Privacy Policy

Last updated: April 2026

1. Data Controller

StartRace is the data controller for personal data collected through this platform. When processing data on behalf of event organizers, StartRace acts as a data processor following the organizer's instructions.

2. Data We Collect

We collect the following categories of personal data:

Personal information:

• Name, email address, phone number
• Date of birth, gender
• Running club affiliation
• Emergency contact information (when provided by organizer forms)

Payment information:

• Payment is processed by Stripe — we do not store your credit card details
• Transaction records and billing history

Technical information:

• IP address, browser type, operating system
• Device identifiers and locale preferences
• Pages visited and actions taken on the platform

Event-related data:

• Race results and timing data
• Signature images and consent records
• Registration history and event participation

3. Purpose of Processing

We process your personal data for the following purposes:

• Event registration and management
• Payment processing and financial record-keeping
• Communication about your registered events (confirmations, updates, results)
• Publishing race results and start lists
• Generating finisher certificates
• Marketing communications (only with your explicit consent)
• Platform improvement and analytics
• Security, fraud prevention, and abuse detection

4. Legal Basis (GDPR Art. 6)

• Contract performance — processing necessary to fulfill your event registration and provide platform services.
• Consent — marketing communications, image rights, and other optional processing activities.
• Legitimate interest — platform improvement, security, fraud prevention, and analytics.
• Legal obligation — tax records, regulatory compliance, and responding to lawful requests.

5. Data Sharing

We share your data with the following parties:

• Event organizers — your registration data, results, and consent records necessary for event management.
• Stripe — payment processing. Stripe acts as an independent data controller for payment data.
• Resend — email delivery service for transactional and marketing emails.
• Legal authorities — when required by law or to protect our legitimate interests.

We do not sell your personal data to third parties.

6. Cookies

We use cookies and similar technologies to provide essential platform functionality. For details, see our Cookie Policy.

7. International Transfers

Your data is primarily processed within the European Union. If data is transferred outside the EU/EEA, we ensure appropriate safeguards are in place, including standard contractual clauses approved by the European Commission.

8. Data Retention

We retain your personal data for the following periods:

• Account data — for the duration of your account and 3 years after your last event participation.
• Financial records — as required by applicable tax law (typically 5-7 years).
• Consent and signature records — as required by the event organizer and applicable regulations.
• Technical logs — up to 12 months for security and debugging purposes.

9. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access — obtain a copy of your personal data.
• Right to rectification — correct inaccurate or incomplete data.
• Right to erasure — request deletion of your data ("right to be forgotten").
• Right to restriction — limit how we process your data.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests.
• Right to withdraw consent — withdraw consent at any time without affecting prior processing.
• Right to lodge a complaint — file a complaint with your supervisory authority (UODO in Poland: uodo.gov.pl).

To exercise your rights, contact us at privacy@startrace.com. We will respond within 30 days.

10. Children's Data

StartRace is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe we have collected data from a child, please contact us immediately for deletion.

11. Security

We implement appropriate technical and organizational measures to protect your data, including TLS encryption for data in transit, access controls, and regular security reviews. However, no system is completely secure, and we cannot guarantee absolute security of your data.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or platform notification. We encourage you to review this policy periodically.

13. Contact

For data protection inquiries, contact us at privacy@startrace.com.