Privacy Policy

CurbCrew is an online race-tracking platform. It allows race organizers to create competitions with GPX routes and register runners, lets runners share their real-time GPS position along the route, and lets spectators follow runners live and pick a spot to catch them along the way. The Service is offered through both a web application and a companion Android/iOS tracker app.

This Service is provided by:

• Name: Entropitor BV
• Registered office: Albrechtplein 2, box 0102, 3000 Leuven, Belgium
• VAT / company number: BE1005.983.535
• Email: support@curbcrew.cc
• Website: https://curbcrew.cc/

The Customer's privacy is very important to Entropitor. In line with this principle, Entropitor has designed this Privacy Policy to help the Customer understand how Entropitor collects, transmits, shares and uses the Customer's data and how it protects the Customer's privacy when using the Platform, as described in Entropitor's Terms and Conditions.

Because CurbCrew is built around sharing location data, Entropitor pays particular attention to how that data is collected and who can see it. Entropitor only processes the Customer's GPS position for the purpose of the race the Customer takes part in, and only for as long as it is needed to provide the Service.

Before continuing to read this Privacy Policy, Entropitor would like to draw the Customer's attention to the following:

• Entropitor recommends that the Customer first carefully read Entropitor's Terms and Conditions.
• Where the Customer participates as a Runner and shares their real-time location, the legal basis for processing that location data is the Customer's consent (Article 6(1)(a) GDPR), which is given before tracking starts.
• Providing certain personal data (such as the Customer's name and account credentials) is a necessary condition for entering into and performing an agreement with Entropitor (Article 6(1)(b) GDPR). If the Customer prefers not to provide this data, it will not be possible to use the Service or certain parts of it.
• For analytical and security purposes, Entropitor processes pseudonymised data on the basis of a legitimate interest in operating and improving the Platform (Article 6(1)(f) GDPR).

The Service is not directed at children under the age of 16. Where a minor takes part in a race, Entropitor relies on the race Organizer and the minor's parent or guardian to provide any required consent. If the Customer believes Entropitor holds data about a child without the appropriate consent, the Customer should contact Entropitor as soon as possible via support@curbcrew.cc.

The following terms are capitalized in this Privacy Policy and should be understood accordingly:

• Entropitor: Entropitor BV, operator of the CurbCrew platform and the controller of the Customer's Data.
• Platform (also "App"): the CurbCrew web application (curbcrew.cc and all subdomains) and the companion Android/iOS tracker app that provide the Service.
• Data: all information regarding the Customer that Entropitor possesses and/or uses in accordance with section 5 ("What information does Entropitor collect about the Customer?").
• GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data ("General Data Protection Regulation").
• Service (also "CurbCrew"): the race-tracking platform described in section 1, provided by Entropitor through the Platform.
• Organizer: a Customer who creates a competition and registers runners.
• Runner: a Customer whose real-time GPS position is tracked along a route during a competition.
• Viewer (also Spectator): a Customer who follows a competition live and may choose a viewing spot along the route.
• Customer: any person who uses the Service.

Entropitor will only collect the Customer's Data to achieve its purposes, unless it has obtained the Customer's consent or is legally required to do so. Entropitor's purpose is to provide the Service to Customers. The Customer's Data is essential for the normal functioning of the Platform.

Entropitor collects the following categories of Data:

• Information specifically provided by the Customer: personal data the Customer provides directly, including but not limited to their name, email address, password (stored only as a secure hash, never in plain text), and an optional profile icon. If the Customer is an Organizer, this also includes the competitions they create and the GPX route files they upload.
• Location and tracking data: when the Customer participates as a Runner, the GPS positions recorded by their device along the route (latitude, longitude, elevation and timestamps), together with the route positions derived from them. If the Customer is a Viewer, the viewing spot they choose along the route as well as the current live location, if the Customer chooses to share their live location. This location data is the core of the Service and is only collected while the Customer is actively taking part.
• Information automatically provided by the Customer: technical data automatically generated when the Customer uses the Platform, including but not limited to their user ID, IP address, browser and device type, operating system, and login sessions and timestamps.
• Payment data: when the Customer purchases a plan, payment is handled by Entropitor's payment processor (Stripe). Entropitor receives confirmation and transaction details necessary to fulfil the order, but does not receive or store the Customer's full card details.

Note that the operating system of the Customer's phone or computer may store other information when the Customer uses the Platform. Such storage is not related to Entropitor, and Entropitor therefore accepts no responsibility for it.

Entropitor uses the Customer's Data solely for the purposes set out below and for purposes that fall within reasonable expectations. Specifically, the Customer's Data is used to:

• Register and authenticate the Customer's account;
• Provide the Service, including matching the Customer's GPS positions to the route and showing their live position and progress to the organizers and viewers of the competition they take part in;
• Process payments for the plans the Customer purchases;
• Ensure the optimal functioning, security and integrity of the Service;
• Conduct internal research and improve the Platform; and
• Communicate with the Customer about their account, their competitions and the Service.

Entropitor does not sell the Customer's Data, and does not share it with third parties except as described here.

When the Customer takes part in a competition as a Runner, their real-time position and progress are visible to the Viewers following it. This sharing is the very purpose of the Service.

To operate the Service, Entropitor relies on a limited number of processors who act on its instructions, including its payment processor (Stripe) for handling purchases and its hosting and infrastructure providers for running the Platform. These processors receive only the data necessary to perform their function, under the appropriate contractual safeguards.

However, Entropitor may be required to disclose Data when it believes action is necessary to:

• Enforce this Privacy Policy or Entropitor's Terms and Conditions;
• Comply with law enforcement or a legal obligation;
• Respond to claims that violate the rights of third parties; or
• Protect the rights, property, or safety of Entropitor, its Customers and the public.

Finally, Data may be transferred in the context of a legal transfer, such as a merger or acquisition.

In accordance with Articles 15 to 21 of the GDPR, the Customer has a number of rights. The Customer may obtain information from Entropitor regarding:

• Whether or not Data concerning the Customer is being processed;
• The purposes of the processing;
• The categories of Data concerned;
• The recipients or categories of recipients to whom the Data has been or will be disclosed;
• Where possible, the envisaged period for which the Data will be stored, or the criteria used to determine that period;
• The source of the Data, particularly where it is not collected from the Customer directly;
• The existence of the right to request rectification, erasure, restriction of processing, or to object to such processing;
• The right to lodge a complaint with the Data Protection Authority.

In addition, the Customer may request Entropitor to:

• Correct inaccurate Data;
• Delete Data concerning the Customer;
• Restrict the processing of the Customer's Data in the cases provided for by the GDPR;
• Object to the processing of the Customer's Data carried out on the basis of legitimate interest;
• Object to the processing of the Customer's Data for direct marketing purposes.

Furthermore, the Customer may receive the personal data they have provided to Entropitor in a structured, commonly used, and machine-readable format in order to transmit it to another service provider (the right to data portability).

If the Customer wishes to exercise any of the rights described above, they can send an email with their request to support@curbcrew.cc. The Customer also has the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit).

The Customer's Data is stored on servers within the European Union. Where, in order to provide an optimal Service, Entropitor uses processors located outside the European Union, it ensures that appropriate safeguards are in place in accordance with the GDPR.

In accordance with Article 32 GDPR, Entropitor takes all appropriate technical and organizational measures to ensure the security of the Customer's Data. These measures include, but are not limited to, hashing passwords and securing access to its systems.

Entropitor keeps the Customer's account Data for as long as the account remains active. Location and tracking data is retained only as long as needed to provide the Service and the race results, after which it is deleted or anonymized. If the Customer deletes their account, Entropitor will delete their Data, except where it is required to retain certain information to comply with a legal obligation.

If Entropitor discovers a data breach that is likely to result in a high risk to the Customer's rights and freedoms, it will inform the Customer and the competent authority without undue delay.

Entropitor uses only strictly necessary cookies. In particular, it uses an authentication cookie to keep the Customer signed in to their account. Entropitor does not use cookies for advertising. The Customer can block or delete cookies through their browser settings, but doing so may prevent them from signing in or using parts of the Service.

Entropitor reserves the right to amend this Privacy Policy in accordance with applicable privacy legislation.

If Entropitor makes changes to the way it handles information, it will notify the Customer via the Platform or through another form of communication (e.g. by email). Unless otherwise stated, Entropitor's current Privacy Policy applies to all information it has about the Customer and their account. If the Customer objects to any of the changes and no longer wishes to use the Service, the Customer may delete their account and terminate the agreement as provided in Entropitor's Terms and Conditions.

If any part of this Privacy Policy is invalid or unenforceable, this shall not affect the validity or enforceability of the remaining parts of this Privacy Policy, which shall remain in full force and effect.

If the Customer has any questions or comments about this Privacy Policy or the way Entropitor handles their Data, the Customer can always contact Entropitor via support@curbcrew.cc.