No legalese here, just clear straightforward information about what is held about you, and why. Don't hesitate to email moc.niardnastoor#retsambew| if you'd like further clarification or wish to make a subject access request or a request to have any of your personal data purged.
R&R does not and will never sell your personally identifiable information onto any other party in any way.
Various data is stored though, so let's have a look at a breakdown of the what and why:
Competitors that are documented on the site
The only information that the site holds about you is results data that has been collated from various sources, and photos that event photographers have uploaded to the site. Although there's no informed consent given by most riders to have their data or photos listed here, they are believed to be of legitimate interest. R&R couldn't operate if it needed every rider's consent to have their results collated, as the simple fact is that most people listed on the site haven't even heard of it, and it would completely break R&R's business model to get consent from each competitor before being able to display a set of results. As such GDPR dictates that this information is used under the title of legitimate interest.
Most of the site's result data is already on the internet, in the public domain. R&R merely displays the data in a more convenient form. Nevertheless, some people would rather not have their results so easily listed, for whatever reason.
If you'd like your event history and photos removed, email moc.niardnastoor#retsambew| and you can be marked as opting out in the database - your name will still appear in results on the site (these are a matter of public record and may appear in numerous other places on the internet), but just as text, not a clickable link, and people won't be able to see your event history, your photos, or compare themselves against you.
If you've bought a photo on the site the database will retain your name, email address and (in the case of a physical, non-digital order) your postal address alongside your order details. These details are collected from PayPal, and are kept indefinitely. You can see how PayPal deals with your data here. On R&R, the order history has to be kept, but if you wish your personal information to be removed they can be nullified in the database. This will obviously preclude you from retrieving your past orders in the future, if you wished to do so.
Your details are passed on to the photographers via their login on the website.
You may also have been subscribed to an email alert letting you know when new photos of a relevant rider are tagged, or a new result added. At the bottom of every one of these emails you will find a link to quickly and easily unsubscribe from them, if you wish.
If you're a photographer R&R holds your email address and phone number so that we can get in touch with you. If you'd prefer we didn't get in touch, we can close your account. R&R does NOT store your password, not even in an encrypted form. Instead a one-way hash of your password is stored, which can be compared to a one-way hash of what you type in when you log on. This is an industry standard.
The database contains the email address of some event organisers so that you get a notification when one of your events is added to the site. Contact us if you'd like this to be removed.
Logfiles & Analytics
It is standard practice when running a website to keep logfiles on the server of every page request. This is useful for a number of reasons, from detecting and dealing with malicious users through to understanding how an audience interacts with a site so that it can be continually improved for a better user experience. Each entry in the logfile includes the user's IP address, and the full URL of the page they visited, along with that time that they visited it. Logfiles for R&R are kept for 30 days.
In addition, like many sites R&R uses Google Analytics to analyze site traffic. This provides very useful insights such as what percentage of users come from which countries. You can read more about Google's policies here.
Backups of R&R's database (containing all of the points mentioned above) are kept for 30 days. Anything removed from the primary database will remain in backups until 30 days have passed.