Privacy policy
Last updated: 12/10/2026
This is a translation. In case of discrepancy, the Spanish version prevails.
1. Data controller
- Controller: Asier Ogiza, on behalf of Cuadrilla Edurre (organiser of Basauri Motorday).
- Town: Basauri (Bizkaia)
- Email: basaurimotorday.edurre@gmail.com (also to exercise your rights).
We process your data in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
2. What data we process
- Account data: name, surname, email, phone and password (encrypted; we never see it).
- Registration data: ID number (DNI), vehicle details (make, model, year, plate, colour, engine, power, modifications), vehicle photos, t-shirt size and answers to the fields each activity asks for.
- Payment data: the bank-transfer receipt you upload, the amount and its status. We do not take card payments or store card details.
- Event-day data: check-in time, t-shirt pick-up and the staff member who recorded it.
- Contributing photographer profile: name, surname, Instagram, Facebook, email and phone, and the photos they upload.
- Technical data: IP address, browser and a log of relevant actions (logins, changes, errors), for security.
- Browsing data: only if you accept analytics cookies (see the Cookie policy).
We only accept users aged 18 or over (taking part with a vehicle requires a driving licence). If we detect an account belonging to a minor, we will delete it.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and managing your account. | Performance of the relationship you request (art. 6.1.b). |
| Managing your registration: review, payment request and verification, QR accreditation, check-in and t-shirt pick-up. | Performance of the registration contract (art. 6.1.b). |
| Managing shop orders (t-shirts). | Performance of the purchase contract (art. 6.1.b). |
| Emailing you about your registration, your order and event changes. | Performance of the contract (art. 6.1.b). |
| Publishing your vehicle's photos and make/model (and your name next to the car) on the Website and the event's social media. | Your consent when registering (art. 6.1.a). You may withdraw it at any time. |
| Photographing and filming the event and sharing those images, in which attendees and vehicles may appear. | Legitimate interest in promoting the event (art. 6.1.f). You may object and ask us to remove an image. |
| Publishing contributing photographers' profiles next to their albums: name, surname, social media and, only if they choose to, email and phone. | Their consent when creating the profile (art. 6.1.a). They can change what is shown or withdraw the profile from their panel. |
| Website security, fraud prevention and troubleshooting. | Legitimate interest (art. 6.1.f). |
| Website usage analytics (Microsoft Clarity). | Your consent via the cookie notice (art. 6.1.a). |
| Keeping payment records. | Compliance with legal obligations (art. 6.1.c), where applicable. |
We do not use your data for automated decision-making or profiling, and we do not sell or share it for commercial purposes.
4. How long we keep it
We keep your data while you keep your account and for no more than 2 years after your last participation in an event, to manage future editions. You can ask us to delete it sooner at any time. Payment records are kept for as long as applicable law requires. Technical security logs are deleted periodically.
5. Who we share it with
We do not disclose your data to third parties unless legally required. To provide the service we use providers that process data on our behalf (processors):
- IONOS (server hosting, European Union).
- Google (sending emails via Gmail).
- Microsoft (Clarity analytics; only if you accept it).
If you accept external content, Google (Maps, YouTube) and the Instagram feed provider (SociableKit / Meta) will also receive browsing data. Some of these providers may process data outside the European Economic Area; when they do, they rely on appropriate safeguards such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
What is published on the Website (vehicle photos and details, your name next to the car, photo albums with their photographer's profile) is visible to any visitor. Every album photo has a «Pedir retirada» (request removal) link to ask us to take it down.
6. Your rights
You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent (for example, so we stop publishing your car photos), by writing to basaurimotorday.edurre@gmail.com and stating which right you are exercising. We may ask for additional information to verify your identity.
You can correct much of your data yourself from "My account". If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
7. Security
We apply reasonable technical and organisational measures: encrypted connection (HTTPS), encrypted passwords, data access limited to the organisation staff who need it, and backups.
8. Changes
We may update this policy. If the change is significant, we will let you know by email or with a notice on the Website.