Privacy Policy
Last updated: June 2026
This Privacy Policy explains how RaceLabs (“we”, “us”) processes personal data when you use the RaceLabs photo galleries to find and download your event photos. RaceLabs is operated by an independent self-employed provider; the provider's full legal name, tax ID and address are available on request at admin@racelabs.eu and are set out in the data processing agreement signed with each event organiser.
1. Who is responsible for your data
For each event, the event organiser is the data controller: they decide that photographs are taken and made available to participants, and they collect your consent at registration. RaceLabs acts as a data processor on the organiser's behalf, processing the photographs and your data only to provide the photo-sorting and gallery service under a data processing agreement.
If you have a question about a specific event, you may contact either the organiser or us at admin@racelabs.eu.
2. What data we process
- Event photographs and video taken by the event's photographers, in which participants may be identifiable.
- Identification data provided by the organiser or entered by you to access your gallery: bib number, name, and either date of birth or email (whichever the organiser uses to verify you).
- Biometric data (only when you run a personal search): the facial features the system derives to match your own photos, plus your selfie if you choose the optional deeper search. This is processed only after you give consent, and is a special category of personal data under Article 9 GDPR.
- Technical data strictly necessary to run the website (e.g. basic logs).
3. How you access your photos
By bib number and a verification field
You enter your bib number together with a verification field that the organiser holds from your registration: your date of birth or email. As this field is not public, it acts as a verification step that prevents another person from accessing your gallery using only your bib. To return every photo of you (including images where the bib is not clearly visible), the system associates the bib with your face within those photos.
At upload, the event photos are organised by bib number only; no facial data is created at this stage. Facial recognition runs only on demand: when you start a search and accept a mandatory consent checkbox (confirming you have read this Privacy Policy and consent to facial recognition for the sole purpose of finding your own photos), the system then analyses faces to also return photos where your bib is not clearly visible. No biometric data is created or processed before you give this consent.
Optional selfie search (deeper search)
Once inside your gallery, you may optionally upload a selfie to recover additional images. This is covered by the same consent and uses your biometric data only to match further photos of you. You can choose not to use it; the bib search works without it.
4. Why we process it, and the legal basis
- Public event gallery and bib-based organising (browsing all event photos and sorting them by bib number, as the organiser already offered) — carried out by RaceLabs as a processor on the organiser's instruction and legal basis, set at registration.
- Facial recognition to find your own photos, including the optional selfie search, run only when you start a search — your explicit consent given through the mandatory checkbox (Art. 6(1)(a) and Art. 9(2)(a) GDPR). No facial or biometric data is processed before this, and you may withdraw consent at any time.
We do not use facial recognition to build any database of participants searchable by third parties, and we never use it to identify you for any purpose other than returning your own photos.
5. How long we keep it
- Selfie and facial features: deleted immediately after the search completes. They are never stored after processing nor reused for another event.
- Event photographs: kept for the period instructed by the organiser, and in any case no longer than 12 months after the event, after which they are deleted.
- Bib / name / date of birth: kept only for the duration of the service for that event.
6. Who we share it with
We do not sell your data and we do not share it with third parties for their own purposes. We rely on a small number of sub-processors strictly to operate the service (for example hosting and storage at Hetzner Online GmbH (Germany, EU)), bound by confidentiality and data-protection obligations. We share data with the event organiser, who is the controller.
7. International transfers
Your data is hosted and processed within the European Economic Area (Hetzner, Germany). We do not transfer your personal data outside the EEA.
8. How we protect your data
We use industry-standard security measures, including encryption of data in transit and at rest, access controls and authentication, and secure data centres. Access to event photos and identification data is limited to what is necessary to run the service.
9. Cookies
We use only the cookies and local storage strictly necessary for the website and the photo galleries to work (for example, keeping your session while you browse your gallery). We do not use advertising, analytics or third-party tracking cookies, so no cookie consent banner is required. If this ever changes, we will update this policy and request your consent where needed.
10. Your rights
You have the right to access, rectify, erase, restrict or object to the processing of your data, to data portability, and to withdraw your consent at any time (which does not affect processing already carried out). In particular, you may object to or withdraw your consent for the facial search and request removal of your images from the platform at any time. To exercise these rights, contact admin@racelabs.eu. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es).
11. Changes to this policy
We may update this Privacy Policy. The current version is always available at this page, with the date of the latest update shown above.
12. Contact
RaceLabs · admin@racelabs.eu
Full provider identification available on request.