Privacy policy

Data controller

The controller of personal data is:

chlng dev s.r.o.
Údolní 36/400
602 00 Brno
Czech Republic
Company ID: 22394524
E-mail: info@chlng.me

1. What personal data we process

Depending on how you use the Website and the App, we process the following categories of personal data:

• Account and profile data: e-mail address, username, password (stored only as a hash), gender, profile and cover photo and, if you sign in with Google, the identifier and e-mail address Google provides to us.
• Activity data: sports activities imported from the apps and devices you connect (see section 2), such as the activity type and title, start and end time, duration, distance, elevation gain, pace and speed, calories, steps, device name, the GPS route and the original activity file (FIT).
• Heart-rate data: heart rate and the related sensor data from your activities, processed only on races that require a fitness test and only with your explicit consent (see section 3).
• Participation and results: the races and challenges you join, the activities you submit, their evaluation, rankings, points and medals.
• Payment data: if you buy a paid plan, the payment is handled by our payment provider Stripe. We store only your customer identifier and the status of your subscription, never your card number.
• Newsletter e-mail address: provided voluntarily through the “Notify me” form on the Website.
• Technical data: IP address, browser and device information and server logs created when you use the Website or the App.

2. Connected apps and devices

To take part in races and challenges, you can connect your CHLNG account to the service that records your sports activities: Garmin, Suunto, COROS, Polar or ROUVY. The connection uses the provider's own authorisation (OAuth): you approve it in the provider's interface and we never see your password for that service.

Once a service is connected, the provider notifies us about your new activities and we download them, including the original activity file. We store the data listed in section 1 and link it to your CHLNG account. For the data we receive from these services, chlng dev s.r.o. is an independent controller.

We keep the original activity file solely so that we can check the activity against the race route and verify and recalculate race results and leaderboards. We do not use it for any other purpose and we do not pass it on to anyone.

Data from Garmin is obtained through the Garmin Connect Developer Program on the basis of the authorisation you give in Garmin Connect. We receive only the activity data you agree to share with us and we do not access any other data in your Garmin account. Garmin's own processing of your data is described in the Garmin Connect privacy notice.

Data from Polar is obtained through the Polar AccessLink API on the basis of the authorisation you give in Polar Flow. We receive only the training data you agree to share with us and we do not access any other data in your Polar account. Polar Electro Oy's own processing of your data is described in the Polar privacy notice.

Data from Suunto is obtained through the Suunto API on the basis of the authorisation you give when connecting your Suunto account. We receive only the activity data you agree to share with us and we do not access any other data in your Suunto account. Suunto's own processing of your data is described in the Suunto privacy policy.

You can disconnect a service at any time in your account settings in the App (Connected apps & devices) or by removing CHLNG from the connected apps in the provider's service (for example for Garmin: Garmin Connect → Connected Apps; for Suunto: Suunto app → Profile → Partner services). When you disconnect, we revoke our access with the provider where it allows it, delete the access tokens for that service and stop receiving new activities. Activities already imported stay linked to your account because race results are based on them; you can ask us to delete them at any time (see section 7).

3. Purposes and legal basis of processing

We process personal data for the following purposes and on the following legal bases:

• Operating the App (your account, importing activities, checking them against race routes, calculating results and leaderboards, awarding medals): performance of a contract under Article 6(1)(b) GDPR.
• Comparing your heart rate with your fitness test on races that require it: your explicit consent under Article 9(2)(a) GDPR, which you give in the App before registering for such a race and may withdraw at any time in your account settings.
• Fair play and security (detecting manipulated or mismatched activities, preventing abuse, protecting our systems): our legitimate interest under Article 6(1)(f) GDPR.
• Payments and accounting: performance of a contract and compliance with our legal obligations under Article 6(1)(b) and (c) GDPR.
• Newsletter and information about the launch of the platform, including marketing messages about CHLNG products, features and events: your consent under Article 6(1)(a) GDPR, which you may withdraw at any time via the unsubscribe link in every e-mail.

Activities are evaluated automatically (adherence to the race route, comparison with the fitness test). When the system flags an activity, the race's promoter or CHLNG administrators review it; you can contest the outcome by contacting us.

4. Who can see your data

We do not share your personal data with third parties. Within the App it is visible only as follows:

• Other participants: the leaderboards and results of the races you take part in show your username, profile photo, results and medals. Your heart rate and your original activity files are never shown to other participants.
• Race promoters: the organiser of a race sees the list of participants and their results. When the system flags an activity on a race that requires a fitness test, the promoter also sees the review material, including a heart-rate chart and the measured values.
• CHLNG administrators have access to the data to the extent needed to operate the service, resolve reviews and handle your requests.

5. No sharing with third parties

We do not sell, rent or otherwise pass personal data on to third parties, and we do not share it with anyone for their own purposes.

Data is stored and processed on the technical infrastructure we use to run the service (hosting and data storage, e-mail delivery, payment processing). These providers act solely on our behalf and on our instructions and may not use the data for anything else. Where such infrastructure is located outside the European Economic Area, we rely on the European Commission's adequacy decisions or standard contractual clauses.

6. Data retention

We keep personal data only for as long as necessary for the purposes above, in particular:

• Account, activity and results data: for as long as your account exists. When you delete your account or ask us to delete your data, we erase it without undue delay, except for data we are required to keep by law (for example accounting records).
• Original activity files (FIT): for as long as the results of the races they were used in are kept, so that the route check and the leaderboards can be verified and recalculated; otherwise they are deleted together with your other data.
• Access tokens of connected services: until you disconnect the service or the provider revokes the connection.
• Heart-rate data: until you withdraw your consent or delete your account. Evaluations already made before the withdrawal remain in place.
• Newsletter e-mail address: until you withdraw your consent.
• Technical logs: for the short period needed for security and troubleshooting.

7. Your rights

Under the GDPR you have the following rights:

• Right of access: Obtain information about the processing of your personal data and a copy of it.
• Right to rectification: Request the correction of inaccurate or incomplete data.
• Right to erasure: Request the deletion of your personal data, including imported activities and activity files.
• Right to restriction and right to object: Request that we restrict processing, or object to processing based on our legitimate interest.
• Right to data portability: Receive the data you provided to us in a structured, machine-readable format.
• Right to withdraw consent: Withdraw your consent at any time without affecting the lawfulness of processing carried out before the withdrawal. Heart-rate consent can be withdrawn in your account settings, the newsletter via the unsubscribe link in every e-mail.
• Right to lodge a complaint: Lodge a complaint with a supervisory authority.

The supervisory authority in the Czech Republic is the Office for Personal Data Protection (ÚOOÚ).

To exercise your rights, contact us at the e-mail address in section 11. We will respond within one month.

8. Data security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or unauthorised disclosure. Data is transmitted over encrypted connections and access to it is limited to the people who need it to operate the service.

9. Cookies

The Website and the App use only cookies that are necessary for their operation, such as the cookie that keeps you signed in and the cookie that remembers your language. We do not use advertising or analytics cookies and we do not track you across other websites.

10. Changes to this privacy policy

We may update this policy from time to time. The current version is always available on this website. Each version takes effect on the effective date that identifies it; we may publish it before that date. We will inform you about material changes in the App or by e-mail.

11. Contact

If you have any questions about this policy or the processing of your personal data, you can contact us at:

info@chlng.me