Privacy policy

Data controller

Data controller: José Grancha Bonora · 33569848Z · Avenida Valladolid 26, 46020 Valencia. For any question about your data, write to ayuda@pasadorsal.es or use the contact form.

What data we process

From your account: email, display name and the profile picture you choose from the website's drawings. We don't ask for your phone number. If you sign in with Google, Google gives us your email, your name and your account identifier.

If you transfer a bib: your proof of registration, the bib details and, if you choose to give it, the reason why you can't run. If you reserve one: the details the organiser asks for to change the holder (first name, surnames and contact email; ID number and date of birth only if that race's official form requires the holder to enter them, and never for code transfers).

If you join a race's official waiting list: the date and version of the consent you give, the place turns you receive and, if you accept one, the organiser's registration code or link (encrypted) and whether you have registered.

In addition, the chat messages for each transaction, the proof of transfer you provide, your reviews and feedback, what you write to us through support or the contact form, your name and email if you request a race that isn't listed, and technical security data: the IP address of important actions and the log of your sign-ins.

For each visit to the website, without cookies: the page you view (with no identifiers or personal data in the address), the website you came from and the link's campaign, the type of device, the browser, the operating system, the language, the screen size and the country, region and city derived from your IP address. The IP address is not stored: it is only used at that moment for this and for a fingerprint that changes every day, so we can't know who you are or follow you from one day to the next.

If you sign up, we store with your account where you came from that time: the link's campaign (its utm parameters), the domain of the website you came from and the first page you saw, with no identifiers. It doesn't change afterwards.

Purposes and legal basis

To provide the service you ask for (account, listings, queue, reservations, chat and email notifications about your transactions): performance of the contract (Art. 6(1)(b) GDPR). If you request a race that isn't listed, we use your email to ask you if we have any questions and to let you know when it has a guide: this is part of that request. Queue email notifications too: you ask for them when you tap ‘Notify me’. And to pass the seller the transfer details when the person running is the same person who reserves, because the transfer can't be done without them: only the seller sees them and every access is logged.

On the basis of legitimate interest (Art. 6(1)(f)): security and fraud prevention (IP address, sign-in log, chat filter, access logs and audit trail); the rules and their consequences (breaches, moving to the back of the queue, blocks); the details of the runner when they are not the person who reserves; replying to what you write to us through support or the contact form; improving the website with the feedback you give us; counting visits to know which pages are used and where people come from (with Umami, our own and cookie-free; if you turn on ‘Do Not Track’ in your browser, we don't count yours); knowing which channels bring people who really use Pasadorsal, using where your sign-up came from, which we only see as figures per channel; and keeping transactions, their audit trail and their movements to defend ourselves against possible claims. While there are no payments, no law requires us to keep them; once there are, we will keep accounting records as a legal obligation (Art. 6(1)(c)). You can object to everything we process on the basis of legitimate interest (we explain how in ‘Your rights’).

With your consent (Art. 6(1)(a)), which you can withdraw whenever you like: showing your feedback on the home page and notifying you of your turns by Telegram (in Settings; see ‘Telegram notifications’ below), and sending your name and email to a race's organiser if you accept a place on its official waiting list (in Notifications; see ‘A race's official waiting list’ below).

Optional email notifications, such as the reminder before the transfer deadline when you mark ‘I'm registered’, are switched on by you and you can turn them off in Settings › Alerts or with the unsubscribe link in each email. No Pasadorsal email contains advertising.

If you reserve for someone else

If you reserve a bib for someone else to run, you give us their details for the change of holder. We process them on the basis of legitimate interest (so that the transfer can be made, Art. 6(1)(f) GDPR) and only for that purpose: we pass them to the seller so they can make the transfer with the organiser, and we delete them 30 days after the transaction closes. Before giving them to us, tell that person you are doing so and show them this policy (GDPR, Art. 14). If they are a minor, you must be their parent or guardian.

The reason in your listing

When you publish a bib you can say, if you want, why you can't run: work, a trip or a change of plans, or that you've signed up for another race. It is not health data and it is not compulsory: if you don't give one, the listing doesn't show any reason. We delete it together with the proof of registration, 30 days after the race or after the listing is withdrawn or expires.

Who else sees it

The seller receives the transfer details of the person who reserves, and the race organiser receives whatever you give it when you re-register through its official procedure. If you accept a place on a race's official waiting list, its organiser receives your name and your email.

We are helped, as data processors and under a data processing agreement, by: UpCloud Oy (Finland; server and database in Madrid and files in Frankfurt); Sweego, from MINDBAZ (France; sending emails, with its sub-processors in France and the Netherlands); a storage provider in the European Union other than UpCloud for the nightly backup, which is encrypted before it leaves and which it cannot read (we will publish its name here when we sign up with it); and, only if we switch it on, Sentry (Functional Software Inc., United States; error reports, without emails, IP addresses or transfer details).

The following are not our processors but controllers of their own service: Google, if you sign in with Google (for the European Economic Area, Google Ireland Limited), and Telegram Messenger Inc., if you connect Telegram for turn notifications. Pasadorsal's internal Telegram alerts to the administrator don't include your name or your email. For now there are no payments; once there are, Stripe will process the payment data and this will be stated here.

Outside the European Economic Area

The data is hosted in the European Union. It only leaves it in three cases.

Google, if you sign in with Google: Google LLC (United States) may process the sign-in data. It participates in the EU-US Data Privacy Framework, which the European Commission considers adequate (Implementing Decision (EU) 2023/1795).

Sentry, only if we switch it on: although the reports are stored in its European Union region, Functional Software Inc. is a United States company. The transfer is covered by the Data Privacy Framework or by the standard contractual clauses in its agreement.

Telegram, only if you connect turn notifications: Telegram Messenger Inc. is outside the European Economic Area, in countries without an adequacy decision and without the GDPR safeguards. That is why we only notify you by Telegram with your explicit consent, which you give when you connect it (Art. 49(1)(a) GDPR) and withdraw by disconnecting it.

How long we keep it

Details for the change of holder, 30 days from when the transaction closes; proof of the transfer, 120 days; a transaction's chat, 12 months from when it closes (without a transaction, 12 months from the last message). The seller's proof of registration and the reason given in the listing, 30 days after the race or after the listing is withdrawn or expires. The IP address of logged actions and of reservations, 365 days. Emails sent, 90 days (sign-in codes sent to an email without an account, 7 days). Sessions, up to 180 days from when you sign in (the session cookie, as stated in the cookie policy). Support chat, 12 months from when the conversation closes, and contact form messages, 12 months from when we deal with them. If you request a race that isn't listed, your email is deleted when we deal with the request, after 12 months if you made it without an account, or when you delete your account. Your place in a race's queue, official place turns you didn't accept and the ‘I'm registered’ mark, 6 months after the race (or until you delete your account). For a race's official waiting list, the code or link for a place, 30 days after it expires or is closed, and who accepted each place, 5 years from when it closes, after which it is anonymised. What you write in a complaint, an incident or a report, 5 years from when it closes; the email of a race request made without an account, 12 months. If an email bounces or is marked as spam, we keep the address for 24 months from the last notice so as not to write to it again (for a spam complaint, also for as long as there is an account with that address); if you unsubscribe from notifications, for as long as you have the account.

Your account, your reviews and your feedback, until you delete the account: it is then anonymised and your public profile is no longer shown; only the stars of your reviews remain, without your name or your comment. Transactions, their audit trail and money movements are kept blocked for 5 years from when they close, without your contact details, in case a claim has to be dealt with, and are then anonymised. Once there are payments, accounting records will be kept for 6 years, as required by the Spanish Commercial Code. Backups keep deleted data for at most 35 more days. Visit statistics don't include your IP address or anything that identifies you: the fingerprint used to count visits changes every day. Where your sign-up came from, for as long as you have the account; when you delete it, it no longer holds any of your data, just another figure.

Your rights

You can ask for access to your data (with a copy in a commonly used format), for it to be rectified or erased, and for its processing to be restricted or your data to be ported, by writing to ayuda@pasadorsal.es. You can also object at any time to what we process on the basis of legitimate interest: we will stop unless there are compelling legitimate grounds or we need it to defend ourselves against a claim.

To know it's you, it's enough for you to write from your account's email address; if you write from another one, we will send a code to your account's email. We won't ask for a copy of your ID unless there are reasonable doubts and no other way to check. We will reply within one month at most; if the request is complex or there are many, we may extend this by two more months, letting you know within the first. It's free. We keep each request and our reply for 3 years so that we can show we dealt with it.

You can withdraw your consents whenever you like from Settings: your feedback on the home page, in ‘Your feedback about Pasadorsal’; Telegram notifications, in Settings › Alerts; and the consent for a race's official waiting list, in Notifications. In Settings, ‘Download my data’ instantly gives you a copy, as a JSON file, of what we hold about your account, which you can take to another service; anything not included (such as security logs) we will give you if you ask. You can delete your account yourself from Settings (if you have no open transactions).

If you think we haven't dealt with your request properly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).

Minimum age and minors

Pasadorsal is only for people aged 18 or over: you confirm this when you sign up. If we detect that an account belongs to a minor, we suspend it, cancel its open transactions without blaming anyone, delete the account and bring forward the deletion of its feedback, its chat and its transfer details. We only keep, blocked, a minimal record (without the date of birth) for as long as a claim could be made. If you reserve for another person who is a minor, you must be their parent or guardian.

Security

The most sensitive data (ID numbers and transfer codes) is stored encrypted, the connection is always encrypted and fonts are served from our own domain, without Google Fonts.

To stop programs that request sign-in codes or send messages in bulk, when you request the code and on the contact form your browser solves a small computational challenge (ALTCHA, the ‘I'm not a robot’ box). It takes place entirely between your browser and our server: it doesn't collect personal data, doesn't use cookies or store anything in your browser, and doesn't call any third party.

Notifications about similar races

Only if you tick it when joining a race's queue (‘Also notify me about similar races’): at most one email a day with the bibs published for everyone in races of a similar distance, on nearby dates and close to yours. To choose them we use the races' data, not your location. It doesn't give you turns in those races. You can turn it off in the same queue dialog or with the unsubscribe link in the email.

Telegram notifications

Only if you connect Telegram in Settings › Alerts and give your explicit consent when connecting it (we keep the date and the version of the text you accepted): we store the identifier of your chat with our bot to notify you of your turns, in addition to email. Telegram doesn't give us your phone number or your contacts, and we don't ask for them. Telegram Messenger Inc., controller of its own service and outside the European Economic Area, receives the race name, the turn's end time and the link; never your email or transaction details. You can disconnect it whenever you like from the website, by sending /desconectar to the bot or by blocking it; when you disconnect it or delete your account the identifier is deleted, and notifications sent are deleted after 30 days.

A race's official waiting list

Some organisers use Pasadorsal as their official waiting list. To run a race's list we act on behalf of its organiser, under a data processing agreement (Art. 28 GDPR) that it signs before opening the list; we remain the controller of your account and of the race's queue.

When you join the official list you give your consent (Art. 6(1)(a)) for us, if you accept a place, to send your name and your email to that organiser for your registration; we keep the date and the version of the text you accepted. You can withdraw it whenever you like in Notifications: you stop receiving official places, and anything the organiser has already received is processed by the organiser, which is the controller for your registration. The organiser doesn't see anyone else on the list, only figures (how many are waiting, how many places are filled), and every time it checks who accepted a place, this is logged. We don't ask you for registration details (ID number, date of birth…): you give them to the organiser on its platform.

The registration code or link is stored encrypted and deleted 30 days after it expires or the place is closed. Who accepted each place is kept for 5 years from when it closes (blocked if you delete your account), in case a claim has to be dealt with, and is then anonymised; place turns you didn't accept are deleted with the queue, 6 months after the race.

If you sign an organiser's agreement on Pasadorsal on its behalf, we keep as proof of the agreement the signed text, the organiser's company name and tax ID (CIF), your name and your position, your account, the date and time and, for 12 months, the IP address and browser you signed from. We process this to perform and be able to prove that agreement (Art. 6(1)(b) and 6(1)(f)) and keep it while the organiser uses the list and afterwards until any actions arising from the agreement are time-barred.

Automated decisions

Some consequences of the rules apply automatically, without a person being involved, because they depend only on a deadline: if you let 3 turns in a row expire without responding, you move to the back of the queue (those that expire at night and those you skip yourself don't count); if you don't provide your details on time, your reservation expires; and if you miss a deadline that was yours as a seller or buyer, your breach counter goes up, which others can see on your profile. These are the public rules in ‘Rules and consequences’ in the terms, the same for everyone: we don't do profiling or scoring, and none of this blocks your account on its own. If one of these consequences seems unfair to you, ask for it to be reviewed by a person: we will reply with their decision and the reasons for it (GDPR, Art. 22).

If you are an organiser's contact

To let an organiser know that there are transfers for its race on Pasadorsal, to ask about its procedure or to suggest the official waiting list, we use the contact details it publishes on its website or in the race rules (the email and, if published, the phone number and the name and position of the contact person) and whatever it replies. We do so on the basis of legitimate interest (Art. 6(1)(f) GDPR, with the presumption in Art. 19 of the Spanish Data Protection Act (LOPDGDD) for the contact details of people working for an organisation) and only to talk to the organiser: we don't pass them on to anyone. We keep them for as long as the relationship with the organiser lasts and, if there is none, for 12 months from the last contact; after that only the organiser's details remain. You can object, ask us not to write to you again or exercise your other rights using the email in ‘Your rights’.