PRIVACY POLICY
Last updated: March 2, 2026
1. Data Controller
The controller of personal data collected through the poltrax.pl website is:
Poltrax sp. z o.o.
ul. Gwiaździsta 7C/37, 01-651 Warsaw, Poland
NIP: 5252885584 | KRS: 0000933538 | REGON: 520496560
Contact for data protection matters: [email protected]
2. What We Do
Poltrax provides live GPS tracking services for sport event organizers. We rent GPS devices to organizers, who distribute them to participants of their events. GPS positions are collected, processed, and displayed publicly in real time on poltrax.live, and after the event they are made available as route replays and downloadable GPX files.
3. What Data We Process and Legal Basis
3.1. Contact Form (poltrax.pl)
| Data scope | Name, email address, phone number, message content, estimated number of devices, event dates |
|---|---|
| Processing purpose | Handling inquiries regarding GPS device rental and service provision |
| Legal basis | Art. 6(1)(b) GDPR — taking steps at the request of the data subject prior to entering into a contract; Art. 6(1)(f) GDPR — legitimate interest of the controller (handling correspondence) |
| Retention period | For the time necessary to handle the inquiry, then for the limitation period of potential claims (3 years) |
| Data provision | Voluntary, but necessary to handle the inquiry |
3.2. Event Participant Data (poltrax.live)
| Data scope | First and last name, bib number, GPS position (geographic coordinates, speed, timestamps), route traveled during the event |
|---|---|
| Processing purpose | Live tracking of participant positions during the event, providing route replays and GPX files after the event |
| Legal basis | Art. 6(1)(f) GDPR — legitimate interest of the controller and the event organizer (provision of GPS tracking service ordered by the organizer) |
| Data source | Participant data is provided by sport event organizers who are our clients. Poltrax does not collect participant data directly — we do not operate participant registration or sign-up forms. |
| Public visibility | Participant GPS positions are displayed publicly in real time on poltrax.live during the event. After the event, route data remains publicly available as replays and downloadable GPX files. |
| Retention period | Data is stored indefinitely to enable access to results and route replays after the event. Participants may request deletion of their data at any time (see section 6). |
| Data provision | Data is provided by the event organizer under a service agreement. |
3.3. Event Organizer Data (B2B Clients)
| Data scope | Contact person's first and last name, email address, phone number, company/organization name, event details |
|---|---|
| Processing purpose | Performance of the GPS device rental and tracking service agreement |
| Legal basis | Art. 6(1)(b) GDPR — performance of a contract |
| Retention period | For the duration of the contract, then for the period required by law (including 5 years for tax purposes) |
3.4. Web Analytics (Google Analytics)
| Data scope | Anonymized IP address, device and browser information, pages visited, time spent on pages |
|---|---|
| Processing purpose | Website traffic analysis and functionality improvement |
| Legal basis | Art. 6(1)(a) GDPR — user consent |
| Retention period | According to Google Analytics settings (default 14 months) |
| Data provision | Voluntary — data collected only after consent to analytics cookies |
4. Relationship with Event Organizers
Poltrax provides GPS tracking services on behalf of sport event organizers. Regarding participant data:
- The event organizer is the data controller of their participants' personal data — the organizer decides to use the GPS tracking service and is responsible for informing participants about data processing, including the transfer of data to Poltrax.
- Poltrax processes participant data as a data processor on behalf of the organizer and as a controller regarding the public display of results and routes.
Event organizers who use Poltrax services are required to inform their participants about GPS data processing, including the public display of positions on poltrax.live.
5. Data Recipients and Processors
Personal data may be shared with the following categories of recipients:
| Entity | Purpose | Location |
|---|---|---|
| Google LLC | Web analytics (Google Analytics) | USA — based on EU-US Data Privacy Framework adequacy decision |
| Cloudflare Inc. | DDoS protection, CDN, DNS | USA — EU-US Data Privacy Framework + Standard Contractual Clauses |
| SMSAPI (Sinch) | SMS notifications | Poland/EU |
| Mailjet (Sinch) | Email notifications | EU |
| Sentry (Functional Software Inc.) | Application error monitoring | USA — EU-US Data Privacy Framework |
| Hosting providers | Server and database hosting | EU |
Personal data is not sold to third parties.
6. Data Subject Rights
Under the GDPR, you have the following rights:
- Right of access (Art. 15) — you can obtain information about whether we process your data and receive a copy.
- Right to rectification (Art. 16) — you can request correction of inaccurate data.
- Right to erasure (Art. 17) — you can request deletion of your data, including GPS data from route replays and GPX files.
- Right to restriction of processing (Art. 18) — you can request restriction of processing in certain cases.
- Right to data portability (Art. 20) — you can request your data in a structured format.
- Right to object (Art. 21) — you can object to processing based on legitimate interest.
- Right to withdraw consent (Art. 7(3)) — for processing based on consent (e.g., analytics cookies), you can withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
For event participants: If you want to delete your GPS data, route, or results from an event replay, contact us at [email protected] or your event organizer.
To exercise the above rights, contact us: [email protected]
You also have the right to lodge a complaint with a supervisory authority:
President of the Personal Data Protection Office (PUODO)
ul. Stawki 2, 00-193 Warsaw
https://uodo.gov.pl (otwiera w nowej karcie)7. Data Transfers Outside the European Economic Area
Some processors handling data on our behalf are based in the United States (Google, Cloudflare, Sentry). Data transfers are based on:
- European Commission adequacy decision under the EU-US Data Privacy Framework (DPF) — for entities certified under the DPF program.
- Standard Contractual Clauses (SCCs) approved by the European Commission — as an additional safeguard.
8. Data Security
We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, destruction, or modification, including:
- Data transmission encryption (HTTPS/TLS)
- DDoS protection (Cloudflare)
- Access control for systems and databases
- Regular backups
9. Automated Decision-Making
We do not make automated decisions, including profiling, within the meaning of Art. 22 GDPR, that would produce legal effects concerning you or similarly significantly affect you.
10. Cookies
What are cookies?
Cookies are small text files stored on your device when you use our website. We use them to ensure proper website functionality and to analyze traffic.
Types of cookies
| Category | Purpose | Consent required? |
|---|---|---|
| Essential | Proper website functionality, security, attack protection (Cloudflare) | No — Art. 6(1)(f) GDPR |
| Analytics | Website traffic analysis (Google Analytics) — collecting anonymized visit statistics | Yes — Art. 6(1)(a) GDPR |
Managing cookies
On your first visit to the website, we display a banner requesting consent for analytics cookies. You can:
- Accept or reject analytics cookies via the banner.
- Change settings at any time by clicking the "Cookie settings" link in the page footer.
- Block cookies in your browser — instructions can be found in your web browser settings.
Refusing analytics cookies does not affect your ability to use the website.
11. Changes to the Privacy Policy
This privacy policy may be updated to reflect changes in our data processing practices or changes in applicable law. The date of the last update is provided at the beginning of this document.
12. Contact
If you have questions about this privacy policy or the processing of your personal data, contact us: