Privacy policy

1. Data controller

TdeTrial (hereinafter, "the Service") is a digital scoring platform for motorcycle Trial competitions. The data controller is TdeTrial, based in Spain.

For any data protection enquiry, contact us at: tdetrial@gmail.com

2. Data we collect

We collect different data depending on user type:

• Organisers: Name, email, phone, organisation or club name.
• Observers (judges): Name, email and phone (optional), access PIN (stored as cryptographic hash), device identifier used for scoring, sync history.
• Riders: Name, bib number, category, club, bike brand and model, email, phone, date of birth, federation licence number (all optional except name). Sports scores, times, incidents and results.
• Public (live portal): We do not collect personal data. The live portal requires no registration or authentication.
• Automatically collected data: Technical session data: IP address, browser type, operating system, pages visited, timestamps.

3. Legal basis for processing

• Consent: for analytics and functional cookies.
• Contractual necessity: organiser access, observer access and score management.
• Legitimate interest: event management, fraud prevention, service improvement.
• Legal obligation: data retention as required by applicable law.

4. Purpose of processing

• Provide scoring platform functionality.
• Manage registrations and competition participation.
• Publish standings and sports results.
• Send event-related communications (with user consent).
• Analyse service usage to improve the experience.
• Comply with legal and tax obligations.

5. We do not sell your data

TdeTrial does NOT sell, rent, or share personal data with third parties for commercial or advertising purposes. We never have and we never will.

We only share data with providers strictly necessary for the operation of the service (see section 7).

6. Data retention

• Observer sessions: deleted after 30 days of inactivity.
• Sports data (scores, standings): retained for the season duration plus a minimum of 2 additional years, per sports regulations.
• Organiser accounts: retained until deletion is requested.
• Consent records: 18 months (GDPR requirement).
• Contact messages: 12 months.

7. Providers (data processors)

We use the following providers to operate the service:

• Supabase: database and authentication (hosted in the EU).
• Vercel: web hosting.
• Resend: transactional email delivery (event notifications, access credentials).

All providers comply with GDPR and have signed Data Processing Agreements (DPA).

We do not use advertising services or share data with social networks.

8. Your rights (GDPR articles 15-22)

You have the right to:

• Access your personal data.
• Rectify inaccurate data.
• Request erasure of your data ("right to be forgotten").
• Restrict processing.
• Data portability.
• Object to processing.
• Withdraw consent at any time.

To exercise these rights, email us at tdetrial@gmail.com with "Data protection" in the subject line.

You may also file a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

9. Security

We apply technical and organisational measures to protect your data:

• HTTPS encryption for all communications.
• Access PINs stored with cryptographic hash (pgcrypto).
• Role-based access control (Row Level Security).
• Regular security audits.

10. International transfers

Data is stored on servers within the European Union. Should any provider require transfers outside the EU, they are carried out under Standard Contractual Clauses approved by the European Commission.

11. Changes to this policy

We reserve the right to update this policy. Any changes will be published on this page with the update date. If changes are significant, we will inform you by email or through a visible notice on the service.