Privacy

Who is responsible

Pace, org.nr. 926 408 968, Apotekergata 10, Oslo, Norway, is the data controller for this site. For anything in this policy: hei@pacepacepace.com.

What we collect, and why

When you order

Your height, weight and chosen size (the vest is made to them), your email and phone number (to deliver the order and reach you about the fit), and the amounts and dates of payment. Card details never reach us — payment runs entirely on Stripe’s systems.

When you sign in

Your name, email address and profile picture, from your Google account, to create and recognise your account. We update these from Google only until you edit them here — after that, your version wins.

When you enter a race

Your email and name (for the entry and the receipt), the event and tier you chose, the price and the dates of payment. The organiser of the event receives your name and email as the entrant. Card details never reach us.

When you organise

The organisation’s name, country, website and a contact email, the terms version you accepted and when, and our decision on your application with the reviewer’s name. If you connect Stripe, we hold your Stripe account id and a mirror of its standing (whether charges and payouts are enabled, and what Stripe still requires) so the site can tell you where you stand. Your identity documents and bank details go to Stripe directly and never reach us.

When you browse

One cookie, set only when you sign in, that keeps you signed in. It is HttpOnly and Secure, and it identifies your session, not your behaviour. There are no analytics or advertising cookies on this site. Our servers keep operational logs and traces (request timings, errors) to keep the service working; these are about requests, not profiles.

How long we keep it

A started order that is never paid — including any measurements in it — is deleted automatically within 25 hours. A race entry that is never paid releases its place within the hour and is kept as a record of the attempt. Paid orders and entries are kept for as long as Norwegian accounting law requires (five years, bokføringsloven), and so is an organiser record once money has moved through it. Your account exists until you ask us to delete it. Sign-in sessions expire after 30 days.

Where it lives, and who touches it

Our database runs on servers in Germany (Hetzner), backed up within the EU. Requests are served through Cloudflare’s network. We use three processors, each only for what they are for: Stripe (payments, and for organisers the connected account that pays them out — Stripe is an independent controller for the identity and bank information it collects), Google (sign-in), and Cloudflare (hosting and delivery). We do not sell personal data, and we do not share it with anyone else unless the law requires it.

Your rights

You can ask for a copy of your data, ask us to correct it, delete it, or hand it over in a portable form — email hei@pacepacepace.com and we will answer within a month. If you think we have handled your data wrongly, you can complain to Datatilsynet (the Norwegian Data Protection Authority), datatilsynet.no.

Changes

If this policy changes in a way that matters, the date above changes with it, and anything material is announced on the site before it takes effect.