Privacy Policy

1. Data Controller

The data controller of your personal data is the operator of the CZEnduro platform:

2. Scope and Purpose of Personal Data Processing

2.1 Basic User Data

Processed data:

• Email address
• Password (stored in securely encrypted form)
• User role (rider, organizer, admin)

Purpose of processing:

• Creating and managing user accounts
• Authentication and access authorization
• Communication with users regarding platform services
• Account security (protection against brute-force attacks, password reset)

Legal basis: Performance of contract (Art. 6(1)(b) GDPR) and legitimate interest of the controller (Art. 6(1)(f) GDPR) in securing the service.

2.2 Rider Profile Data

Processed data:

• First and last name
• Date of birth
• Gender
• Nationality
• Phone number
• Emergency contact (name, phone)
• License number (if required)
• Team name (optional)
• Health information relevant to the race (optional)

Purpose of processing:

• Race registration
• Identification of race participants
• Emergency contact
• Providing medical assistance in case of injury
• Creating race results

Legal basis: Performance of contract (Art. 6(1)(b) GDPR). For health data, the legal basis is explicit consent (Art. 9(2)(a) GDPR).

2.3 Motorcycle/Bike Data

Processed data:

• Vehicle brand, model, and year of manufacture
• VIN (vehicle identification number)
• License plate number (optional)
• Engine volume and type (for motorcycles)
• Bike type (for bike races)
• Vehicle category

Purpose of processing:

• Classification into the correct race category
• Verification of vehicle technical parameters
• Maintaining records of racing vehicles

Legal basis: Performance of contract (Art. 6(1)(b) GDPR).

2.4 Registration and Payment Data

Processed data:

• Race registration information (race, category, price, start number)
• Payment data processed through Stripe (card number, payment method)
• Payment status and transaction information
• Registration history

Purpose of processing:

• Processing registration payments
• Issuing invoices and tax documents
• Managing race participation
• Fulfilling legal accounting and tax obligations

Legal basis: Performance of contract (Art. 6(1)(b) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR).

2.5 Uploaded Documents

Processed data:

• Racing licenses
• Medical certificates
• Other documents required by the race organizer

Purpose of processing:

• Verification of eligibility to participate in the race
• Meeting conditions set by the organizer or legislation

Legal basis: Performance of contract (Art. 6(1)(b) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR).

2.6 Race Organizer Data

Processed data:

• Business name / First and last name
• Company ID, Tax ID (for legal entities and self-employed)
• Registered office / residence address
• Contact email and phone
• Bank account details (IBAN)
• Date of birth (for individuals)
• Stripe Connected Account ID

Purpose of processing:

• Managing organizer accounts
• Processing payments and fund transfers
• Fulfilling accounting and tax obligations
• Communication with organizers

Legal basis: Performance of contract (Art. 6(1)(b) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR).

2.7 Technical and Security Data

Processed data:

• IP address
• Login information (successful/unsuccessful logins)
• System activity history (audit log)
• Technical data about device and browser

Purpose of processing:

• Securing the platform against abuse
• Detection and prevention of fraudulent behavior
• Technical support and incident resolution
• Service analysis and improvement

Legal basis: Legitimate interest of the controller (Art. 6(1)(f) GDPR) in securing the service and preventing abuse.

3. Personal Data Retention Period

After the retention period expires, personal data is securely deleted or anonymized in a way that prevents their re-identification.

4. Sharing Personal Data with Third Parties

We may share your personal data with the following categories of recipients:

We do not transfer data to third countries outside the EU/EEA except for Stripe and AWS, which have appropriate personal data protection guarantees.

5. Your Rights as a Data Subject

According to GDPR, you have the following rights:

6. Personal Data Security

We take the security of your personal data very seriously. We have implemented the following technical and organizational measures:

7. Cookies and Tracking Technologies

The CZEnduro platform uses the following types of cookies:

We do not use: Third-party analytics cookies, advertising cookies, or other tracking technologies for marketing purposes.

You can manage your preferences in your browser settings. Blocking cookies may limit platform functionality.

8. Automated Decision-Making and Profiling

The CZEnduro platform does not use automated decision-making or profiling within the meaning of Art. 22 GDPR. All decisions regarding registrations and race participation are made by human operators (race organizers or administrators).

9. Minors

The platform services are intended for persons over 16 years of age. Processing personal data of children under 16 requires consent from a parent or legal guardian.

If we discover that we have unintentionally collected personal data from a child under 16 without the consent of a legal guardian, we will immediately delete such data.

For parents/legal guardians: If you wish to exercise any data subject rights on behalf of your child, contact us at info@czenduro.cz. We will require identity verification and proof of legal guardianship.

10. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons.

We will inform you of material changes by email or through a visible notice on the platform at least 30 days before the changes take effect.

The date of the last update can be found at the top of this document. We recommend checking this policy regularly.

11. Contact Information