PRIVACY POLICY

The Pyrenean Pass League — Pilot Edition

Last updated: 29 July 2026

Quick summary: to take part we need your name and email. The app uses your GPS location to check that you are at a pass, and stores a record of every validation. Your name, your score and your validations are public in the standings. We do not sell your data and we do not use advertising identifiers.

1. Data controller

The data controller is the promoter of The Pyrenean Pass League, who organizes this pilot edition on a personal basis, without an association or company structure, as described in the Rules.

Privacy contact address: privacidad@laligapirenaica.com

As the promoter is not an entity required to appoint one, no Data Protection Officer has been designated. Enquiries are handled directly at the address above.

2. What data we process

2.1 Account data

When you register in the app we process:

• The name or alias you choose to display.
• Your email address.
• Your password, managed by Firebase Authentication. The promoter never has access to your password: it is stored encrypted by Google and we only receive a user identifier (uid).

2.2 Validation records (visits)

Every time you validate a pass — automatically during a ride, or by tapping “Validate” — an immutable record is created containing:

• Your user identifier (uid).
• The identifier of the validated pass.
• The date and time of the validation (UTC).
• The GPS coordinates (latitude and longitude) at the moment of validation.
• The accuracy reported by the GPS sensor, in metres.
• The distance to the pass at the moment of validation, in metres.
• The points awarded.

These fields exist so that a validation can be audited in the event of a complaint or suspected manipulation (Articles 5 and 10 of the Rules).

2.3 Location

The app requests foreground location permission (to show your position on the map) and, optionally, background location permission (to validate passes automatically while you ride). See section 5.

2.4 Usage data

We use Firebase Analytics (Google Analytics 4) to understand how the app is used during the pilot: screens viewed, ride start and end, the outcome of permission requests, onboarding progress, sign-ups and logins, and pass validations. Google additionally collects technical device data (model, operating system, language, approximate country) and an app installation identifier.

The advertising identifier (IDFA on iOS, Advertising ID on Android) is never accessed — it is expressly blocked in the app’s configuration. We do not run advertising and we do not track you across third-party apps.

2.5 Website newsletter

If you subscribe to the newsletter on this website, your email address is sent to Buttondown, the provider that handles delivery. You can unsubscribe from any email you receive.

2.6 What we do not process

• We do not store a continuous trace of your routes — only the specific points where a validation occurs.
• We do not process data about your motorcycle: not its make, its registration plate, or your insurance policy details.
• We do not process special categories of data (health, biometrics, beliefs).
• We do not sell or transfer data for commercial purposes.
• Participation is free: we process no payment data of any kind.

3. Purposes and legal bases

You can withdraw any consent at any time — by revoking the permission in your operating system settings, or unsubscribing from the newsletter — without affecting the lawfulness of processing carried out beforehand.

4. Public data

This matters, and is worth reading before you register:

• Your standings row (display name, total score, number of unique passes and date of your last validation) is publicly readable: anyone using the app can see it.
• Your validation records are also publicly readable, so that the app can show who has visited each pass. They include the coordinates and time of the validation, which correspond to the pass in question.

Choose a name you are comfortable seeing in a public leaderboard. You can change it at any time, and the change is reflected in the standings.

Nothing else is public: your email address, your permissions and your analytics data are not accessible to other participants.

5. Background location

Automatic validation requires the app to know your position while the screen is off or the app is in the background. Specifically:

• Your location is compared against the coordinates in the pass catalog and is only stored when a valid validation occurs (inside the pass radius and with sufficient accuracy).
• Intermediate positions are processed on the device and are not sent to any server.
• You can revoke the permission at any time in your system settings. The app will keep working, but you will have to validate each pass manually while standing at it.
• With no signal, the validation is stored locally and synced once connectivity returns.

6. Processors and international transfers

To provide the service we rely on the following providers, acting as data processors:

Transfers outside the European Economic Area are covered by the European Commission’s Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

Data will also be disclosed to the competent authorities where there is a legal obligation to do so.

7. Retention periods

• Account: for as long as your account remains active, and until you request its deletion.
• Validations: throughout the season and for up to 12 months after it closes, so that complaints about the final standings can be resolved.
• Analytics: according to the retention configured in Google Analytics, up to a maximum of 14 months.
• Newsletter: until you unsubscribe.

Once those periods elapse, the data is deleted or irreversibly anonymized.

8. Your rights

You may exercise your rights of access, rectification, erasure, restriction, objection and portability at any time, as well as withdraw your consent, by writing to privacidad@laligapirenaica.com from the address you registered with. We will respond within one month at the latest.

Please note that:

• Validation records are immutable from within the app: if you request their erasure, the promoter deletes or anonymizes them manually.
• Deleting your account removes your standings row and the accumulated score. This is irreversible.
• You can delete your account yourself from inside the app, or request it by email: Delete your account.

If you believe your request has not been handled properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

9. Minors

Participation is restricted to people aged 18 or over (Article 3.1 of the Rules). We do not knowingly collect data from minors. If we identify an account belonging to a minor, it will be deleted.

10. Security

Access to data is restricted by row-level security rules: each participant can only write their own validations and their own standings row, and validations cannot be modified or deleted once created. Communications with the server are encrypted (TLS), and passwords are held by Google, never by the promoter.

11. Changes to this policy

Any material change to this policy will be announced on the website and, where it affects processing that relies on your consent, consent will be requested again. The date of the last update appears at the top of this document.

12. Contact

privacidad@laligapirenaica.com

Published by the promoter of The Pyrenean Pass League — Pilot Edition