Processing of personal data

Who the controller is

The controller of personal data is BIKODY systems s.r.o., company ID (IČO) 30048532, registered office Korunní 972/75, 130 00 Prague 3, Czech Republic, entered in the Commercial Register kept by the Municipal Court in Prague, section C, file 456488 (“BIKODY”).

BIKODY is the controller of all personal data the service processes — data about accounts, wallets, riders in the central register and riders entered in individual races.

For questions about personal data and to exercise your rights, contact info@bikody.com.

What data we process

• About the account holder: e-mail, name, phone, photo, sign-in records (time, IP address, browser), consent to the terms and its version, transactions in the credit wallet.
• About the rider: first name and surname, date of birth, sex, nationality, club and team, licence number and UCI ID, race number, transponder number, photo, entries, times and results.
• About the organiser: identification and billing details of the organisation, the bank account for paying out entry fees and details of the people acting on its behalf.
• From running the service: technical records (IP address, time, browser), passings through timing loops, the location of tracking devices during a race and change records (who changed what and when).

Where the data comes from

From you, from the race organiser, from sports federations (licence records) and from running the service, for example from timing.

Why we process data and on what legal basis

• Running the account, race entries, entry fees and the wallet — performance of a contract (Art. 6(1)(b) GDPR).
• The central rider register, so that data is corrected in one place and applies in every race — legitimate interest (Art. 6(1)(f) GDPR).
• Publishing start lists and results — legitimate interest: a sports competition is announced publicly and the results list is part of it.
• Passing results to the sports federation and the UCI for races in their calendar — legitimate interest.
• Accounting and taxes — compliance with a legal obligation (Art. 6(1)(c) GDPR).
• Securing the service, detecting misuse and resolving disputes — legitimate interest.
• Measuring site traffic — your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

Children’s data

Children’s rider profiles are created and managed by their legal guardian. We need the date of birth to assign the age category under federation rules. Public outputs show only the year of birth.

Who we share data with

• The organiser of the race the rider enters — to the extent needed to run the race.
• The sports federation and the UCI, if the race is in their calendar.
• The public: start lists and results (name, year of birth, category, club or team, result) are public and can be found by search engines.
• Processors that run the service for us: Stripe (card payments — we have no access to card numbers), Postmark (sending e-mails), DigitalOcean (server and database) and Google (traffic measurement, only with your consent).

Transfers outside the EU

Stripe, Postmark, DigitalOcean and Google are companies based in the USA. Transfers rely on the EU–US Data Privacy Framework or on standard contractual clauses approved by the European Commission. The UCI is based in Switzerland, which the European Commission has found to ensure an adequate level of protection.

How long we keep data

• Account and rider profiles — for as long as the account exists. After the account is closed we delete or anonymise the data.
• Race results — permanently. They are sporting results and part of the public history of the competition.
• Accounting documents — for the period required by accounting and tax law.
• Sign-in records — 180 days.
• Database backups — 14 days.

Your rights

You have the right of access to your data, to rectification, erasure, restriction of processing and data portability, the right to object to processing based on legitimate interest and the right to withdraw consent at any time. Exercise them at info@bikody.com; we will reply within one month.

Erasure does not cover data we must keep under the law, nor the results of races already held.

You can lodge a complaint with the Czech Office for Personal Data Protection (uoou.gov.cz).

Automated decision-making

None takes place. The age category is calculated from the date of birth under federation rules; this is not a decision with legal effects.

Cookies

Essential cookies (sign-in, security, language and consent choice) are always active. Google Analytics cookies are set only after your consent, which you can withdraw at any time.