Privacy policy

At Time2Race, we attach great importance to the protection of your personal data, which we process in connection with your registration on our platform, its use, and our communications with you. Time2Race is a brand of Group-E SRL, registered with the Crossroads Bank for Enterprises under number 0837.215.413, with its registered office at Rue du Panorama 13, 1331 Rosières.

We undertake to process your data in a lawful, fair and transparent manner, in accordance with Regulation (EU) 2016/679 (GDPR) and the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.

For the purposes of this Policy, the following definitions apply: "personal data" means any information relating to an identified or identifiable natural person; "processing" means any operation performed on such data; "data controller" means the party that determines the purposes and means of the processing; "data processor" means the party that processes the data on behalf of the controller; "consent" means any freely given, specific, informed and unambiguous indication of your wishes by which you accept the processing of your data.

We are the data controller for your data in respect of your registration on the Time2Race Platform, its use, the provision of your bib, and the creation of a race by you (in which case you act as an organiser).

When you register and take part, as a runner, in a race whose timing is provided by Time2Race, we act as a data processor for the race organiser, who is the data controller for the processing of data carried out in the context of organising the race. Our role is then limited to making our services available to the organiser, who is responsible for informing you, in accordance with the GDPR, of the processing they carry out on your data.

In connection with your registration and use of the Platform, as well as the provision of your bib, we process the following categories of data concerning you:

• Identification data: surname, first name, telephone number (mobile), email address, address, username;
• Personal details: date of birth, gender;
• Transaction data: amount, status and reference of the payment, purchase of a bib. Your payment card details (number, expiry date, security code) are entered and processed directly by our payment service provider on its own secure page; Time2Race has no access to them and does not store them;
• Information relating to the use of the Platform: registration date, friends, events followed or saved, people followed, profile photo, cover photo, messaging;
• Information relating to bibs: bib number, RFID tag;
• Physical description: t-shirt size;
• Sporting data: race registrations and timings;
• Additional information that you freely provide: emergency number, etc.

When you create a race as an organiser, we additionally process: your identification data, the organiser's contact details, its financial data (IBAN account number), the information relating to the creation of the race, and any additional information freely provided. Mandatory data is identified by an asterisk on the Platform (data minimisation principle); failure to provide it may prevent Time2Race from concluding and properly performing the contract with you.

As a general rule, your data is collected directly from you. However, certain data relating to a third party may be entered by a user (for example, an emergency number, or the data of a race organiser where it concerns a natural person).

In connection with your registration and use of the Platform, as well as the provision of your bib, we process your data in order to: create and manage your user profile; manage your preferences (profile visibility, notifications, messaging); communicate with you regarding your registration, your purchases or at your request; provide you with a bib (payment, allocation of the number, delivery); enable you to register for a race created by an organiser; enable you to create a race; and manage complaints, disputes and requests to exercise rights. The legal basis is the performance of the contract or of pre-contractual measures (Art. 6(1)(b) GDPR).

In connection with the creation of a race by you, we process your data in order to enable you to create the race, manage the practical arrangements and handle complaints and disputes, on the same legal basis. Once the race has been created, the organiser acts as the data controller for all the data it processes in the context of its organisation.

Publication of results. When you take part in a race, your results and rankings (name, bib, category, time) are published on the Platform and accessible to the public, including via search by name, in accordance with the practice of sporting competitions.

Newsletter. The sending of the newsletter is based on your consent (Art. 6(1)(a) GDPR), obtained via a non-pre-ticked checkbox; you may withdraw it at any time, as easily as you gave it, by simply unsubscribing.

Automated decision-making. We do not carry out any solely automated decision-making producing legal effects concerning you.

We keep your data only for as long as necessary for the purposes pursued (storage limitation principle, Art. 5(1)(e) GDPR):

Your data is accessible only to Time2Race staff members who need it in the course of their activity, as well as to suppliers and providers who process data on behalf of Time2Race in the context of specific services, in particular our payment service provider (payment processing) and our email service provider. These providers act as data processors, under agreements compliant with the GDPR.

When you take part, as a runner, in a race timed by Time2Race, we may transmit certain of your data to the race organiser, who, as the data controller, informs you of the purposes pursued. Apart from these cases, no data is transmitted to third parties, subject to any possible transmission to the supervisory authorities in application of Belgian law.

Your data remains within the European Economic Area (EEA). Our payment and email service providers are established in the European Union; Time2Race does not transfer your personal data outside the EEA, and in particular not to the United States.

Should Time2Race in the future need to use a data processor established outside the EEA, such a transfer would take place only subject to appropriate safeguards provided for by the GDPR: an adequacy decision of the European Commission, or the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914 of 4 June 2021), or binding corporate rules or an approved code of conduct.

In accordance with the GDPR and the Belgian Act of 30 July 2018, you have, as a data subject, a right of access, rectification, erasure ("right to be forgotten"), restriction, portability and objection to the processing of your inaccurate, incomplete or irrelevant data. You may also withdraw your consent to the use of your email address for the newsletter at any time.

Data breach. In the event of a breach likely to result in a risk to your rights and freedoms, we notify the Data Protection Authority within 72 hours and, where the law requires it, the data subjects (Art. 33 and 34 GDPR).

Any request may be sent to us in writing, accompanied by proof of identity (a double-sided copy of your identity card, from which the information that is not necessary may be redacted), at the following address:

Time2Race — Group-E SRL, Rue du Panorama 13, 1331 Rosières, admin@time2race.be

You may also contact us via the Platform. Time2Race has not appointed a Data Protection Officer (DPO); for any question relating to your data, contact admin@time2race.be.

Time2Race does everything possible to ensure follow-up as promptly as possible. If our response does not fully satisfy you, you have the right to lodge a complaint with the supervisory authority. For Belgium, this is the Data Protection Authority (DPA) — Rue de la Presse 35, 1000 Brussels — contact@apd-gba.be.

Time2Race uses only a single, strictly necessary cookie, and no analytical, advertising or tracking cookies.

This cookie is essential to the operation of the service (secure login). As such, it is exempt from the consent requirement within the meaning of the ePrivacy Directive (Article 129 of the Act of 13 June 2005): no cookie consent banner is required as long as the site uses only this strictly necessary cookie.

You may at any time view and delete the cookies installed on your device via your browser settings (Chrome, Firefox, Safari, Microsoft Edge). Disabling this cookie may, however, prevent you from staying logged in to the Platform.

As technology and legislation are constantly evolving, we may amend this Policy. The version in force is published on the Platform.