Legal information and privacy

1. Data controller

Controller

Miguel Ángel Martín Martínez

Tax ID (NIF / CIF)

75932512J

Address

Calle Párroco José Rodríguez, 33 · 18014 Granada (Spain)

Email

[email protected]

2. Data Protection Officer (DPO)

For any question relating to the processing of your personal data, you can contact our Data Protection Officer:

Contact person

Miguel Ángel Martín Martínez

DPO email

[email protected]

3. For what purposes do we process your data?

1. Management of your user account. Creation, maintenance and authentication of your account, including email, password (hashed), name, city, avatar, banner and bio.
2. Recording and publication of routes. Storage of the routes you record with their GPS coordinates, associated photographs, description, difficulty and duration, as well as the comments, likes and saves you generate.
3. Background location during a recording. While you have an activity in progress in the mobile app, and only while it is in progress, we record your position even if the screen is off or you are in another app. Without this, the track would be cut off every time you put your phone in your pocket, which is exactly what people do when walking or cycling.
   Collection starts when you press start and ends when you press finish: there is no tracking outside that interval. While it is active, you will see a permanent system notification. You can revoke the location permission in your device settings at any time; the app will continue to work, but it will not be able to record routes.
4. Suggestion of your city. If you authorise us to do so, we convert your approximate position into the name of a city to fill in that field of your profile and to sort the people and clubs we show you by proximity. We store only the name (for example, "Granada"): we do not keep the coordinates of that query.
5. Social functionality. Management of follows, direct messages between users, posts in groups, group events and other social interactions within the Site.
6. Record of the notice for events. When you publish an event or sign up for one, we store the fact that you accepted the corresponding notice: your user, the event, the date and the version of the notice. This allows us to prove that participants were informed should a claim arise. If you delete your account, it is no longer associated with your personal data, like the rest of your activity.
7. Management of the shop and orders. Processing of merchandise orders (T-shirts, trousers, socks and accessories): selected sizes, shipping address and payment data processed through Stripe. Your card number never reaches our servers.
8. Premium subscription and credits. Management of the monthly/annual subscription through Stripe and of redeemable credits (subscription, redemption, expiry).
9. Push notifications and transactional email. Sending alerts about your account activity (likes, follows, messages, events) through Firebase Cloud Messaging (push) and our own SMTP server (email).
10. Sending routes to your sports watch. If you use the "Send to my Garmin" feature, we generate a course file with the route's coordinates and record which route you have sent and when, so that we can warn you if you send it twice. If you also link a watch, we store the device model, the dates of linking and last access, and an encrypted code (non-reversible) that allows the watch to identify itself to us. We do not access any data in your Garmin account or the activities you record with the watch.
11. Leaderboards and rankings. Compilation of public leaderboards (monthly, yearly, all-time) based on the kilometres and activities recorded.
12. Fraud prevention and security. Detection of abusive behaviour, impersonation or unauthorised use, keeping only the strictly necessary logs.
13. User support. Handling of queries, rights requests and communications that you initiate with our support service.

4. What is the legal basis?

• Performance of the contract for account management, publication of routes and the operation of the social network and the shop.
• Express consent for sending push notifications and marketing communications, as well as for any processing of special categories of data.
• Legal obligation for the retention of tax and accounting data (4 years) and to comply with requests from the competent authorities.
• Legitimate interest for fraud prevention, platform security, compilation of leaderboards, recording acceptance of the notice for events and product improvements, always after weighing up your rights.

5. Recipients and data processors

In order to provide you with the service, we share certain data with the following data processors, all of them subject to confidentiality and security obligations:

• Stripe Payments Europe Ltd. (Stripe). Processing of card payments and subscriptions. Its main servers are located in the United States; transfers are covered by the European Commission's Standard Contractual Clauses (SCC) and the EU-US Data Privacy Framework (DPF).
• Google Firebase (Cloud Messaging). Push notification service. Based in the United States, with transfers covered by SCC and DPF.
• OpenStreetMap Foundation (Nominatim service). A non-profit foundation that converts city names into coordinates and vice versa. It receives the text you type when searching for your city and, when you use the option to detect your location, a position rounded to approximately one kilometre: never your exact position. It does not receive your identity, your email or any other data from your account, so it cannot link that query to you.
• MapTiler. Supplies the map images. Your device does not communicate directly with this provider: requests go through our server, so MapTiler sees which areas of the map are requested but not who requests them.
• Minio (self-hosted). Storage of the photographs you upload to your routes. The data remains on servers located in the European Union under our control.

Audience measurement. To find out how many people visit the site and which pages they view, we use Umami, hosted on our own servers in the European Union. It is not an external data processor: the data does not leave our infrastructure and is not shared with anyone. It does not use cookies or store anything on your device, does not keep your IP address — it only infers the country from it — and does not link browsing to your account or build profiles. Details of what is recorded are in the cookie policy.

We do not sell or transfer your personal data to third parties for their own commercial purposes.

About Garmin watches. Garmin is not one of our data processors: we do not send it any of your data and we do not have access to your Garmin account. There are two points you should be aware of. First, when you share a route with the Garmin Connect app on your phone, it is your own operating system that hands the file over to it, and from that moment the processing is governed by Garmin's privacy policy. Second, if you link the watch through our Connect IQ app, the watch has no internet connection of its own: its requests to our servers travel through the Garmin Connect app installed on your phone, which acts as a network gateway.

6. International transfers

Some of the processors listed (Stripe, Firebase) may process data on servers located outside the European Economic Area. These transfers are carried out with all the safeguards required by the GDPR:

• Standard Contractual Clauses (SCC) of the European Commission adopted in 2021.
• EU-US Data Privacy Framework (EU-US DPF) and its extension to the United Kingdom / Switzerland, where the provider has signed up to it.
• Additional technical and organisational measures (TLS 1.3 encryption in transit, encryption at rest, minimisation, access control).

You can request more information about the mechanisms applied by writing to [email protected].

7. Retention period

We apply the following criteria:

• Active account: for as long as your relationship with us as a registered user lasts.
• After closing your account: erasure is immediate and irreversible: your email, username, profile photo, cover, city, password and notification token are deleted, and the link with Google or Apple is broken. Your routes and kilometres are kept in anonymised form, attributed to a "deleted user", so as not to alter the historical leaderboards or the activity of the clubs you took part in. There is no recovery period: once the closure is confirmed, the account cannot be restored.
• In backups: data that has already been erased may remain in encrypted copies for a maximum of 6 months, blocked and with no use other than disaster recovery, until those copies expire.
• Tax and accounting data (invoices, receipts): 4 years from the date of issue, in accordance with Spanish commercial and tax legislation.
• Linked watches: the linking data (model, dates and encrypted code) is deleted as soon as you revoke the watch from "My watches" in the app, and in any case when you close your account. You can revoke it at any time without giving any reason; the watch loses access immediately.
• Security and fraud prevention logs: the minimum time strictly necessary for the purpose for which they were collected and, where applicable, the applicable legal period.

8. Your rights

As a data subject, you can exercise the rights provided for in the GDPR at any time:

• Access: find out what data we process about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure ("right to be forgotten"): request the deletion of your data.
• Objection: object to processing based on legitimate interest.
• Restriction: request that we restrict processing in certain cases.
• Portability: receive your data in a structured, commonly used format (JSON).

You can exercise any of these rights through the Exercise my rights form, or by email to [email protected], attaching a copy of an identity document.

9. Right to lodge a complaint with the supervisory authority

If you consider that the processing of your personal data infringes the applicable legislation, you can lodge a complaint with the Spanish Data Protection Agency (AEPD):

• Website: www.aepd.es
• Address: C/ Jorge Juan, 6 — 28001 Madrid (Spain)
• Telephone: 901 100 099 / 91 266 35 17

10. Changes to this policy

We may amend this policy to adapt it to new legislation or case law. In the case of substantial changes, we will let you know by means of a banner within the app and, where applicable, we will ask for your consent again. The version in force at any given time will always be available on this page.