Your participants' data.

This agreement is part of the terms for organisers. It applies from the moment you create an event on Revena, and for as long as Revena processes your participants' data.

Controller: you, the organiser, as filled in under Settings in your organiser dashboard. Processor: Revena, a trading name of Marco Castermans, sole proprietorship, 3700 Tongeren-Borgloon, Belgium, company number 1036.559.717.

1. What it covers

Purpose

Managing entries for your events: tickets, following up payments, start list, check-in, desk, volunteers, results, emails to your participants, returning participants, and importing and exporting your participants.

Who

Your participants, the people they sign up, their emergency contacts, your volunteers and your team members.

What data

Name, email address, date of birth, category, mobile number, club, T-shirt size, emergency number, answers to your own questions, orders and payment status, bib number, check-in, time and position in the results, email unsubscribes, and whatever you import yourself.

Sensitive data

None. Revena doesn't allow questions about health.

Duration

As long as you use Revena, and after that until the data has been deleted as set out in section 9.

What Revena does as controller in its own right is not covered by this agreement: the Revena pass, the points, the rankings, the community, and the order as a service to the participant. That's set out in Revena's privacy statement.

2. Only on your instructions

Revena only processes the data to provide the service described in the terms, and in line with what you set in the organiser dashboard. Those are your instructions. If Revena thinks an instruction breaks the law, we'll tell you straight away.

Revena doesn't use the data for itself, doesn't sell it and doesn't give it to anyone else, except to the sub-processors in annex 1 or if the law requires it. If Revena has to hand over data to a public authority, we'll tell you first, unless the law forbids it.

3. Confidentiality

Anyone at Revena who can access the data is bound by confidentiality and only looks at it when needed for the service or to help you.

4. Security

Revena takes the measures in annex 2. We adapt them when technology or risks change, and never in a way that weakens the protection.

5. Sub-processors

You authorise Revena to use the sub-processors in annex 1. Revena imposes the same obligations on them as in this agreement, and remains responsible for what they do.

If Revena wants to add or replace a sub-processor, you hear about it at least 30 days in advance by email. If you have a valid reason to object, let us know within those 30 days. If we can't find a solution together, you can stop at no cost.

6. Outside the EU

Revena stores the data in the EU. If a sub-processor outside the EU can access it, that only happens on a valid basis under the GDPR, such as the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.

7. Help with rights and obligations

• Requests from participants. If a participant asks Revena for access to, correction or deletion of data about their participation, we forward that request to you within 3 working days. In the organiser dashboard you can look up, correct, export and delete data yourself.
• A data protection impact assessment (DPIA) or a question from the supervisory authority. Revena gives you the information you need.

8. A data breach

If Revena notices a breach involving your participants' data, we tell you without undue delay, and within 48 hours. We say what happened, which data and how many people are affected, what the consequences may be and what we're doing. That way you can notify the Data Protection Authority within 72 hours if you need to.

9. When it ends

If you stop using Revena, you have 30 days to export your data. Within 60 days after that, Revena deletes it, including at the sub-processors, except what the law lets us keep. Backups are overwritten within 30 days after that. On request, we confirm that everything has been deleted.

While you use Revena, these periods apply, and you can't extend them yourself:

• the emergency number and the mobile number: 30 days after the event;
• participants from previous editions can only be emailed if they took part in the last three years;
• the list on the scanner and the desk: until everything has been sent, no more than 7 days after the event.

10. Audits

On request, Revena gives you the information that shows it complies with this agreement. If you want an audit, that's possible once a year, at your own cost, with 30 days' notice and carried out by someone bound by confidentiality. After a data breach it's always possible.

11. Liability

Liability follows the terms for organisers and article 82 of the GDPR.

Annex 1. Sub-processors

• Supabase Inc.
  WhatDatabase, login, storage and server functions
  WhereEU (Paris)
• Resend Inc.
  WhatSending emails
  WhereEU (Ireland), under the standard contractual clauses
• Vercel Inc.
  WhatHosting the website and the server functions
  WhereEU (Paris), under the standard contractual clauses

Stripe Payments Europe Ltd. and Mollie B.V. are not sub-processors. They process payment data as controllers in their own right, under your own contract with Stripe or Mollie.

Billit NV only processes Revena's invoices to you, and is therefore not covered by this agreement.

Annex 2. Security

• Everything between device and server is encrypted (TLS). The database and the backups are encrypted.
• Each organiser only sees their own data. That's set in the database itself, with rules per row (row level security), so even a bug in the app can't get round it.
• Team members have a role: Admin or Staff. Each role only sees what it needs. Volunteers at the desk or the scanner get no account but a PIN per edition, and only see the list of that edition.
• Logging in uses a one-time code by email. Volunteers at the desk and the scanner use a PIN that only works for that event.
• A log records who did what in the organiser dashboard. The log is kept for two years.
• QR codes, links and file names contain no personal data, only random codes.
• Payment notifications from Stripe and Mollie are processed once, even if they arrive twice.
• Real participant data never goes into test environments, logs or examples.
• Daily backups, and a plan for restoring them.
• Anyone at Revena with access to production data uses strong two-step verification.
• Software and dependency updates are kept up to date.