Privacy policy

Trading name:

EntrySwap

Company name:

EntrySwap, S.L. (sociedad unipersonal)

Tax ID (NIF / CIF):

B05649900

Address:

Calle Major, 15, piso 0, puerta 1, 25586 Isil, Alt Àneu (Lleida)

Contact:

info@entryswap.com

EntrySwap is not required to appoint a Data Protection Officer under Article 37 of Regulation (EU) 2016/679, the General Data Protection Regulation (hereinafter, the “GDPR”), or under Article 34 of Ley Orgánica 3/2018, the Spanish Data Protection and Digital Rights Act (hereinafter, the “LOPDGDD”). Any question relating to the processing of personal data may be sent to info@entryswap.com.

Depending on how the User uses the EntrySwap platform (hereinafter, the “Platform”), EntrySwap processes the following categories of personal data:

• Registration data: first name and surname(s), email address and contact telephone number.
• Identification data for the name transfer under the Via EntrySwap option: when the User reserves a bib under this option, in addition to the above, their Spanish national identity number or foreigner identity number (DNI or NIE) and their date of birth. These data are mandatory, as the race organisers need them to process the entry, assign the age category and provide insurance cover. Optionally, the name or nickname that the User wishes to have printed on the bib.
• Waiting list data: under the Via the Organiser option, the race and distance of interest, the first name, surname(s) and email address with which the User wishes to enter the race, and their position on the list.
• Bib listing data: the race and distance of the entry, the email address with which the User registered and, if they choose to give it, the reason why they will not be taking part. This last item is voluntary and is not published.
• Rating data: the ratings that buyers give sellers under the Via the Organiser option, their date and, where applicable, their comment.
• Profile and transaction data: history of bibs listed, reserved or accepted, and the information on each transaction (race, amount, date and status).
• Payment data: card or bank account details are processed entirely by the payment service provider (Stripe). EntrySwap does not store card details.
• Race organiser data: the entity’s tax identification number (NIF), the name and position of the contact person, corporate email address, telephone number and race details.
• Technical data: information about access to the Platform (IP address, browser type and the page on which an error occurred) recorded by the error diagnostics tool. EntrySwap also uses a cookieless analytics tool that records, in aggregate form, the pages visited, the country and the type of device, without identifying the User or tracking them across websites. EntrySwap does not use third-party advertising tools.
• Communications: the content of the messages that the User sends to EntrySwap.

Disclosure of data necessary to provide the service. The service that the User contracts consists of enabling the name transfer of the entry to be carried out. Under the Via EntrySwap option, this requires the race organisers to receive the buyer’s identification data. Under the Via the Organiser option, it requires the seller to receive the buyer’s first name, surname(s) and email address, since it is the seller who requests the transfer from the organisers. These disclosures are therefore based on the performance of a contract (Art. 6(1)(b) GDPR) and not on consent, so they cannot be withdrawn separately while keeping the transaction in place. A User who does not wish their data to be disclosed may refrain from completing the reservation or accepting the bib, or may cancel them.

Ratings. EntrySwap has balanced buyers’ legitimate interest in knowing how reliable sellers are against the rights of those sellers. Accordingly, only the seller’s first name and the initial of their first surname, their average rating and the number of ratings are published; ratings may not include personal data of third parties or data concerning health, and the seller may request a review of a rating and exercise their right to object to its processing in accordance with section 7.

• Account data: for as long as the account remains active. After the account is closed, they are kept blocked for the limitation period for legal claims and then erased.
• Transaction data: 6 years from the transaction, owing to accounting obligations (Article 30 of the Código de Comercio, the Spanish Commercial Code) and tax obligations. After that period, the buyer’s identification data (DNI or NIE, telephone number and date of birth) are erased and only the financial information necessary for accounting purposes is kept.
• Waiting list data: until the list closes, which happens at the end of the organisers’ deadline for name transfers or, failing that, on the date on which the race is held, or until the User is no longer on the list, if that happens earlier.
• Ratings: for as long as the rated seller’s account remains active.
• Marketing communications: until consent is withdrawn.
• User support enquiries and conversations: for the time needed to resolve the enquiry, up to a maximum of two (2) years.

Race organisers (independent controllers), under the Via EntrySwap option. When the User reserves a bib under this option, EntrySwap discloses to the race organisers their first name and surname(s), DNI or NIE, email address, telephone number and date of birth, as well as the nickname for the bib if one has been given. In respect of the seller, EntrySwap discloses the email address with which they registered, so that the organisers can locate their entry and cancel it. The organisers process those data as an independent controller, in accordance with their own privacy policy, in order to manage the entry and participation and to comply with their insurance and sports federation obligations. The organisers do not act on behalf of EntrySwap, nor does EntrySwap act on behalf of the organisers.

Seller, under the Via the Organiser option. Once the parties have been put in touch, EntrySwap discloses to the seller the buyer’s first name, surname(s) and email address, solely so that the seller can request the name transfer from the organisers. The seller processes those data as an independent controller and is bound, under the Terms and Conditions, not to use them for any other purpose and to erase them once the transfer has been completed or has failed. Under this option, EntrySwap does not disclose data to the organisers: it is the seller who gives them the buyer’s email address, and the organisers process the data they receive in accordance with their own privacy policy.

Other Users. Before accepting a bib, buyers can see the seller’s first name and the initial of their first surname, their average rating and the number of ratings received.

Processors. EntrySwap uses the following providers, which act as processors, are bound by contract in accordance with Article 28 GDPR and are not authorised to use the data for their own purposes:

• Stripe Payments Europe, Ltd. (Ireland): payment processing. Card details are processed directly by Stripe; EntrySwap does not store them.
• Resend: sending of emails relating to transactions.
• Neon: database hosting.
• Vercel: hosting and delivery of the web application.
• Sentry: error logging and technical diagnostics. It is configured not to collect identification data, although it may incidentally process IP addresses and technical browser data.
• Google Workspace (Google Ireland Limited): corporate email from which enquiries are handled.
• Umami: Platform usage statistics, with the data hosted in the European Union (Frankfurt). It does not use cookies or persistent identifiers and does not collect data that could identify the User.

Authorities and law enforcement agencies: where there is a legal obligation or a court order.

EntrySwap does not sell personal data or disclose it to third parties for its own commercial purposes. EntrySwap does not use advertising, profiling or cross-site tracking tools. The analytics tool does not use cookies or allow the User to be identified, so it does not require their prior consent; the legal basis is EntrySwap’s legitimate interest in understanding how the Platform is used (Art. 6(1)(f) GDPR). Should tools that require consent be introduced in the future, EntrySwap will update this policy and obtain the User’s consent before activating them.

EntrySwap hosts the data in the European Union and contracts with its providers through their European entities wherever possible. However, some of them, such as Sentry, Vercel or Umami, are United States companies or may access the data from outside the European Economic Area for support purposes.

In such cases, the transfers are based on the safeguards provided for in Chapter V GDPR: the adequacy decision on the EU-US Data Privacy Framework, where the provider is certified, or the Standard Contractual Clauses approved by the European Commission, together with supplementary measures. The User may request a copy of, or information about, those safeguards at info@entryswap.com.

Users who choose to contact EntrySwap via WhatsApp should bear in mind that the conversation is transmitted and stored through that service, which is provided in Europe by Meta Platforms Ireland Limited under its own privacy policy, over which EntrySwap has no say. EntrySwap processes the telephone number and the content of the message solely to deal with the enquiry. Alternatively, the User may write to the email address given in this policy.

As a data subject, the User may exercise the following rights recognised by the GDPR and the LOPDGDD:

• Access: to find out which of their personal data EntrySwap processes.
• Rectification: to correct inaccurate or incomplete data.
• Erasure: to request the deletion of their data when it is no longer necessary for the purpose for which it was collected.
• Restriction of processing: to request that the processing of their data be restricted in the cases provided for by law.
• Data portability: to receive their data in a structured, commonly used format.
• Right to object: to object to processing based on legitimate interest, including the publication of ratings, or for direct marketing purposes.
• Withdrawal of consent: at any time, without affecting the lawfulness of processing carried out before its withdrawal.

To exercise these rights, the User may send an email to info@entryswap.com stating the right they wish to exercise. It is sufficient to send it from the email address associated with their account or transaction: EntrySwap will not routinely request a copy of an identity document. Additional identification documents will only be required where there is reasonable doubt as to the identity of the requester, and only to the extent strictly necessary to resolve it.

EntrySwap will respond within one (1) month of receipt of the request, which may be extended by a further two (2) months where the request is particularly complex, in which case EntrySwap will inform the User of the extension and the reasons for it.

Where the data have already been disclosed to a race’s organisers or, under the Via the Organiser option, to the seller, the recipient processes them as an independent controller, so the User must contact that recipient directly to exercise their rights. At the User’s request, EntrySwap will provide the organisers’ contact details.

If the User considers that the processing of their data does not comply with the applicable legislation, they may lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

EntrySwap applies appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction or alteration. However, no system for transmitting data over the Internet is completely secure, so EntrySwap cannot guarantee the absolute security of communications.

EntrySwap may update this Privacy Policy. In that case, it will update the date shown at the top of the document and, where the changes are substantial, will notify the User by email or by means of a prominent notice on the Platform.