Legal
Privacy policy
This is a translation for your convenience. If there is any discrepancy, the Spanish version prevails.
This policy explains what personal data Remonta processes, for what purpose and on what legal basis, both on this website (www.remonta.me) and in the application (app.remonta.me and, soon, the iPhone and Android apps). It's written to be understood; if anything isn't clear, write to us.
1. Who processes your data
It depends on where you come from:
- In the application, the data controller is the rowing club you belong to: it decides what your data is used for. Its administration can give you its contact details. Remonta is the data processor: it hosts and maintains the platform on behalf of the club and only processes data following its instructions (art. 28 GDPR).
- On this website (for example, when you use the contact form), the controller is Remonta.
- Owner of Remonta: Daniel Delgado Márquez, Tax ID (NIF) 44668858Y, with address at C/ Arenal 9, planta 2, oficina 13, 29016 Málaga (Málaga), Spain.
- Data protection contact: contact@remonta.me.
2. What data we process
In the application
- Identification and contact: name, email, phone, national ID number (only if your club asks for it, for example for regatta absence letters), date of birth, sex, rowing side and club.
- Sporting activity: training results and their pieces, attendance, selections, crews and squads, how you felt (energy and effort) and the damage reports you create.
- Weight and height: only if you provide them. They may be considered health data.
- Device and notifications: the identifier your phone provides to send you notifications, its platform (iPhone or Android) and the record of notifications already sent to you.
- Account and preferences: password (stored hashed, never in plain text), open sessions, text size, high contrast and notification preferences.
- Email: the delivery status of service emails (delivered, bounced, blocked), with the reason given by the recipient's server, to know whether they reached you.
- Technical data: like any web server, the hosting provider may log your IP address and connection data for the operation and security of the service.
On this website
- Contact form: name, email, club (optional), reason and message, and the IP address it's sent from (to prevent abuse).
- Visitor statistics: we use Cloudflare Web Analytics, which doesn't use cookies or identify people: it measures page views, approximate country, browser and load time in aggregate.
We don't ask for your location, or access to your camera, microphone or contacts. There is no advertising or cross-site tracking, we don't sell your data and we don't make automated decisions or build profiles about you.
3. What we use it for and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating your account and managing the club's training, attendance, crews, selections, equipment and issues. | Performance of the relationship between you and the club (art. 6.1.b GDPR). |
| Sending you service emails: account verification, invitations and password changes, and knowing whether they arrived. | Performance of the relationship (art. 6.1.b). |
| Sending you push notifications (attendance reminders, schedule changes, selections, tests, requests and issues). | Your consent, given when you accept the system's notification permission (art. 6.1.a). You can withdraw it in your phone's settings or in Profile → Notifications. |
| Recording your weight and height. | Your explicit consent (art. 9.2.a). It's optional and you can delete them whenever you want. More in Consent for health data. |
| Generating regatta attendance letters for school or work. | Performance of the relationship with the club (art. 6.1.b). The ID number is only included if the club has asked for it. |
| Responding to what you send us through the contact form or by email. | Pre-contractual steps at your request and legitimate interest in replying to you (art. 6.1.b and 6.1.f). |
| Keeping the service secure and preventing abuse (rate limits, technical logs). | Legitimate interest (art. 6.1.f). |
| Measuring the use of this website, in aggregate and without cookies. | Legitimate interest (art. 6.1.f). Nobody is identified. |
4. Minors
If you are under 14, processing your data requires the consent of your parents or guardians (art. 7 of the Spanish LOPDGDD). It is up to the club to obtain and keep it. If you think there is a minor's account without that authorisation, write to us and we'll review it with the club.
5. Who else receives your data
Within the club, the people who need your data according to their role can access it, such as your squad's coaches and the administration. Outside the club, only these providers working on our behalf:
- Supabase: the application's database, in Ireland (European Union).
- Render: hosting of the application server (Frankfurt, European Union).
- Cloudflare: hosting of this website, cookie-free visitor statistics and protection against abuse. Cloudflare processes the IP address of each visit to serve and protect the page.
- Brevo: sending service emails and reporting whether they arrived. Based in France (European Union).
- Google: notifications on Android (Firebase Cloud Messaging).
- Apple: notifications on iPhone (APNs service).
- AEMET, MET Norway and Open-Meteo: marine and wind forecasts. They only receive the club's coordinates, no personal data. The marine maps on the coach dashboard are requested by your browser directly from aemet.es, so AEMET can see your IP.
Some of these providers may process data in the United States. Those transfers rely on the safeguards of art. 46 GDPR: the adequacy decision for the EU–US Data Privacy Framework or standard contractual clauses. We don't share data with anyone else, except where legally required.
6. How long we keep it
- Your account data, for as long as you have the account. You can delete it yourself in the app: Profile → Delete my account (how it's done and what's deleted). Your name, email, phone, ID number, date of birth, sex, training, measurements, how-you-felt data, attendance, crews, selections, requests, open sessions, devices and notifications are deleted immediately.
- What the club uses (scheduled templates, calendar sessions, events, invitations and issues) stays, but without your name: it appears as “Deleted user”. That information no longer identifies you.
- Your open session expires after 30 days.
- Contact form messages, for as long as the conversation lasts and up to one year afterwards, in case you write again.
- The provider's backups may keep data for a limited time until they are renewed.
7. Your rights
You can request access, rectification, erasure, objection, restriction of processing and portability of your data, and withdraw your consent where you gave it, without affecting anything done before.
- You delete your account yourself in the app (see section 6 and the Delete your account page).
- For everything else, write to your club or to contact@remonta.me, and we'll pass your request on to the responsible club. We reply within one month at most.
- If you think we haven't handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es).
8. Security
Connections are encrypted (HTTPS), passwords are stored hashed, the session uses a cookie protected from scripts, access to data is limited by role and each club only sees its own. The contact form has rate limits to prevent abuse.
9. Changes to this policy
If anything important changes, we'll update the date above and let you know in the app or by email.