Data Protection Officer ("DPPO") 

Some of the administrators have appointed DPPAs. Below you can find these controllers, as well as contact details of their DPDP.

For Poland:

You can contact the DPDP appointed by Benefit Poland in the following way:

• by post to the address, with a note "IOD";
• by e-mail at: iod@benefitsystems.pl.

About Croatia

You can contact a DPO appointed by Benefit Croatia in the following way: 

• by post to the address, with a note "DPO";
• by e-mail at: dpo@benefitsystems.hr;

In favor of Slovakia

You can contact the DPO appointed by Benefit Slovakia in the following way:

• by e-mail to: dpo@multi-sport.sk. 

Categories of personal data

The controllers process your personal data, such as:  

• Credentials;
• Data relating to your use of services (including services of our partners and ancillary service providers offered in connection with the MultiSport program).

Processing objectives

If you use your MultiSport card abroad, the controller in the country you are visiting will process your personal data for the following purposes: 

The processing above is based on the legitimate interest of the controller consisting in the correct execution of the agreements, the prevention of fraud, the need to establish or defend against claims or to carry out marketing activities (Article 6(1)(f) of the GDPR or Article 5(2)(f) of the Turkish Data Protection Law).

• tax and accounting purposes, as this is required by the applicable legal provisions (legal basis: Article 6(1)(c) of the GDPR or Article 5(2)(ç) of the Turkish Data Protection Law).

The Controller receives your data both from the company that issued your MultiSport Card (e.g. as part of the access verification process) and directly from you (e.g. the time and place of an international visit you make in the country in which the Controller is performing).

Data retention period

Where the processing is based on a legitimate interest, the controller will process the data until it is necessary for the fulfilment of that legitimate interest, for example until the end of your visit or until your complaint has been processed. Processing also stops when you present an effective objection to it.

Where the law imposes certain obligations on the Controller, in particular tax and accounting obligations, the Controller will process the data necessary for the fulfillment of these obligations for the period required by law.  

Recipients of personal data

Your personal data will be transferred to the companies of the Benefit Systems group, including in particular those that have issued your MultiSport card, Partners (sports and leisure facilities), entities providing teleinformation and IT support and security services, entities providing storage and deletion services for data carriers, entities providing consumer services and supporting our marketing activities,  legal advisers and auditors. Your data may also be transferred to public authorities in cases required by law.

Data Subjects' Rights Under GDPR and Turkish Data Protection Law

You are entitled to:

• object to processing;

• access to your data;

• receive correction of your personal data;

• obtain deletion of your personal data;

• obtain restriction of the processing of your personal data;

• correct or delete your personal data so that it is communicated to each recipient to whom the personal data has been transferred;

• claim compensation for damages resulting from the unlawful processing of personal data, and

• not to be subject to a decision based solely on automated processing. 

In order to exercise the above rights, please contact the appropriate controller or its PDPO using the contact details specified in the sections: "Controller" or "Data Protection Officer" above.

Right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with a competent supervisory authority.

Profiling information

No profiling is carried out using your personal data.

Automated decision-making

We do not make decisions that are based solely on automated processing of your data that have legal effects for you or similarly significantly affect you.

Transfers without: (1) The European Economic Area (EEA), (2) Turkey. 

If your place of origin is the EU or Turkey, as a rule, your personal data is not transferred outside the European Economic Area (EEA) or Turkey, respectively. However, such a transfer can take place if you make an international visit to a country located outside your territory of origin. We make every effort to ensure that data is transmitted in accordance with the law and to apply appropriate safeguards. In particular, this includes the use of standard contractual clauses approved by the European Commission and, in the case of Turkey, a standard contract for the transfer of personal data abroad. You can contact us to obtain a copy of the precautions used. You can find the contact details in the sections: "Controllers" or "Data Protection Officer" above.

Provision of personal data

The provision of data is voluntary, but necessary to provide the service. Failure to provide data will result in the inability to provide the service.

Privacy Policy

Regarding the following controllers, further information on the processing of personal data and on the rights of data subjects can be found in the privacy policy available on their websites:

• For Poland: https://www.benefitsystems.pl/en/privacy-policy/ 
• For Czech Republic: https://multisport.cz/en/personal-data-protection/ 
• For Croatia: https://benefitsystems.hr/en/privacy-policy-for-multisport-card-users/ 
• For Slovakia: https://multi-sport.sk/ochrana-informacii/  
• For Bulgaria: https://benefitsystems.bg/en/gdpr_updated/ 
• For Türkiye: https://benefitsystems.com.tr/en/privacy-policy/