Privacy Policy

1. Who we are

RaceSolution is a race management and timing platform operated by Chris Bainbridge, trading as Bainbridge Services, a sole trader registered in Mauritius (Business Registration Number I25008115), of 30 Calodyne Bungalows, St Francois, Riviere du Rempart, Mauritius 31726 ("we", "us", "our"). This policy explains what personal data we collect, how we use it, and your rights in relation to it.

If you have any questions, contact us at: [email protected]

2. Data we collect

Account holders (race organisers, timers, admins)

• Name and email address
• Display name
• Account role (e.g. administrator, timer)
• Organisation association
• Hashed password (never stored in plain text)
• Firebase authentication identifier

Racer data (entered by race organisers)

Race organisers import and manage racer information for their events. This typically includes:

• First name and last name
• Bib number
• Category, team, gender, age or age category, and country
• Phone number, where the organiser records one
• Any additional fields the organiser chooses to add
• Check-in status, race status (DNS, DNF, finished, etc.) and any penalties

Racer data is entered by the organising body, not collected directly from participants by RaceSolution.

Safety data (RaceSafety, entered by race organisers and their staff)

Organisers who use RaceSafety can record information to keep participants safe during their event:

• Medical information - medical conditions, medications and allergies
• Emergency contacts - name, phone number and relationship
• Gear checks - which items of required kit were checked, missing or failed
• Incident reports - what happened, where (GPS location or an estimated position on the course), when, who reported and responded, follow-up actions, and any photos or videos attached by field staff
• Other people involved in an incident - such as spectators or members of the public, including their name and phone number where recorded
• Medical withdrawals - where a participant is withdrawn from a race on medical grounds

Medical information is special category data under data protection law. It is only visible to an organiser's staff who have been given medical access, it is never shown on public race pages or included in the public demo, and every time a medical record is viewed, edited or exported we record who did it and when in an audit log.

Event and timing data

• Event name, description, date and status
• Checkpoint names, GPS coordinates and elevation
• Timing records (bib number, checkpoint, recorded timestamp, recorded by)

Billing data

• Paddle customer and subscription identifiers
• Historical Stripe and PayPal transaction identifiers, for subscriptions purchased before our move to Paddle
• Subscription plan, status and billing dates

We do not store full card numbers or payment credentials. Payment processing is handled entirely by Paddle, our merchant of record.

Location data (mobile app)

• Incident location - GPS coordinates recorded when field staff log a safety incident, so its location is captured accurately.
• Live location sharing - staff members can let event admins request their current location via the "Let admins request my location" toggle in the app's Account screen (on by default for staff accounts, and can be turned off at any time). While enabled, the device reports its GPS position (latitude, longitude, accuracy, and time) whenever an event admin requests the team's current locations - capture only ever happens in response to a request, never on a continuous timer. Whenever this is enabled the device shows a clear indicator - a permanent notification on Android, or the system location indicator on iOS - so it's never running without the user's knowledge. Each reported position is kept as part of the event's record, to support post-event reporting and to help diagnose location-reporting issues.

Technical data

• Push notification tokens for devices signed in to the mobile app, so we can send alerts such as location requests
• When you last used the web or mobile app
• An audit log of access to medical records (see "Safety data" above)
• Server-side warning and error logs (no personal data included at standard log level)
• Local app preferences stored on your device (e.g. UI settings) via the mobile app

3. Our role: organisers decide, we process

For account holders' own details, we are the data controller.

For racer data, safety data and other information an organiser enters about their event, the organiser is the data controller and we process that data on their behalf as their data processor. The organiser decides what is collected and why, and is responsible for having a lawful basis for it. For medical information, that is usually the participant's explicit consent, given when they enter the event.

If you took part in an event and have a question about your data, including a request to see, correct or delete it, please contact the event organiser first. If you contact us, we will pass your request to the organiser and help them respond.

4. How we use your data

• Providing the service - authenticating your account, running events, recording timings, and displaying live results.
• Event safety - for organisers using RaceSafety, making medical information, emergency contacts, gear checks and incident reports available to the organiser's authorised staff during and after their event.
• Billing and subscription management - processing payments, managing subscriptions, and sending billing-related notifications.
• Transactional emails - account verification, password reset, invitations, and system notifications sent to administrators.
• Security - CAPTCHA verification on account creation to prevent automated abuse (via Cloudflare Turnstile).
• Service operation - error logging for diagnosing technical issues.

We do not use your data for advertising, and we do not sell or share it with third parties for marketing purposes.

5. Third-party services

The following third-party services process data as part of delivering RaceSolution:

6. Mobile app (RaceSolution Timing)

The RaceSolution Timing app is available for Android and iOS. It:

• Authenticates using Firebase Authentication (email and password)
• Reads and writes race and timing data to Google Cloud Firestore
• Stores local preferences on your device using standard OS-provided storage
• Requests location access to record where a safety incident happened, and - only for staff who have live location sharing enabled - to report the device's position when an event admin requests it (see "Location data" above). Staff who enable live location sharing are asked to grant "Always" / "Allow all the time" location access, so a request can still be answered while the app is in the background. While sharing is enabled the app also keeps a lightweight low-power presence running so it stays reachable for a request - on Android via a background process shown with a permanent notification, on iOS via a coarse (roughly cell-tower-level) location session shown with the system location indicator. Precise GPS is still only read at the moment an admin requests it.
• Requests camera, microphone, and photo library access so field staff can attach photos or videos when logging a safety incident
• Does not request contacts permissions
• Does not include any analytics or crash-reporting SDK
• Checks network connectivity to manage offline data synchronisation
• Keeps a local copy of the event data a signed-in user can access, which can include safety data for users with medical access, so the app keeps working without a connection

7. International transfers

We operate RaceSolution from Mauritius, and our service providers listed above may process data in other countries, including the United States. This means personal data may be accessed or processed outside the UK and European Economic Area.

Where data protection law requires it, we protect these transfers with appropriate safeguards, such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, and the equivalent measures our providers offer. Contact us if you would like more information about the safeguards in place.

8. Data retention

We retain your account data for as long as your account is active. If you delete your account or organisation, associated data is removed from our systems. Billing records may be retained for the period required by applicable tax and accounting regulations.

Racer data entered by an organiser is retained until the organiser deletes the event or their organisation.

Safety data (medical information, emergency contacts, gear checks, incident reports and their attachments, and the medical access audit log) is part of the event's record and is removed when the event or organisation is deleted. We encourage organisers to delete medical information once it is no longer needed for their event.

Live location history (see "Location data" above) is retained as part of the event's record on the same basis as other event data, and is removed when the event or organisation is deleted. Turning off live location sharing stops any further positions being recorded but does not delete positions already reported.

9. Your rights

Depending on where you are, you have rights under data protection law, such as UK GDPR, EU GDPR or the Mauritius Data Protection Act 2017, including:

• Access - request a copy of the data we hold about you
• Rectification - ask us to correct inaccurate data
• Erasure - ask us to delete your data ("right to be forgotten")
• Portability - receive your data in a structured, machine-readable format
• Objection - object to processing where we rely on legitimate interests

To exercise any of these rights, email us at [email protected]. We will respond within 30 days. If your request is about data an event organiser entered about you, see section 3: we will pass it to the organiser and help them respond.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you are based in the UK, or with the Data Protection Office of Mauritius, where we are based.

10. Cookies

The RaceSolution web application uses session cookies solely to keep you signed in. We do not use tracking, advertising, or third-party analytics cookies.

11. Changes to this policy

We may update this policy from time to time. When we do, we will update the date at the top of this page. Continued use of RaceSolution after a change constitutes acceptance of the revised policy.

12. Contact

Bainbridge Services
Chris Bainbridge, sole trader, registered in Mauritius (BRN I25008115)
30 Calodyne Bungalows
St Francois
Riviere du Rempart
Mauritius 31726
Email: [email protected]
Website: race-solution.com