PALMARO PRIVACY POLICY

At Palmaro, we process only the data needed to operate accounts, build cycling race histories, provide public rider profiles, protect the Service and improve it. This Privacy Policy explains what data we process and what happens to it.

1. Who controls your personal data

The controller of personal data processed in connection with Palmaro is:

Judyta Gwóźdź, conducting business under the name
PRO-CLIP JUDYTA GWÓŹDŹ
ul. Rynek 17
42-600 Tarnowskie Góry
Poland
Tax ID (NIP): 6452520586
REGON: 382077251

For privacy and personal-data matters, contact:

palmaro.cc@gmail.com

2. What data we process

Depending on how you use Palmaro, we may process the following categories of data.

Account data

• email address;
• account identifier;
• login and session information;
• account creation date;
• information about the version of the Terms accepted and the version of the Privacy Policy acknowledged.

Authentication uses a one-time OTP code. Palmaro does not store a traditional password for your account.

Profile data

• first name;
• last name;
• country;
• year of birth;
• classification sex used for race results;
• selected cycling disciplines;
• profile photo, if added;
• public profile URL;
• profile and activity-link visibility settings.

Race participation data

We may process, among other things:

• participation in a Race;
• Race name and variant;
• date;
• discipline;
• User result;
• OPEN position;
• category position;
• category name;
• number of classified competitors;
• statistics calculated from results;
• information about whether a Race is featured on the profile.

Private race data

The User may also store:

• an activity link;
• a private note.

Private notes are not displayed publicly.

An activity link may be visible on a public profile according to the current visibility setting. The User may change this setting in the account settings.

Data submitted through reports and contact forms

If you use the contact form, submit a race-data correction or contact us by email, we may process:

• your email address;
• the content of your message;
• information about the relevant Race or profile;
• a source link;
• other information voluntarily included in the report.

Technical and security data

When you use Palmaro, technical information may be processed, including:

• IP address;
• date and time of connection;
• information about the device, operating system and browser;
• session and authentication information;
• technical logs;
• error and security-event information.

We do not use this information to build commercial advertising profiles of Users.

3. Where the data comes from

Most personal data is provided directly by the User.

We do not create rider profiles for people who do not have Palmaro accounts, and we do not mass-import third-party rider profiles from other services.

Information about Races themselves may also come from:

• other Palmaro Users;
• the Palmaro administrator;
• publicly available organiser information;
• official timing systems;
• official result documents and result lists;
• other reliable sources that make it possible to verify information about the Race.

Such information is used to build the shared event-data layer to which Users can connect their own race participation.

4. Why we process data and the legal basis

Operating the account and providing the Service

We process account, profile, Race and result data in order to:

• create and operate the account;
• authenticate the User;
• store race history;
• calculate statistics;
• create the rider profile;
• provide Palmaro features.

The legal basis is performance of the contract for the use of Palmaro, under Article 6(1)(b) GDPR.

Public rider profile

One of Palmaro’s core features is allowing Users to present their cycling race history to other people.

A profile is public by default, and the User is informed of this when creating it. Visibility can subsequently be changed in the account settings.

To the extent that publication results from the functionality chosen by the User and the profile visibility settings, the processing is carried out in order to provide the requested Service under Article 6(1)(b) GDPR.

Maintaining and correcting the shared Race database

We may analyse, correct, merge and organise shared Race data and User reports so that the database remains useful and is not affected by deliberate duplicates, spam or obvious errors.

The legal basis is our legitimate interest in maintaining the quality and reliability of the Service, under Article 6(1)(f) GDPR.

Security and prevention of abuse

We may process technical data, logs, IP addresses or the minimum account information necessary to:

• protect accounts;
• detect unauthorised access attempts;
• prevent spam;
• prevent deliberate database pollution;
• enforce restrictions against Users who seriously abuse the Service;
• protect Palmaro and other Users.

The legal basis is our legitimate interest in ensuring security and preventing abuse, under Article 6(1)(f) GDPR.

Contact, corrections and complaints

We process data submitted through forms and messages to respond to a request, review a correction or handle a complaint.

Depending on the matter, the legal basis may be performance of the contract, compliance with a legal obligation or our legitimate interest in handling User communications.

Development and analysis of Palmaro

Palmaro uses simple internal product analytics, for example to measure:

• number of accounts created;
• onboarding completion;
• first Race added;
• number of Races added;
• use of core features.

We use this information to understand whether the application works as intended and which parts require improvement.

The legal basis is our legitimate interest in developing and improving our own Service under Article 6(1)(f) GDPR.

Where reasonably possible, we use aggregated data for analytics.

Future newsletter or marketing communications

Creating a Palmaro account does not currently subscribe the User to a newsletter.

Palmaro may in the future make it possible to separately subscribe to updates about new features or product development, for example during onboarding or in account settings.

Where such communication requires consent, it will only be sent after the User has voluntarily given that consent. Consent may be withdrawn.

5. What information is public

If the profile is public, anyone using the Internet may be able to see information intended for public presentation, including:

• first name and last name;
• profile photo, if added;
• country;
• cycling disciplines;
• race history;
• results;
• OPEN and category positions;
• statistics generated from race history;
• featured Races;
• activity links, if public visibility of those links is enabled.

Email addresses and private notes are not part of the public profile.

A public profile may be accessible at an individual URL and may be opened without signing in.

A profile appears in Palmaro’s rider search only after the User has added at least one Race.

6. Search-engine indexing

Public profiles may be indexed by search engines such as Google or Bing.

This means that a public profile or part of it may appear in search results outside Palmaro.

If the User later changes the profile to private or deletes the account, Palmaro will stop making that information available in accordance with the current settings. However, Palmaro does not directly control how quickly an external search engine updates its index, cache or previously displayed search result.

7. Service providers that process data

Palmaro uses specialised technology providers to operate the Service.

Supabase

Supabase provides, among other things:

• database infrastructure;
• User authentication;
• API services;
• profile-photo storage;
• security mechanisms;
• technical logs.

The primary Palmaro database is located in:

West EU (Ireland), eu-west-1.

This means that the main project data is hosted in an AWS region in Ireland.

Resend

Resend is used to send authentication-related emails, primarily OTP codes.

For this purpose, Resend may receive data such as:

• the recipient’s email address;
• the content of the technical message;
• delivery-related data.

Resend is a US-based provider. Where personal data is transferred outside the European Economic Area, appropriate transfer mechanisms are used as required by applicable data-protection law.

FlutterFlow

FlutterFlow is used to build and deliver the application interface.

The main application data is stored in Supabase rather than in a separate Palmaro database hosted in FlutterFlow.

Depending on the distribution method, FlutterFlow may be involved in hosting or delivering the compiled web frontend.

OVHcloud

OVHcloud is used primarily for domain-related infrastructure and hosting the marketing website at palmaro.cc.

The marketing website does not contain the Palmaro account database.

OVHcloud may process ordinary technical information necessary to serve the website, including server or connection logs where applicable.

Other recipients

Personal data may also be disclosed:

• to public authorities where required by law;
• to professional advisers where necessary to protect legal rights or establish, exercise or defend claims;
• to another entity in the event of a lawful transfer of the business or part of the Service, subject to applicable data-protection requirements.

We do not sell Users’ personal data to advertisers.

8. Transfers outside the European Economic Area

The primary Palmaro database hosted through Supabase is located in Ireland.

Some providers or their subprocessors may nevertheless process certain personal data outside the European Economic Area.

Where this happens, we rely on legally recognised transfer mechanisms where required, such as:

• an adequacy decision of the European Commission;
• the EU–US Data Privacy Framework, where applicable;
• Standard Contractual Clauses approved by the European Commission;
• another transfer mechanism permitted by the GDPR.

9. How long we keep data

We do not keep personal data longer than necessary for the purpose for which it is processed.

Account and profile

As a general rule, account and profile data is stored for as long as the User has a Palmaro account.

When the account is deleted, data relating exclusively to that User is removed from the active database in accordance with the account-deletion process.

Shared Race data

Information about a Race or classification originally added by a User may remain after account deletion if it is also used by other Users or is necessary to preserve the integrity of the shared Race database.

In such cases, the association between the shared record and the deleted User may be removed.

Backups

Deleted information may remain for a limited period in existing backups.

It is not restored to active use except where system recovery is necessary. The information disappears as backups are replaced or overwritten through the ordinary backup cycle.

Technical and security logs

Technical logs are retained for the period reasonably necessary for security, troubleshooting and prevention of abuse.

If an account has been restricted because of serious abuse, we may retain the minimum information necessary — for example an email address or restriction record — for as long as reasonably necessary to prevent repeated abuse or protect our legal rights.

OTP-related information

Authentication providers and email-delivery providers may retain delivery and technical logs according to their own service configuration and retention rules.

Reports, correspondence and complaints

We keep correspondence and reports for as long as necessary to handle the matter and afterwards for a period reasonably necessary to demonstrate how the matter was resolved or to establish, exercise or defend legal claims.

10. Profile photos

Adding a profile photo is optional.

Profile photos are stored in private Supabase Storage.

The Palmaro database stores the file path rather than a permanent public file URL.

Where the profile is public, the photo may be displayed as part of the public rider profile.

We do not use profile photos for biometric identification or facial-recognition purposes.

11. Cookies and similar technologies

Palmaro may use technically necessary browser or device mechanisms required, for example, to:

• maintain a session;
• authenticate Users;
• protect the Service;
• provide PWA or application functionality.

At the current stage, we do not use Google Analytics, Meta Pixel, Hotjar or similar marketing tracking tools.

The palmaro.cc marketing website may be connected to Google Search Console for the purpose of monitoring its visibility in search results. This does not require placing a marketing tracker in the User’s browser.

If in the future we introduce analytics, advertising or similar technologies that require User consent, an appropriate consent mechanism will be implemented before those technologies are activated, and this Privacy Policy will be updated.

12. Links to other services

Palmaro may contain links to external services, such as:

• Race organiser websites;
• official result pages;
• timing systems;
• Strava or other activity platforms.

When the User follows such a link, the external service provider is responsible for its own processing of personal data in accordance with its privacy rules.

13. How we protect data

We use technical and organisational safeguards appropriate to the nature of Palmaro, including:

• authentication using one-time OTP codes;
• backend-level access controls;
• Row Level Security in Supabase;
• separation of public and private data;
• private storage of profile photos;
• restricted access to private notes;
• controls limiting access to User data;
• an account-deletion mechanism.

No online system can guarantee absolute security, but Palmaro is designed so that access to data is limited to what is necessary to operate the Service.

14. Your rights

Subject to the conditions set out in the GDPR, Users may request:

• access to their personal data;
• a copy of their data;
• correction of inaccurate data;
• deletion of data;
• restriction of processing;
• data portability where applicable;
• objection to processing based on our legitimate interests.

Where processing is based on consent, the User may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Requests may be sent to:

palmaro.cc@gmail.com

We may ask for confirmation of identity where necessary to ensure that personal data is not disclosed to the wrong person.

15. Right to complain to a supervisory authority

If a User believes that their personal data is being processed unlawfully, they may lodge a complaint with the competent data-protection supervisory authority.

In Poland, the supervisory authority is the:

President of the Personal Data Protection Office
(Prezes Urzędu Ochrony Danych Osobowych)

A User may also exercise rights before another competent supervisory authority in the European Union where applicable.

16. Users under 18

Palmaro is intended for Users who are at least 18 years old.

The year of birth is required when creating a profile, and the application does not allow a full profile to be completed by a person who does not meet the age requirement.

If we become aware that an account was created using false information in order to circumvent this restriction, we may delete the account.

17. Automated decisions

Palmaro may automatically calculate sporting statistics, ranking percentages and other information derived from race results.

We do not, however, make decisions concerning Users solely through automated processing where those decisions would produce legal effects or similarly significantly affect the User.

18. Changes to this Privacy Policy

This Privacy Policy may be updated, in particular where:

• new features are introduced;
• the way personal data is processed changes;
• new service providers are added;
• Premium is introduced;
• a newsletter, notifications or new analytics tools are introduced;
• applicable law changes.

Where a change is material for Users, we will provide appropriate notice through the application, by email or through another suitable channel.

The current Privacy Policy will be made available through Palmaro in a form that allows it to be saved and reproduced later.

19. Language version

This Privacy Policy may be made available in several languages.

The Polish version is the source version. The English version is intended to provide Users with an equivalent and understandable description of how Palmaro processes personal data. Mandatory rights under the GDPR and other applicable data-protection laws remain unaffected.