Privacy · The 24 Club

1. Data controller

The controller is Bruno Manuel Claro, owner of the registered Correr Lisboa trade mark, Portuguese tax number 207 370 524, acting in the course of his business activity. The 24 Club is a project by Correr Lisboa.

Associação Correr Lisboa, Portuguese tax number 513 203 206, may collaborate on initiatives, training sessions or events. Where it independently determines the purposes and means of processing, specific information will be provided in the context of that initiative.

Email: geral@correrlisboa.com
Telephone: +351 928 381 644

2. Data we process

We process only data appropriate to the features you use:

Account and profile: name, public name, email, password stored only as a secure hash, member number, language, consents and preferences.
Challenge and progress: selected parishes, submitted activities, date, distance, file source, candidate parish, validation result, conquests, reviews and milestones.
GPS data received through GPX or an authorised integration: route, start and finish coordinates, distance within boundaries and technical integrity indicators required for validation.
Starter Kit purchases: eligibility, official black T-shirt size, data needed for the passport, personalisation, billing, payments, delivery of the initial kit components, organisation of the later Finisher T-shirt handover at the closing event and transactional messages. Full card details will not be stored by The 24 Club.
Challenge rankings: after the first approved conquest, public name or alias, participant number where available, and progress metrics strictly needed for the partial or total position shown. Membership is not required for these general rankings.
Hall of Fame, only at the participant’s option: public name, member number, completion date and duration, photograph and personal statement.
Digital certificate, after all 24 conquests: public name, member number, completion and issue dates, and a random validation code. Anyone holding the code can verify the certificate on a public page without accessing routes or activities.
Digital Finisher member card: locally creates a QR Code from the certificate’s random code. When shown in store, anyone scanning the QR can confirm on a public page the current card status, public name, member number and completion date. The QR does not disclose email, routes, coordinates or activities.
Support and security: messages, IP, date and time, browser, session, authentication and events required to prevent abuse.

We do not request health data for participation. Do not include health information or third-party data in files, photographs or messages unless strictly necessary and requested through an appropriate channel.

3. Data sources

Data is supplied by the participant, generated through platform use or received from an integration the participant chooses to connect, such as Garmin. Connecting an integration is always initiated and authorised by the data subject and can be disconnected in the personal area.

4. Purposes and legal bases

Creating and managing an account, receiving activities, validating criteria, maintaining the digital passport and showing the general challenge rankings to authenticated participants: performance of the Terms and pre-contractual steps.
Managing Starter Kit eligibility and orders, billing, tax duties and consumer requests: contract performance and legal obligations.
Protecting accounts, detecting fraud, GPX manipulation and abuse, maintaining security and defending legal claims: the controller’s legitimate interests, balanced against participant rights.
Sending service communications: contract performance or the legitimate interest in keeping the service operational.
Sending occasional progress reminders or marketing, joining a future exclusive member ranking, Hall of Fame publication, use of a photograph or optional integrations: consent, which may be withdrawn at any time without affecting prior processing. Journey reminders can be disabled in the profile.
Handling requests and valid authority demands: legitimate interest, contract or legal obligation, as applicable.

5. Conquest validation

When the validation engine is available, an activity will be compared with official civil-parish boundaries and the published criteria. The system may automatically produce a candidate parish and a technical result.

This validation does not produce legal or similarly significant effects. If you believe it is wrong, you may request human review through the contact in this Policy. The relevant outcome and criteria will be explained clearly.

6. Sharing and processors

Data may be processed by hosting, database, storage, email, security, technical support, payment or integration providers, only as necessary and under confidentiality and data-protection obligations.

When you connect Garmin, you are sent to Garmin authorisation and Garmin sends The 24 Club the activity totals and GPS data covered by the permissions granted. We do not receive your Garmin password, import laps or advanced training metrics, and you can disconnect the integration at any time.

When you choose to pay for the Starter Kit through the Payment Link, Stripe receives the details entered at checkout — email, tax number, selected size and information required for the payment method — together with an internal member reference used for reconciliation. The 24 Club does not receive or store full card details.

Data may also be disclosed to authorities where required by law or a valid order. We do not sell personal data. Opening a social-media or external-service link is subject to that third party’s policy.

7. International transfers

We favour providers that process data in the European Economic Area. Where a provider involves an international transfer, legally required safeguards will be used, such as an adequacy decision or standard contractual clauses and, where needed, supplementary measures. You may request information about the applicable safeguard.

8. Public information and location privacy

Personal progress and activities are private by default. The public map never displays full routes, addresses, start or finish coordinates or unauthorised activity data.

The partial and total challenge rankings are visible only to authenticated participants and automatically include active accounts after their first approved conquest, using the public name selected in the profile. They do not disclose email, routes, pace or coordinates. A future exclusive member ranking and Hall of Fame inclusion will require specific authorisation, which can be withdrawn in the profile.

9. Retention

Account, profile, conquests and progress summary: while the account is active; accounts inactive for 24 months may be deleted after reasonable notice where possible.
GPX files and detailed routes received by upload or integration: until validation is final and the challenge period has elapsed, up to 12 months after receipt, unless a dispute, integrity investigation or legal duty applies.
Technical outcome and conquest record: for the life of the account, to maintain the digital passport.
Support and review requests: up to 24 months after a request is closed.
Technical and security logs: up to 12 months, unless an incident or legal defence requires longer.
Billing and transaction data: for the period required by tax and accounting law.
Evidence of consent, accepted legal versions and objections: as long as necessary to demonstrate compliance and defend rights.
Backups: scheduled to rotate within 90 days after deletion from the live system.

At the end of the applicable period, data is deleted or irreversibly anonymised. A legal duty, dispute or investigation may justify strictly necessary additional retention.

10. Security

We apply technical and organisational measures appropriate to risk, including secure password hashing, encrypted production communications, access control, prepared queries, CSRF protection, security logs and minimised exposure of location data. No system is infallible; incidents are assessed and notified as legally required where applicable.

11. Your rights

You may request access, rectification, erasure, restriction, portability or objection, withdraw consent and request review of a validation. Exercising rights is free unless a request is manifestly unfounded or excessive, and reasonable identity confirmation may be required. We respond within the statutory period.

12. Children

Independent account creation is intended for people aged 18 or over. A minor should participate only with the authorisation and supervision of a legal representative, who may exercise the applicable rights. We do not knowingly collect children’s data without that involvement.

13. Cookies and changes

Current cookie use is described in the Cookie Policy. This Policy may be updated for new features or legal changes. Material changes will be communicated appropriately and the date at the top of the page will be updated.

14. Garmin Connect™ data

When a participant voluntarily connects Garmin Connect™, Garmin provides The 24 Club only with data covered by the permissions granted: technical connection and activity identifiers, activity name and type, date and time, duration, distance, device model when available, and GPS samples required for the route. We do not receive the Garmin password, health data, laps or advanced training metrics.

This data is linked to the participant’s The 24 Club account and processed solely to identify eligible runs or walks, confirm that the activity occurred after the challenge started, calculate total distance and distance inside the civil parish, check that start and finish are in the same civil parish, assess GPS quality and integrity, prevent duplicates, determine a conquest, and maintain the passport and review history.

Connection tokens are stored encrypted. Totals, technical outcomes and routes are stored in the service’s private database and infrastructure under access controls. Temporary webhook payloads are deleted after processing. The retention periods in section 9 apply to routes and records. Disconnecting Garmin or revoking permissions prevents future imports; deleting the account removes associated Garmin data unless retention is strictly required by law, a dispute or security needs.

Garmin transmits the data to The 24 Club. Hosting, database, storage, security, email or technical-support providers may process it only where necessary to operate and protect the service, under confidentiality and data-protection obligations. Garmin data is not sold, sent to Stripe or any other payment provider, or shared publicly. It may be disclosed to authorities only where required by law or a valid order.

Garmin data, including activities, totals, routes and coordinates, is not sent to or processed by OpenAI or any other external artificial-intelligence or machine-learning service. The AI assistant available in the backoffice is used only to prepare public editorial content about civil parishes and is isolated from accounts, activities and Garmin data.

Any future change to this Policy relating to Garmin data will be submitted to the Garmin Connect Developer Program team and implemented only after written approval, in addition to any notices and consent required by law.

Manage or disconnect Garmin