Privacy notice

1. Who we are

The controller of your data is Asociația Sportivă Alergători cu Jumătate de Normă, of Str. Drumul cu Plopi nr. 116, Vila 35, Sc. B, Ap. 35, sat Sânpetru, com. Sânpetru, jud. Brașov, CIF 52207751 — “the club” or “we”. Contact: brasovrunners@gmail.com.

We have no data protection officer: article 37 of Regulation (EU) 2016/679 (the GDPR) does not require one of a small club without systematic monitoring or large-scale special data.

2. What we keep and why

From the form: first and last name, date of birth, sex, nationality, the country you live in and your city, email, telephone and the form's language. We use them to run the event: places and the waiting list, the messages about your registration and your race number (name and email); age and sex category and whether a minor must be registered by a parent (date of birth and sex); to reach you on race day if needed (telephone); to know where participants come from (nationality, country and city). Basis: art. 6(1)(b) GDPR — performing the participation agreement. The required ones are marked on the form: without them you cannot register. Your confirmed email address identifies you (no account or password); we also keep it in canonical form, so nobody takes two places. You may also register someone else — a family — on the same address, up to the limit the club sets: each person stays a separate registration, with their own data above, their own declaration and their own place. If you register someone else on your address, do so with their knowledge and agreement; we receive their details from you (art. 14(2)(f) GDPR). The messages about them — the confirmation, the declaration (the signed copy, with their identity document's series and number), the reminders — go to your address in their name; the first one says where we got the details and links to this notice (art. 14(3)(b) GDPR). Show them these messages. The consents — for the health note, for appearing on the public list and for Strava and Instagram — can be given only by the person themselves; for a minor, by the parent or guardian. Whoever registers another adult cannot give them on that adult's behalf, so we do not ask for them on that registration; the declaration, with the statement about health, is signed by the person themselves.

Your emergency contact: we keep the name and telephone number you give us only to call that person if something happens to you at the event — the legitimate interest of you and the club in telling someone close (art. 6(1)(f) GDPR) and, in an emergency, vital interests (art. 6(1)(d)). Tell them you gave us their details; the rights in section 8 are theirs too. Only the club's organisers and administrators see them, on the registration's page and the event's emergency sheet, and we delete them seven days after the event.

Optional, same basis: t-shirt size, club, display name and the tick saying you are a member of the group — unverified, without effect on your place.

The health note (an allergy, a condition, a medicine) is special-category data, kept only with your explicit consent, ticked separately (art. 6(1)(a) and art. 9(2)(a) GDPR), only so the race organisers know what to do if you need help on race day. It is never required. Only the organisers see it, on the registration's page and the event's emergency sheet; it appears in no participant-list export, email or copy sent to the club (only you receive it, if you ask us for a copy of your data). You withdraw it at any time from “My registrations”, without losing your place.

The statement that you are medically fit (the required tick on the form): we keep only the fact that you ticked it and when, no medical information. Because it concerns your health, we treat it as data concerning health: we use it for your registration (art. 6(1)(b) GDPR) and keep it as evidence that you made it, for the establishment, exercise or defence of legal claims (art. 6(1)(f) and art. 9(2)(f) GDPR). Only the organisers see it, on the registration's page and in the participant-list export; we keep it as long as the registration (section 7). For a registration entered by the team or at the race-day desk, the statement is on the paper declaration.

We also keep the registration's history (states, moments, who acted), race number and check-in: art. 6(1)(b) GDPR; after the registration ends, art. 6(1)(f), as proof that places were given fairly. The platform manages places and the waiting list by the rules in the terms: where the event offers freed places automatically, in the order in which email addresses are confirmed; otherwise an organiser names the person offered the place, on objective grounds, and the platform records who and when. Some places are given outside the advertised ones (organisers, volunteers, pacemakers, partners, invited runners) and take none of them. A place held and not signed for in time (100 minutes, or until the confirmation deadline before the race where the event sets one, or 72 hours for a waiting-list offer) passes to the next person on the waiting list — automatically where the event offers automatically, otherwise through an organiser. We do no profiling. The automatic step applies the same rule to everyone and we do not consider it a decision with legal or similarly significant effect under art. 22 GDPR; a place given by an organiser is a human's decision. You may always ask a person on the team to review what happened to your place. The organisers may also keep internal notes about a registration, for organising the event (art. 6(1)(f) GDPR); only the club's organisers and administrators see them, not you — in the backoffice and in the registrations export (Excel or CSV) they download — and they are deleted with the registration (section 7); an exported file is deleted within the times in the same section. If you make an access request we give you those too (section 8).

Your date of birth also tells us whether you meet the event's minimum age, where it has one: it is set for each event, shown on its page and counted on the day of the event; we register nobody younger. A minor (under 18 on the day of registering) is registered by a parent or legal guardian with the child's details. The email and telephone on the form are usually the parent's, who then receives every message; we also keep the parent's name and, at signing, the series and number of the parent's or guardian's identity document and, for a minor aged 14 or over, the minor's as well, where the declaration in force asks the minor to sign too; the parent or guardian acts for a child under 14 and approves the acts of one aged 14 to 18 (Romanian Civil Code, art. 41(2) and art. 43(2)), and it is they who give the optional consents for the child — the health note, the public list (art. 6(1)(a) and art. 9(2)(a) GDPR); the kit is collected against either one's document — basis art. 6(1)(b) GDPR, the same periods as below. For a minor we keep no Strava or Instagram. We do not publish photographs in which a child is the subject unless a parent asks us to in writing (an email is enough); group photographs in which the child is not the subject are published like any other (section 4).

Optional: a link to your Strava profile and your Instagram username — so we can follow you and tag you in the club's posts on those platforms (the tag is visible there); we publish them on the site only if you choose to (section 4) and never give them to anyone. Basis: your consent (art. 6(1)(a) GDPR), withdrawn at any time from “My registrations”, without affecting your registration.

The club's invitations: through “Invitations” in the backoffice, a club administrator may enter your name and email address to send you one personal invitation to an event, with a place kept for you until a deadline. Basis: the club's legitimate interest in inviting its members, partners and guests (art. 6(1)(f) GDPR). We keep the name and address until you accept the invitation, the club withdraws it or its deadline passes; if you accept, they become your registration's data and are kept as such, otherwise we delete them as we do a registration whose address was never confirmed (section 7).

3. Declaration and identity document

The declaration of own responsibility confirms your place. We keep the name typed as signature, the text's fingerprint, the moment and how you signed (email or paper, with the recording team member's name). If you sign electronically, we keep with the signed declaration the IP address and the browser you sign from, as they are at the moment of signing, as proof of the signature, for as long as we keep the declaration (section 7); for a signature on paper we keep nothing of the kind. Basis: art. 6(1)(b) GDPR; as evidence after the event, art. 6(1)(f). The declaration also carries your statement that your health allows the effort; we treat it as data concerning health and keep it only as evidence, for the establishment, exercise or defence of legal claims (art. 9(2)(f) GDPR), as long as the declaration (section 7). We never ask for or keep any medical document.

It is a simple electronic signature under Regulation (EU) No 910/2014 (eIDAS) and Romanian Law no. 214/2024, which cannot be denied legal effect only for being electronic (art. 25(1) eIDAS).

Where the declaration asks, we take your identity document's series and number (for a minor, the parent's or guardian's and, from age 14, when the declaration asks it, the minor's too), never a copy, only so that it names you unambiguously and we can hand you your kit: art. 6(1)(b) GDPR, not legitimate interest, as it is a national identification number (art. 2(2)(b) of Romanian Law no. 190/2018 on measures implementing Regulation (EU) 2016/679). Without them you cannot sign the declaration, and without the declaration the place is not confirmed. Only the club's people who need them see them: the volunteers at the kit-collection desk, for the registration in front of them, and the club's organisers and administrators also on the registration's page and in the exported participant list (deleted within the period in section 7); in the declaration copies emailed to the club they are masked (at most the first two and last two characters remain), and we delete them from our database seven days after the event.

On a group run you may sign, if you wish, a self-declaration on the run's page; it registers you for nothing and is not a condition of running with us. We keep the name typed as the signature, the email address we send your copy to, the text's fingerprint and the moment of signing, together with the IP address and the browser you sign from, as proof of the signature; you and the club each receive a copy by email. You sign it once for a run that repeats, where the declaration's text says so: it then covers every date of it, until you withdraw it or it is replaced by a new version. If you sign it again on the same text, we keep no second one: we resend your copy. On a new version of the text, the new one is in force and we keep the old one as evidence of what you accepted then, until you ask us to erase it (section 8). If the run has a minimum age above 18, we also ask for your date of birth, only to check it; we do not keep it (after a refused signing it stays, encrypted, in your browser for at most ten minutes, so you need not type it again). If a parent or legal guardian signs for a minor, we also keep the minor's name, written by the minor as their signature, on the same row beside the parent's; the minor's date of birth is asked only to check the run's minimum age and is not kept. Basis: our legitimate interest in being able to show that you were informed of the run's risks and accepted them (art. 6(1)(f) GDPR), and for the statement about your health, establishing, exercising or defending a legal claim (art. 9(2)(f) GDPR); signing is voluntary and you may object at any time (section 8). We keep it as long as it is needed for your taking part in the runs it applies to. If you ask us to withdraw it (section 8), we no longer use it for later runs; we may keep a copy after that only as long as needed to establish, exercise or defend a legal claim, with the general three-year limitation period in view, then delete it.

4. Public list, results, photographs

The public participant list, off on every event until the club switches it on, shows only the name (or display name) and club of those who ticked “I want to appear on the participants & results list” when registering (and the race number of the confirmed and, where they chose it, their Strava and Instagram — below), for at most 30 days after the event, after which the list closes by itself — consent, art. 6(1)(a) GDPR, withdrawn at any time from “My registrations”, or from the link in your confirmation email; no tick, no listing.

Beside each name the list shows where the registration stands — “Confirmed”, “Registered, awaiting confirmation” or “On the waiting list”. It holds the confirmed participants, those who confirmed their address and have not yet signed the declaration, and those on the waiting list, in its order, without a numbered place. A registration with an unconfirmed address, or cancelled, expired or erased, does not appear; confirmed participants without the tick are only counted. If you registered under an older version of this notice, which did not describe the states, you appear on the list, as before, only once your place is confirmed.

Beside the name of each confirmed participant the list also shows the “race number” — the one they wear in the race. A confirmed participant who has no number yet appears without one. Those whose place is not confirmed yet, those on the waiting list and those not shown by name have no number on the list. The number is part of your listing: you withdraw it with the listing.

Beside your name, the list also shows the Strava link and the Instagram username you gave on the form, each linked to your profile, only if you also ticked “Also show my Strava and Instagram beside my name on the list” — a separate consent (art. 6(1)(a) GDPR) that changes nothing else about your registration. Without the tick, or if you are not on the list, they do not appear. For a minor they never appear, because we keep none. You withdraw it at any time from “My registrations”, by deleting your Strava and Instagram or by leaving the list; they leave the list at once.

A race's results (“Results” on the event's page) appear only after the race, only for that race, and only if one of the club's administrators publishes them. For each runner they show the place (overall, by sex and in their category), the race number, the time, whether they finished, dropped out, did not start or were disqualified, and the category — the sex and age group on the day of the race. The club types the times, from the race's timing.

The name (or display name) appears in the results only for those who ticked “I want to appear on the participants & results list” when registering — one tick for the list and the results, withdrawn the same way, from “My registrations” or from the link in your confirmation email, and the name then leaves the results too (consent, art. 6(1)(a) GDPR). Everyone else appears as “Participant #race number”, with place, time and category but no name (legitimate interest, art. 6(1)(f) GDPR: showing how the race went). A runner who did not register and whose time the organizers entered by hand appears by name only if they told the organizers they want to (for a minor, the parent or guardian tells them); otherwise they appear as “Participant #race number”. The organizers record the agreement in the log, with who recorded it and when. The runner (for a minor, the parent or guardian) can withdraw the agreement at any time by writing to us, and the name then leaves the results (consent, art. 6(1)(a) GDPR). If you registered under an older version of this notice, which did not describe the results, you appear in them only by number, as “Participant #race number”, even if you ticked. The results close by themselves with the public list, within the same period. In our database, the results stay as long as we keep the race's registrations (section 7); the name the club typed for a runner who did not register stays no longer.

The “I'm coming!” answer on the page of an event that needs no registration (a group run, for example) shows publicly how many said they are coming and, row by row, the name only of those who ticked “I want my name to show”; everyone else is only counted, with no name. Without the tick nothing about you appears but the total. Basis for the name: your consent (art. 6(1)(a) GDPR), which you can withdraw at any time by unticking the name in a recognised browser, in the members' zone or on the page of the “I'm not coming any more” link in the email you received, or by writing to brasovrunners@gmail.com. Unticked, the name stays in the answer but no longer shows publicly; you can tick it again. If you ticked that you are a member of the group, or answered from the members' zone with your member account, the mark “BVR” shows beside the name you show, and the number of members coming shows too, without names. With no name shown, no mark shows. Basis for the mark: your consent (art. 6(1)(a) GDPR) — the member tick or, for an answer given from an account, the name's tick. The member tick is your own statement and the club does not check it; you remove it in a recognised browser or on the page of the “I'm not coming any more” link, and a mark set from an account stops showing when you untick the name and is deleted with the answer if you take it back; the mark shows only for answers given or changed after this sentence took effect. An answer is not a registration: it holds no place and signs no declaration.

Photographs and video from events, published in the gallery and on the club's channels: legitimate interest (art. 6(1)(f) GDPR) — showing the club's events; public place, no names, no EXIF. A portrait is published only with your agreement (Romanian Civil Code, art. 73–75). Tell us which and we take it down within a month, no reason needed.

The site's “The team” page introduces the people in the club's team and the volunteers who agreed to appear: their name, what they do for the club, a few words about them, a photograph and, if they wish, a link to a public profile of theirs. Basis: each person's consent (art. 6(1)(a) GDPR; Romanian Civil Code, art. 73–75), which they may withdraw at any time by writing to us: their card is taken off the site without delay and without asking for a reason, and the photograph is deleted.

5. Emails

We send only messages about your registration: confirmations, links, the waiting list, a reminder 2 days before (or as the event chooses) and at most one thank-you after the race, about that event, and the organizers' announcements about the event you registered for — a change of place or time, a cancellation or a message they write, about the weather for instance — not commercial communications under Romanian Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector (art. 12); marketing only with separate consent. Basis: art. 6(1)(b) GDPR. Of each message we keep the address, its facts and delivery state, not the text — except the words the organizers wrote in an announcement, the same for everybody; links, only as a fingerprint.

"Tell me when registration opens": if you leave your address on an event's page before its registration opens, we send you one email, shortly after it opens, with the link to the form. We keep the address on the notification list only until that message is sent and delete it from the list with it (the message itself keeps the address like any other message, see above) — or without a message, if the event is cancelled or registration no longer opens on the site. Basis: your consent (art. 6(1)(a) GDPR), which you can withdraw at any time before it is sent by writing to brasovrunners@gmail.com.

The “I'm coming!” answer: if you type an email address under “I'm coming!” on an event's page, we keep the address, the name (if you wrote one), whether you ticked that you want your name to show, whether you ticked that you are a member of the group (or answered from a member account), the page's language, this notice's version and the moment of the answer, and we send you one message (at most one every ten minutes for the same address and event) with two buttons: “Yes, I'm coming”, which counts you, and “I'm not coming”, which deletes your answer. If you ask from the page not to come any more, we send you only the withdraw link. Without “Yes, I'm coming” you are not counted, and an unconfirmed answer is deleted after 7 days; the links are valid for you only and work once: “Yes, I'm coming” works for 48 hours (at the latest until the event starts), “I'm not coming” until the event starts. Basis: your request to be counted and the club's legitimate interest in knowing how many are coming (art. 6(1)(f) GDPR), and for the name, the consent above. If you are subscribed to “The ‘Coming?’ question before runs” (or to all the newsletter's topics), before the event (a week ahead at most, from the hour the club chose) we automatically send you the question “Coming?”, with the buttons “I'm coming” and “I'm not coming”. When we send it, we write your address from the subscribers' list as an unconfirmed answer to that event: it does not count you and is not on the list of answers; only an administrator of the club sees it, in your data. “I'm coming” opens a page where “Yes, I'm coming” counts you, without another email. “I'm not coming” deletes it at once, and if you press nothing we delete it after 7 days. Basis: your consent given by subscribing (art. 6(1)(a) GDPR). If you answered “I'm coming!” at an earlier event of the same series (a weekly run, say) and the club chose to ask those who answered too, we may send you the same question, at the address of that answer, for as long as the answer is kept (30 days from the event) and only if you gave it after this sentence took effect. Every such message has the button “Don't ask me again for this series”: one press, and for that series we never ask you again. To honour the refusal we keep only your address, in its canonical form, and the series (the event's type and title), nothing else, for as long as the series exists and one year after its last date. Basis: the club's legitimate interest in knowing how many come to a series you already answered (art. 6(1)(f) GDPR), with your right to object at any time: through that button, which stays valid after the event, or by writing to us (section 8). If a browser was recognised by “Yes, I'm coming” or “I'm not coming any more” (section 10), at another event the answer is one press, with no message: the address has already been proved. If you are a member and have signed in to the members' zone, under “Runs” the answer is one press, with your account's address and no message; the account's name shows only if you tick “I want my name to show”.

The club's news (newsletter): if you subscribe on the contact page, we keep your email address, the page's language, the topics you choose from “All the news”, “Big events”, “Shoe testing”, “Special events”, “The weekly runs”, “Volunteering” and “Results and photos”, when you subscribed and the version of this notice you were shown, so that we send you only what you chose — the messages the club writes on those topics and, for new events, one automatic announcement when an event appears on the calendar and, if you choose “The ‘Coming?’ question before runs” (or all the topics), up to a week before an event where the club counts who comes, one more automatic message that asks whether you are coming (see the “I'm coming!” answer, above). The subscription starts only once you press the link we email you; an address never confirmed is deleted when the link expires, 48 hours after the last request, and we do not write to it again. Basis: your consent (art. 6(1)(a) GDPR; art. 12 of Romanian Law no. 506/2004). You change your topics or unsubscribe at any time, from the link in every message or by writing to brasovrunners@gmail.com, with no consequence; when you unsubscribe we delete your address from the list at once. Only the club's organizers and administrators see the list of subscribers with their addresses, in the site's administration area, from which they can also download it. Of each message sent we keep what the first paragraph of this section says; the newsletter's text we keep as the club's publication, without the addresses of those who received it.

Offers and benefits: only if you tick “I want to receive offers and benefits from Brașov Runners and its partners.” — when registering, when you sign your declaration, or later from your registration's page. The box is optional, never ticked in advance, and changes nothing about your registration; you answer for each registration separately. With it, we send offers and benefits from the club and from its partners — sponsors, shops, the events' partners — to the registration's email address. We keep your answer and when you gave or changed it. For another adult registered on your address, only that person gives it, when they sign their declaration or from their own registration's link. Legal basis: your consent (art. 6(1)(a) GDPR; art. 12 of Romanian Law no. 506/2004). You withdraw it at any time, with no consequence for your registration, from your registration's page or from “My registrations”, or by writing to us at brasovrunners@gmail.com. It is separate from the newsletter: unsubscribing from one does not take you off the other. Only the club's organizers and administrators see the list of those who ticked it, with their addresses, in the site's administration area, from which they can also download it.

The list for partners: with the same box, the club may give its partners — the club's sponsors and the partners of its events — your first name, last name and email address, so that they send you their own offers and benefits themselves. Nothing else: not your date of birth, your telephone or any other registration data. We never sell the list. We never give a partner the data of a minor: the list holds only participants who are 18 or older on the day it is made. Your consent covers both the club's messages and the partners'; a partner who receives the data uses it as a separate controller, only for its own offers, under its own privacy notice, and you may also ask it directly to stop writing to you. The club gives the list only with consents given under a version of this notice that says so. If you withdraw your consent, we give your data to no partner from then on, and we ask the partners who already hold it to stop writing to you and to delete it. Legal basis: your consent (art. 6(1)(a) GDPR; art. 12 of Romanian Law no. 506/2004). On request we tell you which partners we gave your data to (art. 15 and art. 19 GDPR): for every list, the club keeps whom it gave it to and which registrations it held. About what a partner does with your data you may complain at any time to ANSPDCP (section 9).

The contact form ("Write to us"): it takes your name, email address and message, with the language and the page you wrote from, and sends them as an email to the club's mailbox, through the club's Gmail or through the club's email service (Mailgun, EU region), as the club chooses, and through the other if the chosen one is down (section 6); in the club's mailbox we keep them at most 12 months from the conversation's last message. The platform keeps the message only until it leaves — usually a few seconds, at most three days if no email service works — and then deletes it. We use them only to answer you — for nothing else. Basis: our legitimate interest in answering what you asked (art. 6(1)(f) GDPR). The form has the same anti-bot defences as the registration form (section 10).

The “Tell us something” forms on the contact page — how an event went, a suggestion, a complaint and the confidential “Girl Zone” form — are anonymous unless you choose otherwise: each form opens with the choice of writing anonymously or “With my name”. Anonymously, we ask for neither your name nor a contact, and if you typed them anyway we do not send them: we do not know who wrote. With your name, you send it with the message, together with an email (optional) or a phone number if you want an answer (the email becomes the message's reply address, and is deleted with it), and you choose who hears it: the club or the person the club designated for safety. What you fill in leaves at once as an email; the platform keeps the message only until it leaves — usually a few seconds, at most three days if no email service works — and then deletes it. An anonymous message reaches the club's mailbox (through Gmail or Mailgun, as the club chooses for the form, and through the other if the chosen one is down; section 6), and one from the “Girl Zone” form only the own address of the person the club designated for it; a message with your name reaches whom you chose. At the club, messages reach its mailbox; at the designated person, only that person's own address, through the club's email service (Mailgun, EU region), without passing through the club's mailbox — unless the club chooses, for her messages, the club's Gmail (section 6): then the message leaves the club's mailbox and stays in its Sent folder, which whoever reads it sees. Her message may take the same way when Mailgun is down, if the club chose that for her. We keep them as ordinary correspondence, at most 12 months, and a message from the “Girl Zone” form only as long as it takes to deal with what it reports. A message may name another person: we treat it confidentially and use it only to handle the matter. Basis: our legitimate interest in knowing how the people who run with us feel and in keeping the events safe (art. 6(1)(f) GDPR). The forms have the same anti-bot defences as the contact form (section 10).

The members' shop (“The club's shop”): in the members' area, a member with an account can order the club's merchandise (t-shirts, buffs, stickers). For an order we keep your member account and your name, the product, the variant, the quantity, the price, the note you write if you write one, the order's status and its moments; the email address is taken from your account, to confirm the order and to tell you when it is paid, and if the club has chosen an address for orders, an email about each order is sent there. Basis: performing the order you placed (art. 6(1)(b) GDPR) and, for what must be kept as accounting records, the club's legal obligation (art. 6(1)(c) GDPR). Payment is not made on the site: you pay by bank transfer or in cash, as the club says with every order, and the platform does not receive, keep or process card data. We keep an order until you receive it, then for as long as the law requires for accounting records; if your member account is removed, the order stays with your name, without the address. Only the club's organizers and administrators see the orders.

Volunteers (“I want to volunteer”): if you offer to volunteer at an event, from its page, or if an organizer puts you on the event's volunteers' list, we keep your name, email address, telephone number, the roles you ticked and the role or roles the organizers give you, the short message you write, if you write one, the offer's state (registered, confirmed or cancelled), its moment and, for an offer made on the site, the version of this notice you had in front of you; the organizers may add a note of their own about the offer. We also keep your acceptance of the volunteer agreement (“Volunteer agreement”) — its version, the moment, the way (on the form, from the link received by email, or on paper, with the organizers) and the fingerprint of the text accepted; if you accept electronically, on the form or from the link received by email, we also keep the IP address and the browser you accept from, as proof of the acceptance — and your statement that you are of the age the agreement asks. If the form also asks the boxes “Date of birth”, “Sex”, “City”, “I have volunteered at other races before”, we keep your answers to them, or the ones the organizers note for you when they put you on the list themselves: your date of birth (from which we work out your age on the day of the event; it stands in for the age statement), sex, city, whether you have volunteered at other races before, whether you say you belong to the club's group and, only while the club gives volunteers T-shirts, your T-shirt size; they are your own answers and we check none of them, and the organizers use them only to place volunteers in roles and to prepare the event, nothing else. If you are a minor of the age the agreement asks, you may volunteer only with a parent's or guardian's consent: the form then also asks the boxes “Parent's or guardian's name”, “Parent's or guardian's email”, and we keep your parent's or guardian's name and email address, for as long as we keep your offer, to ask for their consent — they receive an email with a single-use link where they read the agreement and accept it in their own name (the name they type, the moment, the version, the fingerprint of the text accepted and the IP address and browser they accept from), or they sign it on paper, with the organizers — and until then the organizers cannot confirm you; the organizers use these data only for this consent. The basis for the parent's or guardian's data is the club's legitimate interest in taking minor volunteers only with their parent's or guardian's consent (art. 6(1)(f) GDPR), and, for their acceptance of the agreement, to conclude and perform it (art. 6(1)(b) GDPR). Purpose: to organize the help at the event and to contact you about it. After you send the offer you receive an email of receipt, with the accepted agreement attached and no link that does anything, and the organizers receive an email that you offered, without your address and telephone number; when the organizers give you a role or change your roles, you receive a short email that names them; if an organizer entered you, you may receive an email with a single-use link to accept the agreement. Basis: your consent, given by the box on the form (art. 6(1)(a) GDPR), which you can withdraw at any time by writing to us, and, for a person an organizer entered, the club's legitimate interest in organizing the event with those who offered it help or whose help it accepted (art. 6(1)(f) GDPR); the acceptance of the agreement we keep to conclude and perform it (art. 6(1)(b) GDPR). If the organizers invite you at your email address, to an event whose volunteers are by invitation only, we keep the address the invitation went to, the organizers' message, in Romanian and English, if they write one, the moment it was sent and whether the invitation was used or withdrawn; the basis is the club's legitimate interest in inviting its volunteers (art. 6(1)(f) GDPR), and the organizers have the address from you or from the club's contacts; you receive an email with a single-use link to the form, and the address on the form stays the invitation's; we delete them with the offer, 30 days after the event starts (section 7). At an event whose volunteers are members only, the form fills in your name and address from your member account. The public list of volunteers: if the event's volunteers' list is public and you ticked “I want to appear on the public list of volunteers” — on the form, or with an organizer who recorded the tick for you —, the event's page shows your name and the role or roles the organizers give you, nothing else, once the organizers confirm you and until your offer is deleted (thirty days after the event's start, section 7); volunteers who did not tick, and minors, are counted, without names. Basis: your consent, given by this tick (art. 6(1)(a) GDPR), which you can withdraw at any time by writing to us; your name then leaves the page. The offer is not a race registration, holds no place and is not on the public list of participants. The full list of volunteers, with the address and telephone number, is seen only by the club's organizers and administrators. The form has the same anti-bot defences as the registration form (section 10).

6. Who else sees it

Processors handle it on our behalf, under contract (art. 28 GDPR): Vercel Inc. — hosting the site (functions in Frankfurt; requests pass through Vercel's global network); Neon, Inc. (Databricks group) — database, Frankfurt; Mailgun Technologies, Inc. (Sinch group) — sending email, EU region; Cloudflare, Inc. — storing photographs (at a preferred European location, delivered through Cloudflare's global network) and the Turnstile anti-bot check, on Cloudflare's global network (section 10); Zitadel, a Swiss provider (the EU-region instance) — the sign-in accounts of the club's team and members, no participant data; Switzerland has a European Commission adequacy decision (art. 45 GDPR).

The club's mailbox is a Gmail account (Google). Mail to brasovrunners@gmail.com and from the contact form reaches it, as do the copies below; some may be forwarded to organisers' mailboxes. For an ordinary Gmail account, Google also processes data under its own terms, not only on our behalf.

When our email provider (Mailgun) refuses or delays sending — a pause it asks for, or its limit spent — a message from the platform to you may leave, until it resumes, through the club's Gmail mailbox (Google Ireland Ltd.), with the same content and the same data, for the same purpose and on the same basis as the message itself (section 5): so that a message about your registration is neither lost nor late. The club switches this on or off with the setting “Gmail takes over when Mailgun stops”.

Copies in the club's mailboxes. When you sign the declaration, a PDF copy of it — with your name and the event, and your identity document's series and number masked (at most the first two and last two characters remain) — reaches the club's archive mailbox and at most a few organisers' addresses chosen by the club. The club also receives a short message when you confirm your place (name, event, race number) and may receive a copy of the emails we send you about your registration, without the personal links and without attachments. Basis: our legitimate interest in having declarations and confirmations to hand on race day and as evidence afterwards (art. 6(1)(f) GDPR). We delete these copies three years after the event.

Photographs published on Facebook, Instagram (Meta) or Strava reach those platforms, which process them under their own terms. Data may also reach the authorities where the law requires, and a lawyer over a claim. We never sell it or give it to anyone else, with one exception: if you ticked offers and benefits, we may give the club's partners — the club's sponsors and the partners of its events — your first name, last name and email address, so they send you their offers; they use it as separate controllers (section 5).

The database, the site's functions and email sending are in the EU (Frankfurt; Mailgun's EU region). Vercel's and Cloudflare's global networks and the club's mailbox may process data outside the EU as well, and Vercel, Neon, Mailgun, Cloudflare and Google are or belong to US companies and may access the data from the US. Transfer basis: the European Commission's standard contractual clauses in each one's data processing agreement (art. 46(2)(c) GDPR) and, for certified providers, the EU-U.S. Data Privacy Framework (art. 45 GDPR). On request we send the list of providers with each one's basis and a copy of the clauses.

7. How long we keep it

Registrations and declarations signed for an event with registration: three years from the event (the general limitation period, art. 2517 of the Romanian Civil Code); electronic ones are deleted automatically; paper ones are destroyed by the club at the same point, after it has covered the identity documents' series and numbers on them within seven days of the event. A registration whose email address was never confirmed: 30 days. Identity document series and number, the health note and the emergency contact: seven days from the event (the note sooner, if you withdraw consent). A self-declaration signed on a group run: as long as it is needed for the runs it applies to; once you ask us to withdraw it, it is no longer used for later runs. A copy may be kept after that, for as long as needed to establish, exercise or defend rights, including with regard to the general three-year limitation period set by art. 2517 of the Romanian Civil Code. If a complaint, a dispute or proceedings are under way, the document may be kept until they are finally settled. Your participant details (name and email address): with your last registration. Copies in the club's mailbox (section 6): three years from the event. Contact-form messages: 12 months from the conversation's last message. An address subscribed to the newsletter: until you unsubscribe; never confirmed, 48 hours from the last request. The consent to offers and benefits: until you withdraw it, and never longer than the registration. The list given to partners: the club's copy, deleted within 30 days of the download; at the partner, as long as its own privacy notice says, and when you withdraw your consent we ask it to delete your data; whom we gave it to and which registrations it held stay in the team's log, without the file. Exported lists and downloaded files carrying identity document series and numbers: deleted within seven days of the event; other exported lists and printed race-day sheets: destroyed within 30 days of the event. Sent-email records: 90 days; an undelivered message, as long as the registration, or 90 days if it belongs to none. Used or expired links: 30 days. Anti-abuse counters: one day. The team's log (art. 5(2) GDPR): three years, without an erased person's identity. Notice version and consents: as long as the registration (art. 7(1) GDPR). Database backups: at most seven days more after a deletion. Providers' logs: hosting, at most one hour; Mailgun, per the account's plan, and an address that bounced stays on its suppression list until we remove it. The public list: while the club has it switched on, and at most 30 days after the event. Photographs: until removed or you object. If an incident occurs at an event from which a claim may arise, we keep the data of those involved — including the copies in the club's mailbox — beyond the periods above only as long as needed to establish, exercise or defend a legal claim, until it is finally settled (GDPR art. 17(3)(e) and art. 6(1)(f)).

“I'm coming!” answers: the address, the name (if you wrote one) and the answer's state, 30 days from the event's end, then we delete them automatically; an unconfirmed answer is deleted after 7 days, and the answers of a cancelled event at the next automatic clean-up after the cancellation. The refusal to be asked again for a series: the address (in its canonical form) and the series, for as long as the series exists and one year after its last date, then we delete them automatically. The refusal stays even after a request to erase your answers, because without it we would ask you again. The recognised browser (section 10): one year from the last answer, or until you press “Not me”.

Volunteer offers: 30 days from the event's start (one entered after the start, 30 days from its entry), then we delete them automatically; sooner at your request. The event's roles, without any name, stay as long as the event does.

A race's results — the place, the race number, the time, the category and, for those who ticked, the name, plus the name the club typed for a runner who did not register: three years from the race, like its registrations, then we delete them automatically. They leave the event's page earlier, with the public list. The results file the club downloads from the backoffice is a copy the automatic deletion cannot reach: the club keeps it no longer than the same period.

8. Your rights

What you can do yourself. From “My registrations” (the link comes by email) you see your active registrations, their state, number and QR code, cancel a registration, choose whether you appear on the public list, and delete your health note and your Strava and Instagram. Cancelling frees the place but does not delete the data: a cancelled registration is kept as section 7 says.

What we do on request. Write to brasovrunners@gmail.com from the registered address, or confirm your identity (art. 12(6) GDPR); we answer free of charge within one month; for a complex request, or for many requests, this may be extended by at most two more months, and we tell you why within the first month (art. 12(3) GDPR). Access: we send you a copy of your data. Rectification: we correct what is wrong. Erasure: we remove the registration, the declaration and, if you have no other, your details; the log keeps when and why, not who, and the place passes to the first on the waiting list. Restriction: you can ask us to keep your data without using it while we check whether it is accurate or whether your objection is justified, instead of erasing it, or when we no longer need it but you need it for a legal claim (art. 18 GDPR). On request, we tell you whom we disclosed it to (art. 19 GDPR). Portability: the data you gave, as a file. Withdrawing consent, at any time, without retroactive effect and without losing your place.

Your right to object. You may object at any time to processing based on our legitimate interest — keeping evidence, photographs, the log, the anti-bot check, the copies in the club's mailbox. We stop unless compelling legitimate grounds or a legal claim prevail; for photographs we ask no reason.

9. Complaints

Write to us first. You may always complain to Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, 010336 Bucharest, www.dataprotection.ro, anspdcp@dataprotection.ro (art. 77 GDPR), and have a judicial remedy before the courts of Romania or, if you live in another Member State, of that State — against us (art. 79) or a decision of the authority (art. 78).

10. Cookies and technical data

No traffic analytics, advertising or tracking. What we use is strictly necessary and needs no consent (Romanian Law no. 506/2004, art. 4(6)): the colour scheme and a new-version notice, in your browser's own storage, never sent to us; two encrypted cookies lasting at most 10 minutes, set only when you submit the registration form, the declaration, the contact form, the “Tell us something” forms or the “I want to volunteer” form — one keeps what you typed if the form comes back with an error, the other your address and first name for the confirmation screen; for the team, the sign-in cookies (the session, 30 days, and its short-lived protections). The language is in the address, not a cookie. A YouTube video on an event page loads only when you press it; only then does Google receive your IP address and may set its own cookies. A route's map on an event page loads with the page, without a press; when the event has maps on both Strava and Garmin Connect, only the one in the chosen tab loads (Strava first), and the other only when you choose its tab. Strava, or Garmin, receives your IP address and may set its own cookies the moment its map loads, and not before.

The recognised browser: after you press “Yes, I'm coming” or “I'm not coming any more” in the email you received, your browser receives two cookies, lasting a year from the last answer: one, unreadable by scripts, with a random code whose fingerprint we keep on the server, linked to your address, and one with the address masked (like an…@gmail.com) and your name, with no code, so the page can show “Answering as …”. We use them only so that “I'm coming!” and “I'm not coming any more” are one press at other events, at your request: they are strictly necessary for that function you asked for (Romanian Law no. 506/2004, art. 4(6)), track nothing and open nothing else — no registration, no account. “Not me” on the event's page deletes both and deletes the row on the server.

Hosting sees each request's IP address; its log is kept at most one hour, unlinked to registrations. The form has a trap field, a fill-time check and limits per email and per link, kept one day, with no IP address; the only IP address we keep is that of an electronic signature (sections 3 and 5). When the anti-bot check is on, the form uses Cloudflare Turnstile: Cloudflare receives the IP address and the browser's technical signals only to decide whether the request comes from a person, with no tracking cookies (basis: art. 6(1)(f) GDPR).

11. Changes

Every version of this notice is numbered, dated, fingerprinted and never changes after approval; your registration records the version you acknowledged. The version in force is at this address; a material change is announced on this page and, for registrations to events not yet held, by email, before it applies.

12. The club's team and members

For volunteers and organisers with access to the platform we keep name, email address and role, who did what on the platform, and the name of whoever recorded a paper declaration. Zitadel holds the sign-in account; a session lasts 30 days. Basis: our legitimate interest in knowing who has access and who acted (art. 6(1)(f) and art. 5(2) GDPR). When access is withdrawn we delete the account on the platform, and the Zitadel one on request; the log stays at most three years.

The club's members may receive an account with which they enter the members' area of the site. For them we keep name, email address, the member role, preferred language, the date of the first sign-in and the membership level the club gives them, if it gives one (only the administrators see it); we email them the invitation, and Zitadel holds the sign-in account, as for the team, with the same 30-day session. The members' area shows only the text the club writes for its members and the published events; it shows no other member's data and gives no access to running the site. Basis: the club's legitimate interest in offering its members what it promised them (art. 6(1)(f) GDPR). A member may ask us at any time to delete their account by writing to us; we also delete it when they are no longer a member, and the Zitadel one on request.