Privacy Policy
Effective 2 November 2026 · Version 2026-11-02
English translation. Read the Bulgarian original
for the plovdiv.run website and the races organised through it
The personal data controller is VIVENTA GROUP OOD, company registration number 208948386, with its registered office and business address at 4A Anton Chekhov Square, apartment 34, Plovdiv, correspondence address: 4A Anton Chekhov Square, apartment 34, Plovdiv, email: support@plovdiv.run (the ‘Organiser’).
This policy applies to visitors to the plovdiv.run website (the ‘website’), account holders, participants in races organised by the Organiser, parents and legal guardians of participants aged under 18, and representatives of legal entities registering teams. Terms have the meanings given in the website’s General Terms and Conditions and Regulation (EU) 2016/679 (the ‘GDPR’).
The Organiser processes only the data needed for the purposes listed in the table:
Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
Creating and maintaining a user account | Email; names where provided; a record of the user’s declaration that they are aged 14 or over; when Google sign-in is chosen — Google account identifier, names, email and verified-email status | Performance of a contract — Article 6(1)(b) GDPR | Until the account is closed |
Registration and participation in a race | Names, email, phone number, date of birth, results category, selected distance, optional club and country, optional expected finish time, shirt size, the checkbox recording the health and risk declaration, emergency contact (name and phone number); for participants aged under 18 — details of the parent or legal guardian | Performance of a contract — Article 6(1)(b); for the emergency contact and defence of legal claims — legitimate interests under Article 6(1)(f) GDPR | Up to 5 years after the race for necessary contractual evidence; up to 30 days for other organisational data |
Corporate teams | Details of the legal entity’s representative and the participants’ details provided by that representative | Performance of a contract — Article 6(1)(b); legitimate interests, including defence of legal claims — Article 6(1)(f) GDPR | Up to 5 years after the race for necessary contractual evidence; up to 30 days for other organisational data |
Payments and invoicing | Payment information received from the payment service provider; invoicing details | Legal obligation — Article 6(1)(c) | The periods required by accounting and tax legislation |
Timing, rankings and publication of results | Names, results category, age group, club, country where provided, race number and recorded time | Performance of a contract; for the results archive — legitimate interests under Article 6(1)(b) and (f) | The results archive is retained indefinitely unless an objection is upheld |
Medical assistance following an incident and defence against specific legal claims | Health information learned while providing assistance | Vital interests — Article 6(1)(d) and Article 9(2)(c); for legal claims — Article 6(1)(f) and Article 9(2)(f) GDPR | Until the urgent need ends and the information is handed to the medical team; for specific legal claims — under the rule below |
Photography and video | Images of participants and spectators | Legitimate interests in reporting a public event — Article 6(1)(f); for advertising in which the participant is the main subject — consent under Article 6(1)(a) | Up to 5 years after the race; where based on consent — until withdrawal, but no longer than 5 years after the race |
Informational and advertising messages | Names and email | Consent — Article 6(1)(a) | Until consent is withdrawn |
Website security | IP address, device and browser information, access logs | Legitimate interests — Article 6(1)(f) | Up to 12 months from creation of the record |
Complaints, objections and requests | The information in the complaint or request and related correspondence | Legal obligation and legitimate interests — Article 6(1)(c) and (f) | Up to 5 years after the case is finally closed |
These periods are the maximum retention periods for each purpose. Data is deleted or anonymised sooner if it is no longer needed. The participation and team periods apply to copies for the particular race; data in an active account, accounting documents and the results archive follow their separate periods in the table.
For up to 5 years after a race, only data necessary to prove registration, performance of the contract and the declarations made is retained. Data used solely to organise the race, including emergency contact details and shirt size, is deleted within 30 days after the race.
For a specific dispute, incident or legal claim, only relevant evidence is retained, with restricted access, for the necessary period taking account of the applicable limitation period, its suspension or interruption, and until the proceedings are finally concluded and the decision enforced. This rule also applies to records relating to a specific security incident. The need for retention is reviewed periodically, and data is deleted or anonymised when that need ends.
The Organiser does not maintain medical records. In an emergency, health data is processed to protect vital interests where the person is physically or legally incapable of giving consent. The data is handed to the medical team and erased when the urgent need ends. Retention for legal claims is limited to what is necessary for a specific claim under Article 9(2)(f) GDPR.
The need to retain and publish photographs and videos is reviewed at least annually. Their retention period does not limit the right to object or withdraw consent.
The health and risk declaration is made by selecting a checkbox on the registration form. The Organiser stores only the record that the checkbox was selected and the date of selection as evidence that the declaration was made. The Organiser does not collect information about illnesses or other medical information during registration.
The details marked as required on the registration form are necessary to conclude the participation contract. Registration cannot be made without them.
A person aged under 14 cannot create an account. A parent or legal guardian registers them for a race and provides their details. A minor aged 14 to under 18 registers personally with the consent of a parent or legal guardian.
The Organiser shares data only to the extent necessary: with processors acting on the Organiser’s behalf and instructions (providers of hosting, email, electronic timing and the registration platform); with the insurer covering participants, to the extent needed for insurance and payment of compensation; with the race medical team and emergency medical services in an incident; with photographers and video operators engaged by the Organiser; and with public authorities where required by law. When a user chooses Google sign-in, the Google account identifier, names, email and verified-email status are exchanged for authentication. Google sign-in is optional; signing in using a one-time email code is also available.
Data is shared with sponsors and partners only with the person’s consent.
Card payment takes place on BORICA’s payment page. To initiate and authenticate payment, the Organiser sends BORICA the payer’s name and email, billing address, amount, currency and order reference. Participants enter their card details directly on BORICA’s page. The Organiser does not receive or store the full card number, expiry date or security code. BORICA and the acquiring bank process payment data as independent controllers under their own privacy policies. The Organiser receives the payment result and the technical identifiers needed to verify it.
When Google sign-in is chosen, Google also processes identification data as an independent controller. For users in the European Economic Area, the service is generally provided by Google Ireland Limited; Google LLC and affiliated companies may also be involved in processing. Data may be processed outside the European Economic Area. Google describes the applicable international transfer mechanisms at https://policies.google.com/privacy/frameworks, including Google LLC’s participation in the EU–US Data Privacy Framework and standard contractual clauses where needed. Google’s privacy policy is available at https://policies.google.com/privacy. Where the Organiser transfers data outside the European Economic Area, the applicable adequacy decision or another permitted safeguard under Chapter V GDPR is used.
Everyone whose data is processed has the right to access their data and obtain a copy, request correction of inaccurate or incomplete data, request erasure where the data is no longer necessary or is processed unlawfully, request restriction of processing and portability of data they have provided, object to processing based on legitimate interests, including publication of their name in the results archive, and withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
Requests should be sent to support@plovdiv.run. The Organiser responds within one month, which may be extended by a further two months for complex or numerous requests; the person is notified of the extension.
Anyone may complain to the Bulgarian Commission for Personal Data Protection: 2 Professor Tsvetan Lazarov Boulevard, Sofia 1592, www.cpdp.bg.
The website uses essential cookies needed for its operation and account sign-in. Analytics and advertising cookies are used only after consent is given through the banner on the first visit. Consent can be changed at any time in the website’s cookie settings.
The Organiser applies technical and organisational measures to protect data, including encrypted connections and restricted access. Participant accounts use one-time email codes or Google sign-in; the Organiser does not create or store passwords for these accounts. Administrative access requires a passkey and a code from an authenticator app. The Organiser does not carry out automated decision-making, including profiling, that produces legal effects concerning individuals.
The Organiser may amend this policy by publishing the new text on the website with the date of the change. Account holders are notified of material changes by email.
This policy takes effect on 30 October 2026.
Public participant list
If you choose (for a child, if their parent or legal guardian chooses), the public participant list shows two names, country and club only after confirmed payment. This is optional and does not affect participation. You can withdraw your choice in your account at any time; your details will then stop appearing in the public list. Paid entry totals by distance are shown without requiring publication of names.