Privacy Policy
Last updated: 2 September 2026
Nederlandse versie: cyclingsoft.com/privacybeleid
1. Who we are and what this policy covers
CyclingSoft is a platform for the operational management of professional and amateur cycling teams, published by Exsited bv, Patrijsstraat 1, 8540 Deerlijk, Belgium, company number BE 0533.883.644 (“CyclingSoft”, “we”, “us”).
This policy applies to:
- the website cyclingsoft.com;
- the CyclingSoft mobile app for riders and staff (Android package
be.paxbase.rider, iOS: CyclingSoft); - the CyclingSoft web portals for teams, staff, partners and sponsors.
It explains what personal data we process, why, on what legal basis, how long we keep it, and how you can exercise your rights — including how to have your account and data deleted.
Contact for any privacy matter: get@cyclingsoft.com.
2. Our role: controller and processor
Our role differs depending on who you are, and this determines who you address your request to.
We are the controller for data we decide the purposes of ourselves: visitors to cyclingsoft.com, prospects and business contacts, demo requests, our own billing and support records, and account and security data of the users of our platform.
We are a processor for the data a cycling team, organisation or partner enters into the platform about its riders, staff and contacts — selections, contracts, equipment allocation, travel, medical records, communication. In that case the team is the controller: it decides why and how that data is used, and we process it only on its documented instructions under a data processing agreement (Art. 28 GDPR).
If you are a rider or staff member and your request concerns team data, you can always send it to us: we act on what we control, forward the rest to your team, and tell you the outcome of both.
3. What data we process
Visitors to cyclingsoft.com — IP address, device and browser type, pages viewed, referring source, and the data you enter in a contact or demo form (name, email, phone, team or company, message).
Customers and business contacts — name, professional contact details, role, company details, contract and billing data, correspondence and support history.
Users of the app and portals (riders, staff, partners) — name, email address, phone number, sign-in data and password (stored hashed), profile photo, date of birth, nationality, language, role and permissions within the team, and technical data such as device identifiers, push notification tokens, app version, session and access logs.
Operational team data (we act as processor) — depending on the modules a team uses: race programme and selections, availability, travel and accommodation details, equipment and fleet allocation, clothing and shoe sizes, licence and UCI administration, emergency contacts, contract and remuneration data, expense claims, internal messages and notifications, media and photographs.
Health data (we act as processor) — see section 4.
Partner and sponsor contacts — name, professional contact details, agreements, benefits and orders placed through the partner portal.
We do not sell personal data, and we do not use platform data to train AI models for other customers.
4. Health data
Some teams use CyclingSoft to record health-related information about their riders and staff: medical certificates and fitness-to-compete records, injuries and rehabilitation, allergies and dietary requirements, anti-doping administration such as whereabouts and TUE records, and comparable data.
This is a special category of personal data under Art. 9 GDPR. The following applies:
- The team is the controller. It determines what is recorded, who may see it, and on which legal basis (typically Art. 9(2)(b) or 9(2)(h) GDPR, in combination with the team’s obligations as an employer and under the rules of the UCI and the national federation, or the explicit consent of the person concerned).
- We act solely as processor and use this data only to provide the platform: storage, display to the users the team has authorised, and technical support.
- Access is restricted. Health data is visible only to the roles the team designates for it — typically a doctor, physiotherapist or performance manager, not the entire staff. Access is logged.
- Our own staff access it only where necessary for support or security, under confidentiality obligations, and never to consult individual records for any other purpose.
- If you want to know what health data your team holds about you, or want it corrected or removed, address your team as controller. We will support them and can be reached at get@cyclingsoft.com.
5. Why we process it, and on what basis
| Purpose | Legal basis |
|---|---|
| Providing the platform, app and portals | Performance of a contract (Art. 6(1)(b)) — with the customer team, or with you as a user |
| Processing data a team enters about its riders and staff | Processing on behalf of the controller (Art. 28), on the team’s basis |
| Account management, authentication, support | Performance of a contract (Art. 6(1)(b)) |
| Security, abuse and fraud prevention, logging | Legitimate interest (Art. 6(1)(f)) — keeping the platform secure |
| Invoicing and accounting | Legal obligation (Art. 6(1)(c)) |
| Improving and stabilising the platform, error analysis | Legitimate interest (Art. 6(1)(f)) |
| Website analytics and marketing cookies | Consent (Art. 6(1)(a)), via the cookie banner |
| Commercial communication to business contacts | Legitimate interest (Art. 6(1)(f)), or consent where required |
| Handling disputes and legal claims | Legitimate interest (Art. 6(1)(f)) |
6. Push notifications and app permissions
The app sends notifications about matters such as selections, schedule changes and messages. You can switch these off at any time in your device settings; that does not affect the rest of the app.
The app requests device permissions only for the features that need them — for example the camera to upload a profile photo, or storage to add a document. We ask for the permission at the moment the feature is used, and refusing it disables only that feature.
7. Who receives the data
We share personal data only with:
- the team or organisation you belong to, within the permissions it has configured;
- our processors, each bound by a data processing agreement:
- Combell NV, Skaldenstraat 121, 9042 Ghent, Belgium — hosting, storage and backups;
- Expo (650 Industries, Inc.) — delivery of push notifications to the app;
- Google Ireland Limited — Google Analytics 4 and Google Tag Manager, on the website only and only with your consent;
- third parties a team connects itself to the platform (for example a training or timekeeping system), on that team’s instructions;
- public authorities, where we are legally required to disclose.
Apart from these parties we do not engage any processors. We never sell personal data to third parties.
8. Where the data is stored, and international transfers
The platform, its data and its backups are hosted in Belgium, in the data centres of Combell NV. Two processors may process a limited set of data outside the European Economic Area: Google (analytics data from the website, only with your consent) and Expo (the technical delivery of push notifications). This takes place under the European Commission’s standard contractual clauses or the EU-U.S. Data Privacy Framework, together with additional safeguards. Team data, health data and the content of the platform itself do not leave the Belgian hosting environment.
9. How long we keep it
| Data | Retention |
|---|---|
| Account and profile data | For as long as the account is active, then deleted or anonymised within 30 days |
| Operational team data | For the term of the agreement with the team; after termination we return or delete it within 90 days, unless the team requests otherwise in writing |
| Health data | On the team’s instructions and within the periods it determines; deleted at the latest when the agreement ends, subject to statutory retention obligations |
| Invoicing and accounting records | 7 years (statutory tax retention) |
| Contracts and correspondence | Duration of the relationship plus 10 years |
| Security, access and fraud logs | 12 months |
| Support correspondence | Duration of the relationship plus 2 years |
| Website analytics | Maximum 26 months |
| Marketing contacts | Until consent is withdrawn, and at most 3 years after the last interaction |
| Data relating to an ongoing dispute | Until resolved, plus the statutory limitation period |
Anonymised, aggregated statistics that can no longer be traced back to a person fall outside these periods.
10. Security
We apply encryption in transit (TLS) and at rest, role-based access control with logging, separate environments for development and production, regular backups with restore testing, and confidentiality obligations for everyone with access. We assess new features for their privacy impact before release, and we report a personal data breach to the supervisory authority within 72 hours and inform affected persons where required.
11. Your rights
Under the GDPR you have the right to access your data (Art. 15), to have it corrected (Art. 16), to have it erased (Art. 17), to restrict processing (Art. 18), to data portability (Art. 20), to object to processing based on a legitimate interest (Art. 21), and to withdraw consent at any time (Art. 7(3)) without affecting the lawfulness of what happened before.
Send your request to get@cyclingsoft.com. We respond within 30 days. Where we have reasonable doubt about your identity we may ask for additional verification; we do not require a copy of your identity document as a matter of course.
Where your request concerns data your team entered, section 2 applies: we act on what we control and forward the rest to your team.
You also have the right to lodge a complaint with the Belgian Data Protection Authority, Drukpersstraat 35, 1000 Brussels, +32 (0)2 274 48 00, contact@apd-gba.be, www.dataprotectionauthority.be.
12. Deleting your account and data
You can delete your CyclingSoft account and the data associated with it at any time.
On the web — follow the instructions at cyclingsoft.com/delete-account.
By email — email get@cyclingsoft.com with the subject “CyclingSoft account deletion request”, stating the email address your account was created with.
We delete your account credentials, profile data, the data you entered in the app, and the technical identifiers linked to you (push tokens, device identifiers, session logs). We confirm your request within 5 working days and complete it within 30 days; backups still containing your data are overwritten within 90 days.
We retain what we are legally required to keep or need for an ongoing matter: invoicing and accounting records for 7 years, security and fraud logs for 12 months, and data relating to a dispute until it is resolved plus the statutory limitation period (Art. 17(3)(e) GDPR). Retained data is restricted and not used for any other purpose.
Where your account was created by your team, the team remains the controller for the data it manages. Send your request to us anyway: we delete your personal account and the data we control, forward the rest to your team, and confirm the outcome of both to you.
Full instructions: cyclingsoft.com/delete-account
13. Minors
Teams also use CyclingSoft for riders under 18. Where a team records data about a minor, it does so as controller and on its own legal basis, with the involvement of a parent or legal guardian where the law requires it. We do not knowingly collect data from minors through cyclingsoft.com outside a team context. If you believe we hold data about a minor that should not be there, contact get@cyclingsoft.com and we will act without delay.
14. Cookies
cyclingsoft.com uses necessary cookies for session, security and your cookie preference, and — only with your consent — analytics and marketing cookies. You can change or withdraw your choice at any time through the cookie settings on the site. The app itself does not use advertising cookies or tracking for advertising purposes.
15. Changes to this policy
We may amend this policy. The date at the top shows when it was last changed. For substantial changes we notify users of the app and the portals in the platform itself, or by email.
16. Contact
Exsited bv — Patrijsstraat 1, 8540 Deerlijk, Belgium — company number BE 0533.883.644
Email: get@cyclingsoft.com