Privacy statement

The controller is Lionsclub Raalte, Kanaalstraat OZ 27, 8102 GG Raalte, the Netherlands. That is the club that organises the Stoppelveldrit and that decides what happens with your data.

We have no data protection officer, and none is required: the processing is too small and too simple for that. Your request reaches the board of the club.

The legal basis is article 6(1)(b) GDPR: processing is necessary to perform the contract you enter into with us by registering. Without your name and a way to reach you we cannot send you a ticket and cannot tick you off at the start.

This is explicitly not consent. Ticking “I agree to the terms and conditions” while registering is acceptance of those terms, not consent within the meaning of the GDPR. Consent can be withdrawn at any moment, and that does not sit well with a ticket you have bought. So we never ask you for consent to process your registration data.

For a registration we record:

• •the name of the contact person registering;
• •that person’s email address and phone number;
• •the name of every rider taking part;
• •the chosen distance and the number of riders;
• •the entry fee and any donation, and whether payment has been made;
• •an order reference and a randomly generated check-in code;
• •whether and when you checked in at the start;
• •the language you used the site in, so the confirmation email arrives in the same language.

We use that data to:

• •send the confirmation email with your ticket;
• •produce the participant list and tick people off at the start;
• •contact you if the ride is cancelled or moved, or if something goes wrong with your payment;
• •add up numbers and amounts for catering, the annual report and the account we give to the good cause — for which we use totals only, no names.

We neither see nor keep your bank account number: that stays with the payment provider and your bank. We do not send a newsletter and we do not use your email address to approach you unasked next year.

A registration form on the open internet is found by a script sooner or later. To stop the form being abused to send unsolicited email or to flood us with fake registrations, we briefly count how many requests come from the same IP address.

The legal basis is article 6(1)(f) GDPR: our legitimate interest in protecting the site and participants’ mailboxes. The measure is kept as light as possible.

• •Your IP address is not stored in the database. There is no column for it.
• •The counter lives only in the server’s working memory and is gone on restart.
• •If an IP address ends up in a log line, it appears masked: the last part is replaced, so the address can no longer be traced to a single connection.

This site uses no tracking cookies, no analytics and no advertising pixels. The only cookies we set are functional: they keep a logged-in volunteer logged in. That is also why there is no cookie banner on this site.

If you register more than one rider, you enter the names of your fellow riders. They never visited this site themselves and so did not give us their name themselves. We think that is worth saying separately.

Of them we record only the name, plus the distance they are riding and whether they checked in at the start. No email address, no phone number, no date of birth. We use that name solely for the participant list and for ticking people off at the start, and for nothing else.

For these riders the processing rests on article 6(1)(f) GDPR: our legitimate interest in knowing who is out on the road. Without a participant list we do not know who is riding if there is a breakdown or an accident.

Please tell your fellow riders that we hold their name and point them to this page if needed. If someone wants their name corrected or removed, that can be done through our contact address — they may do so themselves and do not have to go through you.

We use three parties. With all three there is a processing agreement in place, or they are controllers in their own right where that is appropriate.

• •Railway — hosting and database. The website runs here and the registrations are stored here. We chose a region inside the European Union, so the data does not leave the EU.
• •Postmark — sending email. Postmark receives your email address, your name and the contents of the confirmation email (distance, number of riders, order reference). Postmark is a US service; that means a transfer to the United States.
• •Mollie — the payment. Mollie receives the amount, an order reference and your email address, plus whatever you enter at your bank or card issuer. Mollie is a Dutch payment provider and is itself a controller for the payment data, with its own privacy statement.

Beyond that we pass nothing on. We do not sell data and we do not trade it. The good cause receives no names — it hears an amount.

• •Rider names: deleted three months after the ride, so by 23 November 2026 at the latest. After that the participant list no longer exists.
• •Contact details on a registration (name, email address, phone number): anonymised one year after the ride, so by 23 August 2027 at the latest. What remains is a row without personal data: distance, number of riders and amount.
• •The email sending log: 90 days. It holds no full email address, only a masked version.

The financial records that must be kept for seven years under Dutch tax law are not in this database. They sit with the payment provider and in the club’s bookkeeping. The clean-up above therefore does not conflict with that obligation.

• •The site runs entirely over https.
• •The database is not reachable from the internet; only the website itself can access it.
• •The participant list can only be viewed by a small number of volunteers, who receive a one-time code at their own email address each time.
• •The check-in page works with a long, randomly generated code in the link. That code does not appear in the participant list, in exports or in log files.
• •In our log files email addresses are masked, and names, phone numbers and codes are not written out at all.

You have the right to see your data, to have it corrected or erased, to have processing restricted, to receive your data in a common file format, and to object. Send a message to our contact address. We respond within a month, and usually much sooner.

Because the processing rests on the contract and not on consent, there is no consent for you to withdraw. You can object to the two processing activities that rest on our legitimate interest: counting requests per IP address, and recording the names of fellow riders.

A request for erasure before the ride means in practice that we can no longer carry out your registration: without a name, nobody is on the participant list. We say so honestly before we delete anything.

If you are unhappy with how we handle your data you can lodge a complaint with the Autoriteit Persoonsgegevens, the Dutch supervisory authority (autoriteitpersoonsgegevens.nl). We would of course rather hear it from you first.

If what we process or who we use changes, we update this page and change the date at the top. There is no archive of earlier versions; this site exists for one edition of the ride.