Privacy policy

Who is responsible for your data

The data controller is Valua Travel [TO COMPLETE: legal name] (NIF [TO COMPLETE: NIF]), with registered address at [TO COMPLETE: registered address]. For anything related to your personal data you can write to info@transpyr.com or call [TO COMPLETE: phone]. [TO REVIEW: whether a Data Protection Officer has been appointed; if so, add the DPO contact here.]

This policy applies to the public website https://www.transpyr.com, your private account, the registration and payment process, and the emails we send you to access your account or manage your registration. It follows Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD).

What data we collect

We collect only the data needed to run the event and to comply with the law:

• Account profile: name, email address and preferred language, if you create a private account.
• Identity: first name, last name, date of birth, gender, nationality and ID document number (DNI, NIE or passport).
• Contact: email, phone, postal address and language preference.
• Emergency contact: name and phone of a person to call in the event of an accident.
• Billing: invoicing name, tax ID and address when you request an invoice in a name other than your own.
• Event data: modality, distance, pack, extras, jersey size, club or team, and times or results if they are published.
• Health data: allergies and dietary restrictions that you choose to tell us about (see below).
• Payment metadata: order reference, amount, date, authorisation code and the masked card number returned by the payment gateway. We never receive or store full card numbers.
• Technical data: IP address and browser data in server logs, plus the cookies described in the Cookie policy.

Your private account

You can create an account before buying. Creating an account does not create a registration, reserve a place, make a payment or subscribe you to marketing communications. The account profile contains your name, email address and preferred language.

We send an access link to verify your email address. It expires after 15 minutes and can be confirmed once. Opening the link alone does not sign you in. After you confirm, an essential session cookie keeps you signed in for up to 30 days; signing out revokes that session.

Your account shows registrations with the same verified rider email address. A billing email or a group purchase does not give you access to another rider's registration. Updating your account name or language does not change the information stored with a registration.

Why we process it and on what legal basis

• Registration and event management (bib assignment, timing, road book, logistics, results): performance of the contract (Art. 6(1)(b) GDPR).
• Payment and refunds through Redsys: performance of the contract and our obligation to keep accounting records (Art. 6(1)(b) and (c)).
• Invoicing and tax obligations: legal obligation (Art. 6(1)(c)), including the Spanish invoicing regulation.
• Operational communications about your registration and the event (confirmation, changes, safety notices): performance of the contract (Art. 6(1)(b)).
• Communications about future editions: legitimate interest in informing existing riders (Art. 6(1)(f) GDPR and Art. 21.2 LSSI), or consent for newsletter subscribers. You can opt out at any time from any email.
• Emergency contact and medical assistance on the route: protection of vital interests (Art. 6(1)(d)) and performance of the contract.
• Health data (allergies, dietary needs): your explicit consent (Art. 9(2)(a)). We use it only to organise catering and to brief the medical team. If you do not provide it, we cannot cater for specific needs.
• Photographs and video taken at the event: legitimate interest in documenting and promoting the event (Art. 6(1)(f)); see the Terms of participation for how to opt out.
• Security of the Site and fraud prevention: legitimate interest (Art. 6(1)(f)).

Emergency contact

When you give us the name and phone of an emergency contact you confirm that you have informed that person and that they agree to be contacted by the organiser or by medical services if needed. We use this data only in an emergency.

Who receives your data

We do not sell your data. We share it only with service providers acting as processors under Art. 28 GDPR contracts, or with third parties when this is necessary to deliver the services you bought:

• Redsys Servicios de Procesamiento, S.L. and the organiser's bank: card payment processing and refunds.
• Resend, Inc.: sending transactional emails (account access, registration confirmation, invoices, event notices).
• Clerk, Inc.: authentication of the organiser's staff in the backoffice only. Riders do not have Clerk accounts and the public site does not load Clerk.
• Vercel Inc. (hosting and file storage) and Neon Inc. (database): the infrastructure on which the Site, account data and registration data run.
• Anthropic, PBC: automatic translation of product descriptions and site texts. No rider personal data is sent to this provider.
• Hotels and accommodation partners: name, dates, room type and dietary needs of riders who bought a pack with accommodation.
• Insurers and medical or emergency services: the data strictly needed for accident insurance and assistance during the event [TO REVIEW: name the insurer].
• Timing and results providers: bib number, name, category and times [TO REVIEW: only if a third-party timing company is used].
• Public authorities (tax agency, police, courts) when the law requires it.

International transfers

Some providers (Vercel, Neon, Resend, Clerk, Anthropic) are US companies. Where data leaves the European Economic Area, the transfer is covered by the provider's certification under the EU-US Data Privacy Framework or by the European Commission's Standard Contractual Clauses, together with additional safeguards. We select EU regions for hosting and database where the provider offers them [TO REVIEW: confirm the EU region configuration for Vercel functions and Neon].

How long we keep it

• Registration and event data: until the end of the event plus the period during which liability claims may arise (generally 5 years, Art. 1964 Civil Code) [TO REVIEW].
• Invoices and accounting records: 4 years for tax purposes (Art. 66 General Tax Law) and 6 years for commercial records (Art. 30 Commercial Code).
• Health data: deleted within 3 months after the event, unless needed for an incident file.
• Communications about future editions: until you opt out or after 3 years without interaction.
• Server logs and security data: up to 12 months.

Your rights

You have the right to access your data, to rectify it, to request its erasure, to restrict or object to its processing, to request portability and to withdraw any consent you have given without affecting prior processing. You also have the right not to be subject to automated decisions with legal effects; we make none.

To exercise these rights, email info@transpyr.com from the address you registered with, stating which right you are exercising. We may ask for a copy of your ID document if we cannot otherwise verify your identity. We reply within one month.

If you believe your rights have been infringed, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es, C/ Jorge Juan 6, 28001 Madrid).

Security and minors

We apply technical and organisational measures appropriate to the risk: encrypted connections (TLS), a backoffice protected by staff authentication, least-privilege database access and card data handled exclusively by the payment gateway. Participation is limited to adults; we do not knowingly collect data from persons under 18.

Changes to this policy

We may update this policy to reflect legal or operational changes. The version in force is identified by the "Last updated" date on this page, and the version you accepted is recorded with your registration (current version 2026-11-11).