PRIVACY
POLICY.
Last updated:
This Policy explains how personal data is processed on The 24 Club by Correr Lisboa website and platform, including accounts, digital passports, activity validation and, where applicable, physical-kit purchases and the Hall of Fame.
The 24 Club is designed around data minimisation, transparency and privacy by design. Full routes and exact start and finish locations are not made public.
1. Data controller
The controller is Bruno Manuel Claro, owner of the registered Correr Lisboa trade mark, Portuguese tax number 207 370 524, acting in the course of his business activity. The 24 Club is a project by Correr Lisboa.
Associação Correr Lisboa, Portuguese tax number 513 203 206, may collaborate on initiatives, training sessions or events. Where it independently determines the purposes and means of processing, specific information will be provided in the context of that initiative.
- Telephone
- +351 928 381 644
2. Data we process
We process only data appropriate to the features you use:
- Account and profile: name, public name, email, password stored only as a secure hash, member number, language, consents and preferences.
- Challenge and progress: selected parishes, submitted activities, date, distance, file source, candidate parish, validation result, conquests, reviews and milestones.
- GPS data, when upload is enabled: GPX file, route, start and finish coordinates, distance within boundaries and technical integrity indicators required for validation.
- Physical-kit purchases: kit type, eligibility, t-shirt size, data needed for the passport or physical certificate, personalisation, billing, payments, delivery and transactional messages. Full card details will not be stored by The 24 Club.
- Exclusive member ranking, only at the participant’s option: public name or alias, member number and progress metrics strictly needed for the displayed position.
- Hall of Fame, only at the participant’s option: public name, member number, completion date and duration, photograph, favourite parish and personal statement.
- Support and security: messages, IP, date and time, browser, session, authentication and events required to prevent abuse.
We do not request health data for participation. Do not include health information or third-party data in files, photographs or messages unless strictly necessary and requested through an appropriate channel.
3. Data sources
Data is supplied by the participant, generated through platform use or received from an integration the participant chooses to connect, such as Garmin when available. Connecting an integration will always be initiated and authorised by the data subject.
4. Purposes and legal bases
- Creating and managing an account, receiving activities, validating criteria and maintaining the digital passport: performance of the Terms and pre-contractual steps.
- Managing eligibility and orders for physical kits, billing, tax duties and consumer requests: contract performance and legal obligations.
- Protecting accounts, detecting fraud, GPX manipulation and abuse, maintaining security and defending legal claims: the controller’s legitimate interests, balanced against participant rights.
- Sending service communications: contract performance or the legitimate interest in keeping the service operational.
- Marketing, member-ranking participation, Hall of Fame publication, use of a photograph or optional integrations: consent, which may be withdrawn at any time without affecting prior processing.
- Handling requests and valid authority demands: legitimate interest, contract or legal obligation, as applicable.
5. Conquest validation
When the validation engine is available, an activity will be compared with official civil-parish boundaries and the published criteria. The system may automatically produce a candidate parish and a technical result.
This validation does not produce legal or similarly significant effects. If you believe it is wrong, you may request human review through the contact in this Policy. The relevant outcome and criteria will be explained clearly.
6. Sharing and processors
Data may be processed by hosting, database, storage, email, security, technical support, payment or integration providers, only as necessary and under confidentiality and data-protection obligations.
Data may also be disclosed to authorities where required by law or a valid order. We do not sell personal data. Opening a social-media or external-service link is subject to that third party’s policy.
7. International transfers
We favour providers that process data in the European Economic Area. Where a provider involves an international transfer, legally required safeguards will be used, such as an adequacy decision or standard contractual clauses and, where needed, supplementary measures. You may request information about the applicable safeguard.
8. Public information and location privacy
Personal progress and activities are private by default. The public map never displays full routes, addresses, start or finish coordinates or unauthorised activity data.
Hall of Fame inclusion is optional and requires specific authorisation. The exclusive ranking is visible only to authenticated members and participation is also optional. In both cases, participants choose the displayed name and may withdraw authorisation; removal will occur within a reasonable time, subject to temporary cached copies.
9. Retention
- Account, profile, conquests and progress summary: while the account is active; accounts inactive for 24 months may be deleted after reasonable notice where possible.
- GPX files and detailed routes: until validation is final and the challenge period has elapsed, up to 12 months after submission, unless a dispute, integrity investigation or legal duty applies.
- Technical outcome and conquest record: for the life of the account, to maintain the digital passport.
- Support and review requests: up to 24 months after a request is closed.
- Technical and security logs: up to 12 months, unless an incident or legal defence requires longer.
- Billing and transaction data: for the period required by tax and accounting law.
- Evidence of consent, accepted legal versions and objections: as long as necessary to demonstrate compliance and defend rights.
- Backups: scheduled to rotate within 90 days after deletion from the live system.
At the end of the applicable period, data is deleted or irreversibly anonymised. A legal duty, dispute or investigation may justify strictly necessary additional retention.
10. Security
We apply technical and organisational measures appropriate to risk, including secure password hashing, encrypted production communications, access control, prepared queries, CSRF protection, security logs and minimised exposure of location data. No system is infallible; incidents are assessed and notified as legally required where applicable.
11. Your rights
You may request access, rectification, erasure, restriction, portability or objection, withdraw consent and request review of a validation. Exercising rights is free unless a request is manifestly unfounded or excessive, and reasonable identity confirmation may be required. We respond within the statutory period.
12. Children
Independent account creation is intended for people aged 18 or over. A minor should participate only with the authorisation and supervision of a legal representative, who may exercise the applicable rights. We do not knowingly collect children’s data without that involvement.
13. Cookies and changes
Current cookie use is described in the Cookie Policy. This Policy may be updated for new features or legal changes. Material changes will be communicated appropriately and the date at the top of the page will be updated.