Piolhos Elétricos Piolhos Elétricos

Privacy policy

Draft: this text still has to be reviewed by a lawyer. Highlighted parts are still to be filled in.

In force from: [to fill in: date]

PiolhosHQ is the registration and results system for the radio-controlled car races run by [to fill in: organisation name]. This page explains what personal data we keep, why, who we share it with, for how long, and how to use your rights.

Who is responsible for the data

[to fill in: organisation name], [to fill in: address]. Privacy contact: [to fill in: privacy contact email].

What we keep

  • Account: your email and chosen language. There are no passwords: you sign in with a 6-digit code sent by email.
  • The account's drivers: first and last name, nickname and pronunciation (optional), date of birth, whether they're left-handed, experience, country, city, club, sponsor and preferred race number (optional).
  • Photo (optional): resized, and we only keep a copy with no metadata (no GPS location or camera details). The original file isn't kept.
  • Consents: your choices about the public profile, public photo and news emails, with the date.
  • Parent or guardian (drivers under 18): name and email, and the consent record: how it was given (declaration by the person who signed up, email link, or paper form), when, and the exact wording declared. If a guardian refuses, we also keep the date of the refusal.
  • Event entries: preferred class, mode and colour, assigned class and number, whether it's paid, and when it was made; and, if a driver is removed from an event, who removed them and when.
  • Results of events, once published (not launched yet).
  • Security: for each signed-in session, the IP address and browser used. Sign-in codes are only stored as an irreversible hash (never the code itself).
  • Server logs: IP address and pages visited, for security and troubleshooting.
  • Organisers: for the people who run events, name, email and, for each admin session, the IP address and browser.

What we use it for, and on what basis

  • Running events (registration, classes, numbers, LiveTime timing, results): to do what you asked for when signing up. (Legal basis to be confirmed.)
  • Public profile and photo: only with your consent (or a parent's or guardian's, under 13). You can withdraw it at any time.
  • News and invitations by email: only with your consent.
  • Account security (codes, sessions, attempt limits): legitimate interest in protecting accounts. (To be confirmed.)

Children

Age is worked out from the date of birth. Under 13, a parent's or legal guardian's consent is needed. Until then the driver can race, but their name, photo and results are hidden from the public (shown as "Driver #PE-…"). In public, minors only appear with their first name and last initial (or nickname). From 13 to 17, drivers can give the consents themselves.

What is public

Only with consent, and never while it's pending: the name (for minors, first name and last initial or nickname), the photo (if chosen) and results. Never public: email, date of birth, left-handedness, experience, and preferred mode and colour.

Who we share it with

  • The event organisers see entry details in the admin area.
  • Timing software (LiveTime): for each entry we export first and last name, nickname, pronunciation, class, whether it's paid, registration date, driver ID, number, colour, sponsor, city, country, club and experience (as a number from 1 to 9). Email and date of birth are only exported if the organisers turn that on.
  • Hosting: [to fill in: hosting company].
  • Sending email: Mailgun Technologies, Inc..
  • Photo storage: DigitalOcean, LLC (Frankfurt).

We don't sell data or use it for advertising.

How long we keep it

  • Sign-in codes: deleted after 1 day. Sessions: up to 6 months.
  • Links sent to a parent or guardian: stop working after 30 days.
  • Account, drivers and entries: while the account exists. (Period after the last event to be decided.)
  • Results: kept as the history of events and championships; if you ask us to delete a driver, the results stay but are anonymous. (To be confirmed.)
  • Backups: up to 30 days. (To be confirmed.)
  • Server logs: period to be decided.

Cookies

We only use cookies needed for the site to work: the browser session (including your language, the event you chose and the email you're signing in with), the account session (up to 6 months) and, for organisers, the admin session (up to 12 hours). No advertising or analytics cookies.

Your rights

You can ask for access to your data and a copy, correct it, delete it, restrict or object to its use, and withdraw consents at any time (on the driver's page, under "Consents"). For requests, write to [to fill in: privacy contact email]; we answer within one month. If you ask us to delete a driver, their personal data is removed (including the photo) and their results become anonymous. You can also complain to the Portuguese data protection authority (CNPD), www.cnpd.pt.

Security

Connections are encrypted (HTTPS). Drivers have no passwords; the admin area needs a password and an authentication code. Admin passwords are stored hashed and two-factor secrets encrypted; photos are served through links that expire.

Changes

If this policy changes, we update the date at the top of this page.