IADO Privacy Policy

Indonesia Anti-Doping Organization (IADO) Privacy Policy

This policy is concerned with the use of personal data related to anti-doping, including past, present and future information. The information shall be collected from the athletes and support personnel (“You”) as defined in IADO anti-doping rules. The Indonesia Anti-Doping Organization (“IADO”, “us”, “we” or “our”) shall only use the information for the purpose of anti-doping. IADO considers the protection of your personal data as our duty, and the process shall be in accordance with the International Standard for the Protection of Privacy and Personal Information (ISPPPI) set out by The World Anti-Doping Agency (WADA) and, when applicable, The Personal Data Protection Law No. 27 of 2022.

The Scope of this Policy

This policy covers personal information past, present and future which has been received from you or about you for the purpose of doping control. It also covers the processing of your information, including storing, analysing, updating, accessing, transferring and deleting of said data.

This policy shall not be concerned with any scope outside doping control processes.

IADO shall update this policy when needed. The update shall be made known to you and IADO’s staff in advance. IADO’s staff shall strictly adhere to this policy and shall make sure any third party involved shall do the same. IADO’s staff shall be held accountable by law for the breach of this policy.

What Data Do We Collect?

Identifiers such as a real name, alias, postal address, hometown, unique personal identifier, online identifier, Internet Protocol address, email address, account name, national card identity number, driver’s license number, passport number, or other similar identifiers;
Data from device settings such as information you allow IADO to receive through device settings you turn on, such as access to your GPS location, camera or photos;
Information such as signature, physical characteristics or description, telephone number, insurance policy number, education, employment, information, medical information, or health insurance information, employment history, bank account number, credit card number, debit card number, or other financial;
Age and date of birth;
Physical information, such as height, weight, body measurements and gender;
Images, photos and videos;
Internet or other electronic network activity information, including without limitation, browsing history, search history, and information regarding a consumer’s interaction with an Internet web site, application, or advertisement;
Geolocation data;
Information about any sports you may play or with which you are associated;
Professional or employment-related information;
Inferences drawn from any of the information identified above to create a profile about a person reflecting the person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

“Personal Information” does not include publicly available information. “Publicly available” means information that is lawfully made available from state, or local government records, or any conditions associated with such information. In addition, to the extent that any Personal Information is “de-identified,” it will be treated as non-Personal Information, and we may use it without obligation to you, except as prohibited by applicable law.

How Will Your Data Be Used?

Your data shall be used by IADO for the following purposes:

To formulate our Registered Testing Pool and Test Distribution Plan including whereabouts information.
To investigate any potential Anti-Doping Rule Violation.
To tailor and implement our education plan.
To carry our anti-doping related research.
To communicate with you on anti-doping matters and processes.
To promote international cooperation in the fight against doping in sport.
To be used in the process of applying for a TUE.
To be used in the process of Athlete Biological Passport.
To be used in the process of compliance and enforcement.
To be used in the process of Result Management.

Your data shall not be used for any commercial purposes. IADO shall be assessing the processing of your data every 3 months to mitigate any risk to your data.

Your data may be shared with other anti-doping organisations through Anti-Doping

Administration and Management system (ADAMS) in accordance with the International Standard for the Protection of Privacy and Personal Information (ISPPPI). See ANNEX B for details.

How Is Your Data Protected?

In accordance with Standard Operation Procedure SOP-SEKRE-01 about Documented Information Procedure, IADO has setup a Document Control Centre (DCC) where the movement of each document containing your personal data shall be tracked both within IADO and in the case where third party is involved. IADO has also set up a secure email and cloud server to store your information electronically. Access shall only be granted to people or people within IADO’s departments when required within each anti-doping process. Physical copies of your document and information shall be stored in locked cabinets with access available only to the DCC.

Your Rights

Under this policy, and in accordance with the Personal Data Protection Act B.E.2562 (2019), you have the rights to:

Request to access your own personal data.
Request to alter or update your personal data.
Request the deletion of your personal data (subject to World Anti-Doping Code, International Standards, IADO’s anti-doping rules and applicable law).
Request to terminate your consent.
Request the transfer of your personal information to other anti-doping organisations.
Lodge an official complaint with IADO on the process of Personal Data Protection.

Retention Time

The duration of the retention of your personal information is laid out in Annex A of this policy. The retention time is in accordance with the International Standard of the Protection of Privacy and Personal Information (ISPPPI).

Our Contact

Legal Staff

(+62) 813 8841 4641

Indonesia Anti-Doping Organization

FX tower 15th Sudirman

Indonesia

ANNEX A: RETENTION TIMES

ADRV: Anti-doping rule violation

AAF: Adverse analytical finding

ATF: Atypical finding

APF: Adverse passport finding

ATPF: Atypical passport finding

Referenced data will be deleted no later than the end of the calendar quarter following the expiry of the stated retention period.
Retention times are limited to two categories: Twelve (12) months and ten (10) years. The period of ten (10) years represents the time period during which an action may be commenced for an anti-doping violation under the Code. The period for twelve (12) months represents the time period relevant to count three (3) whereabouts failures giving rise to an anti-doping rule violation, and is also applied to certain incomplete documentation and TUE-related information.
Retention times can be extended in case of pending or reasonably anticipated anti-doping rule violations, investigations, or other legal proceedings.

Module	Data	Retention Period	Remarks	Criteria
1- Athlete			Athlete data relevant for practical purposes and for notification purposes in the event of an ADRV. These data are not particularly sensitive.
Athlete (general)	Name, Date of birth, Sport Discipline and Gender	10 years as of time when Athlete is excluded from ADO’s Testing program or as of time other data categories have been deleted (see, e.g. Section 6 – ADRV), whichever is later	Necessary to notify of ADRV and to keep a record of Athletes included in an ADO’s Testing program.	Necessity
	Contact information (phone number (S), email address, mailing address)	10 years as of time when Athlete is excluded from ADO’s Testing program	Same as above.
2 – Whereabouts* *(except for city, country, and In – Competition whereabouts information, which are needed for the Athlete Biological Passport- see section 7)
Whereabouts	Whereabouts (other than city, country and in-Competition whereabouts)	12 months as of end of the whereabout s quarter for which the data was submitted	Relevant to count 3 whereabouts failures in 12 months’ time.	Necessity
	Whereabouts failures (filing failures and missed tests)	10 years as of date of whereabout s failure	Relevant to count 3 whereabouts failures in 12 months’ time and to other possible ADRVs. If ADRV, will also be kept as part of results management file (see section 6).	Necessity
3 – TUEs			Destroying medical information makes it impossible for WADA/ADOS to review TUEs retrospectively after TUE has lost its validity. TUE information is largely medical and therefore sensitive.
TUE	TUE certificates and rejected TUE decision forms	10 years as of certificate date/date of rejection decision	Can be relevant in case of retesting or other investigations.	Proportionality / Necessity
	TUE application forms and supp. med information and any other TUE info not otherwise expressly mentioned herein.	12 months from end of validity of TUE	Loses relevance after expiration of TUE except in case of reapplication.	Proportionality / Necessity
	Incomplete TUEs	12 months from date of creation	Can be relevant in case of reapplication.	Proportionality
4- Testing
Testing	Doping Control Forms (DCFs)	10 years as of Sample collection date	DCFs, associated mission/Testing orders, and chain of custody documents are relevant for Athlete Biological Passport and in case of reTesting of Samples. If ADRV, will also be kept as part of results management file (see section 6)	Proportionality / Necessity
	Mission/Testing Orders	Retained until all associated DCFs have been deleted	Same as above.	Proportionality / Necessity
	Chain of custody	10 years as of document creation date	Same as above.	Proportionality / Necessity
	Incomplete Testing documentation or documentation not matched to a Sample	12 months as of document creation date	Documentation that is incomplete or not matched to a Sample typically results from a data entry error and is discarded after a short delay for data integrity purposes.	Proportionality
5 – Test results/Result s Management	Analytical test results (incl. AAF/ATF), laboratory reports, and other associated documentation	As of Sample collection date / date of creation of relevant documents: 10 years*	Necessary because of multiple violations and retrospective analysis. If ADRV will also be kept as part of the results management file (see section 6). *Subject to the criteria and requirements of the Code/Internationa l Standards, analytical data resulting from Sample analysis and other Doping Control information may, in certain circumstances, be kept beyond the applicable retention period for research and other purposes permitted by Article 6.3 of the Code. Samples and data must be processed to ensure they cannot be traced back to an athlete before being used for such secondary purposes. 10 years is the maximum retention time for identifiable data and Samples. See the International Standard for Laboratories for details.	Necessity Proportionality / Necessity
6 – Proceedings and Decisions (ADRV)		As of date of final decision:	Managed by disciplinary body / sports federation / ADO.
Decisions and Proceedings	Sanctions and Decisions under the Code	Longer of 10 years or duration of sanction*	Necessary because of multiple violations and possible duration of sanctions. * Decisions (e.g. CAS decisions) can be important legal precedents and part of the public record; in such cases, ADOs may decide to retain a decision beyond the applicable retention period.	Necessity Proportionality / Necessity
	Relevant documentation/file s (incl. AAF or whereabouts failure record, case files, laboratory and ABP documentation packages, etc.)	Longer of 10 years or duration of sanction	Necessary because of multiple violations and possible duration of sanctions.	Necessity
7 – Athlete Biological Passport
Results	Biological variables, ATPF, APF, APMU reports, expert reviews and other supporting documentation.	10 years as of date of match between results and Doping Control Form	Necessary because of multiple violations and to analyze or review biological variables, APMU reports and expert reviews over time.	Necessity
Whereabouts	Whereabouts (only city, country and In-Competition whereabouts)	10 years as of end of the whereabouts quarter for which the data was submitted	Needed to support atypical/abnormal results, or to refute Athletes’ claims.	Proportionality / Necessity

ANNEX B : ATHLETE’S INFORMATION NOTICE

Processing Data in ADAMS

You are being asked to read the following Information Notice to ensure that you are aware that some personal information related to you will be used and processed by the Anti-Doping Organization through the anti-doping administration and management system (“ADAMS”), a web-based data management system developed and administered by the World Anti-Doping Agency (“WADA”). This Information Notice is intended to provide you with more information on ADAMS and how your personal information will be used in connection with ADAMS. For more information on ADAMS, consult the WADA website at www.wada-ama.org.

Purpose of ADAMS

ADAMS enables Anti-Doping Organizations (“ADOs”), such as IADO, International Federation, and WADA to conduct harmonized, coordinated and effective anti-doping programs and to fulfil their respective responsibilities arising under the World Anti-Doping Code (“Code”).

ADAMS may be used for scheduling In- and Out-of-Competition doping tests and managing related information, including Therapeutic Use Exemptions (“TUEs”), information related to athlete whereabouts, information about the results of anti-doping tests, managing the Athlete Biological Passport, and sanctions-related information relevant to individual athletes and other Persons.

WADA relies upon ADAMS to fulfil its responsibilities under the Code, including the performance of Out-of-Competition Testing, the review of TUEs, and its implication on anti- doping rule violation investigations and procedures.

Categories of Data Concerned

ADAMS contains the following categories of data:

Your unique ADAMS profile consisting of data relating to your identity (name, nationality, date of birth, gender, sport(s) and discipline(s) you compete in, organizations and/or sports federations to which you belong, an indication of whether you compete at an international or national level, and whether you are considered to be a National or International-Level Athlete in accordance with the Rules of your International Federation and/or National AntiDoping Organization);
Data relating to your whereabouts (e.g., training, competitions, travel, periods spent at home, on vacation, or other regular or exceptional activities), including, each time you elect to use the “auto-location” reporting button on the ADAMS app, information about your mobile device’s location;
Data relating to test distribution planning (for the testing pools in which you are included);
Data relating to your TUE, if any;
Data relating to Doping Control (test distribution planning, Sample collection and handling, laboratory analysis, results management, hearings and appeals); and
Data relating to the Athlete Biological Passport.

Some of the above data may constitute protected personal data under national data protection or privacy laws where you reside.

Responsibility

Your Custodian Organization, which is the Anti-Doping Organization that has primary responsibility for entering and managing your profile in ADAMS, has created your unique ADAMS profile. You can identify your Custodian Organization by viewing the “Security” tab of your athlete profile. In addition, WADA will access and process certain of your data in ADAMS (i.e., TUE data, laboratory results, Athlete Biological Passport, sanctions and whereabouts data) to fulfil its responsibilities under the Code. Your Custodian Organization and WADA are responsible for protecting your information in accordance with applicable laws and WADA’s International Standard for the Protection of Privacy and Personal Information. WADA, moreover, has implemented strict contractual controls governing the use of ADAMS by ADOs and others.

You will be responsible for ensuring that all information that you enter into the system or that is entered on your behalf by other parties, such as your agent or coach, is accurate. Where your Custodian Organization uses the ADAMS whereabouts module, you will be responsible for ensuring that the information you provide relating to your whereabouts is accurate and up-to-date. Please note that failure to provide and/or update accurate whereabouts information is likely to constitute an anti-doping rule violation, whether the failure is intentional or negligent.

You will be provided with a confidential password in order to enter your own data onto ADAMS and you will be responsible for keeping this password confidential at all times. Should you inadvertently disclose your password, you should contact your Custodian Organization immediately and a new password will be assigned to you.

Legal basis

Your Custodian Organization and WADA process your personal data relying on different legal bases, depending on the particular context in which it is processed. This includes processing in circumstances where it is permitted or required to do so under applicable anti-doping laws, including Swiss anti-doping and sports laws; where the processing is necessary to meet the substantial public interests served by eliminating doping in sport; where the processing is based on your consent, which may subsequently be withdrawn; and where necessary to meet legitimate interests. The AntiDoping Organization that created your profile in ADAMS may be relying on these or alternative legal bases, including applicable anti-doping laws.

Disclosures

Part of your ADAMS profile created by your Custodian Organization may be shown to other ADOs using ADAMS to ensure that only a single athlete profile for you is created.

The Custodian Organization and WADA, where appropriate, may enable other ADOs and service providers to access certain of your information appearing in ADAMS to enable them to administer anti-doping programs. In particular, the Custodian Organization shall grant WADA the authorization to disclose your whereabouts information to other Anti-Doping Organizations so that such AntiDoping Organizations are able to fulfil their obligations pursuant to the Code.

Where this occurs, such ADOs and service providers also must abide by strict contractual controls and will be responsible for protecting your information in accordance with applicable laws and WADA’s International Standard for the Protection of Privacy and Personal Information.

These other ADOs may include, as relevant or appropriate: national Olympic committees, national Paralympic committees, major event organizations such as the International Olympic Committee and International Paralympic Committee, international federations and national anti-doping organizations. These ADOs are granted access on a need-to-know basis in accordance with the Code. By viewing the “Security” tab on your ADAMS profile, you can learn which organizations have access to your data.

WADA and the organizations listed above will not disclose any of your data other than to authorized persons within their organizations on a need-to-know basis; and each of the organizations accessing and using ADAMS may only do so in order to fulfil their responsibilities and obligations arising under the Code, which primarily involves the establishment of anti-doping programs and ensuring appropriate information sharing as provided for under the Code.

If you are found to have committed an anti-doping rule violation and receive a sanction as a result, the respective sanctions, your name, sport, Prohibited Substance or Method, and/or tribunal decision, may be publically disclosed by your Custodian Organization and relevant ADOs, in accordance with the Code.

International transfers

Your data may be made available through ADAMS to persons or parties located outside the country where you reside. For example, your information will be shared with WADA, established in Switzerland and Canada, and may be shared with ADOs in countries where you may train or participate in sporting events. The data protection and privacy laws of these countries may not always be equivalent to those in your own country. In any case, ADOs have to comply with WADA’s International Standard for the Protection of Privacy and Personal Information.

Such transfers are a necessary consequence of your participation in organized sport and facilitate the strong public interests served by eliminating doping in sport. In WADA’s case, the transfers are made to two countries, Canada and Switzerland, that have been deemed to provide adequate protection by a number of regional and national data protection agencies, as well as the European Commission. In the event your information is transferred to another country, including Canada and Switzerland, it will be subject to the laws of that country and may be disclosed to or accessed by the courts, law enforcement and other public authorities in accordance with those laws.

Rights

You may have certain rights under applicable laws and under WADA’s International Standard for the Protection of Privacy and Personal Information, including rights to access, rectification, restriction, opposition and deletion, and remedies with respect to any unlawful processing of your data. You also may have a right to lodge a complaint with a national regulator responsible for data protection in your country. To the extent you have questions or concerns about the processing of your data, you may consult with your Custodian Organization and/or WADA (privacy@wadaama.org), as appropriate.

Security

ADAMS is hosted in data centers in Canada. Strong technological, organizational and other security measures have been applied to ADAMS to maintain the security of the data entered onto ADAMS. In addition, WADA and ADOs have put in place internal and contractual guarantees to ensure that your data remain confidential and secure pursuant to their commitments under the International Standard for the Protection of Privacy and Personal Information.

Data retention

Your data will be retained in ADAMS for the duration and in accordance with the criteria set out in Annex A to WADA’s International Standard for the Protection of Privacy and Personal Information. For instance, if your Custodian Organization uses ADAMS for TUEs and you are granted a TUE, the TUE approval forms will be stored electronically in ADAMS for a period of ten years following the approval date. The period of ten years represents the time period during which an action may be commenced for an anti-doping violation under the Code. Supporting medical and other TUE related information is only retained for a period of 18 months from the end of the validity of the TUE. Data may be retained for a longer period where required by law or for the purpose of an anti-doping investigation or proceeding.

Right to object

You understand that if you object to the processing of your data, it still may be necessary for your Custodian Organization and WADA to continue to process (including retain) certain of your data to fulfil obligations and responsibilities arising under the Code, International Standards, and/or national anti-doping laws, notwithstanding your request; including for the purpose of investigations or proceedings related to a possible anti-doping rule violations; or to establish, exercise or defend against legal claims involving you, WADA and/or an ADO. You understand that objecting to the processing, including disclosure, of your data may prevent you, your Custodian Organization, WADA or other ADOs from complying with the Code and relevant WADA International Standards, which could have consequences for you, such as an anti-doping violation under the Code or the inability to participate in sporting events.