Standard Terms and Conditions for the Purchase of Recordings and Video Analysis

About these Terms

These terms and conditions apply when a sports club purchases access to camera recordings and video analysis (the “Service”) at SNØ Oslo AS’s facilities. Upon purchasing the Service, a legally binding agreement is entered into between SNØ and the sports club. Both parties undertake to comply with these terms. In this context, SNØ and the sports club are collectively referred to as the “Parties” and individually as a “Party.”

What the Service Involves

When the Service is used, video recordings are made of athletes invited by the sports club to training sessions at SNØ’s facilities. The recordings may also be analyzed using artificial intelligence (video analysis) to provide feedback on technique and performance. Since individuals are being filmed, this involves the processing of personal data. Both SNØ and the sports club must therefore comply with applicable privacy laws, as stipulated by Norwegian legislation and the EU General Data Protection Regulation (GDPR).

Joint Responsibility for Privacy

SNØ and the sports club share responsibility for protecting the privacy of those being filmed. This is referred to as joint controllership. Both parties must cooperate to ensure that personal data is processed securely and lawfully, and that those being filmed receive clear information about how the recordings are handled.

These standard terms outline the obligations and rights of the Parties and are prepared in accordance with the GDPR. The Parties shall regularly assess the security of their processing of camera recordings and ensure that appropriate technical and organizational security measures are in place at all times to maintain confidentiality and data integrity.

Requirements for Legal Basis of Processing

All athletes must consent to being filmed, regardless of age

All athletes to be filmed must provide consent before any camera recording takes place. Separate consent is also required before any video analysis of the recordings may occur.

The sports club must collect and store consent from all individuals to be filmed and is responsible for ensuring that anyone who has not given consent is not captured on camera. If such filming nevertheless occurs, SNØ must be notified so that the recording can be blurred or deleted.

SNØ has determined that children aged 16 and older may consent to camera recordings and video analysis. SNØ has prepared a consent form that must be used and completed by or on behalf of each athlete, regardless of age. The sports club may not modify this form without written agreement from SNØ.

See the consent form here.

Requirements for the Form of Consent

The GDPR sets requirements for how consent must be obtained. In summary:

• Consent for filming and video analysis must be freely given, specific, informed, and unambiguous. Separate consent must be obtained for each purpose, e.g., one for filming and another for the use of AI in video analysis.
• Consent must be given through a clear affirmative action, such as ticking a box on a consent form. Silence, pre-ticked boxes, or inactivity do not constitute valid consent.
• It must be as easy to withdraw consent as it is to give it. Athletes (or guardians) must be informed about how to withdraw consent and that withdrawal will not negatively affect their participation in the sports club.
• Consent must be documented and stored securely so that it can be presented upon request by SNØ or a public authority.

Consent on behalf of children under 16 years of age:

• For children under 16, consent must be obtained from one or both guardians.

The sports club shall provide other relevant information to data subjects in accordance with the GDPR. This information is already included in SNØ’s consent form.

The sports club must retain the consent forms for at least two years after the recordings have been completed and must promptly present the forms if requested by SNØ or public authorities.

Verification of Consent

SNØ may, in connection with camera recordings at its facilities, conduct unannounced inspections to ensure that all athletes being filmed have given consent. The sports club is required to bring documentation of obtained consents when recordings take place.

Inquiries from Athletes

Both Parties (SNØ and the sports club) shall be available to receive inquiries from data subjects (athletes/guardians) concerning the exercise of their rights under data protection law, including requests for access, rectification, erasure, restriction, objection, and data portability.

The sports club has primary responsibility for handling such requests and must respond without undue delay and no later than one month after receipt, unless otherwise provided by law or regulation.

If the sports club is unable, for technical or practical reasons, to fulfill a request, SNØ shall assist without undue delay to ensure that the data subject’s rights are respected. The sports club must forward the request to SNØ as soon as it becomes clear that it cannot fulfill it. The requester must be informed as soon as possible if the response is expected to take more than 30 days.

If SNØ receives a request directly, SNØ must promptly forward it to the sports club and assist in its handling.

Both Parties shall keep records of all received and processed requests. Upon request, either Party must provide the other with access to these records without undue delay.

Data Protection Impact Assessment

SNØ has prepared a Data Protection Impact Assessment (DPIA) for the use of camera recordings and artificial intelligence for training purposes. This assessment will be shared with the sports club upon request.

Security Requirements

Technical and Organizational Measures

Both Parties must maintain appropriate technical and organizational measures at all times to ensure the confidentiality, integrity, and availability of personal data.

The measures shall include, at a minimum:

• Access control and authentication for all systems processing the recordings
• Logging of access and data changes
• Encryption of stored and transmitted data
• Secure deletion and destruction of data when no longer needed
• Backup and recovery procedures
• Training for employees and volunteers with access to personal data

Risk Assessment and Audit

The Parties shall conduct regular risk assessments of the processing and update security measures as necessary. Both Parties must be able to demonstrate compliance with these security requirements upon request from the other Party or supervisory authority. Each Party has the right to conduct audits or inspections of the other Party’s security measures by mutual agreement.

Notification of Security Breaches

In the event of a personal data breach, the Party discovering the breach must immediately notify the other Party. The Parties shall cooperate to meet any reporting obligations to the Norwegian Data Protection Authority and to notify affected individuals, if required.

Internal Control and Audit

The Parties shall establish and maintain an internal control system documenting compliance with these Standard Terms and data protection regulations. Each Party has the right, by agreement, to audit the other Party’s compliance. In the event of noncompliance, the Parties shall cooperate to correct and document remedial actions.

Use of Data Processors

Snø uses external data processors to provide the Service. For all processing of personal data carried out by such processors on behalf of Snø, data processing agreements have been entered into in accordance with the requirements of the GDPR.

Prohibition on Further Processing

Recordings and personal data may only be used for the purposes agreed upon and described in the consent form and information notice. Neither Party may use the recordings for other purposes or transfer them to third parties without new consent from the data subjects or another valid legal basis.

Prohibition on Transfer of Personal Data Outside the EEA

The Parties shall not transfer personal data to countries outside the EEA or to countries not deemed to have an adequate level of data protection, in accordance with the European Commission’s adequacy decisions.

Other Obligations

The sports club shall follow the relevant recommendations of the Norwegian Sports Federation’s Streaming Committee:

• Caution should be exercised when recording children under 13 years old. However, the committee recognizes that in some sports, such as alpine skiing or rowing, such recordings may be necessary to monitor and assist athletes during training.
• The recordings shall not be distributed or shown to anyone other than the involved athletes/coaches and may only be used for developmental purposes.
• If the sports club purchases rights to recordings from Snø, any subsequent publication of all or part of the recordings must be carried out in accordance with the Norwegian Sports Federation’s guidelines.

Data Deletion Requirements

Personal data and recordings must be deleted when there is no longer a lawful basis for processing. The Parties shall jointly determine when recordings may be deleted.

Liability and Limitation of Liability

If a Party breaches the agreement or data protection laws, resulting in loss or damage to the other Party or to data subjects, the responsible Party may be held liable under general tort law and Article 82 of the GDPR.

Liability covers direct financial loss, including fines or orders from supervisory authorities resulting from the breach. Indirect losses may not be claimed.

Disputes and Governing Law

Disputes between the Parties shall first be resolved through negotiations. If no agreement is reached, the matter may be brought before the ordinary courts. The agreement is governed by Norwegian law, and Oslo District Court shall have jurisdiction, unless otherwise agreed.

Read more about:

Terms and conditions

Privacy Policy

Cookie Policy

SNØ safety rules