Privacy Policy
How Raceras protects athlete identities, manages RFID race telemetry, and safeguards participant records in strict adherence to Republic Act No. 10173 (Philippine Data Privacy Act of 2012).
RA 10173 / NPC
Registered and compliant with the Philippine National Privacy Commission (NPC) framework for personal data controllers.
Public Race Records
Official gun times, RFID split telemetry, bib numbers, and finisher certificates are published for official sports records.
Tokenized Checkouts
Card numbers and e-wallets are handled by PCI-DSS Level 1 certified gateways. Raceras never stores card PANs or CVVs.
Data Subject Rights
Transparent access to your records. Submit requests to inspect, rectify, transfer, or restrict processing anytime.
Applicable to all competitive road cycling, criteriums, marathons, duathlons, virtual runs, and endurance sports operated via Raceras.
Introduction & Statutory Scope
Welcome to Raceras ("Raceras", "we", "our", or "us"), operated by Raceras Web Portal Services. Raceras is a sports technology and ticketing ecosystem designed for sanctioned competitive road cycling, criteriums, marathons, running circuits, duathlons, virtual runs, and endurance racing across the Philippines.
We are dedicated to safeguarding your personal data and upholding your fundamental rights to privacy in accordance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA) of the Philippines, its Implementing Rules and Regulations (IRR), and all applicable advisories and circulars promulgated by the National Privacy Commission (NPC).
Personal Information Controller (PIC): Raceras Web Portal Services acts as the PIC for your platform account, user credentials, technology fee transactions, telemetry platform services, and website analytics.
Personal Information Processor (PIP) & Joint Controller: For specific event rosters, bib assignments, and on-course logistics, Raceras processes participant registries under the mandate and authorization of independent third-party Event Organizers.
Information We Collect
To facilitate verified race registrations, configure RFID timing arrays, process payments, and ensure participant safety, we collect several categories of information:
- Full legal name, preferred name, and alias
- Gender and biological sex for sanctioned race wave classifications
- Date of birth, age, and verified age category
- Nationality and club / cycling team affiliation
- Government ID number (when required for age bracket or prize claims)
- Email address for registration barcodes and payment receipts
- Mobile phone number for race morning SMS alerts
- Physical residential / delivery address for race kit courier shipping
- Jersey, singlet, finisher shirt, and merchandise sizing selections
- Emergency contact person's full name, relationship, and active phone
- Voluntarily reported blood type and critical allergies
- Voluntary medical notes for on-course first-aid emergency response teams
- Allocated race bib number and RFID timing transponder ID
- Gun start wave, split gate timestamps, and elapsed chip times
- Average speed, pace, category rankings, and podium placements
- Strava activity telemetry, GPX/FIT tracks, and screenshots for Virtual Runs
- On-course and finish-line action photographs taken by accredited photographers
- Bib number indexing and facial geometry embeddings for athlete photo lookups
- Payment references, e-wallet transaction IDs, convenience fee breakdown
- IP address, browser user-agent, operating system, and security tokens
Lawful Bases & How We Use Data
Under the Data Privacy Act of 2012 (Sections 12 and 13), processing is lawfully conducted on the bases of contract fulfillment (facilitating race participation), compliance with legal obligations (BIR and tax laws), vital interests (protecting racer health during medical emergencies), and legitimate athletic interests. We use your data specifically to:
Public Disclosure of Race Results & Event Media
Competitive road cycling, criteriums, endurance runs, and duathlons are public sporting spectacles. Participation in events listed on Raceras inherently involves public-facing athletic records:
Your race bib number, full name, age bracket, registered club/team, wave start time, split intervals, net chip finish time, category rank, and finisher status are published openly on our public results portal (/results). These records form an authentic historical registry of athletic achievements.
Accredited event photographers capture candid, crowd, and finish-line action photographs throughout sanctioned venues. These images are uploaded to the Raceras photo gallery where participants, sponsors, and supporters can view, search, and download event memories.
Data Sharing & Third-Party Transfers
Raceras does not sell, rent, or trade your personal information to third-party commercial marketing or advertising firms. We only share personal data with vetted entities under strict contractual data sharing agreements:
We transmit registrant manifests, category classifications, apparel sizes, and emergency contacts to the respective Event Organizer hosting your race to enable race bib printing, wave marshalling, and course safety.
For events offering direct kit delivery, recipient names, delivery addresses, and contact numbers are securely integrated with courier dispatch systems for door-to-door parcel delivery.
Payment processing is performed via licensed Philippine payment aggregators (including PayMongo and Xendit) and digital wallet networks (GCash, Maya).
In the event of physical collapse, crash, or trauma on the race course, emergency medical responders receive immediate access to declared medical notes and next-of-kin contacts.
Disclosures are made when mandated by Philippine court orders, subpoenas, Bureau of Internal Revenue (BIR) audits, or legitimate directives from the National Privacy Commission.
Payment Processing & Card Security
When purchasing event registrations, add-on merchandise, or photo bundles, your checkout session is encrypted end-to-end via Transport Layer Security (TLS 1.3).
Raceras never collects, intercepts, or retains raw primary account numbers (PAN), credit card security codes (CVV/CVC), or bank PINs on our servers. All sensitive financial authentication is transacted directly through Level 1 PCI-DSS certified payment processors. Raceras only stores anonymized masked identifiers, payment method types (e.g. "GCash", "Visa ending in 4242"), and unique transaction hashes for reconciliation and BIR tax invoicing.
Sensitive Emergency & Medical Data
Under Section 13 of the Philippine Data Privacy Act, medical details, blood types, and sensitive health declarations require heightened protective safeguards. Raceras enforces strict handling rules:
- Voluntary Disclosure: Declaring medical conditions, allergies, or blood types during registration is voluntary and collected exclusively for athlete life protection.
- Confidential Role-Based Access: Health disclosures are never visible on public registration lists or public leaderboards. Access is restricted strictly to designated safety marshals and on-duty medical response personnel.
- Emergency Contact Protocol: In the event of a race accident or hospitalization, we utilize your designated emergency contact details solely to inform next of kin and provide paramedics with vital medical context.
Data Retention & Storage Lifecycle
We retain personal data only for as long as necessary to accomplish the intended sports registration purposes or comply with statutory retention mandates:
Retained indefinitely as official historical athletic splits, podium records, and verifiable finisher certificates.
Retained for a minimum of ten (10) years in accordance with Philippine National Internal Revenue Code bookkeeping rules.
Courier tracking data and parcel address notes are archived and purged 90 days following event completion.
Security Measures & Technical Safeguards
Raceras implements comprehensive organizational, physical, and technical security protocols to protect athlete records against accidental destruction, unauthorized modification, unlawful access, and security breaches:
Your Rights Under the Philippine Data Privacy Act (RA 10173)
As a registered athlete and data subject, you hold comprehensive rights under Chapter IV of the Data Privacy Act:
You have the right to know whether your personal data is being processed, why it is being collected, and who receives it.
You have the right to request a copy of the personal information Raceras holds regarding your identity and race participation.
You have the right to dispute any inaccuracy or error in your data (e.g., misspelled name, wrong birthdate, inaccurate category or club name) and have it promptly corrected.
You have the right to suspend, withdraw, or order the removal of your personal information from our active databases, subject to legal retention constraints.
You have the right to obtain your personal information in a structured, commonly used, and machine-readable format.
If you believe that your personal data has been misused, improperly disclosed, or that your rights have been violated, you have the right to file a complaint before the National Privacy Commission (privacy.gov.ph).
Children & Minor Athletes (Under 18 Years)
Sanctioned junior cycling races, youth runs, and kiddie categories listed on Raceras allow participation of athletes under the age of 18 only with the express written consent and authorization of a parent or legal guardian.
Parents or guardians registering a minor athlete represent that they have full legal authority to grant consent for the minor's data collection, RFID timing processing, on-course photo publishing, and athletic risk assumption. If you believe a minor has registered without parental authorization, contact our Data Protection Officer immediately for registration cancellation and record deletion.
Revisions & Notice of Changes
We may periodically revise this Privacy Policy to reflect evolving sports regulations, statutory amendments under the Philippine Data Privacy Act, new payment gateway integrations, or platform features.
Material updates will be notified by posting the updated policy on this page with an updated "Last updated" date and, where appropriate, sending an announcement to registered athletes. Continued use of Raceras following such updates indicates your agreement to the updated Privacy Policy.
Contact Our Data Protection Officer (DPO)
If you have inquiries, clarifications, or wish to exercise any of your data subject rights (access, rectification, erasure, or objection), please submit a formal request to our designated Data Protection Officer:
Entity: Raceras Web Portal Services
Jurisdiction: Republic of the Philippines
Data Protection Officer Email: [email protected]
Response Timeframe: Within fifteen (15) business days upon identity verification.