Privacy policy
Last updated: November 4, 2026
This policy explains which personal data Zenko processes, why, for how long, and what your rights are, under the General Data Protection Regulation (GDPR) and the French Data Protection Act. It covers thezenkotrail.eu website and the app.zenkotrail.eu application.
1. Who is responsible?
[À compléter : nom ou raison sociale], reachable at contact@zenkotrail.eu, is the controller for processing related to the website and user accounts.
For volunteer data entered in an event, the event organizer (club, association, committee) is the controller: they decide which data to collect and why. Zenko then acts as a processor under Article 28 of the GDPR and only processes that data to provide the service to the organizer.
2. The website
- No cookies are set and no advertising trackers are used.
- Audience measurement: we use Umami, self-hosted on our own server. It sets no cookies, does not store your IP address, does not follow you across other sites, and only produces aggregated statistics (page views, country, device type). This matches the consent exemption criteria of the CNIL, the French data protection authority. Your browser’s “Do Not Track” signal is honored.
- Technical logs: like any web server, ours temporarily records connection data (IP address, date, requested page) to keep the service secure. These logs are deleted automatically by rotation.
- Fonts are hosted on our server: no third-party services are called.
3. The application
Data processed
| People | Data | Purpose | Legal basis |
|---|---|---|---|
| Organizers | Email address, password (stored hashed, never in plain text) | Create and secure the account, provide the service | Performance of contract (terms of use) |
| Volunteers | First and last name and, if provided: email, phone, notes; shifts (checkpoint, role, times) | Organize the event on behalf of the organizer | Set by the organizer (usually legitimate interest or the volunteering commitment) |
| Volunteers with an account | Email address, hashed password | View their shifts, report incidents | Performance of contract (terms of use) |
| Everyone | Technical logs (IP address, date, request) | Security, abuse prevention, troubleshooting | Legitimate interest |
Cookies and local storage
The app uses a single, strictly necessary cookie to keep you signed in (HttpOnly, secure, valid for 7 days). It also keeps a few preferences in your browser (last opened event, selected race, theme). These are essential to the service and do not require consent.
Map tiles
To display the map, your browser downloads tiles from OpenStreetMap and OpenTopoMap servers, which receive your IP address in the process. No data about your event is sent to them.
4. Where is the data and who can access it?
Data is hosted by Hostinger International Ltd on a server located in Frankfurt am Main, Germany, in the European Union. It is never sold, rented or used for advertising. Only the publisher and the hosting provider (as technical processor) can access it. Within an event, data is visible only to its organizers and, for their own records, to registered volunteers.
5. How long?
- Account: as long as it is active, then deleted on request.
- Event data: until the organizer deletes it or deletes their account.
- Backups: 14 days, then deleted automatically.
- Technical logs: a few weeks at most, by automatic rotation.
- Audience statistics: aggregated and anonymous, kept indefinitely.
6. Security
Encrypted connections (HTTPS), hashed passwords, a database not exposed to the internet, key-only server access, automatic security updates and daily backups.
7. Your rights
You have the right to access, rectify, erase, restrict, port and object to the processing of your data. Write tocontact@zenkotrail.eu: we reply within one month.
Are you a volunteer? Your data was entered by the race organizer: contact them first. We will help them handle your request, or you can also write to us directly.
If you believe your rights are not respected, you can lodge a complaint with the CNIL:www.cnil.fr/fr/plaintes, or with your local data protection authority.
8. Organizers’ commitment
By entering their volunteers’ data, organizers commit to informing them, collecting only data useful to the event, and deleting it once it is no longer needed.
9. Changes
This policy may change, especially at the end of the beta. The last update date is shown at the top of the page. App users will be notified of any significant change.