Privacy policy
Last updated:
Draft text: this page must be checked by a legal professional before going live.
Who is responsible?
Medalify is a trade name of [To be completed: registered company name], registered with the Dutch Chamber of Commerce under number [To be completed: Chamber of Commerce (KvK) number], located at [To be completed: address]. For privacy questions, contact us at [To be completed: email address].
What data do we process and why?
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, address, email, phone number, order | Fulfil and ship your order, customer contact | Performance of contract | 7 years (Dutch tax law) |
| Personalisation (name, race, times, GPX route) | Make your product as you designed it | Performance of contract | As long as needed for the order, then with the order records |
| Account data (email, hashed password, addresses) | Order history and faster checkout | Consent / contract | Until you ask us to delete your account |
| Result search (name, race, year) and an encrypted IP code | Look up your result and prevent abuse | Legitimate interest | Up to 30 days |
| Payment data | Process payment via Mollie; we never store card details | Performance of contract | 7 years (Dutch tax law) |
Who do we share data with?
We only share what is necessary with: Netlify (hosting and database), Mollie B.V. (payments), our email service for order confirmations, the carrier delivering your parcel and the AI service we use to look up public race results (name, race and year only). Data processing agreements are or will be in place with these parties. Some of these services may process data outside the European Economic Area; this only happens with appropriate safeguards such as the European Commission's standard contractual clauses. [To be completed: verify list of processors and countries]
Your rights
You have the right to access, correct or delete your data, to restrict processing, to object and to data portability. Send your request to [To be completed: email address]; we respond within one month. If you are not satisfied with how we handle your data, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Security
We use an encrypted connection (https), passwords are only stored as a hash and API keys of connected services are stored encrypted in the database. Only authorised administrators can access orders.
See also our cookie policy and the terms and conditions.