Privacy Policy – GDPR and International Data Protection Compliance – Main Team Organisation (MTO) 

Effective Date: November 7, 2025

1. Data Controller

The entities responsible for your personal data are:

Main Team Organisation GmbH
Zimmersmühlenweg 62
61440 Oberursel, Germany Email: info@main-team.org

Main Team Organisation LLC
405 Lexington Avenue, 9th Floor New York, NY 10174, United States Email: info@main-team.org

Both entities organize and manage international educational events and Olympiads, including but not limited to the International STEM Olympiad, Neo Science Olympiad, Hi-Lingua Language Competition, German Math Olympiad, and Coding Olympiad.

For privacy-specific inquiries, please contact:
info@main-team.org 

2. Introduction

Main Team Organisation ("MTO", "we", "us", "our") respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, process, and store personal information when you visit our websites, register for Olympiads, participate in online exams or on-site events (including Grand Final Programs), or purchase related services.

This Policy applies to all websites and services operated by MTO, http://main-team.org. 

3. Personal Data We Collect

We may collect and process the following personal data depending on your interactions with our platforms and events:

• Full name, date of birth, and gender
• Country, city, school name, and grade
• Email address and (optional) phone number
• Role at the event (e.g., student, supervisor, parent, accompanying person)
• Payment details (processed securely via third-party providers such as Stripe; MTO does not store credit card data)
• Device and technical data (IP address, browser type, cookies, usage logs)
• Exam data, including exam recordings used for monitoring purposes
• Photographs or videos taken during online or on-site events, or submitted by participants, parents, or teachers

During on-site events, we may also process:

• Attendance confirmation data
• Issuance of identification badges displaying names and roles for organizational and safety purposes

We do not collect special categories of personal data (such as health or medical information) in connection with our events.

4. Legal Bases for Processing

We process your personal data under Article 6 GDPR and other applicable laws:

• Contractual necessity (Art. 6(1)(b)) – to register participants, provide exams, organize online and on-site events, evaluate results, issue awards, and process payments.
• Legal obligation (Art. 6(1)(c)) – to comply with tax, accounting, or regulatory requirements.
• Consent (Art. 6(1)(a)) – for optional marketing communications, use of photos/videos for promotion, or other non-essential processing.
• Legitimate interests (Art. 6(1)(f)) – to ensure platform security, prevent fraud, improve services, organize safe on-site events, issue identification badges, confirm attendance, and monitor exams for fairness and safety.

For U.S. participants under 13, parental consent is obtained in compliance with COPPA.

5. Children’s Data and Parental Consent

• If you are under 16 years of age, verifiable consent from a parent, legal guardian, or authorized school representative is required before collecting or processing personal data.
• Teachers or school coordinators may provide consent on behalf of students participating through an institution.
• By registering a participant under 16, parents or guardians confirm consent for data processing, public posting of names/photos/videos (where applicable), and acceptance of this Privacy Policy and the Terms of Service.

6. How We Use Your Data

Your personal data is used for legitimate operational, educational, and organizational purposes, including:

• Registration and participant verification
• Confirmation of attendance during on-site events
• Issuance of identification badges displaying names and roles for participants, supervisors, and accompanying persons
• Communication of event details, schedules, and updates via email, WhatsApp, or social media chat (marketing communications only with consent; opt-out available at any time)
• Conducting online exams and Olympiad assessments
• Organizing and managing on-site Grand Final Programs and related activities
• Scoring, evaluation, and award determination
• Publishing official results and photos/videos for educational, promotional, or advertising purposes:
  - We may publicly announce names of award recipients and their Olympiad categories on our official websites and social media. For participants under 16, this is done only with parental or school consent. Requests for removal can be made via info@main-team.org.
  - We may take and publish photographs and videos of participants, supervisors, and accompanying persons during online or on-site events for MTO’s educational, promotional, or advertising purposes.
  - Such content is not sold or shared with third parties. For participants under 16, explicit parental consent is required; opt-out requests are honored.
• Issuing and shipping certificates, medals, or prizes
• Processing payments and maintaining accounting records
• Statistical and academic analysis to improve services
• Ensuring exam integrity through secure monitoring and proctoring systems

7. Data Sharing and Storage

7.1 Trusted Service Providers

We share personal data only with trusted third parties essential for service delivery: 

• Stripe – secure payment processing
• MailerLite – email communications (only with consent)
• Postal and courier services – shipping awards and certificates
• IT, hosting, and data security providers – platform operation

Event venues hosting our on-site programs may operate their own security and video surveillance (CCTV) systems. Such systems are managed by the venue operator as an independent data controller and are subject to the venue’s own privacy policies.

7.2 Data Storage and Hosting 

• Data is stored on secure servers located in Germany and the EU/EEA.
• Some processing may occur outside the EU/EEA (e.g., in the United States), safeguarded via:
  - European Commission Standard Contractual Clauses (SCCs), or
  - EU–US Data Privacy Framework participation.

7.3 Security

We implement strict measures to protect your data: 

• Encrypted data transfer (SSL/TLS)
• Encrypted storage and role-based access controls
• Limited access to authorized personnel only
• Regular audits and monitoring

7.4 Data Retention

• Participation data: retained up to 2 years after last event
• Legal/financial records: retained up to 10 years (Germany and U.S. laws)
• Marketing data: retained until consent withdrawal

Attendance confirmation data and badge-related information are retained only as long as necessary for event documentation and organizational purposes, and in accordance with the retention periods stated above.

7.5 Exam Recordings

All exam recordings are stored securely on encrypted disks in AWS data centers in Frankfurt. 

• Access is strictly limited to authorized personnel
• Recordings are used solely for exam monitoring
• Automatic deletion occurs within two weeks after the exam; no copies are retained

8. Cookies and Tracking

• Essential cookies are required for site functionality
• Non-essential cookies are used for analytics and personalization, only with consent
• Consent may be managed or withdrawn anytime via browser settings

9. Your Rights Under GDPR

You have the right to:

• Access your personal data
• Request correction or deletion
• Restrict or object to processing
• Receive data in a portable format
• Withdraw consent at any time
• Lodge a complaint with your local Data Protection Authority or the German Federal Commissioner for Data Protection (BfDI)

Contact: info@main-team.org

10. Non-Discrimination and Equal Treatment

Participation is offered without discrimination based on gender, nationality, race, religion, disability, parental status, or learning differences.

11. Updates to This Policy

We may update this Privacy Policy periodically. The latest version will always be posted on our websites.