1. Controller
Use the real controller identity and contact details. Your current page already states the controller as VDE Region Nord e.V. and gives contact details, so this can be reused consistently.
2. Processing activity
State clearly that during the VDE E-Race, photos and videos are taken by:
- VDE E-Race / organizer media team
- accredited photographers / videographers
- participating teams, where permitted under the event media concept
3. Purposes
State specific purposes, for example:
- documentation of the event
- reporting on the event
- public relations
- sponsor communication
- promotion of the VDE E-Race and future editions
- promotion of participating teams in connection with the event
- creation and operation of a shared event media pool
4. Legal basis
State the legal basis clearly, for example:
- Art. 6(1)(f) GDPR
5. Legitimate interests
State the actual interests, not generic boilerplate. For example:
- making the event publicly visible
- documenting competition activities
- communicating with sponsors and the public
- attracting future teams, volunteers, partners, and participants
- enabling event-related reporting by participating teams
The EDPB guidance explicitly requires the legitimate interests pursued to be identified when relying on Art. 6(1)(f).
6. Recipients / categories of recipients
State that recordings may be disclosed to or published by:
- VDE E-Race / VDE Region Nord e.V.
- participating teams
- photographers / videographers / media service providers
- press / media partners, where applicable
- platform operators when content is posted to social media
- the public, where content is published
The Commission’s GDPR information guidance requires people to be informed about relevant processing information and their rights.
7. Publication channels
Do not write „any form“ or „any channels“. Replace it with categories:
- website
- social media
- printed materials
- press articles
- presentations
- livestreams
- aftermovies
- event recap / archive pages
8. Storage period / criteria
State something concrete. Example:
- original media files are retained as long as necessary for event documentation, archive purposes, and communication about current and past editions, unless overriding objections require restriction
- published materials may remain publicly accessible for as long as the relevant publication remains online or in circulation
- media already shared in the pool or publicly distributed may not be fully retractable
9. Right to object
Because you are relying on legitimate interests, explain the right to object under Art. 21 GDPR, not „withdraw consent“. The current generic policy does include a general right-to-object section, but not in the event-media context.
10. Practical objection process
State what participants can do:
- approach the organization team during the event
- or contact the stated email afterwards
- requests will be reviewed for future use where feasible
- already published or distributed material may not be fully removable