Consent for usage of data

---

Declaration of consent and privacy policy

The German Aerospace Center (in the following "DLR"), takes the protection of your personal data, which you provide us in your capacity as a participant (m/f/d) of TaFMAC (Track and Field Master Athletics Cohort study), very seriously.

Before you start filling out the registration form, we would like to inform you about the personal data we process in the context of this membership, for how long and for what purposes we do this and provide you with further information required by data protection law.

In accordance with the GDPR and the BDSG, we use the terms defined in the GDPR and the BDSG. The definitions can be viewed on the Internet, for the GDPR and for the BDSG .

1. Name and address of the person responsible

Responsible in the sense of the GDPR is: Deutsches Zentrum für Luft- und Raumfahrt e. V. (DLR)

Linder Höhe, 51147 Cologne, Germany, Phone: +49 2203 601-0, Internet: https://www.dlr.de

2. Name and address of the data protection officer (DPO)

Data protection officer Uwe Gorschütz, Linder Höhe, 51147 Cologne, Germany, e-mail: datenschutz@dlr.de

3. Purpose for data processing

Purpose of the data processing is to create a valuable data resource of international track and field master athletes to address a wide range of scientific questions on sports participation, training regimes and age-related changes in function and health status including an assessment of the risks and benefits of track and field athletics participation for fitness, health, autonomy and social participation in older people.

4. Legal basis for data processing

The legal basis for the processing is Article 6 paragraph 1 letter a) of the GDPR, Article 9 paragraph 2 letter a) and Article 89 GDPR in conjunction with § ARTICLE 27 BDSG.

Important note; due to the legal basis Art. 89 para. 2 GDPR (scientific research) is invoked subject to the exceptions to the rights under Articles 15, 16, 18 and 21. See point Rights in relation to your personal data

5. Categories of data

Procedure	Data	Legal basis
Athlete registration	Last name, First name, date of birth, gender, email address, preferred language	Article 6 (1) (a) GDPR
Medical data	Jump test, body composition, anthropometrics, ultrasound, blood analysis, spirometry, ECG, questionnaires, cognitive-fitness-test, resting metabolism, gait speed, grip strength, sports performance, history of injuries, training programme, social-economic aspects, muscle stiffness, skin thickness at shank	Article 6 (1) (a) GDPR, Article 9 (2) (a) GDPR, Article 89 GDPR in conjunction with §27 BDSG

6. Receiver/third party

The pseudonymized medical-scientific data (see listed in point 5) will be transferred to external partners to a cooperation in part for common scientific research. Following external cooperation partners will receive pseudonymized data in part:

• Prof. Dr. Mary Breheny, Massey University, School of Health Sciences, Palmerston North, Neuseeland
• Prof. Dr. Nicola Maffulli, University of Salerno, Department of Trauma and Orthopaedic Surgery, Salerno, Italien
• Prof. Dr. Hirofumi Tanaka, University of Texas, Department of Kinesiology and Health Education, Austin, USA
• Prof. Dr. Phil Chilibeck, College of Kinesiology, University of Saskatchewan, Kanada
• Prof. Dr. Daniel Arvidsson, University of Gothenburg, Department of Food and Nutrition, and Sport Science, Göteborg, Schweden
• Prof. Dr. Wilhelm Bloch, Deutsche Sporthochschule Köln, Institut für Kreislaufforschung und Sportmedizin, Köln, Deutschland
• Prof. Dr. Eri Miyamoto Mikami, Juntendo University, Graduate School of Health and Sport Science, Inzai City, Japan
• Prof. Robert Olek, Poznan University of Physical Education, Athletics, Strength and Conditioning, Posen, Polen
• Dr. Zsolt Radak, Hungarian University of Sport Science, Budapest, Ungarn
• Prof. Dr. Alexander Pfeifer, Universität Bonn, Institut für Pharmakologie und Toxikologie, Bonn, Deutschland

7. Retention

The personal data is stored on external web hosting. After completing the registration and booking, the personal data is stored in encrypted form on a DLR server. A REDCap system is also operated on external web hosting, which is used to store individual data. This server can be reached via the Internet, but is extra protected by the specified security mechanisms. The complete data sets will be stored on coded hard disks of the measurement notebooks as well as on coded external hard disks. Additionally, the data sets will be transferred via secure VPN-connection on a DLR-hosted server. The web hosting is provided and maintained by the company IONOS. There is an order data processing contract with the provider. The external hard disks are maintained by the department of muscle and bone metabolism of the Institute of Aerospace Medicine, the DLR-server are maintained by ComputaCenter and the IT team of the Institute of Aerospace Medicine.

8. Termination

The personal data of the person concerned will be deleted or blocked as soon as the purpose of the processing no longer applies. The list for pseudonymisation is deleted after 10 years, thus, after 10 years the data will be anonymous. Storage may also take place if this has been provided for by the European or national legislator in EU ordinances, laws or other regulations to which the person responsible is subject.

9. Rights in relation to your personal data

If your personal data is processed, you are a data subject within the meaning of the GDPR and you are entitled to the following rights vis-à-vis the person responsible in accordance with the regulations mentioned below:

1. In accordance with Art. 15 GDPR, you can request information about the personal data processed by us. In particular, you can request information on the purposes of processing, the category of personal data, the categories of recipients to whom your personal data have been or will be disclosed, the planned storage period and the existence of the rights explained in this section 4 and 6.

2. In accordance with Art. 16 GDPR, you may request the immediate correction of incorrect or incomplete personal data held by us.

3. Pursuant to Art. 17 GDPR, you may request the deletion of your personal data stored with us, unless processing is necessary for reasons stated by law, in particular to exercise the right to freedom of expression and information, to fulfil a legal obligation, for reasons of public interest or to assert, exercise or even potentially defend legal claims.

4. In accordance with Art. 18 GDPR, you may request the restriction of the processing of your personal data if you dispute its accuracy, if the processing is unlawful but you refuse to delete it and we no longer need the personal data, but you need it for the assertion, exercise or defence of legal claims or if you have lodged an objection to the processing in accordance with Art. 21 GDPR.

5. In accordance with Art. 20 GDPR, you may receive your personal data that you have provided to us in a structured, common and machine-readable format or request that it be transferred to another responsible party.

6. In accordance with Art. 7 Para. 3 GDPR, you can revoke any consent you have given us in terms of data protection at any time. As a result, we may no longer continue to process the data which was based on this consent in the future.

7. According to Art. 21 GDPR right of objection

   If personal data are processed on the basis of legitimate interests in accordance with Article 6 paragraph 1 letter f) of the DPA, you have the right to object, in accordance with Article 21 of the DPA, to the processing of your personal data for reasons arising from your particular situation or if the objection is directed against direct marketing. In the latter case you have a general right of objection, which we will implement without specifying a specific situation, unless the processing is necessary for the performance of a task carried out in the public interest, Art. 21, paragraph 6 of the GDPR

8. Pursuant to Art. 77 GDPR, you may complain to a supervisory authority. As a rule, the supervisory authority of your usual place of residence or workplace or the seat of the person responsible is available for this purpose. The Federal Commissioner for Data Protection and Freedom of Information (BfDI), Graurheindorfer Str. 153 in 53117 Bonn is responsible for DLR. In order to exercise these rights, please contact the office indicated in section 1. or 2.

10. Declaration of agreement

I hereby declare my agreement that I am authorised by the German Aerospace Centre e.V. (hereinafter referred to as "DLR") within the framework of the above-mentioned TaFMAC project (see item 3), that the personal data collected in item 4 may be processed.