acknowledges:
      1. to be 16 years of age or older;
      2. that he has the consent of his parents or legal guardian to use the Application if he is under 16 years of age;
      3. that all the information provided is true, accurate, complete and timely updated;
      4. that the provided data does not represent identity theft or violation of the rights of a third party in any aspect;
      5. in the case of registration on behalf of a federation, club, association or other legal entity, that the person registering has the right and authority to agree to these General Terms on behalf of the federation, club, association or other legal entity.
   9. Elevien reserves the right to terminate the account of a person if it can be reasonably believed that a person is under 16 years of age, and is using the Application without the consent of a parent or legal guardian.
   10. If a person uses the verification of other service providers such as Facebook, Twitter, Google, etc. during the process of creating an account or accessing the Application, they automatically comply with their terms of service / use as well as these General Terms.
   11. In the event that the Application is used to organize, judge and/or transmit the Competition in the sense of point 2.1.1, the Owner is obliged to collect and enter the following data into the Application, at least one hour before the start of the Competition:
       1. data about the Competition: name of the competition, discipline (for example Men’s Sports Gymnastics or Women’s Sports Gymnastics or both), date and time of the start of the competition, list of apparatus or disciplines in which the competitors are competing, list of age categories/competition programs, number of allowed attempts on the vault, the number of apparatus on which gymnasts perform at the same time;
       2. data about the Gymnasts: name, surname and mobile phone number of the Gymnast, but the mobile phone number is not mandatory information in this case;
       3. data about the Judges: name, surname and mobile phone number of the Judge.
   12. In the event that the Application is used for the organization and/or transmission of the Competition in the sense of point 2.1.2, the Owner is not obliged to use the Application for judging or to enter information about the judges, and the Owner may enter the data specified in paragraph 3.11. without obligation to respect any deadline.
   13. The Owner can use the Application while simultaneously using existing (non-digital) methods and tools (for example, but not exclusively, other software solutions, applications and similar).
   14. The Owner can organize the competition using the Application independently or with the help of employees and other authorized persons of Elevien, and if he decides to do the latter, the Owner must at least, but not exclusively: (i) deliver all the above information to Elevien’s employees or other authorized persons weeks before the start Competitions, but in any case no later than 24 hours before the start of a Competition, together with evidence that the Owner has a valid legal basis for processing personal data and may transfer them to Elevien, (ii) allow Elevien’s employees or other authorized persons access to the hall if help with the recording of the competition is needed and (iii) enable Elevien’s employees or other authorized persons to access technical aids as needed and upon request (for example, but not exclusively, power sockets, chargers, printer, central computer program and the like).
   15. In addition to all of the above, and for the purpose of ensuring high standards of privacy protection and security of personal data of the User and all other natural persons whose personal data (as that term is defined by the Applicable Law) is processed using the Application, and especially for the purpose of protecting minors, each Owner is obligated, during the whole time of using the Application, to ensure that authorizations for access to content related to a particular Competition, such as recordings and personal data of participants which are available on the Application, are not given to persons who have no interest in accessing and participating in a particular Competition in the role of gymnasts, trainers or professional staff, referees or spectators.
   16. The Owner expressly guarantees that it has a valid legal basis for collecting and processing the personal data of the User and all other natural persons whose personal data (as defined by the Applicable Law) is processed using the Application, as well as for forwarding this data to Elevien or entering it into the system independently and for the storage of such data, including videos, and/or their forwarding to third parties via the Application.
4. Responsibility for using the Application
   1. The Owner is responsible for using the Application in accordance with these General Terms and in the manner defined by the Terms. At the same time, the Owner will be obligated to compensate for any damage resulting from the use of the Application in a way that is not in accordance with these General Terms and in case of any violation of personal data, intellectual property rights or regulatory obligations by the Owner.
   2. Since the Owner gives access to the Competition to persons designated as the Gymnast, the Recorder and the Administrator along with a certain set of rights from point 3.4., the Owner is obligated to ensure that the Gymnast, the Recorder and/or the Administrator use the Application in accordance with these General Terms and in the manner defined by the Terms. The Owner will be responsible for all damages that occur due to using the Application in a way that is not in accordance with these General Terms by the Gymnast, the Recorder and/or the Administrator and in case of any violation of personal data, intellectual property rights or regulatory obligations by the Gymnast, the Recorder and/or the Administrator.
   3. The Owner will be responsible for all damages caused by the fact that the Gymnast, the Recorder and/or the Administrator may have used the Application to process personal data which the Owner, the Gymnast, the Recorder and/or the Administrator has collected without authorization or illegally, or personal data for which there is no legal basis for processing in accordance with the Applicable Law and the Applicable Law for Personal Data Processing.
   4. The Owner is not authorized to change the basic settings of the Application in any way in order to enter or use it for data processing and/or for operations for which the Application is not intended (for example, but not exclusively, storing the Data Subject’s IP address). The Owner will be responsible for any damage caused by such actions of the Owner.
   5. Each person who registers or creates an account is responsible for maintaining the confidentiality of his activation code and login data and for all activities that take place under his account and password, as well as for limiting access to the device through which he uses the Application.
   6. Elevien bears no responsibility, for direct or indirect loss, damage or lost profit caused by the use or inability to use the Application, unless the inability to use the Application is a direct consequence of the action or omission of Elevien which was caused by its intent or gross negligence.
   7. Elevien does not make any guarantees that the functions contained in the Application will be in accordance with the Owner’s needs, nor that the Application will function without difficulties and errors. The Owner assumes full responsibility and risk arising from the choice of the Application as a technology to achieve the intended results, as well as for the results obtained by installing and/or using the Application.
5. Responsibility for content
   1. The Owner is solely responsible for all content that the Owner, the Recorder and/or the Administrator stores in the Application, including but not limited to text, images, videos and web pages. Elevien has no control over the source of such content, does not influence in any way the creation, filtering, obtaining and recording of such content and will not be responsible for the use or misuse of the stored content as well as for any damage that may occur to the Owner, the User or a third party in related to the use or misuse of the content found on the Application and/or related to the operation of the Application.
   2. It is forbidden to store on the Application:
      1. content that represents a threat, insult, defamation, an incentive to discrimination, hatred and/or violence, as well as encouragement to such or other behaviors that would be considered a criminal offense;
      2. content whose use and/or sharing would lead to civil, criminal or misdemeanor liability or would in any other way violate the rights of a third party;
      3. content for the use and/or sharing of which there are no authorizations or consents from authorized persons or it is otherwise illegal;
      4. content that is technically harmful (for example, but not limited to, computer viruses, harmful components, corrupted data or other harmful software or harmful data).
   3. In case of learning about any content that would be against the Applicable Law and any other positive regulations that bind the Owner, as well as if such content could constitute a violation of these General Terms, the Owner will immediately, without delay, inform Elevien, which is authorized to remove such contents from the Application system without delay or consent of the Owner or any third party. If it is doubtful whether any content is against the Applicable Law and other mandatory regulations that may be applicable as stated in the previous sentence, Elevien is authorized to assess on its own, in good faith, whether such content is against positive legal regulations or not, and to remove such content. In doing so, the Owner waives all claims against Elevien, whether contractual or non-contractual.
   4. If Elevien, regardless of the situation described in the previous paragraph 5.3., came to know about the existence of any contents on the Application that would be contrary to the positive Governing Law and any other positive regulations to which the Owner is obliged, Elevien is authorized by itself, without any further approval or consent of the Owner or any third party, to remove the relevant contents from the Application’s system. If it is doubtful whether any content is against the positive legal regulations as stated in the previous sentence, Elevien is authorized to assess on its own, in good faith, whether such content is against the Applicable Law and any other positive regulations to which the Owner is obliged or not,  and remove such content. In doing so, the Owner waives all claims against Elevien, whether contractual or non-contractual,
   5. Elevien reserves the right at any time to suspend or terminate a person’s account and/or prohibit a person from further using the Application in the event that the person’s account or the content transmitted through that account does not comply with these General Terms or otherwise interferes with the use of the Application.
6. Application rights, use and restrictions
   1. All intellectual property rights over the Application, including the name and all technological elements of the software solution that exist or will arise in the future (including but not limited to names, program code, technologies, themes and used elements) belong exclusively to the Elevien company (as this company is defined in the preamble of these General Terms) and the said trading company is the holder of the copyright and all other intellectual property rights over the Application. The Owner and the User do not claim any intellectual property rights on the Application, but only a limited right to use the Application is established for them in accordance with the provisions of these General Terms.
   2. The Owner and/or the User are prohibited from copying, selling, renting, licensing or otherwise distributing and/or providing the Application, in whole or in part, for a fee or without a fee, and are prohibited from enabling other persons to they do.
   3. The Owner and/or the User may not:
      1. reverse engineer or otherwise attempt to obtain the source code of the Application;
      2. adapt or modify the Application or carry out processing or other processing based on the Application;
      3. publish, copy, sell, lend, rent, license or otherwise distribute and/or make the Application available to anyone else for a fee or free of charge, and it is prohibited to enable other persons to do so;
      4. misuse the Application for any commercial purposes;
      5. misuse the Application in such a way that it is used to perform actions that are punishable under the enforcement regulations applicable in the Territory and/or which actions pose a risk of criminal or misdemeanor liability under the enforcement regulations applicable in the Territory;
      6. try to bypass technical protection measures in the Application;
      7. use the Application in any other illegal way, for any illegal purpose or in any way that does not comply with the terms of these General Terms.
   4. The Owner and the User hereby undertake that they will in no way act in a way that can be considered a violation of copyright on a computer program in the sense of Article 278 of the ZASP.
   5. Nothing mentioned in the previous paragraphs in any way derogates from the mandatory regulations of the Governing Law, i.e. Article 208 and 209 of the ZASP.
7. Technical Support
   1. The Owner is provided with technical support through the Ticketing system and via the e-mail address [email protected] for the entire period of use of the Application service.
   2. Technical support will be provided, i.e. put into operation, immediately upon receiveng the notification of an error in the Application’s operation. Any error in the operation of the Application will be corrected within 24 hours. If an error in the operation of the Application is of such a nature that it cannot be corrected within 24 hours of receiving the notification, the Owner will be notified accordingly and will be informed of the reasons and further steps.
8. Protection of personal data
   1. Since for the purpose of performing the service of the Application, Elevien is the Processor and the Owner is the Controller, Appendix 1 of these General Terms contains the Terms. Among other things, the Terms specifically regulate the subject and duration of the processing, the nature and purpose of the processing, the type of personal data and category of the Data Subject and the obligations and rights of the Controller.
   2. In accordance with the Applicable Law, Elevien will be liable only for the damage caused to the Owner, the User or any third party as a result of Elevien’s violation of the Terms and these General Terms.
   3. Since the Owner collects the User’s personal data through the Application, the Owner is obliged to inform the Users in an appropriate manner about the personal data it collects in accordance with Article 13 and 14 of the General Data Protection Regulation. Elevien shall in no way be liable or be obligated to compensate the Owner, the User or any third party for damages if the Owner has not provided the User with adequate notice of the data processed through the Application in accordance with the Applicable Law.
9. Final provisions
   1. These General Terms will be made available when contracting the Application service, on the elevien.com website as well as within the Application.
   2. The Applicable Law applies to these General Terms and all disputes of the addressees of these General Conditions that will arise from these General Terms and/or in connection with them will be resolved in accordance with the Applicable Law and before the competent courts of the Republic of Croatia (if the involved parties fail to resolve the dispute amicably beforehand).
   3. These General Terms shall enter into force on the date specified at the bottom of these General Terms.
   4. All amendments and additions to these General Terms will be made available to the Owners and Users in the same way and they will be informed accordingly about the nature of the amendment. All amendments and additions to these General Terms shall be equally and appropriately applied to the Owners and Users.
   5. In the event that certain provisions of these General Terms are determined to be legally invalid and invalid, the obligations set forth in these General Terms will continue to be performed in the remaining part, and the contracting parties will immediately replace such provision with a provision that is legally valid.

In Osijek, September 20, 2023.

APPENDIX 1

TERMS OF PERSONAL DATA PROCESSING THROUGH THE APPLICATION

1. Subject of the Terms
   1. The subject of these Terms is the processing of personal data through the Application, whereby the company Elevien d.o.o. with its business seat in Osijek, Ulica kralja Zvonimira 5, OIB: 81460325089, or a person related to it and/or any other person authorized by Elevien to contract the services of the Application, acts in the capacity of a processor (hereinafter: “Processor“), while the Owner as defined in the General Terms of Use, acts in the capacity of a controller (hereinafter: “Controller“) as determined by the Applicable Law.
   2. The provisions listed below, as well as the processing of personal data, will apply only in the case when the Processor processes Personal Data on behalf of the Controller based on the General Terms of Use and the agreed terms of cooperation, i.e. during the use of the Application.
2. Definitions
   1. For the purpose of applying these Terms, the following terms have the following meanings:
      1. “Processing System” means categories of Personal Data that are processed as part of the Application service, categories of Data Subjects whose Personal Data are processed and the Purpose of Processing, describes the Processing and contains other information relevant to the description of the process in which personal data is processed within the Application. Notes on the mentioned items are stored within the user’s account on the Application and are available to the Controller and the Processor accordingly. The processing system forms an integral part of these Terms as Appendix 2;
      2. “Data Subject” means the User as determined by the General Terms of Use, that is, a natural person who accesses the Application whose identity has been determined or can be determined;
      3. “Personal Data” means any data relating to an individual whose identity has been determined or can be determined (Data Subject). An identifiable individual is a person who can be identified directly or indirectly, in particular with the help of identifiers such as name, identification number, location data, online identifier or with the help of one or more factors inherent to physical, physiological, genetic, mental , economic, cultural or social identity (according to the definition in the Applicable Law) which is processed by the Processor on behalf of the Controller when enabling the Application services. Categories of Personal Data that are processed as part of the Application service will be defined as part of the Processing System;
      4. “Processing” means any process or set of processes performed on personal data or sets of personal data, whether by automated or non-automated means such as collection, recording, organization, structuring, storage, adaptation or modification, retrieval, inspection, use, disclosure by transfer, dissemination or otherwise making available, matching or combining, restriction, erasure or destruction, in accordance with Applicable Law. The processing of Personal Data based on the General Terms of Use and the agreed terms of cooperation is also specified in the Processing System;
      5. “Personal Data Breach” means any breach of security or privacy that results in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access of Personal Data. For the avoidance of doubt, the above includes any injury caused by an employee or subcontractor of the Processor or any person acting under the authority of the Processor (eg consultants, etc.);
      6. “Third country” a country that is not a member of the European Union (EU) and/or the European Economic Community (EEA).
   2. Other expressions, definitions and terms that are defined in the part of the General Terms of Use are also applied accordingly in these Terms.
3. Purpose of personal data processing
   1. The purpose of the processing of personal data that is the subject of these Terms is to perform the Application service, that is, to enable the use of the Application service by the Controller for the purpose of organizing, judging and/or transmitting the Competition, provided that one function of the Application does not exclude others.
4. Obligations of the Data Controller
   1. The controller implements appropriate technical and organizational measures to ensure and to be able to prove that the processing is carried out in accordance with the Applicable Law.
5. Obligations of the Processor
   1. The Processor will process Personal Data exclusively in accordance with the General Terms of Use, these Terms and in accordance with the needs and instructions of the Controller, which are essentially contained within the Processing System, unless specific Processing is required by the Applicable Law. In this case, the Processor will notify the Controller of the stated legal obligation before the Processing, unless such reporting is prohibited by law due to important reasons of public interest.
   2. The processor shall keep the Personal Data confidential and ensure that the persons authorized to process the Personal Data have committed themselves to confidentiality or are under a corresponding legal obligation of confidentiality.
   3. The processor will undertake and implement all necessary measures in accordance with Article 6 of these Terms (Security of Processing).
   4. The processor will keep records of the processing of personal data in the sense of Article 30, paragraph 2 of the GDPR.
   5. The data processor will appoint a Data Protection Officer, if the prerequisites from Article 37 of the GDPR are met.
   6. The Processor, taking into account the nature of the Processing, will assist the Controller through appropriate technical and organizational measures, as far as possible, to fulfill the Controller’s obligation to respond to requests for exercising the Data Subject’s rights established by the Applicable Law.
   7. The Processor shall assist the Controller in ensuring compliance with the obligations in accordance with the Applicable Law, taking into account the nature of the Processing and the information available to the Processor.
   8. The Processor shall, at the choice of the Controller, delete or return all Personal Data to the Controller after termination of use of the Application service and delete existing copies, unless there is an obligation to store Personal Data in accordance with the law of the Union or the law of a Member State.
   9. The Processor shall make available to the Controller all the information necessary to prove compliance with the obligations set forth in this Article 5 of these Terms and allow supervision undertaken by the Controller or another auditor authorized by the Controller. In this regard, the Processor shall immediately inform the Controller if, in his opinion, a specific instruction violates the Applicable Law or other relevant provisions of the EU member state on the protection of personal data.
   10. The processor will amend the provisions of the General Terms of Use and/or these Terms in order to comply with the obligations of the Applicable Law.
6. Security of processing
   1. Taking into account the latest achievements, implementation costs and the nature, scope, context and purpose of the Processing, as well as risks of different levels of probability and severity for the rights and freedoms of natural persons, the Processor shall implement appropriate technical and organizational measures before any Processing in order to ensure a level of security adequate to the risk, including, among others, as necessary:
      1. pseudonymization and encryption of Personal Data;
      2. ability to ensure permanent confidentiality, integrity, availability and resilience of the Processing system;
      3. the ability to timely establish availability and access to Personal Data in the event of a physical or technical incident;
      4. process for regular testing, evaluation and assessment of the effectiveness of technical and organizational measures to ensure processing security.
   2. When assessing the appropriate level of security, special consideration is given to the risks posed by Processing, especially the risks of accidental or illegal destruction, loss, alteration, unauthorized disclosure of Personal Data or unauthorized access to Personal Data that have been transferred, stored or otherwise Processed.
   3. The Controller and Processor shall take steps to ensure that any natural and legal person acting as an authorized Controller or Processor who thus has access to Personal Data does not process said data except in the manner determined by these Terms, the Applicable Law and in in accordance with any initial instructions and wishes of the Controller regarding the configuration of the Application. An exception is the situation if such a person is obliged to do so under the law of the European Union or the law of an EU member state.
   4. The Processor shall notify the Controller within 24 (twenty-four) hours if it becomes aware of any Personal Data Breach. Such notification will be sent to the contact address of the Data Controller, which is used in normal communication for the needs of the Application, while simultaneously sending a copy to the email [email protected]. When and to the extent that it is not possible to provide all information about a Personal Data Breach at once, the remaining information may be provided in stages, but without undue further delay.
7. Subcontractors of the Processor
   1. By using the services of the Application, the Controller is aware that, due to the need for web analytics services and in order to advance the functionality of the Application, the Processor uses subcontractors, and that there is a possibility that in the future the Processor may have to engage additional subcontractors or change the existing ones. The Controller hereby gives general consent for engaging such subcontractors as Sub-Processors.
   2. In order to ensure the maintenance of a high level of protection of personal data and the security of the Application, the Processor shall make the decision on the selection of individual processing Sub-Processors cautiously and applying a high standard of professional care. The processor will not subcontract any Personal Data Processing without entering into a written contract with the Sub-Processors that will contain obligations to protect personal data as specified in these Terms.
   3. If the Controller does not agree to the subcontracting of the Processing by the Processor, the Controller may terminate cooperation with the Processor in relation to the Application services.
8. Supervision and audit
   1. The Processor has the right, independently or by appointing an independent third party (who is not a competitor of the Processor and with the Processor’s approval), to monitor whether the Processor complies with the obligations from these Terms and whether it acts in accordance with the initial requests and instructions of the Processor. The data processor will cooperate and assist the data controller or the third party performing the audit by providing the requested information, providing the requested documentation, providing access to business premises, IT systems and other means necessary for effective supervision of compliance with the provisions of these Terms.
   2. The Processor shall ensure that the Controller has equal rights in relation to all selected processing subcontractors. The Processor may offer alternative monitoring solutions, for example an audit performed by an independent third party, which the Controller may or may not accept.
   3. The supervision referred to in this article must be announced to the Processor no later than 30 days before it takes place, and must be carried out based on a framework plan that will be agreed upon by the Controller and the Processor before the supervision is carried out. In the event that they fail to agree on an outline plan, the Data Controller has the right to determine it independently.
   4. The processor will provide the supervisory authority responsible for data protection at the level of the Republic of Croatia or the EU, the possibility of conducting surveillance in the business premises of the processor.
   5. In the event that any body responsible for data protection or another (supervisory) body initiates a review of the Processing of Personal Data by the Controller, or if the Data Subject submits a complaint against the Controller, and the subject is related to the Processing which is assumed to have been carried out by on the part of the Processor, the Processor will assist the Controller with documentation and other information related to the processing, in order to enable the Controller to satisfy the competent authorities in their supervision and respond to any complaint.
9. Additional protective measures
   1. Notice: The Processor shall constantly and timely provide the Controller with all current information about the Processing, which the Controller may reasonably request when necessary to fulfill its obligations under the Applicable Law.
   2. Violations of Personal Data: At the request of the Controller, the Processor will cooperate with the Controller and provide him with information about the nature, circumstances and causes of the Personal Data Breach. The processor will take all actions necessary to prevent further losses or otherwise limit the consequences of a Personal Data Breach. The processor will conduct a professional forensic and security check and audit regarding the Personal Data Breach. Breach of Personal Data will be resolved in accordance with the Applicable Law and the instructions that the Controller may give to the Processor.
   3. Obligation cooperation in order to ensure the Data Subject’s rights: The Processor will, if requested by the Data Controller, at no additional cost to the Data Controller or the Data Subjects:
      1. immediately deliver to the Controller a copy of the Personal Data in an understandable form, and/or
      2. according to the decision of the Controller, at any time provide them with access to Personal Data, and/or
      3. immediately modify, correct, block or delete Personal Data in the manner prescribed by the Applicable Law.
   4. Dealing with requests and complaints from public entities: depending on what is permitted by the Applicable Law, in the event that the Processor receives a request or complaint from a competent authority regarding any Personal Data, it will notify the Controller without delay indicating which competent authority is involved, the scope of the request and the basis stated in the request or complaints. In this regard, the Processor shall without delay send the request or complaint of the Competent Authority to the Controller so that the Controller responds to the request or complaint of the Competent Authority after consultation with the Processor, unless otherwise determined by the Applicable Law or other law applicable to these Terms.

APPENDIX 2

PROCESSING SYSTEM

Purpose of Processing:

Facilitating the organization of gymnastics competitions, their judging and transmission, whether they take place live, remotely (online) or in a hybrid form.

Data Subject categories:

Physical persons who have access to the Application, whether gymnasts (competitors), judges, recorders, viewers and organizers of a sports competition or members of the coaching and/or professional team related to an individual participant of a competition and/or sports club or sports federation.

Categories of Personal Data:

1. Mandatory data: network identifier.
2. Optional data: name/names, current surname/surnames, face and body footage, mobile phone number, information about the country from which the person comes, information on membership in a gymnastics club or other association that is a member of the Croatian Gymnastics Federation or another foreign gymnastics federation.