Privacy notice
Last updated: [DATE]
The short version
- We only collect what you give us in our forms: your name, email and anything you choose to tell us.
- We use it to reply to you and organise the event or fundraiser you asked about. We never sell it.
- We only email you about future events if you tick the box, and you can stop at any time.
- No advertising, analytics or tracking cookies. Our fonts are hosted on our own server.
- Donations are made directly to Checkpoint Canarias through its own Donorbox form, which we show on our donate page, under its privacy policy. We never see your card or bank details.
- You can ask to see, correct or delete your data at any time: [privacy@move4checkpoint.com].
1. Who we are
Move4Checkpoint (including Cycle4Checkpoint, Run4Checkpoint, Hike4Checkpoint, Swim4Checkpoint and You4Checkpoint) is a community fundraising project run by two individuals, [FULL LEGAL NAME 1] and [FULL LEGAL NAME 2]. It is not a company or a registered charity. We decide together how your personal data is used, so we are joint controllers of it under UK and EU data protection law.
Contact us about anything in this notice at [privacy@move4checkpoint.com] or by post at [POSTAL ADDRESS].
2. What we collect
When you fill in one of our forms
- Your name and email address.
- What you tell us: for example which race you're running, your challenge idea, or whether you're bringing a bike.
- Whether you've asked to hear about future events.
- The date you sent it, and the fundraiser link you arrived from, if any (e.g. "flash").
When you visit the website
- Your IP address is used briefly to protect our forms from spam and abuse (we limit how many forms one address can send). Our hosting provider also keeps short-lived technical logs, which may include IP addresses, to keep the site secure and working.
- We use only cookies that are strictly necessary: one that protects our forms against forged submissions, and one that carries your first name to the "thank you" page. Neither tracks you, so we don't ask for cookie consent. We use no analytics or advertising cookies.
When you donate
When you donate, you give directly to Checkpoint Canarias. The donation form is Checkpoint Canarias's own Donorbox form, shown on our donate page, and Checkpoint Canarias is responsible for your donation details (it is the controller, and Donorbox works for it as its processor). How it uses them is set out in [Checkpoint Canarias's privacy policy - ADD LINK]. Card and bank payments are handled by the payment provider you choose on that form, and we never see your card or bank details.
[CONFIRM WITH CHECKPOINT CANARIAS: Option A - We don't receive any information about individual donations. We only see totals, which we use to report what each event has raised. / Option B - Checkpoint Canarias shares with us [the amount and date of each donation and the fundraiser link it came through / LIST EXACTLY], so we can report totals and credit fundraisers. We don't receive card or bank details.]
Our donate page shows Checkpoint Canarias's Donorbox form inside our website. When that page loads, your browser connects to Donorbox, which receives your IP address, browser details and the address of our page (including the tag that says which fundraiser or part of our site you came from) under its own privacy policy.
Health information
We don't ask for health information and we'd ask you not to include it in our forms. Supporting an HIV and STI testing service says nothing about anyone's health, and we never assume or infer anything. If you send us health information anyway, we will delete it unless you've asked us to keep it for a specific reason, such as your safety on a ride. If we ever need safety or medical details from riders, we'll ask separately, explain why, and ask for your explicit consent.
3. Why we use it, and our legal basis
| What we do | Legal basis (UK and EU GDPR) |
|---|---|
| Reply to your sign-up or enquiry, and organise the ride, run or challenge you asked about | Legitimate interests (Art. 6(1)(f)): running the event you asked to take part in. You'd expect us to use your details this way. |
| Set up and track your personal fundraising link | Legitimate interests (Art. 6(1)(f)): crediting what you raise. |
| Email you about future events (only if you ticked the box) | Consent (Art. 6(1)(a)). Withdraw it any time using the link in any email, or by contacting us. |
| Report what each event has raised and credit fundraisers [ONLY IF CHECKPOINT CANARIAS SHARES DONATION DETAILS WITH US] | Legitimate interests (Art. 6(1)(f)): being open about what's raised. |
| Protect the site and forms from spam and abuse | Legitimate interests (Art. 6(1)(f)): keeping the service secure. |
| Keep records the law requires, or deal with legal claims | Legal obligation (Art. 6(1)(c)) or legitimate interests (Art. 6(1)(f)). |
| Health information, only if you give it to us and ask us to keep it | Your explicit consent (Art. 9(2)(a)). |
Where we rely on legitimate interests, we've weighed them against your rights and kept what we collect to a minimum. You can object at any time (see section 7). We don't make any decisions about you by automated means.
4. Who we share it with
We don't sell your data or share it for anyone else's marketing. A few service providers handle it on our behalf, under contracts that require them to protect it:
- Microsoft (Azure) hosts the website and our database, in the UK South (London) region.
- Google (Gmail) delivers and stores the emails our forms send us, and our replies to you.
Donations, and the details you give when donating, go to Checkpoint Canarias and its providers (Donorbox and the payment provider you choose), not through us (see section 2). We don't pass the details from our sign-up forms to Checkpoint Canarias [CONFIRM: or say what is shared and why]. We may also disclose data if the law requires it.
5. International transfers
We are based in the UK, and our website and database are hosted in the UK. The European Commission recognises the UK as giving adequate protection to personal data, so data can flow from the EU to us.
Google and Microsoft may process some data, such as emails, outside the UK and EU, including in the United States. Where they do, the transfer is protected by the safeguards in their terms: the EU-US Data Privacy Framework and its UK Extension, and/or standard contractual clauses and the UK International Data Transfer Addendum. You can ask us for more detail.
6. How long we keep it
- Sign-ups and enquiries: until [12] months after the event or fundraiser you contacted us about, or [12] months after we last heard from you if it doesn't go ahead. Then we delete it, including the notification emails in our inbox.
- Future-event emails: until you unsubscribe or withdraw consent. After that we keep only your email address on a "do not contact" list, so we don't email you again by mistake.
- Donation details Checkpoint Canarias shares with us (if any): for as long as we need them to report totals and credit fundraisers, and no longer than [6] years. Checkpoint Canarias keeps its own donation records under its own privacy policy.
- Technical and security logs: up to [30] days.
7. Your rights
Under UK and EU data protection law you have the right to:
- get a copy of the personal data we hold about you;
- have it corrected if it's wrong, or deleted;
- ask us to restrict how we use it;
- object to us using it on the basis of legitimate interests, and object at any time to marketing emails (we will always stop);
- have it given to you, or to someone else, in a portable format, where the law provides for this;
- withdraw your consent at any time, where we rely on consent. This doesn't affect anything we did before you withdrew it.
Email [privacy@move4checkpoint.com] to use any of these rights. It's free. We may need to confirm your identity, and we'll reply within one month (we'll tell you if a complex request needs longer, as the law allows).
8. Complaints
If you're unhappy with how we've handled your data, please tell us first at [privacy@move4checkpoint.com], by post, or any other way you can reach us. We'll acknowledge your complaint within 30 days, look into it properly, and keep you updated.
You also have the right to complain to a data protection authority at any time:
- UK: the Information Commissioner's Office (ICO), ico.org.uk/make-a-complaint, 0303 123 1113.
- EU/EEA: the authority where you live, work or where you think the problem happened. In Spain, that's the Agencia Española de Protección de Datos, aepd.es.
9. Age
Our forms are for people aged 18 and over. If you're under 18, please don't send us your details.
10. Changes to this notice
If we change how we use your data, we'll update this page and the date at the top. If a change affects you significantly, we'll tell you by email.