Your data, in plain words.

Revena is where you sign up for running and cycling events in Flanders, and where you collect points with the Revena pass. To do that, we need some of your data. This page explains which data, what we use it for, how long we keep it and what you can decide yourself.

In short:

• Everything is private by default. You choose who sees what.
• We never sell your data, and we don't show adverts.
• We don't track whether you open an email, and we don't use cookies that follow you.
• You can delete your account and download your data yourself.

1. Who we are

Revena is a trading name of Marco Castermans, sole proprietorship.

• Address: 3700 Tongeren-Borgloon, Belgium
• Company number: 1036.559.717
• VAT: BE 1036.559.717
• Privacy questions: privacy@revena.be

We don't have a data protection officer, because the law doesn't require one for us. Your question goes straight to the people who make Revena.

2. Revena or the organiser: who decides what

When you sign up, two parties use your data.

The event organiser decides about your participation: the start list, your bib number, the results, safety on the day and their emails about the event. They are responsible for that data. Revena processes it on their behalf, under a data processing agreement. The event page shows who the organiser is and how to reach them.

Revena is responsible for the rest: the website, your account, the Revena pass with your points and your rank, the rankings, the community, and the order as a service we provide to you (your confirmation, your ticket, transferring a ticket, your points).

If you have a question about your participation or your result, ask the organiser. If it's about your account, your pass or the community, email us. Not sure? Email us and we'll pass your question on.

3. What data, what for, and how long

When you sign up for an event

• First name, last name, email address, date of birth, category (man, woman or X)
  What forYour ticket, the start list, the results by category
  Legal basisNeeded for your entry (contract)
  How longSee "With the organiser" below
• Mobile number, if you give it
  What forReaching you if something changes on the day
  Legal basisYour consent, you can leave it blank
  How longUntil 30 days after the event
• Club, T-shirt size
  What forFor the organiser, for the start list and the T-shirts
  Legal basisNeeded for your entry
  How longSee "With the organiser"
• Emergency number
  What forCalling someone if something happens to you during the event
  Legal basisYour safety (legitimate interest of the organiser)
  How long30 days after the event, then deleted
• Answers to the organiser's own questions
  What forWhatever the organiser asks them for, as stated with the question
  Legal basisThe basis the organiser gives
  How longSee "With the organiser"
• Order: what you bought, the amount, the payment status
  What forYour confirmation, your ticket, a refund
  Legal basisContract
  How long90 days after the event at Revena, after that only with the organiser. We keep amounts without names for 10 years for the accounts
• Check-in at the start
  What forKnowing who started, and giving you your points
  Legal basisContract
  How longSame as the entry
• Your time and position in the results
  What forPublishing the results
  Legal basisLegitimate interest of the organiser, a sporting tradition
  How longAs long as the organiser shows the results
• Your place on the waiting list: name and email address
  What forEmailing you when a place comes free
  Legal basisYou ask for it yourself (contract)
  How longUntil the day after the event, then deleted

An emergency number belongs to someone else. Ask that person if it's alright for you to give it.

We never ask about your health. An organiser can't add a question about your health in Revena either.

If you sign someone else up, for example in a group entry, you only give that person's name and email address. They fill in the rest themselves through a link.

With the organiser. The organiser decides how long they keep their participants' data. Revena only lets them invite participants from previous editions who took part in the last three years. After that, those people drop out of the groups the organiser can email. If an organiser stops using Revena, they have 30 days to export their data, and we delete it within 60 days after that.

When you turn on the Revena pass

• Email address, first name, last name, date of birth, municipality, your sports
  What forYour account and your pass
  Legal basisContract
  How longUntil you delete your account
• Your events, check-ins, points, levels, rank, stars and stamps
  What forMaking the pass work and working out your discount
  Legal basisContract
  How longUntil you delete your account
• Your choices about who sees what
  What forRespecting your privacy
  Legal basisContract
  How longUntil you delete your account
• Login code
  What forLogging in without a password
  Legal basisContract
  How long10 minutes

If you signed up without an account and turn on your pass afterwards, we link that entry to your pass so you get the points. You can do that up to 90 days after the event.

If you don't use your account for three years, we send you an email. If you don't log in within 30 days after that, we delete your account.

The pass is available from age 13. Anyone under 16 never has a public profile and never appears in the rankings.

When you take part in the community

• Your profile: name, initials, clubs, rank per sport
  Who sees itYour choice: only you, your friends or everyone. Only you by default
  How longUntil you delete your account
• Your profile photo, if you upload one. We store it square and small, without location or other data from your device
  Who sees itYou and your friends. Never in the ranking or in results
  How longUntil you remove it or delete your account
• Your results and chapeaus
  Who sees itYour choice. Only you by default
  How longUntil you delete your account
• Which events you've signed up for
  Who sees itYour choice. Only you by default
  How longUntil you delete your account
• Your friends and clubs
  Who sees itYou and the other person
  How longUntil you end the friendship or leave the club
• Posts and comments
  Who sees itWhoever can see the event or the group
  How longUntil you delete them
• Your position in the rankings
  Who sees itEveryone, but only if you turn the rankings on
  How longPer season, until you turn it off
• Reports you make or that are about you
  Who sees itRevena
  How longOne year after our decision

Revena has no private messages.

In the results on Revena, a participant under 16 is shown only by first name and the first letter of their last name. If you want to appear anonymously in results on Revena, ask us or the organiser.

After an event you give feedback with a score and three short questions. The organiser sees that feedback without your name.

When you connect Strava

Connecting Strava is your choice. If you don't, Revena gets nothing from Strava.

• Your Strava number and the keys of the connection, encrypted. No name, photo or town from Strava
  What forMaking the connection work and recognising a message from Strava
  Legal basisYour consent: you connect it yourself
  How longUntil you disconnect, revoke access on Strava or delete your account
• Of the activity you pick for a start: its Strava number
  What forShowing your activity with your start, with a link to Strava
  Legal basisYour consent
  How longUntil you unlink it or disconnect Strava
• Of that activity: the name, the sport, the start time, the distance and the moving time
  What forShowing it with your start
  Legal basisYour consent
  How long7 days at most; after that we fetch them from Strava again when you look
• An own time you take from Strava
  What forYour own time for a start without an official time, only for you
  Legal basisYour consent
  How longUntil you change it, unlink the activity or disconnect Strava

We only fetch the list of your activities on the day of an event when you ask for it, to pick one. We don't keep that list.

We only ask Strava for activities you share with everyone or with your followers, not activities only you can see. We never fetch your heart rate, power, map, route or location: Revena processes no health data. Only you see your Strava data. Your friends and the organiser don't see it, and it never appears in results, the ranking or on the wall. We use it for nothing else, we share it with no one and we don't use it for AI.

You can disconnect at any time: in My Revena under Profile, Connections, or on Strava under Settings, My Apps. We then immediately delete everything that came from Strava. If you delete an activity on Strava or make it private, it also disappears from Revena, within 48 hours at the latest. If you delete your account, we immediately delete everything from Strava and revoke access.

Strava, Inc. (San Francisco, United States) is itself responsible for what it does with your data, under its own privacy policy on strava.com. Revena sends no data about you to Strava. Strava does see that you connect Revena and which data Revena requests, and may use that under its own terms.

When you volunteer

For a shift we keep your name, your email address, the shift and whether you did it. With a pass you get points for it. The organiser sees that data. If you work at the desk or the scanner, you log in with a PIN from the organiser. No account is created for you.

The desk and the scanner also work without internet. For that, the list of participants is stored on the device for a while. Seven days after the event we delete that list from the device. We keep a wrong PIN for one day, to prevent guessing.

When you're an organiser

We keep the details of your organisation (name, company number, address) and of your team members (name, email address, role). A log records who did what in the organiser dashboard, so you can check what happened. We keep that log for two years. We keep invoices for ten years, because accounting law requires it.

If you upload a list of participants (for example from another system), we delete the file as soon as the import is done, and after 24 hours at the latest. We keep the participants from the list like a normal entry. Before you import, you confirm that these people took part with you and that you didn't buy the list or get it from someone else; that confirmation is in the log. We don't take over an email address that isn't valid, nor a participation in an edition that hasn't happened yet.

If we contact your club

Revena contacts clubs and associations that organise events, to introduce Revena. For that we keep the club's name, the contact details the club itself makes public, and what we discussed. We do this on the basis of our legitimate interest, for as long as needed to follow up the conversation. If you say you no longer want to be contacted, we note that and keep it forever, so we never contact you again.

When you send us a message

When you use Contact, Suggest an event, Free listing or Book a call, we only use your details to reply to you. We keep them until 12 months after the last contact.

With How many come back, your file stays in your browser. Nothing goes to Revena. If you ask for the report as a PDF, we only use your email address to send that PDF.

When you visit the website

For security, our servers keep technical logs, including your IP address. We delete them after 30 days. To count how many people view a page, we turn your IP address into a code that can no longer be traced back after one day; we delete that code after one day too. To slow down abuse, we count requests per IP address, and we delete those counters after one day as well. We don't use cookies that follow you. See the cookie statement.

If you look for an event near you, we use the municipality in your profile, or your location if you tap the button for it. We don't store your location.

4. Emails

Emails that come with your entry, such as your ticket, practical information and your result, you always receive. They're needed for your participation.

Invitations from an organiser for a next edition or another event by the same organiser may be sent because you took part with them. You only get them if you took part with them in the last three years, and at most one every five days. As soon as you sign up, you get no more invitations for that event. Every invitation has a link to unsubscribe. If you unsubscribe, you won't get any more invitations from that organiser. Invitations come from a different sender address than your ticket.

What an invitation says comes from what you did with that organiser: your distance and time from last year, the year you took part, or the day you signed up last year, so you get a reminder around that day. If you have a Revena pass, it can say how many of your friends on Revena have already signed up. That's only a number, never a name, and it only counts friends who show their events to friends.

Emails from Revena about your pass, such as a new rank or a challenge, can be turned off by type in your account.

Tips from Revena for events by other organisers you only get if you turn them on yourself. They're off by default.

We don't track whether you open an email: there's no invisible image in our emails. Per email, and only as a total, we do count how often the link in that email was opened and how many entries came from it. That works through a code in the link that is the same for everyone who got the email and doesn't point to you. To count a visit once a day, we use the same one-day code as for a visit to the website (see point 3). So we don't know who tapped the link. The organiser sees per email how many entries and how much in entry fees it brought in, never who.

Of a sent email, we keep the address and the content for 30 days, so we can check what went wrong if you didn't get it. After that we only know that an email went out. A link to unsubscribe works for 13 months. If you unsubscribe, or if an email bounces because your address doesn't work or because you report it as spam, we keep that for as long as needed to stop sending you emails.

5. Paying

You pay the organiser directly, through the organiser's payment partner: Stripe Payments Europe Ltd. in Dublin, or Mollie B.V. in Amsterdam if the organiser uses Mollie. That partner processes your payment details itself, as controller, under its own privacy statement on stripe.com or mollie.com. Revena never sees your account or card number. Mollie only tells us whether the payment went through.

6. Who we share data with

• The organiser of the event you sign up for, for your participation. They get nothing about your other events, your points or your community.
• Companies that work for us, and only for what they do for us:Supabase Inc.: database, login, storage and server functions. Your data is stored in the EU, in Paris. Resend Inc.: sending emails. The emails are sent from the EU (Ireland); Resend is an American company, so this happens under the standard contractual clauses. Billit NV: invoices to organisers via Peppol, in Belgium. Vercel Inc.: hosting of the website. The servers that build your pages are in the EU (Paris); a copy of fixed files such as images can pass through servers outside the EU, under the standard contractual clauses.
• Stripe or Mollie, for the payment (see section 5).
• Apple or Google, only if you add your ticket to Apple Wallet or Google Wallet yourself. The details on the ticket then go to them, under their own terms.
• Strava, only if you connect Strava yourself (see "When you connect Strava"). At your request, Strava gives us a few details of your activities; we give Strava nothing about you. Strava is itself responsible for that.
• Public authorities, only if the law requires us to.

We choose companies that keep your data in the EU. If a company outside the EU can access it, for example for technical support, that happens under the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.

7. How we protect your data

• Everything between your device and Revena is encrypted.
• Each organiser only sees their own participants. That's set in the database itself, so even a bug in the app can't get round it.
• You log in with a code sent by email, so there's no password that can leak.
• A QR code or a link never contains your name or your email address, only a random code.
• Anyone who does something in the organiser dashboard is recorded in a log.
• The scanner and the desk only keep their list on the device until everything has been sent, and for no more than 7 days after the event.

If something does go wrong with your data and there's a risk to you, we'll let you know as soon as possible.

8. Decisions made by computer

Revena works out your points, your level and your discount automatically, following the Rules of the Revena pass. They're fixed rules, the same for everyone. A decision that affects you, such as taking away points for misuse or closing an account, is always taken by a person.

9. Your rights

You can:

• ask what data we hold about you, and get a copy;
• have incorrect data corrected;
• have your data deleted;
• ask us to stop using your data for a while;
• take your data with you in a file a computer can read;
• object to what we do on the basis of a legitimate interest;
• withdraw your consent, for example for your mobile number or the tips from Revena.

You can do a lot yourself in your account: update your details, choose who sees what, turn off emails, download your data and delete your account. For anything else, email privacy@revena.be. We reply within one month. If it's about your participation in an event, we pass your question on to the organiser and help them reply.

We sometimes ask you to confirm it's really you, for example with a code sent to your email address.

If you delete your account, we delete your pass, your points, your profile and your posts within 30 days. What the organiser needs for an event you're still signed up for stays with them. What accounting law requires, we keep for as long as that law requires.

10. Complaints

If you're not happy with how we handle your data, email privacy@revena.be first. If we can't sort it out together, you can file a complaint with the Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels, www.dataprotectionauthority.be.

11. If this statement changes

If something important changes, we'll put it here with a new date, and everyone with an account gets an email.