Privacy Policy – Race Day Map
This Privacy Policy explains how Anders Wikström AB (“Race Day Map”, “we”, “us”) processes personal data when you visit racedaymap.com, use app.racedaymap.com or app.racemaps.se, view a map an organiser has embedded on another website, or create an account.
1. Who we are
| Controller | Anders Wikström AB |
|---|---|
| Corporate ID no. | 559358-7578 |
| Registered office | Stockholm, Sweden |
| info@racedaymap.com |
2. What we process
When you open our sites directly, including a map in full screen, we are the sole controller of the processing below.
| Data | Purpose | Legal basis |
|---|---|---|
| IP address, browser and operating system, URL, referrer, date and time | Delivering the site and map, and keeping them secure | Legitimate interest (Art. 6(1)(f)) |
| Usage statistics through Plausible (pages, referrer, country, device type). IP addresses are not stored | Understanding how the site and maps are used | Legitimate interest (Art. 6(1)(f)) |
| Error reports through Sentry (error message, stack trace, browser/OS, URL, IP address) | Finding and fixing bugs | Legitimate interest (Art. 6(1)(f)) |
If you press “show my position”, your browser handles that locally. We do not receive your location.
When a map is embedded on another website, your browser connects to us to load it. That produces technical data such as your IP address, browser data and the address of the embedding page, together with the data in the table above. Race Day Map processes this as an independent controller for its own purposes, including delivering and securing the map. The organiser is responsible for telling its visitors about the embedded map and for obtaining any consent required by law before that processing. If a particular use involves us processing personal data on a customer’s behalf, we will put in place any data processing agreement required by law. Embedded maps set no cookies and do not load sign-in. For data we hold, email info@racedaymap.com.
For account holders we also process:
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email address, account ID and sign-in timestamps. Sign-in is email and password | Your account and its security | Contract (Art. 6(1)(b)) |
| Maps, routes, points, texts, images, event details and organisation name | Providing the service and publishing maps as you instruct | Contract (Art. 6(1)(b)) |
| Subscription details from Paddle (name, email, company, country, VAT number, status, invoices). Not full card numbers | Your subscription and bookkeeping | Contract (Art. 6(1)(b)); legal obligation for accounting records (Art. 6(1)(c)) |
Maps are for places, routes and race information. They are not for participant lists, volunteer contacts or tracking data. If you publish someone else’s personal data anyway, you are responsible for the legal basis and for telling them. A public map is visible to anyone who can open it.
If you email us, we use your name, email address and message to reply. The legal basis is legitimate interest (Art. 6(1)(f)), or contract if you are a customer. We send a newsletter only to people who have signed up (consent, Art. 6(1)(a)). Every newsletter has an unsubscribe link.
3. Recipients
We do not sell personal data. Providers process data for us under a data processing agreement, unless the table says otherwise.
| Provider | Role | Data | Location |
|---|---|---|---|
| Plausible Insights OÜ | Cookieless analytics | Page views and technical data. IP addresses are not stored | EU (Estonia) |
| Paddle.com Market Ltd | Reseller and merchant of record for checkout, payment, invoices and VAT | Billing and payment data | UK. Paddle is an independent controller for the payment data it handles. It may use sub-processors in other countries |
| Google Ireland Ltd / Google LLC (Firebase Authentication and Cloud Firestore) | Sign-in, accounts, and storage of maps. Not loaded on public map views | Account data, map content, IP address at sign-in | Firestore in Europe (eur3). EU-US Data Privacy Framework and standard contractual clauses |
| Stadia Maps, Inc. | Map tiles | IP address, browser data, tile coordinates, referrer |
Map tiles from Stadia’s EU servers in Frankfurt and Paris
(tiles-eu.stadiamaps.com). Stadia Maps, Inc. is a US company and may process data
outside the EU
|
| Functional Software, Inc. (Sentry) | Error monitoring | Error details, browser/OS, URL, IP address | Germany. EU-US Data Privacy Framework and standard contractual clauses |
| Cloudflare, Inc. | Hosting, CDN, DNS and DDoS protection for the website and the app | IP address and request data | Global network. EU-US Data Privacy Framework and standard contractual clauses |
| Google Ireland Ltd / Google LLC (Google Workspace) | Email for info@racedaymap.com | Emails you send us | No region is pinned. Mail may be processed in the United States and other countries where Google operates. EU-US Data Privacy Framework and standard contractual clauses |
We also share data with our accountant where needed for bookkeeping, and with authorities, courts or advisers when the law requires it or a legal claim requires it. If the business is sold, the buyer receives the data needed to continue the service and we will tell you.
Where a provider is in the USA or can access data from there, we use the EU-US Data Privacy Framework where that provider is certified, and/or the European Commission’s standard contractual clauses.
4. Cookies and local storage
We do not use advertising or tracking cookies, and public maps set none.
| Where | What | When |
|---|---|---|
| Public and embedded maps | Nothing set by us | – |
| Signed-in editor | IndexedDB (firebase-*), to keep you signed in |
Only after you sign in |
| Paddle checkout | Cookies set by Paddle, for payment and fraud prevention | Only when you open checkout |
5. How long we keep it
| Data | Retention |
|---|---|
| Server and CDN logs | As long as needed to operate and secure the service, and longer to investigate a security incident |
| Sentry error reports | 90 days |
| Account data and maps | While your account exists. Published maps stay until you unpublish or delete them. After you delete the account, we delete or anonymise the data within 30 days, except what the law requires us to keep |
| Invoices and subscription records | 7 years after the end of the calendar year, as required by the Swedish Bookkeeping Act |
| Emails and support requests | As long as needed to handle the matter |
6. Your rights
You can ask us to:
- confirm whether we process your data, and for a copy of it;
- correct it;
- delete it, unless we must keep it;
- restrict processing in the cases the GDPR allows;
- receive data you gave us under a contract or consent, in a machine-readable format;
- object to processing based on legitimate interest;
- withdraw consent, where we rely on consent. That does not affect processing that has already happened.
Email info@racedaymap.com. We reply within one month. We may ask you to confirm your identity. Log data from a public or embedded map often cannot be linked to you. You can also complain to Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm, www.imy.se, or to the authority where you live or work.
7. Changes
We publish changes on this page. If a change is material, we tell account holders by email or in the app before it takes effect.