Privacy policy

1. Controller

For organiser accounts and billing, the controller is Darko Anojčić, a private individual, Novi Sad, Serbia. Contact: darko.anojcic@gmail.com.

For participant, volunteer and newsletter data collected on a race site, the controller is the race organiser shown on that site; we process that data on the organiser's behalf. Please contact the organiser first for requests about your registration.

2. Data we process

Organisers: name, email, password (stored only as a hash) or Google sign-in, language, organisation name and logo, team roles, bank account details entered for payment instructions, and activity needed to run the service (e.g. who published a site).

Billing: Polar.sh handles checkout and card data — we never see card numbers. We receive the subscription status, period dates and the billing email.

Participants (on behalf of organisers): the registration details the organiser asks for (such as name, email, date of birth, gender, country, club, phone, T-shirt size, emergency contact), order and payment status, bib, check-in and results.

Newsletter subscribers: email address and confirmation (double opt-in). Technical data: IP address and request logs for security and rate limiting.

3. Purposes and legal bases

Providing the service and the subscription (contract); security, fraud prevention and keeping the service running (legitimate interest); invoicing and accounting (legal obligation, via Polar); newsletters (consent, which can be withdrawn at any time). Participant data is processed on the organiser's instructions.

4. Service providers

We use carefully chosen processors: Vercel (hosting and file storage), Neon (database), Resend (email delivery), Polar (payments, Merchant of Record), Upstash (rate limiting) and Google (optional sign-in). Some providers are based outside Serbia; transfers rely on appropriate safeguards such as standard contractual clauses.

5. Retention

Organiser accounts are kept while the account exists. Participant personal data is anonymised automatically 24 months after the race date (payment amounts, bib and results are kept without personal details); abandoned registrations are deleted after 30 days. Billing records are kept as long as accounting law requires.

6. Your rights

You have the right to access, correct, delete or export your data, to restrict or object to processing, and to withdraw consent. Runners can download their data from their registration page. You can lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia (poverenik.rs).

7. Cookies

We use only cookies needed for the service to work: sign-in session, language preference and the registration in progress. We do not use advertising or analytics cookies.

8. Security and changes

Data is encrypted in transit, access is limited to organisation members by role, and sensitive fields are never shown on public pages. We will publish changes to this policy here and notify organisers of material changes.