DRAFT PENDING LEGAL REVIEW
This text is provisional: a lawyer hasn't reviewed it yet and it may change before launch.
Data processing agreement
Version processor-agreement-2026-11
The agreement (Art. 28 GDPR) between the organiser, controller of their event's data, and Runpic, which processes it on their behalf.
Purpose
Runpic processes, on the organiser's behalf, the runner list (bib, name, email) and the event photos, only to find each runner's photos, notify them and sell them.
Instructions
We only process the data according to the organiser's instructions, which are the settings in the event panel. We don't use it for anything else.
Security and confidentiality
We apply technical and organisational measures: encryption in transit, row-level access control in the database, originals without a public URL and an action log. Anyone with access to the data is bound by confidentiality.
Sub-processors
Vercel, Supabase, Stripe, Resend and the vision model provider. We'll give notice before adding others.
Data subject rights
We help the organiser handle runners' requests. If a request reaches us directly, we handle it or pass it on.
End of processing
When the event's deadlines are over we delete the data (see the periods in the privacy policy), except what the law requires us to keep.