Privacy Policy

1. Introduction

This Privacy Policy explains how RiderRank (“we”, “us”, “our”), operating at riderrank.com and through the RiderRank Android app, collects, uses, stores, and protects your personal data. It applies to all users of the Platform, including the HQ, Rankings, Missions, Logbook, Intel, and Comms features, regardless of how you access them.

This Policy is issued in compliance with EU Regulation 2016/679 (“GDPR”) and Spanish Organic Law 3/2018 (“LOPDGDD”). It should be read alongside our Terms of Service v1.0 and Cookie Policy v1.0, both available at riderrank.com.

We are committed to handling your personal data with care, transparency, and respect for your rights. If you have any questions about this Policy, please contact us at legal@riderrank.com with the subject line “Data Protection Request”.

2. Data Controller

The data controller responsible for your personal data is:

All data protection correspondence, rights requests, and complaints should be directed to legal@riderrank.com . We will respond within 30 calendar days.

3. Data We Collect

We collect the following categories of personal data, depending on how you use the Platform:

3.1 Identity and Account Data

Username and display name

Profile photograph (if provided)

Email address

Date of account creation

3.2 Usage and Activity Data

Login history and session timestamps

Features accessed (HQ, Rankings, Missions, Logbook, Intel, Comms)

Rankings activity, scores, and Missions completions

Routes viewed, saved, or interacted with

3.3 User-Generated Content

GPX track files, routes recorded with the Android app, and associated route metadata

Route photographs and descriptions

Route chronicles and Logbook entries

Messages sent via the Comms feature

3.4 Geolocation Data

GPS coordinates contained within uploaded GPX files

Route start and end points

GPS coordinates, altitude, and speed recorded by the Android app while recording a route

Phone sensor data recorded while recording a route (lean angle, acceleration, braking, and vibration)

We strongly advise all users to trim track start and end points before uploading to avoid inadvertently revealing home addresses, workplaces, or other sensitive locations. RiderRank is not responsible for privacy consequences arising from a user’s failure to anonymise their tracks prior to upload.

Important classification note: Uploaded GPX files and routes recorded with the app contain geolocation data relating to motorcycle routes (vehicle trajectory data). They do not constitute data concerning health, physical performance, or any other special category of personal data within the meaning of Article 9 GDPR. RiderRank acknowledges that geolocation data may indirectly reveal personal habits, regular routes, or frequently visited locations. At present, RiderRank does not engage in systematic profiling of user movement.

RiderRank applies a privacy trim of at least 500 metres to the start and end of every route before any further processing. For routes uploaded as a GPX file, this trim is applied server-side, regardless of whether the user has pre-trimmed the track. For routes recorded with the Android app, the trim is applied on the device itself before the route is sent.

The Android app requests location permission and may record your position in the background, with the screen off, only while a recording is in progress. The only exception is the SOS button, which reads your position once when you press it (see section 3.10).

3.5 Technical Data

IP address

Browser type and version

Device type and operating system

Referring URL and pages visited

Cookie and session identifiers (see Cookie Policy v1.0)

Android app: app version and device model, sent along with each route

Android app crash reports: technical information about the crash (error trace and the state of the app and device at that moment) and a random installation identifier. These reports do not include the route identifier or your account data.

3.6 Communications Data

Emails sent to legal@riderrank.com or info@riderrank.com

Support requests and correspondence

3.7 Store and Transaction Data

When you make a purchase through the RiderRank Store, we collect and process the following additional data:

Full name and delivery address (for fulfilment and shipping)

Order details (product reference, quantity, rank/badge specifications for personalised items)

Transaction identifiers and order history (payment processed by the Store Platform Provider; RiderRank does not store card data)

Platform rank tier at time of order (used to verify eligibility for rank-restricted products)

Transaction data is processed under Article 6(1)(b) GDPR and retained for a minimum of five (5) years in accordance with Spanish tax and invoicing obligations under Ley 58/2003 General Tributaria and Real Decreto 1619/2012. Order data is transmitted to the Store Platform Provider and to the current Fulfilment Partner (producing from Barcelona, Spain). Full details are published at riderrank.com/en/legal/terms .

3.8 Live Location (Route Safety)

The “Route Safety” feature of the Android app lets you share your position in real time. While it is enabled, the app sends your position to our servers approximately every 10 minutes during a recording (including while paused) and associates it with a temporary link specific to that route. The feature is enabled by default for signed-in users and can be turned off at any time in Settings.

The temporary link is always created when a route starts, even if you do not share it with anyone. Anyone who has that link can see the last position sent by the app, until the route ends or, if the closure cannot be completed, until the data is deleted (see section 6). No position located within the privacy zone at the start of the route is published.

The end of the route cannot be protected in advance, because it is not known until the route ends. If you do not want your current position to be viewable, turn the feature off before starting the route.

The app settings are not available while a route is being recorded, so the feature can only be turned on or off between routes. If you turn it off, no temporary link is created for later routes. When a route ends or is discarded, the link is closed and its coordinates are deleted from our servers. If that closure cannot be completed, for example because of poor coverage or because the system closes the app, the coordinates are deleted automatically at most 48 hours after the last transmission.

The public link page loads the map from an external tile provider (Esri/ArcGIS). That provider receives the IP address and the map areas viewed by whoever opens the link.

3.9 Emergency Contacts

You may save up to three emergency contacts in your account, providing a name and a phone number. This is data of third parties, who are not necessarily users of the Platform.

The purpose is to be able to alert a trusted person in the event of an emergency during a route. This data is stored on our servers and, encrypted, on the user's phone. It is not used for any other purpose and is not disclosed to third parties, except to the providers that supply our hosting service.

The user is responsible for informing the contact and obtaining their agreement before providing their details.

If you are listed as a user's emergency contact and wish to exercise your rights, including erasure of your number, write to legal@riderrank.com with the subject line “Data Protection Request”, stating your phone number.

3.10 SOS Button

The SOS button in the Android app is available when the “Route Safety” feature is turned on and you are signed in. When you press it, it reads your position once, even outside a recording. If it cannot obtain a current position in time, it may use the last known position of the phone, provided it is at most 60 minutes old.

It then prepares an SMS for one of your emergency contacts, which you send from your phone's messaging app. The message includes the name you identify yourself with in the app, an alert text, a map link with your exact coordinates, the accuracy and the time of that position and, if a temporary tracking link is active, that link. The SOS position is not trimmed by the privacy zone.

RiderRank neither sends nor receives that SMS: the app has no SMS permission and does not use any sending provider. The message travels through your phone's carrier.

4. Lawful Basis for Processing

We process your personal data on the following legal bases under Article 6 GDPR:

4.1 Performance of Contract — Art. 6(1)(b)

Processing necessary to provide the Platform services you have requested, including account creation and management, hosting your User Content, enabling Rankings and Missions, and facilitating Comms between users.

4.2 Legitimate Interests — Art. 6(1)(f)

Processing necessary for our legitimate interests, provided these do not override your fundamental rights and freedoms. This includes platform security and fraud prevention, abuse detection and enforcement of our Terms of Service, and defence of legal claims. Note: analytics processing (including Google Analytics) is based exclusively on consent under Section 4.4, not on legitimate interests.

4.3 Legal Obligation — Art. 6(1)(c)

Processing required to comply with applicable law, including responses to valid court orders, regulatory directives, law enforcement requests, and data breach notification obligations under Article 34 GDPR.

4.4 Consent — Art. 6(1)(a)

Processing based on your freely given, specific, informed, and unambiguous consent. This applies to non-essential cookies and optional marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

Geolocation data contained within GPX files is processed on the basis of your consent, given by the act of uploading. Data from routes recorded with the Android app is processed on the basis of your consent, given by recording the route and saving it: the saved route is sent to the Platform automatically when you confirm saving it or, if the app is closed before you confirm, the next time it is opened with a signed-in session. You may delete uploaded content at any time via your account settings.

4.5 Legitimate Interest — AI Description Generation — Art. 6(1)(f)

Uploaded routes are automatically processed by artificial intelligence models to generate textual mission descriptions. This processing is based on RiderRank's legitimate interest in providing value-added functionality to Platform users (Art. 6(1)(f) GDPR). We have assessed that this processing does not override users' rights and freedoms, given that: (a) data is geographically anonymised before transmission (privacy trim of at least 500 m), (b) no personal identifiers are transmitted to AI providers, and (c) providers are paid-tier services that do not use data to train their models. You have the right to object to this processing at any time by contacting legal@riderrank.com.

4.6 Live Location — Art. 6(1)(b)

Live position data in the “Route Safety” feature is processed to provide the feature you use (Art. 6(1)(b) GDPR). You can turn it off at any time in Settings and, while it is on, you decide whether or not to share the temporary link with other people.

4.7 Crash Reports — Art. 6(1)(f)

Crash reports from the Android app are processed on the basis of our legitimate interest in detecting and fixing errors and in maintaining the stability and security of the service (Art. 6(1)(f) GDPR). They are not used for usage analytics or advertising. We have assessed that this processing does not override your rights, since the reports do not include your account data or route identifiers. You may object to this processing at any time by contacting legal@riderrank.com.

4.8 Emergency Contacts — Art. 6(1)(b) and 6(1)(f)

With regard to the user, the processing is necessary to provide the feature they request (Art. 6(1)(b)). With regard to the contact, it is based on the legitimate interest of the user and of RiderRank in being able to alert a trusted person in an emergency (Art. 6(1)(f)). The contact may object or request erasure of their data at any time by contacting legal@riderrank.com.

5. How We Use Your Data

We use your personal data for the following purposes:

To create, manage, and maintain your account

To host, display, and make available your User Content to other registered users

To operate the Rankings, Missions, and Logbook systems

To enforce our Terms of Service and investigate potential violations

To detect, prevent, and respond to security incidents, fraud, and abuse

To analyse Platform usage in aggregate and improve our services

To respond to your enquiries, rights requests, and support requests

To send service-related notifications (account changes, Terms updates, breach notifications)

To comply with applicable legal obligations

To process and fulfil Store orders, including transmitting order data to our Fulfilment Partner

To issue invoices and comply with tax and accounting obligations under Spanish and EU law

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects. RiderRank is not legally required to appoint a Data Protection Officer (DPO) under Article 37 GDPR. All data protection enquiries should be directed to legal@riderrank.com with the subject line “Data Protection Request”.

To generate automatic AI-powered route descriptions using anonymised trajectory data

To share your position in real time through the temporary link of the “Route Safety” feature, when enabled

To store your emergency contacts

To detect and fix Android app errors through crash reports

To allow you to alert an emergency contact by SMS, with your position, using the SOS button

6. Data Retention

We retain your personal data only for as long as necessary for the purposes set out in this Policy, in accordance with Article 5(1)(e) GDPR:

Upon account closure or a valid erasure request, we will delete or anonymise your personal data within the periods set out above, unless retention is required by law or necessary for the defence of legal claims.

7. Data Sharing and International Transfers

7.1 Who We Share Data With

We do not sell, rent, or trade your personal data. We may share your data with:

Data processor service providers (cloud hosting, analytics, email delivery, e-commerce) acting under data processing agreements compliant with Article 28 GDPR. This includes the current Store Platform Provider operating shop.riderrank.com and the current Fulfilment Partner. Full details are published at riderrank.com/en/legal/terms .

Google (Firebase Crashlytics), as data processor for Android app crash reports, under the Firebase Data Processing and Security Terms

Google (Google Play services), when you use the Android app: Google sign-in, app integrity verification, and app updates are carried out through Google Play services, with which your device communicates directly with Google under Google's terms and privacy policy

Competent authorities (courts, regulators, law enforcement) where required by applicable law or a valid legal order

A successor entity in the event of a merger, acquisition, or sale of assets, with advance notice to you

7.2 International Transfers

RiderRank is based in Spain and its main Platform infrastructure is hosted within the EEA. Where the Store Platform Provider or any other third-country recipient is not covered by an EU adequacy decision, transfers are governed by Standard Contractual Clauses (SCCs) under Commission Decision 2021/914. The identity, country of establishment, and applicable transfer mechanism of the current Store Platform Provider are published at riderrank.com/en/legal/terms . The current Fulfilment Partner produces from Barcelona, Spain (EEA) — no international transfer of production data takes place at present.

Android app crash reports are processed by Google (Firebase Crashlytics), which may process data outside the EEA. These transfers are covered by the EU–US Data Privacy Framework, to which Google adheres, and, if it were not available, by Standard Contractual Clauses.

You may request details of the specific transfer mechanisms applicable to our service providers by contacting legal@riderrank.com .

7.3 AI Processing Sub-processors

For AI route description generation, RiderRank uses the following AI sub-processors, both established within the European Economic Area and neither of which uses customer data to train their models

Google Cloud EMEA Limited — Vertex AI, region europe-west1 (Belgium, EEA). Primary provider. Data processed exclusively within the EEA. Data processing agreement: Google Cloud Data Processing Addendum

Mistral AI SAS — headquartered in Paris, France (EEA). Fallback provider. Data processed exclusively within the EEA. Data processing agreement: Mistral AI Data Processing Agreement. No transfers of data outside the EEA take place in the context of AI route processing.

8. Your Rights Under GDPR

Under Articles 15 to 21 GDPR and the LOPDGDD, you have the following rights in relation to your personal data:

To exercise any of these rights, contact us at legal@riderrank.com with the subject line “Data Protection Request”. We will respond within 30 calendar days. You also have the right to lodge a complaint with the AEPD at aepd.es , or with the supervisory authority in your country of habitual residence.

9. Data Security

RiderRank implements appropriate technical and organisational measures pursuant to Article 32 GDPR to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures are reviewed and updated regularly in line with industry standards.

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay in accordance with Article 34 GDPR, and notify the AEPD within 72 hours pursuant to Article 33 GDPR.

No transmission over the internet is completely secure. While we take all reasonable steps to protect your data, we cannot guarantee absolute security of data transmitted to or from the Platform.

10. Minors

The Platform is not directed at, nor intended for use by, persons under the age of 18. We do not knowingly collect personal data from minors. If we become aware that personal data has been collected from a minor without verifiable parental consent, we will take immediate steps to delete such data. If you believe we have inadvertently collected data from a minor, please contact us immediately at legal@riderrank.com .

11. Cookies

The Platform uses strictly necessary cookies and, with your consent, optional analytics and third-party map cookies. Full details of the cookies we use, their purpose, duration, and how to manage your preferences are set out in our Cookie Policy v1.0, available at riderrank.com/en/legal/cookies .

The Android app does not show a cookie banner because no analytics or advertising cookies are used inside the app: there is no Google Analytics or Meta Pixel. Your session is maintained through credentials stored on your device, which are necessary for the service to function.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or our services. When material changes are made, we will update the “Last Updated” date and notify registered users via their registered email address. Where required by law, we will seek fresh consent.

Your continued use of the Platform after the effective date of any updated Privacy Policy constitutes your acknowledgement of the updated Policy. If you do not accept the updated Policy, you must cease using the Platform and may request deletion of your account.

13. Contact

For all data protection matters: