Puerto Rico Cycling

Privacy Policy

Last updated: May 2026

Draft notice. This document is a starting template. It is not legal advice and must be reviewed by a Puerto Rico–licensed attorney before publishing — particularly for compliance with the Puerto Rico Information Privacy Act (Law 39-2012) and any US state privacy laws (CCPA/CPRA, etc.) that apply to your buyers.

This Privacy Policy describes how Puerto Rico Cycling ("we," "us") collects, uses, and shares personal information when you use the Puerto Rico Cycling ticketing platform (the "Platform"). By using the Platform you consent to the practices described here.

1. Information We Collect

Information you give us directly. When you create an organizer account, register for an event, or purchase a ticket we collect your name, email address, phone number (where required), event-specific form responses, and any payment-related details that are passed through to our payment providers.

Information from your device. We automatically collect technical data such as your IP address, browser type, device identifiers, referring URL, pages visited, and timestamps. This information is used for security, debugging, and aggregate analytics.

Information from third parties. When you pay through Stripe or ATH Móvil, those providers send us limited transaction metadata (transaction id, payment status, partial card info such as the last four digits and brand). We do not store full card numbers.

2. How We Use Information

We use the information to:

  • Operate the Platform — create accounts, list events, sell tickets, send confirmations and tickets, manage attendees, and provide support.
  • Process payments through our providers and verify transactions.
  • Send transactional emails (confirmations, receipts, organizer notifications) related to your activity. We do not send marketing email without your separate opt-in.
  • Detect, prevent, and respond to fraud, abuse, or violations of our Terms.
  • Comply with legal obligations, court orders, or lawful requests.
  • Improve the Platform, including aggregated usage analytics.

3. Sharing of Information

We share personal information only as necessary to operate the Platform:

  • Event organizers receive the registration data of buyers who register for their events (name, email, tier, registration form responses, payment method label, payment timestamp). Organizers are independent data controllers for the data they receive and are responsible for their own privacy practices.
  • Payment processors — Stripe, Inc. and Evertec / ATH Móvil — receive the data required to process payments and verify transactions.
  • Email and infrastructure providers — Amazon Web Services (Simple Email Service, S3, CloudFront) and our hosting providers — process data on our behalf as service providers under written agreements.
  • Mapping providers — Google LLC (Google Maps Embed and Places APIs) — receive the venue address you publish so the public event page can show a map and directions.
  • Government, legal, and regulatory authorities — when required by law or to protect our rights.

We do not sell personal information.

4. Cookies and Similar Technologies

We use first-party cookies (and equivalent storage) for session management and security. We use limited third-party scripts from Google Maps when you view an event location. We do not use advertising cookies.

5. Data Retention

We retain account, event, and registration data for as long as the account is active and as necessary to operate the Platform, comply with our legal obligations, resolve disputes, and enforce our agreements. You can request deletion as described below.

6. Security

We use industry-standard administrative, technical, and physical safeguards to protect personal information, including encryption in transit (HTTPS), encryption at rest where supported, role-based access, and audit logging. No system is perfectly secure, and we cannot guarantee absolute security.

7. Your Rights

Depending on where you live, you may have the right to:

  • Request access to the personal information we hold about you.
  • Request correction of inaccurate information.
  • Request deletion of your information (subject to our legal record- keeping obligations).
  • Opt out of certain disclosures.

Buyers in Puerto Rico have rights under the Puerto Rico Information Privacy Act (Law 39-2012). California buyers have rights under the CCPA/CPRA. To exercise any of these rights, contact us at the address below.

8. Children's Privacy

The Platform is not directed to children under 13 and we do not knowingly collect personal information from anyone under 13. Some events may have minimum ages set by the organizer; the organizer is responsible for collecting parental consent where required.

9. International Transfers

The Platform is hosted in the United States (Amazon Web Services). By using it, you understand that your information is processed in the US.

10. Changes to this Policy

We may update this Privacy Policy from time to time. The "Last updated" date above reflects the most recent change. Material changes will be communicated via email to account holders or through the Platform.

11. Contact

To exercise your rights, ask questions, or report a concern, contact us at [contact email] or by mail at [mailing address].