Privacy Notice

Who we are

O-Entry is operated by Nae Blether Limited, company number SC904161, registered in Scotland. Our registered office is 5 South Charlotte Street, Edinburgh, EH2 4AN, Scotland. For the O-Entry service and account information, Nae Blether Limited is the data controller.

For information used to run an event, Nae Blether Limited and the organising Club are joint controllers. The Club decides to run the event and sets its event requirements; Nae Blether decides substantial parts of how O-Entry collects, stores, accesses and manages the information. For event-entry questions, contact the organising Club. For other privacy questions, email [email protected].

What information we use and why

Account information includes the identity-provider account ID, name and email address returned by Google or Microsoft. We use it to sign you in, manage your account and send account or invitation messages.

Athlete profiles and entries can include names, date/year of birth, sex, club and membership details, SI card number, course and start choices, contact details, student details, emergency-contact name and phone, volunteer choices, and booking, resource and payment status. We use these details to check eligibility and prices, take and manage entries, allocate event resources, prepare operational reports, contact entrants and reconcile payments.

We receive information directly from account holders and athletes, from people managing another athlete's profile or booking, from the sign-in provider you choose, and from the Club and payment services involved in an event.

Some details are needed to enter or administer an event. If required details are missing, O-Entry may be unable to validate or complete that entry.

We use information needed to provide your O-Entry account and requested event services, including entry, administration, payment and service messages, on the basis of contract (UK GDPR Article 6(1)(b)). We use information for event safety, emergency contacts, security, fraud prevention, audit and accountability, and keeping the service reliable on the basis of legitimate interests (Article 6(1)(f)).

Children and information entered by someone else

A parent, guardian, family member or other authorised representative may create or manage an athlete profile and enter someone else in an event. Information may therefore come from that person rather than directly from the athlete. Athlete-sharing lets invited representatives manage a shared profile after accepting an invitation. The person managing a profile should provide this notice to the athlete where appropriate and only enter information they are authorised to provide.

Junior details are used for age-related eligibility, course restrictions, pricing, starts and event safety, on the same contract and legitimate-interests bases described above. A parent, guardian or other authorised person can manage a child's details and entry through the same account and entry tools described above. The person doing so must be entitled or authorised to provide that information.

Medical information

Providing medical information is optional. A signed-in user or authorised athlete representative can save it on an athlete profile, change it or remove it. Saved profile medical information remains until changed or removed. When an entry is made, saved medical information is included in that event's copy by default, with an option to remove it for that event. Guest medical information is event-specific.

Medical information is collected so relevant details can be available in an emergency when needed to protect a competitor's vital interests and they cannot provide the information themselves, for example if they are unconscious, incapacitated or missing. This processing uses the vital-interests bases in UK GDPR Article 6(1)(d) and Article 9(2)(c). A competitor may not have supplied the information themselves; a parent, guardian or other authorised person may have provided it.

The application encrypts medical text before saving it to MongoDB. It is decrypted only when an authorised representative views profile information or an authorised event official uses the event medical-access flow. Individual event access requires a warning and explicit acknowledgement, creates a persistent audit record and queues a content-free notification to the athlete or representative and the organiser. Bulk medical-report access requires acknowledgement and audit, and notifies the organiser only. Completed-event access requires an additional deliberate acknowledgement. Failed notification delivery does not prevent legitimate emergency access; failed deliveries remain recorded for authorised retry. Medical text is not put in ordinary activity records, notifications or generic exports. Archiving preserves the event medical copy for controlled retention review. The application does not automatically remove saved profile medical information.

What event organisers can see

Authorised event roles can see the entry and operational details needed for their work, such as participants, starts, maps/resources, SI hire, parking, volunteer offers and relevant contact details. Finance roles can access payment information. Medical details are restricted to authorised medical roles and use a separate deliberate-access flow. Reports are role-controlled; ordinary operational reports do not include decrypted medical details.

Payments

Paid entries use the organising Club's configured Stripe account and Stripe Checkout. Card-entry and card processing take place on Stripe's hosted payment flow. O-Entry stores payment references, amount, currency and status to associate payment with an entry and reconcile it; the application code does not collect or store card numbers or security codes. Stripe processes payment information under its own service terms and privacy information.

Signing in with Google or Microsoft

When you choose Google or Microsoft, that provider authenticates you and returns an account identifier and profile claims such as your name and email. O-Entry stores the provider identity with your account. We do not automatically join separate Google and Microsoft identities just because their email addresses match. The provider handles its own sign-in data under its privacy terms.

Emails and service messages

O-Entry sends service messages such as entry confirmations, event updates, account and sharing invitations, volunteer-related notices and medical-access notifications. System account messages use a configured Gmail API mailbox. Event messages can use the organising Club's configured Gmail mailbox. Recipient addresses and delivery/message references may be recorded for operation and troubleshooting. These are service communications; the application has no advertising or marketing-email workflow.

Who processes information for us

O-Entry uses MongoDB Atlas to store application records. Stripe provides hosted checkout and payment processing. Google and Microsoft provide sign-in; Google Gmail API and configured Club Gmail accounts send email. A hosting provider runs the O-Entry service. Each provider processes information needed to deliver its service and under its own service terms and privacy information.

We deliberately host the O-Entry application and its database in the EU. O-Entry's stored application data is held within the UK/EU. Some identity, email and payment services may process information outside the UK/EU; where required, appropriate international-transfer arrangements are used. Internet traffic travelling to or from O-Entry may pass through networks in other jurisdictions, and we cannot determine the physical route taken by each connection.

How long information is kept

A System Administrator controls retention reviews and any deletion or anonymisation of event records. Records are preserved pending a controlled review; archiving does not automatically delete information. Financial records may need to be retained for at least seven years. The organising Club may also need records for insurance, safeguarding or accounting purposes.

We keep account and athlete-profile information while it is needed to provide the O-Entry account and profile service. Saved profile medical information remains until changed or removed by an authorised user. Event-specific medical information is preserved when an event is archived. Any retention review or deletion is controlled by a System Administrator. Invitations and temporary resource holds expire; expiry of a temporary item does not itself erase related booking history.

Cookies, browser storage and analytics

O-Entry uses an essential session cookie to keep you signed in and protect requests. The configured session cookie is HttpOnly and uses secure transport outside development/test, with SameSite=Lax. The application code reviewed for this notice does not use advertising analytics or store medical information in browser storage.

Your choices and rights

You can edit many saved athlete details, remove saved profile medical information, manage athlete sharing and choose whether to include saved medical information in a new event entry. You may also have rights to ask for a copy, correction or deletion, to restrict or object to certain uses, or to request transfer of information. Which rights apply depends on the lawful basis and the responsible controller. Some historic booking or financial records may need to be retained; erasure requests are handled case by case rather than through an automatic self-service deletion tool.

If you gave consent for a particular use, you can withdraw it. To exercise a right, contact the relevant organisation using the privacy contact above or ask the organising Club about event-entry information. You can complain to the UK Information Commissioner's Office at https://ico.org.uk/make-a-complaint/.

Automated decisions and profiling

O-Entry automatically checks submitted details, calculates prices and checks eligibility and resource availability to support an entry. It does not make decisions about you solely by automated processing that produce legal or similarly significant effects, and it does not build marketing profiles.

Changes to this notice

We will update this page when O-Entry's information handling changes. Check the date at the top for the latest version.