Organizer panel privacy policy

Controller

The controller for account, access, support, security and contractual management data relating to the panel is Devinet 2013, S.L.U., tax ID B66111550, registered at C/ Vallseca, 8, Bajos (local), 08024 Barcelona (Barcelona), Spain.

For privacy questions you can contact [email protected].

Data we process

We may process identification and contact data of panel users, organizing entity data, roles and permissions, invitations, encrypted credentials, session activity, legal acceptance records, IP address, language, technical support and security logs.

We also process operational data entered in the panel: events, races, routes, forms, sponsors, event conditions, participant lists, bibs, check-in, results, exports and imports.

Purposes and lawful bases

We process data to create and maintain organizer accounts, provide the panel, manage permissions, publish events, operate registrations, send notifications, resolve incidents, keep evidence of legal acceptance, prevent abuse and comply with legal obligations.

The lawful bases are performance of a contractual or pre-contractual relationship, compliance with legal obligations, legitimate interest in maintaining service security and continuity and, where applicable, consent.

Participant data managed by organizers

When an organizing entity configures forms, imports lists, exports participants or manages runner information, it must rely on its own lawful basis and inform affected individuals about its processing.

SnapRace acts as the technology provider for the registration flow and panel. For some processing activities it may act as processor on behalf of the organizing entity and, for others, as an independent controller for security, billing, technical support, legal compliance and platform operation.

Recipients and providers

We may share data with providers needed to host the platform, send emails, provide support, maintain systems, synchronize Firebase/Firestore projections and operate payments through providers such as Stripe.

We may also disclose data to administrative or judicial authorities where required by law or where necessary to defend rights, prevent fraud or respond to security incidents.

Stripe and payment services

If the organizing entity activates payments, Stripe or other payment providers may request verification, identity, business activity, bank account and compliance information.

SnapRace stores the information needed to connect the account, know its operational status, reconcile payments and display configuration data, but the payment provider may act as an independent controller for its own processing.

Retention

Account and organization data are retained while there is an active relationship with SnapRace or while needed to address legal obligations, claims, security, audit or support.

Event, registration and participant data may be retained for the periods needed to provide the service, evidence operations, resolve incidents, comply with tax obligations or address legal liabilities, without prejudice to applicable erasure requests.

Security

We apply technical and organizational measures to protect the panel, including access control, roles, operational traceability, password hashing, permission limits and infrastructure security measures.

The organizing entity must restrict access to authorized people, review permissions, sign out on shared devices and protect exports or files downloaded from the panel.

Rights

Panel users may exercise their rights of access, rectification, erasure, objection, restriction and portability, and withdraw consent where applicable, by writing to [email protected].

They may also lodge a complaint with the Spanish Data Protection Agency at www.aepd.es.

Updates

We may update this Policy to reflect new panel features, providers, integrations, legal obligations or operational changes. We will publish the current version on SnapRace and, where appropriate, provide additional notice.