288 lines
15 KiB
HTML
288 lines
15 KiB
HTML
|
|
<h2>Personal information collection</h2>
|
|
<p>
|
|
At rowsandall.com we take your privacy very seriously.
|
|
In order to provide access
|
|
to the service we must collect and store some personal information about you.
|
|
</p>
|
|
|
|
<p>
|
|
Childen under 16 years of age are not permitted to access the services provided
|
|
by rowsandall.com. By agreeing to this privacy policy you are also agreeing
|
|
that you are 16 years of age or older.
|
|
</p>
|
|
|
|
<p>
|
|
What is collected? Rowsandall.com may collect and use the following kinds of information:
|
|
<ul>
|
|
<li>information about your use of this website
|
|
<li>information that you provide for the purpose of
|
|
registering with the website
|
|
<li>information about transactions carried out over this website
|
|
<li>information that you provide for the purpose of
|
|
using this website, for instance heart rate band and weight information.
|
|
<li>any other information that you send to rowsandall.com
|
|
</ul>
|
|
</p>
|
|
|
|
<p>
|
|
Basic profile information is collected from you when you create your account including your full
|
|
name and email address. As you use the site, information about the users, workouts,
|
|
charts and other resources you interact with will also be stored and linked to
|
|
your profile information.
|
|
</p>
|
|
|
|
<p>
|
|
Explicitly, the following information is collected:
|
|
<ul>
|
|
<li>User name, email address, encrypted password (PBKDF2 algorithm
|
|
with a SHA256 Hash and a password stretching mechanism recommended
|
|
by NIST).
|
|
<li>Your birth date.
|
|
<li>Your user consent to these GDPR compliance policies, and the
|
|
date at which you consented. Without this consent, the site cannot
|
|
be used.
|
|
<li>Weight category. With individual workouts, you may record your
|
|
actual weight during the workout.
|
|
<li>Your gender, if you decide to provide it.
|
|
<li>Heart rate zones you define. Only the actual values are stored. We do
|
|
not keep records of their evolution.
|
|
<li>Power zones and Functional Threshold power. Only the
|
|
actual values are stored. We do
|
|
not keep records of their evolution.
|
|
<li>Parameter values used to construct your Critical Power curve
|
|
(OTW and OTE).
|
|
<li>User preferences, such as the buttons and functionalities
|
|
defined in the Workflow left
|
|
panel and right panel.
|
|
<li>Tokens and their expiry dates used for sharing data with
|
|
other fitness sites. You can actually revoke these at any time.
|
|
<li>User preferences as shown on the user settings page
|
|
<li>Your favorite Flex Charts if defined
|
|
<li>The teams you are a member of.
|
|
<li>Estimated four minute, 2k and 1 hour ergometer and OTW power values,
|
|
based on the workouts you upload, and their evolution during your
|
|
usage of the site
|
|
<li>For members on the Coach plan, the names and purposes of teams. Names
|
|
of team members. (Members who delete their account will be erased from
|
|
existing teams.)
|
|
<li>Any rowing courses you uploaded
|
|
<li>Training targets and training plans
|
|
<li>Your uploaded workouts, their names, boat type, start time and date,
|
|
time zone information, total distance, duration, weight, average
|
|
and maximum heart rate, and references to their locations on third
|
|
party sites, rigging parameters (if provided),
|
|
summary information, any notes you made, privacy status and
|
|
ranking piece status.
|
|
<li>Stroke data, including, for each stroke, time, heart rate,
|
|
pace, stroke rate, work per stroke, power, average and peak
|
|
force, drive length, distance, drive speed, catch and finish angles,
|
|
slip, wash, peak force angle, effective angle, rhythm,
|
|
efficiency and distance per stroke, as well as any other
|
|
data in the data files you shared to rowsandall.com
|
|
<li>Images created on the site, from your rowing data, or uploaded
|
|
to the site.
|
|
<li>Comments you make to your and other people's workouts
|
|
</ul>
|
|
</p>
|
|
|
|
|
|
<h2>Who can I contact?</h2>
|
|
|
|
<p>
|
|
The data protection officer for rowsandall.com is Sander Roosendaal and he may be contacted
|
|
at support@rowsandall.com.
|
|
</p>
|
|
|
|
<h2>Notifications and Email Policy</h2>
|
|
|
|
<p>
|
|
Some actions on the site result in an individual email sent to you.
|
|
</p>
|
|
|
|
<p>
|
|
We will rarely use mass email to communicate to all our users. These cases
|
|
are limited to substantial changes in terms and conditions and other
|
|
announcements impacting the terms on which you use the site. We will
|
|
it is important to get these messages to you. If you do not with
|
|
to receive such emails, you can indicate so in the user settings ("Get
|
|
Important Emails" under "Account Information").
|
|
</p>
|
|
|
|
<p>
|
|
Other site related communication (new features, outages, bugs,
|
|
price changes) are communicated through announcements on the
|
|
website, throught Twitter, Facebook and our blog
|
|
posts.
|
|
</p>
|
|
|
|
<h2>Data Deletion</h2>
|
|
|
|
<p>If you have previously consented to allow rowsandall.com to store and process your personal
|
|
data in accordance with this privacy policy, and you wish to withdraw your conent,
|
|
you can do one of the following:
|
|
<ul>
|
|
<li>Send an email to support@rowsandall.com requesting to withdraw consent and remove your data
|
|
<li>Delete your account using the red button on the user settings page.
|
|
</ul>
|
|
</p>
|
|
|
|
<p>All the data mentioned in the previous section are stored in files
|
|
and in a database, hosted on our hosting provider's servers. Our
|
|
hosting provider is creating backups of those data. The database backups
|
|
are retained for 7 days. File backups are retained for 30 days. However,
|
|
the file names or content do not contain any links to the users. The
|
|
link to the file is stored under the user data in the database, so once
|
|
a database entry is removed, there is no way to link a file with data
|
|
to a particular user.
|
|
</p>
|
|
<p>
|
|
When a user requests deletion of the data, his account and all data linked to his account
|
|
are removed from the database and the files are deleted. This includes all data mentioned in the
|
|
previous section. In backups, database entries will be removed after 7 days and files after
|
|
30 days.
|
|
</p>
|
|
|
|
<p>Data deletion can be initiated by the user through the button on the user settings page.</p>
|
|
|
|
<h2>Data Security</h2>
|
|
|
|
<p>The site uses SSL to encrypt data transferred between the server and the client (web browers,
|
|
mobile apps, third party sites). Any forms are secured from Cross Site Request Forgery (CSRF) using Django's
|
|
CSRF middleware.</p>
|
|
|
|
<p>
|
|
We have a double defense against reading or editing of personal data. First, we ensure that all "protected" views
|
|
are only visible to logged-in users. Only logged-in users have buttons leading to the private parts of the site.
|
|
As a second step, protecting against guessing of URL, before serving data from the database, we check explicitly that the data
|
|
is owned by the user in question, redirecting unauthorized requests to a "Permission Denied" page. Private data is collected
|
|
through POST requests to prevent them from being visible in URL data.
|
|
</p>
|
|
|
|
<p>rowsandall.com will take reasonable technical and organisational precautions to prevent the loss,
|
|
misuse or alteration of your personal information. </p>
|
|
|
|
<p>In case of loss, misuse or alteration of your personal information, we will inform you without undue delay and take measures
|
|
to prevent further misuse. In particular, we will deactivate your account, which will not delete the data but make them
|
|
inaccessible even for people who obtained the password (including yourself). We will await your instructions. If no
|
|
instructions are received within 7 days of contacting you, your account and all your data will be removed.
|
|
</p>
|
|
|
|
|
|
<h2>Who is my data shared with?</h2>
|
|
|
|
<p>
|
|
Only the data owner and the site administrator can edit and/or delete the data. Per our data policy, the site administrator will not alter
|
|
or delete any data owned by users, unless requested so. As data are not stored on servers that are physically owner by us, or by
|
|
our hosting provider, but we use rented server space, we are technically sharing the information to agents or sub-contractors.
|
|
</p>
|
|
|
|
<p>
|
|
Where rowsandall.com discloses your personal information to its agents or sub-contractors for these purposes,
|
|
the agent or sub-contractor in question will be obligated to use that personal information in accordance with the terms of this privacy statement.
|
|
Our hosting provider is based in the European Union and is bound by the same GDPR regulation as we are.
|
|
</p>
|
|
|
|
<p>In addition to the disclosures reasonably necessary for the purposes identified elsewhere above, rowsandall.com
|
|
may disclose your personal information to the extent that it is required to do so by law, in connection with
|
|
any legal proceedings or prospective legal proceedings, and in order to establish, exercise or defend its legal rights.</p>
|
|
|
|
|
|
<p>
|
|
Workout data and charts based on workout data can be shared to anyone by sharing the URL. Workouts have an option to be set to
|
|
"private", in which case the data are not visible to anyone except the owner. The site is not searchable for data other than
|
|
your own data, so there is no way for other people to track your workouts, unless you share them.
|
|
</p>
|
|
|
|
<p>
|
|
Cross-border data transfers. Information that rowsandall.com collects may be stored and processed in and transferred
|
|
between any of the countries in which rowsandall.com operates to enable the use of the information in accordance with this privacy policy.
|
|
In addition, personal information that you submit for publication on the website will be published on the internet and
|
|
may be available around the world.
|
|
You agree to such cross-border transfers of personal information.
|
|
</p>
|
|
|
|
<h3>Team Functionality</h3>
|
|
|
|
<p>
|
|
On rowsandall.com, users with the paid "Coach" plan can establish teams and invite other users to become part of the team. The purpose
|
|
of a team is to share workout and training plan data between the coach and the team members. In terms of sharing behavior, there are two types of teams:
|
|
<ul>
|
|
<li>"All Members" - This is the default team type. All members can see workouts of all other members, except those workouts that the members have
|
|
marked as "private".
|
|
<li>"Coach Only" - With this setting, each individual team member is sharing his workout data only with the team manager. Other members cannot see
|
|
his workouts.
|
|
</ul>
|
|
The sharing behavior is chosen by the team member when he establishes the team and can be changed during the existence of the team.
|
|
</p>
|
|
|
|
<p>
|
|
By accepting an "invitation" to become a member of a team, or by requesting to become part of a team, you agree to automatically
|
|
share all your workout data (including workouts done prior to becoming a member of the team) to the team manager (coach) and,
|
|
depending to the team policy, to other members of the team. When you leave
|
|
a team, all your workout data will immediately become invisible to those who had access to it during your team membership, including
|
|
workouts that cover the period of time when you were member of the team. As a member of a team, you grant the team manager
|
|
permission to edit workout data
|
|
on your behalf, including the creation of charts and cross workout analysis. You also grant the team manager permission to
|
|
edit your heart rate and power settings, as well as functional threshold information and the account information accessible on your
|
|
settings page under the header "Account Information". The team manager is not able to access or change your passwords, team memberships,
|
|
favorite charts, export settings, workflow layout, or secret tokens. Also, the team manager is not able to download all your data,
|
|
not can he deactivate or delete your account.
|
|
</p>
|
|
|
|
<p>
|
|
Each team member is bound by this privacy policy and the GDPR regulation of the European Union regarding the personal data of other team
|
|
members that he has access to. By accepting an invitation to a team, the new member agrees to limit the use of these data strictly to the
|
|
allowed use according to this privacy policy and the GDPR.
|
|
</p>
|
|
|
|
<p>
|
|
Team managers can access requests of users to be added to one of their teams. By accepting the invitation, the manager accepts the responsibilities
|
|
and duties associated with access to personal data of the new team member. He is bound by this privacy policy and the GDPR regulation
|
|
of the European Union regarding the personal data that he has access to.
|
|
</p>
|
|
|
|
<p>
|
|
In case that a team manager wants to change the sharing behavior of one of his teams from "Coach Only" to "All Members", he has to inform all
|
|
impacted team members in due time. He shall give team members a minimum of three days to decide whether they agree with the new sharing policy, and
|
|
collect the consent of the team members with the new sharing policy. The team manager must remove team members who did not give their active consent
|
|
to the new policy from his team. If a team member has not responded within 7 days of being notified, the team manager will understand this as "no consent"
|
|
and remove the team member.
|
|
</p>
|
|
|
|
<p>
|
|
When notified of a change in team sharing behavior by the team manager, the team member has to decide whether he agrees. In case of disagreement, he shall
|
|
revoke his team membership within less than 7 days of being notified.
|
|
</p>
|
|
|
|
<h3>Third Party Sharing</h3>
|
|
|
|
<p>
|
|
This site offers the possiblity to synchronize your data with other fitness sites. By clicking on the share or connect button (link, or
|
|
equivalent) you agree to share information between rowsandall.com and the other website. Rowsandall.com is not responsible for the privacy
|
|
policies or practices of any third party. Sharing the data to third party sites is at your own risk and you should ensure that the third party
|
|
has suitable GDPR compliant measures in place.
|
|
</p>
|
|
|
|
<h2>Inactive Users - accounts are deleted after 18 months</h2>
|
|
|
|
<p>
|
|
If a user is not active on the site for 12 months, we will make deactivate the account. After 18 months, the account is deleted.
|
|
</p>
|
|
|
|
<h2>Duration of consent</h2>
|
|
|
|
<p>
|
|
The data will be retained for the duration of the owner's membership, or 18 months after the user's last activity on the site.
|
|
</p>
|
|
|
|
<h2>Data portability</h2>
|
|
|
|
<p>Through the "download your data" link on the user settings page, each user can download all workout data. Stroke data can be downloaded
|
|
through links in the downloaded workout data file.</p>
|
|
|
|
<p>Your personal data are shown on the user settings page. Send an email to support@rowsandall.com if you wish to obtain a full record of all the personal data
|
|
relating to you that has been collected in accordance with this privacy policy.
|
|
</p>
|
|
|