1. Roles and Responsibilities
ChronoKey (Sub-processor)
We provide the technical timing solution. We process data solely on behalf of the organizer.
The Organizer (Data Controller)
The association or entity organizing the event is responsible for the initial collection of data and for respecting your rights.
2. Data Collected and Legal Bases
In accordance with article 13 of the GDPR, we inform you of the purpose and legal basis of each processing activity.
Participants
- First name and Last name
- Gender
- Date of birth (for age category calculation)
- Athletic performance (split times, ranking)
- Email address — only if the organizer enables the self check-in feature and wishes to send the participant's personal access link
Note: The email address, when collected, is used solely to send the access link to the participant space. It is never used for commercial purposes.
GPS self check-in (optional feature)
When an organizer enables GPS self check-in on a checkpoint, the participant can validate their passage from their personal space (accessed via email link, no account creation required). At that precise moment, the following data may be collected:
- GPS coordinates (latitude, longitude) — only if the participant allows location access in their browser, and only when they validate a passage
- GPS signal accuracy in metres (reliability indicator)
- GPS timestamp provided by the device
- “Suspect” flag — internal indicator visible only to the organizer, triggered if the location is outside the configured radius, if GPS accuracy is insufficient, if checkpoint order is not respected, or if the client’s clock diverges significantly from the server’s
Important: GPS location is never collected continuously — it is captured at a single point in time, only when validating a passage at a checkpoint.
Organizers
- Email address
- Password (stored as a hash, not readable)
- Display name
- Time zone
Volunteers
- Name (optional)
- Email address (optional)
- Check-in history via secure token
Technical data and logs
- IP address (collected during requests)
- Navigation data in case of application error (browser, URL, error trace)
3. Data Recipients
Your data is never sold. It is shared only with the recipients listed below, strictly limited to what is necessary.
The public — race results
Participant results (first name, last name, split time, ranking, and category) are publicly accessible on the event results page, in accordance with common practice in sporting events and the organizer’s decision to publish results.
If you wish your results to be anonymized, contact the event organizer directly (see section 1) or exercise your right to erasure (see section 7).
The event organizer
As data controller, the organizer has access to all data of the participants, volunteers and teams of their event.
ChronoKey (technical sub-processor)
Our technical team accesses data solely for platform operation, maintenance, and support.
4. Processors and Transfers outside the EU
We use technical sub-processors, some of which are established outside the European Union. These transfers are governed by appropriate safeguards in accordance with Chapter V of the GDPR.
OVH — Hosting
Our servers are hosted by OVH SAS, a French company headquartered in Roubaix (France). All data is stored in datacenters located in Strasbourg (France), within the European Union. No transfers outside the EU for this hosting.
Sentry — Error monitoring
We use Sentry (Functional Software Inc., United States) to detect and analyze application errors. In the event of an error, Sentry collects limited technical data: IP address, browser type, page URL, and error trace. This data is not used for advertising purposes.
This transfer to the United States is governed by Standard Contractual Clauses (SCC) approved by the European Commission and by the EU-US Data Privacy Framework (DPF).
Google Fonts — Typefaces
Our site uses the Ubuntu font via the Google Fonts CDN (Google LLC, United States). When loading each page, your browser sends a request to Google’s servers, which involves transmitting your IP address to Google.
This transfer to the United States is governed by the EU-US Data Privacy Framework (DPF), to which Google adheres. Google states that it does not use this data for advertising purposes in this context.
5. Storage and Cookies
Session cookies
We only use strictly necessary session cookies for the platform to function. No advertising or tracking cookies are placed.
Local storage (localStorage / IndexedDB)
Your browser stores locally, at your sole initiative, the following preferences and data:
- Your favorite runners (public results page)
- Your volunteer or participant access token
- Check-ins pending synchronization (offline mode) — stored in IndexedDB, encrypted by the browser, and automatically deleted after successful synchronization
This data stays on your device and is never transmitted to our servers unless you explicitly act (synchronization).
Participant session cookie
When connecting to the participant space via the link received by email, a strictly necessary session cookie is placed on your device. This cookie is protected (HttpOnly, SameSite=Strict) and expires automatically when your access expires. It contains no directly readable personal data.
6. Security and Retention
Security measures
- Check-ins protected by HMAC-SHA256 signature (integrity guaranteed, tamper-proof)
- Access tokens (volunteers and participants) encrypted in the database with AES-256-GCM — the plaintext token never touches the database
- Authentication via SHA-256 hash of the token: a database dump cannot be used to log in
- Check-in timestamps validated server-side: any attempt to falsify the scan time is detected and the check-in is rejected or flagged as suspect
- Configurable geo-fence: the organizer can define a GPS perimeter around a checkpoint to detect self check-ins recorded from a distance
- Real-time application monitoring via Sentry to detect any anomaly or fraud attempt
- Encrypted communications via HTTPS (TLS)
Retention periods
- Results and participant data: retained for the duration of the event, then automatically anonymized 30 days after the end of the race (GDPR cron). Anonymization erases the full name, date of birth, check-in IP addresses and GPS coordinates collected during self check-in.
- Organizer accounts: retained while the account is active, then deleted upon request or after 3 years of inactivity.
- Participant access tokens: valid only for the duration defined by the organizer, then automatically expired.
- Sentry logs: retained for a maximum of 90 days, in accordance with Sentry's default retention policy.
7. Your Rights
Under the GDPR (articles 15 to 22), you have the following rights over your personal data: access, rectification, erasure, restriction of processing, portability and objection. You may also lodge a complaint with the CNIL.
Right to anonymization (results)
If you wish your results to no longer be publicly identifiable, organizers can anonymize your data (e.g. Jean Dupont becomes J. D.) while preserving the integrity of the ranking. During this anonymization, the following data is also permanently deleted: the full name, date of birth, check-in IP addresses, and all GPS coordinates collected during self check-ins (latitude, longitude, accuracy, GPS timestamp). Contact the organizer of the relevant event directly or write to us.
Right to withdraw GPS consent
If you have used the self check-in feature, you can disable access to your location at any time in your browser settings. Subsequent scans will be recorded without GPS coordinates and marked as geographically unverifiable.