Privacy & GDPR

1. Who is responsible for your data

• Data controller: Throwdown SAS, a simplified joint stock company under French law, represented by its president
• Registered office: 6 la boulaie, 79140 Cirières, France
• SIREN number: 994 848 299
• Data protection contact: contact@throwdown.live

No individual is the data controller in a personal capacity. It is the company that determines the purposes and the means of the processing described here.

2. Who does what, us and the organizer

When you register for an event, two parties process your data and each one answers for its own share. We are neither the organizer's processor, nor a joint controller with the organizer. Our responsibilities are separate.

What we answer for: providing and securing the platform, keeping accounts, the data structure and the retention periods, fraud prevention, invoicing, support, audience measurement and our legal and accounting obligations.

What the organizer answers for: running the event, the information the organizer decides to ask you for at registration, the review of supporting documents, checking the conditions of participation, publishing the results, the communication sent to you and compliance with the applicable sporting and federation rules.

The organizer may use your data only for the event. The organizer is contractually forbidden to reuse it for other purposes, to sell it or to pass it to a third party without a legal basis. The organizer remains solely responsible for the messages sent and for the exports carried out.

You may send any request to contact@throwdown.live. If the request is a matter for the organizer, we pass it on and we tell you so.

3. The data we process

• Account: first name, last name, email address, phone number, password kept as a hash, language, country, profile picture where applicable
• Athlete: date of birth, gender, nationality, substitute nationality if you declare one, division, team, bib number, clothing size, estimated time, weight recorded at an official weigh-in
• Legal representative of a minor: first name, last name, email address, phone, date and version of the terms accepted
• Supporting documents: files that the organizer requires at registration, for example a medical certificate, a license or a parental authorization
• Image: your answer to the image rights question, its date and the version of the text accepted, along with any withdrawal
• Videos: recordings of online qualifier workouts and the related measurements
• Orders: amounts, currency, breakdown of the fees, who bears the fees, Flex option, shares of a split payment, spectator tickets, shop items, promo codes, payment status, transaction identifier from the payment provider, delivery address where applicable
• Participation: scores, times, repetitions, penalties, judge notes, rank on the leaderboard, passage through check-in, assignment of a timing chip
• Exchanges: messages from the organizer's broadcast channels, private messages between you and the organizer, support thread with the platform, attachments
• Notifications: preferences, notification token of your device, sending and deliverability history of our emails
• Disputes: score disputes, suspensions issued by an organizer, signed collection mandates
• Reports: identity and email address of the author, competition concerned, ground, explanation and date
• Technical: connection and error logs containing the IP address, the browser and, if you are signed in, the identifier of your account, log of administration actions
• Prospecting: data from the contact and demonstration booking forms

If you link your Concept2 Logbook account for an online qualifier, we receive from Concept2, established in the United States, your Concept2 identifier and the list of your results recorded during the period of the workout, and we keep with your submission the result you choose to attach. The application does not yet include a button to unlink that account. The link is removed on request to contact@throwdown.live, the result already attached to a submission remaining kept with it.

We process no bank card data. The card number is entered in the fields of our payment provider and never passes through our servers.

4. Our processing operations, their legal basis and their duration

• Creating and keeping your account. Legal basis: performance of the contract between us. Duration: the life of the account, then three years of inactivity.
• Handling a registration, a share, a ticket or a shop order, and seeing it through. Legal basis: performance of the contract. Duration: ten years under accounting obligations for payment records.
• Building the start lists, the schedule, the heats, check-in and the leaderboard. Legal basis: performance of the contract and the organizer's legitimate interest in running a sports event.
• Publishing the results and the history of the leaderboards. Legal basis: legitimate interest, which rests on the public nature of a sports competition and on the value of a record of results. See article 9 and your right to object.
• Checking that you meet the conditions of participation. Legal basis: your explicit consent for a document liable to reveal health data, see article 5.
• Using your image for the communication of the event and of the platform. Legal basis: your consent, see article 6.
• Sending you the emails and the notifications related to your registration and to the event. Legal basis: performance of the contract.
• Sending you our commercial information and our newsletters. Legal basis: your consent, which can be withdrawn at any time through the unsubscribe link in every send. For prospecting addressed to professionals, our legitimate interest in making the service known.
• Preventing payment fraud, multiple accounts, falsified scores and abusive use of the service. Legal basis: our legitimate interest in protecting the platform, the organizers and the athletes.
• Providing security, diagnosing incidents and fixing faults. Legal basis: our legitimate interest and our security obligation.
• Measuring the audience and improving the service. Legal basis: our legitimate interest, see article 10 and the cookie policy.
• Keeping our accounts, our invoices and our tax filings. Legal basis: our legal obligations. Duration: ten years.
• Keeping proof of what you accepted and of the mandates signed. Legal basis: our legitimate interest in being able to demonstrate an agreement, and article 7 of the General Data Protection Regulation for consents.
• Receiving and handling reports of content published by organizers, acknowledging them and informing their author of the outcome. Legal basis: our legal obligations under regulation (EU) 2022/2065 on digital services. Duration: three years from the report.
• Answering a request from a competent authority or defending our rights in court. Legal basis: our legal obligations and our legitimate interest.

Where a processing operation rests on our legitimate interest, you may object to it on grounds relating to your particular situation, under the conditions of article 17.

5. Supporting documents and health data

An organizer may require a document at registration, for example a medical certificate of fitness, a sports license or a parental authorization. Such a document may contain health data within the meaning of article 9 of the General Data Protection Regulation. We do not deny that qualification, we frame it.

Purpose: allowing the organizer to check that you meet the conditions of participation that the organizer has set.

Legal basis: your explicit consent within the meaning of article 9.2.a, given at the moment you upload the document. You may withdraw it at any time, the consequence being that the organizer may refuse or cancel your participation.

Recipients: the organizer of the event and the members of the team that the organizer has authorized. The file is never public. It is stored in a private space and opens only through a short-lived signed link.

Duration: the file is deleted automatically thirty days after the end of the event, that period leaving time to handle a challenge. A file uploaded during a payment but never attached to a registration is deleted after seven days. Only the name of the file, its type, its size and the outcome of the organizer's review are kept with the registration.

Some events include an official weigh-in. The weight recorded serves to check your category. It is visible only to the organizer and to the team.

6. Your image

Organizers photograph and film their events. Where the organizer switches this question on, you state at the moment of your registration whether you accept that your image be used for the communication of the event and of the platform. Your refusal is recorded as explicitly as your agreement, and it does not condition your participation.

Legal basis: your consent. We keep your answer, its date and the version of the text you accepted, as proof, for the retention period of your registration.

You may change your answer at any time from your member area, or by writing to contact@throwdown.live. The withdrawal applies for the future. It does not require the withdrawal of material already published where that is practically impossible.

7. Online qualifier videos

Some events include a remote qualifier. You then record your workout, the video is uploaded to the platform and then reviewed by the organizer and by the judges that the organizer appoints.

Purpose: validating your performance and establishing the qualifier leaderboard. Legal basis: performance of the registration contract.

Recipient: Bunny, which hosts and delivers the files from the European Union. Playback goes through signed addresses, the video is not publicly indexable.

Duration: the video is deleted automatically thirty days after the end of the final attached to the qualifier, or thirty days after the end of the qualifier where no final exists. The numerical summary of the performance, which is the proof of the score, is kept with the leaderboard.

8. Messages, emails and notifications

The platform has three channels of exchange. The announcements that the organizer broadcasts to registered participants, the private messages between you and the organizer, and the support thread between you and Throwdown. Messages and their attachments are kept in a private space, accessible only to the participants in the conversation and, for support, to our team.

Emails: two services route them. The emails that organizers send in bulk to their registered participants leave through Amazon Web Services, Amazon SES service, from a region of the European Union. From that service we receive the deliverability information, delivery, failure, rejection and complaint, which we use to avoid writing to a dead address and to preserve our sender reputation. All other emails, registration confirmation, password and account login, notifications by email, split payment and refund notices, leave through the Purelymail email service, operated by Add Rabbit LLC, 502 W 7th St, Erie, Pennsylvania, United States, which also hosts our contact@throwdown.live mailbox. That provider receives the data necessary for the message, email address, name and content of the email. The emails related to your registration and to the event are part of the service. Commercial information sends carry an unsubscribe link that records your refusal by address and by type of send.

Notifications on your phone: if you allow them, your device sends us a technical token that we keep in order to reach you. Routing then necessarily goes through Apple for an iOS device and through Google for an Android device, both established in the United States, which receive that token and the content of the notification. A notification received in a browser goes through the notification service of the publisher of that browser, Apple, Google, Mozilla or Microsoft as the case may be, which receives the technical address of your subscription and the notification, whose content reaches it encrypted. You may withdraw that permission at any time in the settings of your device, and set your preferences from your account.

9. What is public, results and disputes

A competition is a public event. Your first name, your last name, your nationality where it is filled in, your team, your division, your scores and your rank appear on pages accessible to everyone, on the schedule and on the venue display screens. The public feed that third-party applications may pick up to announce events contains no athlete.

Legal basis: the legitimate interest of the organizer and of the platform in publishing the running order and the results of a sports competition, and in keeping a history of them.

Your right to object: you may object to that publication on grounds relating to your particular situation, by writing to the organizer or to contact@throwdown.live. We examine the request and, unless there are compelling grounds to refuse it, your identity is removed from the public display, your line still counting in the leaderboard in anonymous form. Independently of any request from you, an organizer may choose to display an anonymous leaderboard for the whole event.

Score disputes: if you challenge a score, you open a dispute from the leaderboard. It is passed to the organizer, who answers it, and the exchange is kept with your registration. Suspensions: an organizer may issue an exclusion measure attached to your profile for the organizer's own events. It is notified to you, you may challenge it with the organizer, and it is kept for its duration and then three years.

10. Audience measurement and trackers

We measure the audience of the site and of the application with PostHog, hosted in the European Union, and that of the application alone with Google Analytics 4. With your advertising agreement we also load Google Ads, the Meta pixel and the ChatGPT Ads pixel. The nature of each tracker, its duration, the way your choice is collected and the way you can change it are described in our cookie policy.

Our own measurement of event pages: we count the visits to each event page and the time during which the tab stays open, in order to show the organizer how the communication is received. That measurement uses no cookie, no IP address and no account identifier. We record only the moment of the visit, its duration and the site that sent you. It cannot recognize you and therefore does not amount to processing of personal data.

11. Who your data is passed to

• The organizer of your event and the members of the team that the organizer authorizes, for the participants registered for that event. The organizer may consult and export the data, within the limits of article 2. Where the organizer is established outside the European Economic Area, that disclosure amounts to a transfer, see article 12. The identity of the author of a report is never passed to the organizer.
• Our technical team. A few named accounts hold extended access, strictly reserved for running, supporting and securing the service. That access requires strong authentication and it is logged.
• Stripe, payments, payment accounts of the organizers, fraud prevention and invoicing.
• OVH, hosting of the site, of the programming interface, of the database, of authentication and of file storage.
• Cloudflare, delivery of the web application, domain name service and geolocation by IP address.
• Amazon Web Services, Amazon SES service, sending and deliverability tracking of the emails that organizers send in bulk to their registered participants.
• Purelymail, a service operated by Add Rabbit LLC, United States, sending of all our other emails, service emails and notifications by email, and hosting of our contact@throwdown.live mailbox.
• Bunny, hosting and delivery of the qualifier videos.
• PostHog, audience measurement.
• Google, audience measurement and measurement of advertising campaigns, and routing of notifications on an Android device.
• Apple, routing of notifications on an iOS device.
• The publisher of your browser, Apple, Google, Mozilla or Microsoft, routing of notifications received in a browser.
• Meta, measurement of advertising campaigns, if and only if you have accepted advertising.
• Komoot GmbH, Germany, Photon service, address and city search. The text you type into an address or city field and your IP address reach it, directly from your browser.
• CARTO, CartoDB Inc., United States, base maps displayed in the application. Your IP address reaches it, directly from your browser, when a map is displayed.
• Google, Google Fonts service, typeface loaded in the payment form and referenced by our emails. Your IP address reaches it when the form is displayed, or when the email is displayed where your email application loads remote content.
• Administrative and judicial authorities, where a legal obligation requires it of us.

Our authentication and storage layer rests on the Supabase software, which we install and administer ourselves on our own server. It is not a third-party provider, even though your browser keeps a token whose name begins with “sb-”.

We sell your data to no one and we rent it to no one.

12. Where your data is hosted and transfers outside the European Union

The server that carries the site, the programming interface, the database, authentication and the files is located in Milan, Italy. The web application is delivered by Cloudflare from the European Union. The emails that organizers send in bulk to their registered participants leave from a European region of Amazon SES, videos are hosted by Bunny in the European Union and the PostHog audience measurement is collected on its European entry point. The address and city search queries Photon, a service of Komoot GmbH, established in Germany.

Some processing operations involve a transfer outside the European Union. Stripe, some of whose entities are established in Ireland and in the United States, for payment. Apple and Google, in the United States, for the routing of notifications. Meta and OpenAI, in the United States, for advertising measurement where you have accepted it. PostHog, whose parent company is American and whose teams may access the data in the course of support, even though the storage is European.

These transfers are framed by the standard contractual clauses approved by the European Commission and, where the provider is certified under it, by the data protection framework between the European Union and the United States.

Other data reaches recipients established in the United States. Purelymail, a service operated by Add Rabbit LLC, routes our service emails and our notifications by email, and hosts our contact mailbox. That provider is established in the United States and the emails it routes contain the data necessary for the message, email address, name and content of the email. CARTO, CartoDB Inc., receives your IP address when a map is displayed. Google receives your IP address when the typeface of the payment form or of an email is loaded. A notification received in a browser goes through the notification service of the publisher of that browser, Apple, Google, Mozilla or Microsoft, all established in the United States.

The organizer of an event may be established outside the European Economic Area, in a country that the European Commission has not recognized as offering an adequate level of protection. When you register for such an event, the data of your registration is passed to the organizer so that the organizer can run the event you have chosen to take part in. That transfer is framed by the standard contractual clauses adopted by the European Commission on 4 June 2021, in the module applicable between controllers, which the organizer subscribes to by accepting our terms and conditions. The venue of the event and the name of its organizer appear on its page before any registration. You may obtain a copy of these clauses by writing to contact@throwdown.live.

13. How long we keep it

• Account: for the life of the account, then three years without any sign in and without any new registration
• Registrations, scores and leaderboards: kept for the public history of results, without your identity once your account is deleted
• Accounting and payment records, invoices, payouts: ten years
• Supporting documents uploaded at registration: thirty days after the end of the event, and seven days for a file never attached to a registration
• Qualifier videos: thirty days after the end of the attached final
• Messages and attachments, event messaging and support: three years after the last exchange
• Sending and deliverability log of emails: three years
• Refusal to receive our sends: kept with no time limit, that being the only way to honor your refusal
• Notification token of your device: deactivated as soon as it becomes invalid, and kept at the latest twelve months after your last use of the application
• Connection logs and error logs, including the IP address: twelve months
• Log of administration actions: three years
• Score disputes: three years after the end of the event
• Content reports: three years from the report
• Suspensions: for the duration of the measure, then three years
• Proof of acceptance and signed collection mandates: ten years from the end of the relationship
• Prospecting data, contact and demonstration booking: three years from the last contact
• Tracker consent choice: one hundred and eighty days. Trackers subject to consent: thirteen months at most

Once the applicable period has passed, the data is deleted or kept in a form that no longer allows you to be identified.

The periods above are maximum periods. Deletion is automatic for supporting documents, qualifier videos and content reports. For the other categories, we carry it out ourselves when the period expires.

14. Automated decisions

The platform automatically computes several things, the spread of athletes across the heats, the running order, the leaderboard and the tie break on equal points, eligibility for a division with regard to age and to the registration window, and the selection of those qualified for a final. These computations apply the rules published by the organizer.

None of these computations produces in your regard a decision based solely on automated processing within the meaning of article 22 of the General Data Protection Regulation. The organizer may correct them by hand and you may challenge them with the organizer.

15. Minors and legal representative

Creating an account is reserved for persons aged at least fifteen, the age at which a person may consent alone to an information society service within the meaning of article 8 of the General Data Protection Regulation and of article 45 of the French Data Protection Act.

An athlete who is a minor may be registered from the age of eight, if the organizer opens a division matching that age. Below fifteen, the registration is made from the account of the legal representative. Below eighteen, whoever holds the account, we record the identity and the contact details of the legal representative, first name, last name, email address and phone, along with that person's agreement, with its date and the version of the text accepted, kept as proof for the retention period of the registration.

Where the organizer requires a parental authorization as a file, that document follows the regime of article 5 and is deleted thirty days after the end of the event.

The legal representative may at any time access the data of the athlete who is a minor, ask for its rectification or its erasure, and withdraw that agreement, by writing to contact@throwdown.live.

We knowingly collect no data relating to a child under the age of eight. Were such data sent to us, it would be deleted as soon as we became aware of it.

16. Security

• Encryption in transit by TLS between your device and our servers
• Access to the data limited to the company officers and to providers bound by confidentiality, following the principle of least privilege
• Access partitioned by event, an organizer seeing only its own registered participants
• Strong authentication required for accounts holding extended powers
• Documents, videos and attachments stored in private spaces, accessible only through short-lived signed links
• Passwords kept as hashes, never in clear text
• Bank details handled exclusively by our payment provider, they never pass through our servers
• Regular backups of the database

17. Your rights

You hold the following rights over your data.

• Access your data and obtain a copy of it
• Have inaccurate or incomplete data rectified
• Ask for the erasure of your data, within the limits of article 18
• Ask for the restriction of a processing operation
• Object to a processing operation based on our legitimate interest, in particular to the publication of your identity in the results, and at any time to commercial prospecting
• Receive your data in a structured and commonly used format, and ask for it to be sent to another service
• Withdraw your consent at any time, without this calling into question the lawfulness of what was done before the withdrawal
• Set instructions on the fate of your data after your death, in line with article 85 of the French Data Protection Act

Exercising your rights: write to contact@throwdown.live. We may ask you for something allowing your identity to be verified. We answer within one month from receipt of the request, a period extendable by two months if the request is complex or if requests are numerous, in which case we inform you of it and we tell you the reason.

Complaint: if our answer does not satisfy you, you may lodge a complaint with the French data protection authority, Commission nationale de l'informatique et des libertés, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.

18. Deleting your account

You may delete your account at any time from your settings. The deletion automatically erases your first name, last name, email address, phone and picture, from your account and from your own registration and volunteer lines. Your favorites and your collaborator access are deleted, your waiting list entry is anonymized and your email address becomes available again for a new registration.

Not erased automatically are the identity of the legal representative entered on a registration, the date of birth, the answers to the organizer's custom fields, the delivery address of a shop order, the name and email address of the recipient of a ticket and the notification tokens. This other data attached to your orders is erased on request to contact@throwdown.live, subject to what we must keep under our accounting obligations, the order records being kept ten years. The lines of the other members of a team you registered are not modified.

The result and leaderboard lines of events already held are kept without your identity. A public record of results and the ranking of the other participants cannot be rewritten, which justifies that retention under article 17.3 of the General Data Protection Regulation. The accounting records attached to your orders are kept for ten years under our legal obligations.

19. Changes to this policy

We may update this policy to reflect a change in the service, in our providers or in the regulations. The date of the last update is shown at the top of this page, and the version in force is always the one published there.

In the event of a substantial change, we inform you by email at the address linked to your account or by a notification in the application. We do not yet publish an archive of the replaced versions. If you would like a copy of an earlier version, write to contact@throwdown.live and we will send it to you.