EigenScore
EigenScore
Deutsche Fassung: eigenscore.com/privacy-de
Data protection is of a particularly high priority for David Zwetzich, the operator of EigenScore. The use of this website is possible without any indication of personal data; however, if you want to use the platform's features (such as creating an account or taking part in contests), processing of personal data becomes necessary. If the processing of personal data is necessary and there is no statutory basis for such processing, we generally obtain consent from the data subject.
The processing of personal data, such as the name, e-mail address, or username of a data subject shall always be in line with the General Data Protection Regulation (GDPR), and in accordance with the country-specific data protection regulations applicable to us. By means of this data protection declaration, we would like to inform the public of the nature, scope, and purpose of the personal data we collect, use and process. Furthermore, data subjects are informed of the rights to which they are entitled.
As the controller, we have implemented numerous technical and organizational measures to ensure the most complete protection of personal data processed through this website. However, Internet-based data transmissions may in principle have security gaps, so absolute protection may not be guaranteed.
This data protection declaration is based on the terms used by the European legislator for the adoption of the General Data Protection Regulation (GDPR). It should be legible and understandable for the general public. To ensure this, we would like to first explain the terminology used.
In this data protection declaration, we use, inter alia, the following terms:
a) Personal data
Personal data means any information relating to an identified or identifiable natural person
(“data subject”). An identifiable natural person is one who can be identified, directly or
indirectly, in particular by reference to an identifier such as a name, an identification
number, location data, an online identifier or to one or more factors specific to the
physical, physiological, genetic, mental, economic, cultural or social identity of that
natural person.
b) Data subject
Data subject is any identified or identifiable natural person, whose personal data is
processed by the controller responsible for the processing.
c) Processing
Processing is any operation or set of operations which is performed on personal data or on
sets of personal data, whether or not by automated means, such as collection, recording,
organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use,
disclosure by transmission, dissemination or otherwise making available, alignment or
combination, restriction, erasure or destruction.
d) Restriction of processing
Restriction of processing is the marking of stored personal data with the aim of limiting
their processing in the future.
e) Profiling
Profiling means any form of automated processing of personal data consisting of the use of
personal data to evaluate certain personal aspects relating to a natural person, in
particular to analyse or predict aspects concerning that natural person's performance at
work, economic situation, health, personal preferences, interests, reliability, behaviour,
location or movements.
f) Pseudonymisation
Pseudonymisation is the processing of personal data in such a manner that the personal data
can no longer be attributed to a specific data subject without the use of additional
information, provided that such additional information is kept separately and is subject to
technical and organisational measures to ensure that the personal data are not attributed to
an identified or identifiable natural person.
g) Controller or controller responsible for the processing
Controller or controller responsible for the processing is the natural or legal person,
public authority, agency or other body which, alone or jointly with others, determines the
purposes and means of the processing of personal data; where the purposes and means of such
processing are determined by Union or Member State law, the controller or the specific
criteria for its nomination may be provided for by Union or Member State law.
h) Processor
Processor is a natural or legal person, public authority, agency or other body which
processes personal data on behalf of the controller.
i) Recipient
Recipient is a natural or legal person, public authority, agency or another body, to which
the personal data are disclosed, whether a third party or not. However, public authorities
which may receive personal data in the framework of a particular inquiry in accordance with
Union or Member State law shall not be regarded as recipients; the processing of those data
by those public authorities shall be in compliance with the applicable data protection rules
according to the purposes of the processing.
j) Third party
Third party is a natural or legal person, public authority, agency or body other than the
data subject, controller, processor and persons who, under the direct authority of the
controller or processor, are authorised to process personal data.
k) Consent
Consent of the data subject is any freely given, specific, informed and unambiguous
indication of the data subject's wishes by which he or she, by a statement or by a clear
affirmative action, signifies agreement to the processing of personal data relating to him
or her.
Controller for the purposes of the General Data Protection Regulation (GDPR), other data protection laws applicable in Member States of the European Union and other provisions related to data protection is:
David Zwetzich
c/o IP-Management #11658
Ludwig-Erhard-Straße 18
20459 Hamburg
Germany
E-mail: contact@eigenscore.com
Website: www.eigenscore.com
Contact form: eigenscore.com/contact
This website uses only strictly necessary cookies. Cookies are text files that are stored in a computer system via an Internet browser.
The only cookies set by this website are session and authentication cookies of our sign-in service (see section 5). They are technically required to keep you signed in to your account and to protect your session against misuse. Without these cookies, signing in and using an account would not be possible.
We do not use cookies for advertising, tracking, analytics or any other non-essential purpose. Because only strictly necessary cookies are used, no cookie consent banner is required (§ 25 (2) TDDDG).
You may, at any time, prevent the setting of cookies through a corresponding setting of your Internet browser, and may thus permanently deny the setting of cookies. Furthermore, already set cookies may be deleted at any time via your browser. If you deactivate the setting of cookies, you will not be able to sign in to an account on this website.
In addition, while you are signed in, the website keeps a small cache of your sign-in state (your username and profile picture URL) in your browser's session storage so that pages can display your account without a further request. This entry is strictly necessary for the service you have requested (§ 25 (2) TDDDG), contains no tracking identifier, and is removed automatically when you sign out or close the browser tab.
This website is hosted on servers operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. All platform data (accounts, submissions, contest data, contact messages) is stored on these servers in Germany.
The website collects a series of general data and information when a data subject or automated system calls up the website. This general data and information are stored in the server log files. Collected may be (1) the browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which an accessing system reaches our website (so-called referrers), (4) the sub-websites, (5) the date and time of access, (6) an Internet protocol address (IP address), (7) the Internet service provider of the accessing system, and (8) any other similar data and information that may be used in the event of attacks on our information technology systems.
When using these general data and information, we do not draw any conclusions about the data subject. Rather, this information is needed to (1) deliver the content of our website correctly, (2) ensure the long-term viability of our information technology systems and website technology, and (3) provide law enforcement authorities with the information necessary for criminal prosecution in case of a cyber-attack. The legal basis is Art. 6 (1) lit. f GDPR (our legitimate interest in the secure and stable operation of the website).
Server log files are automatically deleted after 30 days at the latest, unless a specific security incident requires a longer retention of individual log entries.
You can register on this website in order to take part in contests, submit solutions and appear on leaderboards. During registration you choose a username; in addition, the sign-in data described below is processed. The legal basis for all processing connected with your account is Art. 6 (1) lit. b GDPR (performance of the user agreement).
Authentication and account management are provided by Clerk, Inc., San Francisco, USA (“Clerk”), acting as our processor under a data processing agreement pursuant to Art. 28 GDPR. When you register or sign in, Clerk processes your e-mail address, your login credentials or — if you sign in via a third-party identity provider such as GitHub or Google — your identity with that provider, your profile picture (if any), your IP address and technical session data, and sets the strictly necessary cookies described in section 3.
Clerk processes data in the United States. This transfer to a third country is safeguarded by Clerk's certification under the EU-U.S. Data Privacy Framework and by EU standard contractual clauses (Art. 46 GDPR). Further information is available in Clerk's privacy policy at clerk.com/legal/privacy.
By registering, the IP address assigned by your Internet service provider, and the date and time of the registration are also stored. The storage of this data takes place against the background that this is the only way to prevent the misuse of our services, and, if necessary, to make it possible to investigate committed offenses. This data is not passed on to third parties unless there is a statutory obligation to pass on the data, or if the transfer serves the aim of criminal prosecution.
Registered persons are free to change the personal data specified during the registration at any time, or to have their account removed as described in section 12.
When you submit a solution to a problem or contest, we store the submitted source code together with your account, the submission time, and the evaluation results (scores and verdicts). Submissions are executed automatically in an isolated sandbox environment on our servers in order to evaluate them against the problem's test data; they are not used for any other purpose.
Your submission code is visible only to you and to us as the operator (for abuse prevention, contest integrity and technical administration). It is not published, shown to other users, or shared with third parties. The legal basis is Art. 6 (1) lit. b GDPR.
EigenScore is a competitive platform. Your username, your profile picture (if you set one), your rating and rating history, and your contest participations, placements and scores are publicly visible on your profile page, on leaderboards and in contest standings. This publication is a core feature of the service you register for; the legal basis is Art. 6 (1) lit. b GDPR.
You are free to choose a pseudonymous username that does not identify you as a natural person. In that case, the publicly visible data is pseudonymous for everyone except us.
This website contains information that enables a quick electronic contact, including a general e-mail address (contact@eigenscore.com) and a contact form. If a data subject contacts the controller by e-mail or via the contact form, the personal data transmitted by the data subject are stored. In the case of the contact form, this is the message text and — if you choose to provide it — your e-mail address; both are stored in our database on our own servers.
Such personal data are stored solely for the purpose of processing the inquiry and contacting the data subject, and are deleted once the inquiry has been dealt with and no statutory retention obligation applies. There is no transfer of this personal data to third parties. The legal basis is Art. 6 (1) lit. f GDPR (responding to inquiries) or Art. 6 (1) lit. b GDPR where the inquiry relates to a user account or the use of the platform.
If you register for a contest, we may send you service e-mails that are necessary in connection with that contest — for example a reminder shortly before a contest you are registered for begins, or information about changes to it. The legal basis is Art. 6 (1) lit. b GDPR; these messages are part of the contest participation you signed up for.
Beyond that, we send announcements of new contests or platform news by e-mail only if you have expressly opted in to such notifications. The legal basis is your consent (Art. 6 (1) lit. a GDPR). You can withdraw this consent at any time with effect for the future, via the unsubscribe link contained in every such e-mail or in your account settings.
E-mails are dispatched through the transactional e-mail service Brevo, provided by Brevo GmbH (formerly Sendinblue GmbH), Köpenicker Straße 126, 10179 Berlin, Germany, which acts as our processor under a data processing agreement pursuant to Art. 28 GDPR and operates its servers within the European Union. For the purpose of delivery, Brevo processes your e-mail address (which we retrieve from our sign-in service, see section 5), your username, the message content and technical delivery data (such as delivery status and time). Brevo does not use this data for its own purposes. Further information is available at brevo.com/legal/privacypolicy.
The platform offers an optional “open to opportunities” setting in your account. If — and only if — you expressly enable it, we may share your profile information (username, rating, contest history and solved problems) together with your e-mail address with recruiters or companies searching for candidates, and such recruiters may contact you by e-mail about job opportunities. The legal basis is your consent (Art. 6 (1) lit. a GDPR).
The setting is off by default, and enabling it is never required to use the platform. You can withdraw your consent at any time with effect for the future by disabling the setting in your account. In order to be able to demonstrate consent (Art. 7 (1) GDPR), we record the time of every grant and withdrawal together with the version of the consent text shown to you.
We use a self-hosted instance of the open-source web analytics software Umami, running exclusively on our own servers, to measure aggregate usage of the website (such as page views, referrers, approximate country of origin, and interactions with platform features).
Umami is operated in cookieless mode: it does not set cookies, does not store identifiers on your device, and full IP addresses are not stored; the collected data cannot be traced back to an individual visitor by us. No data is transferred to third parties. The legal basis is Art. 6 (1) lit. f GDPR — our legitimate interest in understanding and improving the use of the platform in an aggregate, privacy-preserving way. Because no cookies or comparable identifiers are stored on your device, no consent is required (§ 25 (2) TDDDG).
You can request the deletion of your account at any time, via the contact options in section 2. Deletion is implemented as anonymization: your username is replaced with a neutral placeholder, your authentication account (including your e-mail address) is deleted, your profile picture is removed, and your submitted source code is deleted.
Your contest results and rating history remain stored in this anonymized form, because completed contest standings and the rating calculations of other participants depend on them; removing them retroactively would falsify other users' results (Art. 6 (1) lit. f, Art. 17 (3) GDPR). After anonymization, these records can no longer be attributed to you.
The data controller shall process and store the personal data of the data subject only for the period necessary to achieve the purpose of storage, or as far as this is granted by the European legislator or other legislators in laws or regulations to which the controller is subject to.
If the storage purpose is not applicable, or if a storage period prescribed by the European legislator or another competent legislator expires, the personal data are routinely blocked or erased in accordance with legal requirements.
To exercise any of the rights described below, you may at any time contact the controller using the contact details in section 2.
a) Right of confirmation
Each data subject shall have the right granted by the European legislator to obtain from the
controller the confirmation as to whether or not personal data concerning him or her are
being processed.
b) Right of access
Each data subject shall have the right granted by the European legislator to obtain from the
controller free information about his or her personal data stored at any time and a copy of
this information. Furthermore, the European directives and regulations grant the data
subject access to the following information: the purposes of the processing; the categories
of personal data concerned; the recipients or categories of recipients to whom the personal
data have been or will be disclosed, in particular recipients in third countries or
international organisations; where possible, the envisaged period for which the personal
data will be stored, or, if not possible, the criteria used to determine that period; the
existence of the right to request from the controller rectification or erasure of personal
data, or restriction of processing of personal data concerning the data subject, or to
object to such processing; the existence of the right to lodge a complaint with a
supervisory authority; where the personal data are not collected from the data subject, any
available information as to their source; the existence of automated decision-making,
including profiling, referred to in Article 22(1) and (4) of the GDPR and, at least in those
cases, meaningful information about the logic involved, as well as the significance and
envisaged consequences of such processing for the data subject.
Furthermore, the data subject shall have a right to obtain information as to whether personal data are transferred to a third country or to an international organisation. Where this is the case, the data subject shall have the right to be informed of the appropriate safeguards relating to the transfer.
c) Right to rectification
Each data subject shall have the right granted by the European legislator to obtain from the
controller without undue delay the rectification of inaccurate personal data concerning him
or her. Taking into account the purposes of the processing, the data subject shall have the
right to have incomplete personal data completed, including by means of providing a
supplementary statement.
d) Right to erasure (Right to be forgotten)
Each data subject shall have the right granted by the European legislator to obtain from the
controller the erasure of personal data concerning him or her without undue delay, and the
controller shall have the obligation to erase personal data without undue delay where one of
the following grounds applies, as long as the processing is not necessary: The personal data
are no longer necessary in relation to the purposes for which they were collected or
otherwise processed. The data subject withdraws consent to which the processing is based
according to point (a) of Article 6(1) of the GDPR, or point (a) of Article 9(2) of the
GDPR, and where there is no other legal ground for the processing. The data subject objects
to the processing pursuant to Article 21(1) of the GDPR and there are no overriding
legitimate grounds for the processing, or the data subject objects to the processing
pursuant to Article 21(2) of the GDPR. The personal data have been unlawfully processed. The
personal data must be erased for compliance with a legal obligation in Union or Member State
law to which the controller is subject. The personal data have been collected in relation to
the offer of information society services referred to in Article 8(1) of the GDPR.
If one of the aforementioned reasons applies, and a data subject wishes to request the erasure of personal data stored by us, he or she may, at any time, contact the controller, who shall promptly ensure that the erasure request is complied with. Where the controller has made personal data public and is obliged pursuant to Article 17(1) to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform other controllers processing the personal data that the data subject has requested erasure by such controllers of any links to, or copy or replication of, those personal data, as far as processing is not required.
e) Right of restriction of processing
Each data subject shall have the right granted by the European legislator to obtain from the
controller restriction of processing where one of the following applies: The accuracy of the
personal data is contested by the data subject, for a period enabling the controller to
verify the accuracy of the personal data. The processing is unlawful and the data subject
opposes the erasure of the personal data and requests instead the restriction of their use
instead. The controller no longer needs the personal data for the purposes of the
processing, but they are required by the data subject for the establishment, exercise or
defence of legal claims. The data subject has objected to processing pursuant to Article
21(1) of the GDPR pending the verification whether the legitimate grounds of the controller
override those of the data subject.
f) Right to data portability
Each data subject shall have the right granted by the European legislator, to receive the
personal data concerning him or her, which was provided to a controller, in a structured,
commonly used and machine-readable format. He or she shall have the right to transmit those
data to another controller without hindrance from the controller to which the personal data
have been provided, as long as the processing is based on consent pursuant to point (a) of
Article 6(1) of the GDPR or point (a) of Article 9(2) of the GDPR, or on a contract pursuant
to point (b) of Article 6(1) of the GDPR, and the processing is carried out by automated
means, as long as the processing is not necessary for the performance of a task carried out
in the public interest or in the exercise of official authority vested in the controller.
Furthermore, in exercising his or her right to data portability pursuant to Article 20(1) of
the GDPR, the data subject shall have the right to have personal data transmitted directly
from one controller to another, where technically feasible and when doing so does not
adversely affect the rights and freedoms of others.
g) Right to object
Each data subject shall have the right granted by the European legislator to object, on
grounds relating to his or her particular situation, at any time, to processing of personal
data concerning him or her, which is based on point (e) or (f) of Article 6(1) of the GDPR.
This also applies to profiling based on these provisions.
We shall no longer process the personal data in the event of the objection, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims. If we process personal data for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing. This applies to profiling to the extent that it is related to such direct marketing. If the data subject objects to the processing for direct marketing purposes, we will no longer process the personal data for these purposes.
In addition, the data subject has the right, on grounds relating to his or her particular situation, to object to processing of personal data concerning him or her for scientific or historical research purposes, or for statistical purposes pursuant to Article 89(1) of the GDPR, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
h) Automated individual decision-making, including profiling
Each data subject shall have the right granted by the European legislator not to be subject
to a decision based solely on automated processing, including profiling, which produces
legal effects concerning him or her, or similarly significantly affects him or her, as long
as the decision (1) is not necessary for entering into, or the performance of, a contract
between the data subject and a data controller, or (2) is not authorised by Union or Member
State law to which the controller is subject and which also lays down suitable measures to
safeguard the data subject's rights and freedoms and legitimate interests, or (3) is not
based on the data subject's explicit consent.
i) Right to withdraw data protection consent
Each data subject shall have the right granted by the European legislator to withdraw his or
her consent to processing of his or her personal data at any time.
j) Right to lodge a complaint with a supervisory authority
You also have the right to lodge a complaint with a data protection supervisory authority
(Art. 77 GDPR), in particular in the Member State of your habitual residence, your place of
work or the place of the alleged infringement. The supervisory authority competent for us
is: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit,
Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany, e-mail: mailbox@datenschutz.hamburg.de,
datenschutz-hamburg.de.
Art. 6(1) lit. a GDPR serves as the legal basis for processing operations for which we obtain consent for a specific processing purpose. If the processing of personal data is necessary for the performance of a contract to which the data subject is party, as is the case, for example, for the processing operations connected with your user account and contest participation, the processing is based on Article 6(1) lit. b GDPR. The same applies to such processing operations which are necessary for carrying out pre-contractual measures, for example in the case of inquiries concerning our services. If we are subject to a legal obligation by which processing of personal data is required, such as for the fulfillment of tax obligations, the processing is based on Art. 6(1) lit. c GDPR. In rare cases, the processing of personal data may be necessary to protect the vital interests of the data subject or of another natural person; then the processing would be based on Art. 6(1) lit. d GDPR. Finally, processing operations could be based on Article 6(1) lit. f GDPR. This legal basis is used for processing operations which are not covered by any of the abovementioned legal grounds, if processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.
Where the processing of personal data is based on Article 6(1) lit. f GDPR, our legitimate interest is the secure, stable and fair operation of the EigenScore platform, the integrity of contests and past results, and the understanding and improvement of the service in an aggregate, privacy-preserving way.
The criteria used to determine the period of storage of personal data is the respective statutory retention period, and beyond that the periods stated in this declaration (in particular sections 4, 8 and 11). After expiration of the relevant period, the corresponding data is routinely deleted, as long as it is no longer necessary for the fulfillment of the user agreement or the initiation of one.
We clarify that the provision of personal data is partly required by law or can result from contractual provisions. To create an account and take part in contests it is necessary that the data subject provides us with the personal data described in section 5, which must subsequently be processed by us. The non-provision of this personal data would have the consequence that an account cannot be created and contests cannot be entered. Using the website without an account requires no provision of personal data.
We do not use automated decision-making within the meaning of Article 22 GDPR or profiling. The automatic evaluation of contest submissions against test data is part of the service itself and does not produce legal or similarly significant effects.
This privacy policy was created on the basis of the privacy policy generator of the German Association for Data Protection (Deutsche Gesellschaft für Datenschutz) in cooperation with WBS.LEGAL. Legal texts provided and published by Prof. Dr. h.c. Heiko Jonny Maniero (German Association for Data Protection) and Christian Solmecke (WBS law), developed by the LegalTech specialists at Willing & Able. Adapted to the specific processing activities of this website by the operator.