Privacy Policy
1. Data Controller Identity
The website Gravel & Castles is operated by:
- Company Name: Gravel & Castles
- Legal Address: XXX, France
- SIRET: XXX
- Contact Email: legal@gravelandcastles.cc
2. Data We Collect & Why
We collect your personal data to provide a seamless experience, whether you are chasing a historic cash prize or exploring the Tarn region as an adventurer.
| Category | Purpose | Data Type |
| Registration | Manage race entries and timing. | Name, email, age, phone, photo ID. |
| Newsletter | Send updates and race info via Brevo. | Name, Email address. |
| Payments | Process entry fees securely. | Payment card info (via PayPal/Stripe). |
| Health Data | Process deferral requests (Medical). | Medical certificates, pregnancy notes. |
3. Third-Party Services & Storage
To maintain our professional circuit standards, we work with industry-leading partners:
Hosting: Our website is hosted in France by OVH, ensuring your data stays within European borders.
Email Marketing: We use Brevo. You can view their privacy policy here.
Analytics: We use Google Analytics to understand how visitors interact with our site.
Cookies: We use Complianz to manage your cookie preferences and ensure full compliance with French law.
Payments: Payments are handled by PayPal and secure bank card processors. We do not store your full credit card details on our servers.
4. Sensitive Data Handling
In accordance with French law, medical certificates and pregnancy notes submitted for race deferrals are treated with the highest level of confidentiality. This data is only accessible to authorized personnel for the sole purpose of validating your request and is deleted once the verification process is complete.
5. Data Retention
We generally keep your personal data for a period of 3 years following your last interaction with us (e.g., your last race registration or newsletter click). Invoices and financial records are kept for 10 years to satisfy French tax and legal obligations.
6. Your Rights (GDPR)
Under the GDPR, you have the following rights regarding your data:
Access & Rectification: You can ask for a copy of your data or correct any errors.
Erasure (Right to be Forgotten): You can request that we delete your data, subject to legal retention limits.
Portability: You can request a digital copy of your data.
Objection: You can unsubscribe from our newsletter at any time using the link at the bottom of our emails.
To exercise these rights, please contact us at legal@gravelandcastles.cc.
7. Data Transfers
While we strive to keep all data in Europe, some tools (like Google Analytics) may involve data transfers to the United States. We ensure these transfers are protected by Standard Contractual Clauses as required by the CNIL.