Privacy Policy

VELITES FITNESS S.L. (“Velites”), tax ID (CIF) B71248983, with registered address at Travesía Etxesakan 5, Oficina B6, Edificio Bidekoa, 31180 Zizur Mayor (Navarra), Spain, is the controller of the personal data processed in The Wall.

For any privacy matter: legal@velitessport.com.

We process the data you provide when you register and complete your entry:

• Identity and contact: first name, last name, email and, if you provide it, your Instagram handle.
• Participation: country, city, box, Murph Challenge time, dedication, whether you used Velites grips, and plaque number.
• Your photo and the black-and-white version we create from it.
• Your acceptances and consents (terms, image license, age declaration and, if you tick it, marketing).
• Technical data: your IP address and server logs, to protect the service.

Fields marked as required in the form are needed to create your plaque; without them we cannot register you.

• To create, display and maintain your plaque on The Wall and the map, and to let you edit it. Legal basis: performance of the participation terms you accept (Art. 6(1)(b) GDPR).
• To send you service emails: email confirmation, your personal link, event notices and link recovery. Legal basis: performance of the participation terms (Art. 6(1)(b) GDPR).
• To issue and send you the Velites gift card when you complete your entry. Legal basis: performance of the participation terms (Art. 6(1)(b) GDPR).
• To use your photo and participation in Velites communications and promotional materials, under the image license you grant us when you register. Legal basis: your express consent when granting that license (Art. 6(1)(a) GDPR and Spanish Organic Law 1/1982). You can revoke it for future uses by writing to us; this does not affect materials already published.
• To send you marketing communications (news, offers and events). Legal basis: your consent, only if you tick the box (Art. 6(1)(a) GDPR). You can withdraw it at any time using the unsubscribe link in every email or by writing to us.
• To protect the service against abuse and fraud, keep it secure and maintain backups. Legal basis: our legitimate interest in providing a secure and available service (Art. 6(1)(f) GDPR).

We do not make automated decisions or create profiles that produce legal effects concerning you.

Only the black-and-white version of your photo is shown on The Wall. We also keep the original you uploaded in private storage that cannot be accessed publicly, for archival purposes and for the uses covered by the image license.

When we receive each photo, we remove its metadata (such as GPS location, date or device model).

When you replace your photo or your plaque is deleted, we also delete the previous versions.

The Wall is a public memorial: anyone can view your plaque and share its link or image on social media.

• Your plaque shows your first and last name, city, country, box, black-and-white photo, time, dedication, plaque number and whether you used Velites grips.
• The live map shows the approximate location of your city, never your address.
• Your email, Instagram handle, consents and original photo are never published.

We do not sell your data. We only share it with providers that process it on behalf of Velites, under a data processing agreement and solely for the purposes described:

• Supabase Inc.: database and photo storage (servers in the European Union).
• Vercel Inc.: website hosting and execution (United States).
• Upstash Inc.: abuse prevention based on your IP address (United States).
• Google (Google Ireland Limited and Google LLC): sending emails (Google Workspace) and encrypted backups (Google Cloud, European Union). We are moving the hosting of the website, database and photos to Google Cloud (United States); once completed, it will replace Supabase, Vercel and Upstash.
• ActiveCampaign, LLC: service emails for all participants and, only if you consent, marketing communications (United States).
• Shopify (Shopify International Limited and Shopify Inc.): gift card issuance. To send it to you, we create or update your customer record in our store with your name and email, without subscribing you to its marketing communications (Ireland, Canada and United States).
• Mapbox, Inc.: live map and city autocomplete; it receives the city you type in the form and the IP address of anyone viewing the map (United States).

We may also disclose data to authorities when required by law.

Some of these providers process data outside the European Economic Area, mainly in the United States. These transfers rely on the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework, for certified providers; on the adequacy decision for Canada; and, in all cases, on the standard contractual clauses approved by the European Commission (Decision 2021/914) included in their contracts.

You can request a copy of these safeguards at legal@velitessport.com.

• Plaque data: up to 5 years after the event you took part in. After that, we reduce your plaque to a minimal memorial record (plaque number, first name, country and time) and delete everything else, including the photo. You can ask us at any time to delete that record too.
• Unconfirmed registrations: if you do not confirm your email within 30 minutes, they are deleted automatically together with their photo.
• Marketing consent: until you withdraw it.
• IP address and technical logs: up to 30 days.
• Encrypted backups: up to 12 months.

If you request erasure, we delete your data and photos from our active systems. Backups that still contain them are destroyed when their retention period ends and are never used to restore your data.

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consents at any time without affecting the lawfulness of prior processing. Write to legal@velitessport.com with the subject “The Wall — Data protection” from the email you registered with. You can also correct your plaque details using your personal link.

We will reply within one month. If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority of your country of residence.

The Wall does not use advertising, analytics or tracking cookies. It only uses:

• wall_own_token: a technical cookie that recognizes your own plaque in your browser without a password. It is created when you use your personal link and expires after 90 days.
• The map (Mapbox) may store technical data in your browser’s local storage that is needed to provide the map service.

As they are technical and necessary for the service you request, they do not require your consent. If we ever use cookies that do, we will ask for your consent before setting them.

The Wall is intended for people aged 18 or over. Minors may only take part with the consent of their parents or legal guardians, who give it on their behalf. If we detect a registration by a minor without that consent, we will delete it.

We apply technical and organizational measures to protect your data: encryption in transit and at rest, access restricted to the minimum privilege necessary, separation between public plaque data and private data, encrypted backups and regular security reviews. If an incident affecting your data occurs, we will act as required by law.

We may update this policy to reflect legal or service changes. We will publish the new version here with its date and, if the changes are significant, we will let you know.

This policy is governed by Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights, and Spanish Law 34/2002 on Information Society Services and Electronic Commerce.

This policy is available in several languages. In case of discrepancy, the Spanish version prevails.