Privacy Notice

Víctor Manuel Campos Vázquez, an individual operating the Brechear platform (brechear.com), is the controller of the personal data collected through the platform.

The controller's identity and address, for the purposes of article 15, section I of the Law, and for receiving written ARCO requests:

• Address: Cipreses 22, Fraccionamiento Cipreses de Mayorazgo, C.P. 72480, Puebla, Puebla, Mexico.
• Contact for anything privacy-related, including ARCO rights: hola@brechear.com
• Phone: we do not publish one yet. We would rather tell you that than show you a number nobody answers; write to the email address, and if you need us to call you, ask and we will.

Each event's promoter is a controller in their own right. When you register for an event or buy its tickets, the promoter receives your data and decides what to do with it to run their race: they are a separate controller, with their own privacy notice and their own obligations. Brechear does not answer for what they do with that data, and they do not answer for what we do. We explain this further below.

If you are a promoter or part of their team: name, email, password (stored only as a hash, never in the clear), your organization's name and public details, your role within it, and your Stripe account identifier once you connect it. The tax and identity data needed to get paid is collected and held by Stripe, not by Brechear.

If you sign in with Google: the stable identifier of your Google account (the `sub`), the email you linked it with, and your name as Google sends it. We do not store your profile picture, your password, or any Google access token. The first time you sign in with a verified email, earlier entries made with that same email are associated with your account so you can see your history.

If you are a racer and you register: first and last name, email, phone, date of birth, city, state and country, emergency contact (name and phone), vehicle details (make, model, year, number, co-driver, sponsor), class, race number, any custom fields the promoter added to their form, and — if the event requires one — the waiver evidence. If you are a minor, also your parent's or guardian's name and phone.

If you ride along as a passenger on a group ride: your name, whether you are a minor, your guardian's name when you are, and your signature and the date you accepted the waiver. Passengers are recorded within the vehicle's entry.

If the event has accident insurance: additionally your CURP, your date of birth, the name and relationship of the beneficiary you designate, the sum insured set by the policy, and the evidence of your consent (the text you accepted, your signature, the date, your IP address and your browser). See section 5.

If the event offers damage protection: your decision (taking it or declining it), the product and its amounts, the text you accepted, your signature, the date, your IP address and your browser. See section 6.

If you buy spectator tickets: the buyer's name, email and phone, the ticket tiers and quantities, and the QR codes issued.

For any purchase: the amount, currency, description, order status, date, and the identifiers Stripe returns (checkout session and payment intent). Nothing about the card. If you ask for an invoice, additionally your RFC, your legal name (razón social) and the CFDI use code, which we capture in order to hand them to the promoter, who issues the receipt.

If you join a waitlist: first and last name, email, phone and language, so we can tell you when a spot opens up.

If you transfer your entry or receive one: the email and name of the person the spot is offered to, and the record of when it was sent and claimed. The invitation that person receives includes your name, your class and your race number, because they need to know which spot is being offered to them. Once the transfer completes, your personal data on that entry is replaced by the other person's, and a record of the change remains with the IP address and browser it was made from.

If you edit or cancel your entry from your personal link: we store what changed, when, and the IP address and browser it was done from, so we can establish who made the change.

If the promoter collects by bank transfer: the details of the deposit that arrived in their account, so it can be reconciled with your order. The promoter may forward their bank's alerts to an email address operated by Brechear, or upload their bank statement; from those we read and store the amount, the date, the tracking key (clave de rastreo), the reference the payer typed and the sender's name as the bank spelled it — which is sometimes the payer rather than the racer — along with the original text of that alert or of that statement row. If you paid for someone else's entry, your name may appear there.

If you only visit a public event page: a cookieless page view. See section 10.

Primary purposes, meaning the ones needed to provide the service:

• Creating and managing your account and your organization.
• Processing entries, tickets and payments, and issuing the QR access codes.
• Emailing you your order confirmation, your entry pass or your tickets.
• Running the event: registration lists, check-in, tech inspection, heats, gate scanning, scoring, results and series points.
• Giving the promoter the evidence of the signed waiver.
• Where the event has accident insurance, collecting your consent and compiling the list of insured persons so the promoter can hand it to their insurer.
• Recording your decision on damage protection and the security deposit where it applies.
• Reconciling bank-transfer payments and waitlists, and handling entry transfers.
• Handling questions, refunds and support, and defending or evidencing a transaction if there is a dispute or a chargeback.
• Preventing fraud and misuse, and meeting legal, accounting and tax obligations.

Secondary purposes, which you can refuse without affecting your entry or your purchase:

• Telling you about new Brechear features or asking for product feedback.

To refuse the secondary purposes, one click is enough: every announcement we send carries an unsubscribe link at the bottom (and your mail client may show an “Unsubscribe” button that does the same). You stop receiving organizer and Brechear announcements right away, but keep getting your pass, tickets, receipts, reminders and results. You can also write to hola@brechear.com if you prefer.

When you accept our documents. When you tick the box accepting the Terms and this Notice, we store: which document it was, its version, the language you read it in, a cryptographic fingerprint (SHA-256) of the exact text that was on your screen — and the full text where that document is the contract itself — the date and time, your email, the IP address and the browser. We keep it so we can establish which text you had in view at the moment of the transaction, and it is written in the same operation as your registration, purchase or sign-up. The Terms explain, in their section 2, that this act is your electronic signature and how far it goes.

When an event requires a waiver, accepting it stores the following alongside your entry: the text you accepted, the signature you typed, the exact date and time, the IP address you signed from and the browser you used.

We keep that detail because it is what lets the promoter prove, if it ever becomes necessary, that you accepted the waiver.

With one exception we would rather tell you about: to measure how many visits end in a registration, the IP address and browser left in your waiver can be turned back into the same identifier your visit was stored under that day, attributing your registration to the visit that produced it (see section 10). It is a measurement of the event's funnel; we do not use it to build a profile of you or to follow you outside Brechear.

If you are a minor, the waiver is signed by your parent or guardian, and their name and phone are attached to the entry. On group rides, every passenger signs their own; for passengers we store name, signature and date, and we do not store their IP address or browser.

Where the promoter has taken out group accident insurance and you consent, we process: your full name, your CURP, your date of birth, the name and relationship of your beneficiary, the sum insured set by the policy, and the evidence of your consent (the text you accepted under article 167 of the Insurance Contract Law, your signature, the date, your IP address and your browser).

The policy is the promoter's, not Brechear's: they took it out with the insurer they chose, and they are the one who submits and reports it. Brechear is neither an insurer nor an intermediary, and does not share this data with any insurer on its own initiative.

How the data reaches the insurer. When an administrator of the organization asks for it, the platform generates a file with the list of insured persons, which the promoter hands to their insurer. That file contains: policy number, insurer, policyholder, movement type (addition or removal), full name, CURP, date of birth, whether you are the entrant or a passenger, sum insured, currency, date added and an internal reference.

So it is clear what does not leave in that file today: your beneficiary's name and relationship are not included — they are stored in the platform, but the file leaves them blank — and neither do the text of your consent, your signature, your IP address, your browser or your guardian's name. Those stay as evidence.

Inside the platform, this information is visible only to people with an administrator role or above in the event's organization, the same as finances.

The certificate numbers you may see are generated within the platform for internal control; they are not issued by the insurer.

If the event offers damage protection, we store your decision and the evidence of how you made it: the product name, the price, the deductible, the amount of the security deposit when you decline, the terms text you accepted, your typed signature, the date and time, your IP address and your browser.

Remember that it is not insurance: it is a contractual limit that the promoter covers out of their own resources. The security deposit is agreed and collected by them directly; the platform only records the amount.

The promoter can download the list of decisions for their event, which includes the participant's name, their email, the option chosen, the amounts and the signature. That list does not include your IP address or your browser. It is not shared with any third party.

When you register for an event or buy its tickets, your registration data is shared with that event's promoter, who needs it to let you race or enter. It is the very reason you filled in the form.

The promoter can view, export and print that information (lists, check-in sheets, roster, number cards) and is a controller of it in their own right, not a mere processor acting for us: they decide how they safeguard it and what they use it for, within what these documents and the law allow. They may only use it to run their event and communicate with you about it.

If you want to know what a promoter does with your data, or exercise your rights against them, contact them directly: their email is on the public event page. We can help you find them, and if they do not answer, write to us.

Providers that handle the data on our instructions (processors):

• Stripe — payment processing and the promoters' connected accounts. Receives the buyer's name, email and phone, and the card details, which it captures directly in its own checkout. Stripe also processes that data on its own account, under its own policy.
• Resend — sending transactional email and promoters' announcements. Receives the recipient's address and the content of the message.
• Neon — the database where the platform's information lives.
• Vercel — hosting and running the application.

Third parties data is transferred to:

• Your event's promoter, as a controller in their own right (section 7).
• The promoter's insurer, where the event has accident insurance and they hand over the list of insured persons (section 5).
• Meta Platforms and Google, where the promoter configured their own Meta pixel or their own Google Analytics measurement on the public pages of their events (section 10).
• Google, when you choose to sign in with your Google account: the exchange happens between your browser and Google, and we receive your identifier and your email back.

We do not sell, rent or trade personal data. We do not use your data for our own advertising and we do not hand it to data brokers.

We will only disclose data to an authority when there is a duly grounded legal request, or when the law requires it.

Card payments happen in Stripe's hosted checkout. The card number, expiry date and CVV never touch Brechear's servers and are never stored in our database.

For each payment we store only: the identifiers Stripe returns (checkout session and payment intent), the amounts in minor units, the currency, the order status, and the buyer's name, email and phone.

If you pay by bank transfer, the payment does not go through Stripe: it reaches the promoter's account, and what we store is the deposit detail needed to reconcile it with your order.

Our own cookies. Brechear uses the minimum needed to work, all of them httpOnly (page JavaScript cannot read them):

• brecha_sid — your session. It lasts 30 days and exists only to keep you signed in. It is deleted when you log out.
• brecha_oauth — temporary and short-lived, only while you complete a Google sign-in; it exists so that sign-in cannot be tampered with.
• NEXT_LOCALE — remembers the language you chose. It is set by the site's internationalization library, and it is not used in the embeddable event view.

Our own analytics, cookieless. For each visit to a public event page we record: the event, which page it was (landing, register, tickets, live, results or info), the referring site if any, the campaign parameters in the address (`utm_source`, `utm_medium`, `utm_campaign`) if present, the language, the date, and a visitor identifier that is an irreversible hash of your IP and browser combined with a salt that changes every day. We do not store your IP in those page views and bot traffic is discarded. Because the salt changes daily, that identifier cannot follow you from one day to the next or across events; within the same day it does allow your views to be grouped, which is why it can be linked to your waiver evidence as explained in section 4.

That exists so the promoter knows how many people saw their event and how many ended up registering.

Third-party pixels: they exist, and they are the promoter's. A promoter can configure their own Meta pixel (Facebook/Instagram) and their own Google Analytics (GA4) measurement in their settings. When they do, those scripts load on the public pages of that organization's events and on the view of a paid order, where the purchase is reported as a conversion (order identifier, amount, currency and whether it included entries). They do not load on the promoter's dashboard, on your racer documents, in the embeddable view, or on Brechear's home page.

When those scripts load, Meta and Google receive directly from your browser your IP address, the page you are viewing and the identifiers of their own cookies if you have them, and they process that data under their own policies and for their own purposes, including advertising. That measurement is the promoter's decision; our own analytics shares nothing with them.

If you do not want that measurement, you can block third-party cookies and scripts in your browser or use their own opt-out mechanisms, and you can ask the promoter to remove it. If no pixel appears on your visit, it is because that event's promoter configured none.

Published events have public pages, visible to anyone and indexable by search engines. They may show:

• Race results and the live leaderboard: racer name, race number, class, laps or times, position, penalties and status (DNF, DNS, DSQ).
• Series or championship points tables.
• The organizing club's name and public contact details.
• On group rides, the “Who's going?” wall, if the promoter switched it on and you ticked the box to appear. It comes unticked: it is your choice. If you tick it, your first name, your vehicle (make and model), your city and state, and how many people are riding in your vehicle are shown publicly, and only while your entry is confirmed or you have checked in. You can ask to be taken off at any time.

Your email, phone, date of birth, CURP, emergency contact, beneficiary, payment or invoicing details and waivers are never published: only the promoter's team, with the right permissions, can see them.

Racing an event whose results are published is part of competing. If appearing there worries you, talk to the promoter before you register.

• Account and organization: as long as the account is active.
• Entries, tickets and orders: while the event and its series are current and, afterwards, for the period required by applicable accounting and tax obligations.
• Invoicing data (RFC, legal name and CFDI use code): kept with the order for the period required by applicable tax and accounting obligations, and used for nothing other than handing them to the promoter so they can issue the receipt.
• Evidence of the waiver, of insurance consent and of the damage-protection decision: for as long as a claim arising from the event could be brought, under the applicable limitation periods.
• Bank-transfer reconciliation data: for as long as it is needed to evidence the payment and meet accounting obligations.
• Waitlists: while the event is still current.
• Results and series points: kept as the sport's historical record.
• Page views: kept for the promoter's charts; the visitor identifier stops being recomputable from new data once the day's salt changes.
• Email log: recipient, subject and status, for support purposes.

In the interest of transparency: today the deletion of these records is not automated. It happens when you ask for it — within the limits in section 13 — or when the entry, event or account they depend on is deleted, and we are working on scheduled purges.

You have the right to access your data, to rectify it if it is inaccurate, to cancel it when it is no longer needed, and to object to a specific processing. You may also revoke your consent or limit the use or disclosure of your data.

To exercise them, email hola@brechear.com with:

• Your name and an email or other means for us to reply.
• A copy of official ID (or of the document proving representation, if you act on someone else's behalf).
• Which right you want to exercise and over which data, with anything that helps us find it: the event, your race number or the email you registered with.

Under article 31 of the Law, we will answer within a maximum of 20 business days and, if the request is granted, act on it within the following 15 business days. Those periods may be extended once, by an equal period, where the circumstances justify it; if that happens, we will explain why. The process is free; only shipping or reproduction costs, if any, could be charged.

There are limits: we cannot cancel data the law requires us to keep, nor delete waiver evidence, insurance consent evidence or the accounting record of a paid order while the promoter or we may still need them to defend against a claim. If that is the case, we will explain it to you.

If your request is about what a promoter does with your data, address it to them as well, since they are a controller in their own right. If they do not answer, write to us.

If you believe your rights have been infringed, you may turn to the authority responsible for personal data protection, which today is the Secretaría Anticorrupción y Buen Gobierno of the Federal Government (article 3, section XV of the Law), which took over these functions after INAI was wound up.

Brechear does not ask for health data, blood type, ethnic origin, beliefs or biometrics. If a promoter adds a custom field that does ask for such data, they are responsible for obtaining the express, written consent the law requires; we do not recommend it.

Where an event has accident insurance we ask for CURP, date of birth and a beneficiary. Those are not sensitive data, but they are delicate identifiers: they are used only to compile the list of insured persons, and access to them inside the platform is restricted to the organization's administrators.

Events may admit minors if the promoter allows it. In that case the registration form asks for the parent's or guardian's name and phone, and it is they who accept the waiver and consent to the processing of the minor's data.

For accident insurance: the law does not allow death cover for children under 12, so they are not included; from 12 to 17, a parent or guardian consents and signs. We do not collect a date of birth for passengers on a group ride, so their age is not verified in the platform: that is on the promoter.

Brechear is not aimed at minors as users: you must be of legal age to open an account.

We take reasonable administrative, technical and physical measures to protect your data:

• All traffic is encrypted with HTTPS.
• Passwords are stored as bcrypt hashes; nobody at Brechear can read them.
• Sessions use opaque tokens stored hashed in the database, in an httpOnly cookie with an expiry.
• Access to an event's data is limited by role within the organization (owner, admin, staff, scorer), and the most delicate data — finances, CURP, dates of birth — requires an administrator role.
• Payments and card data are handled by Stripe, a PCI DSS Level 1 certified provider.

No system is infallible. If a breach were to significantly affect your rights, we will tell you without delay, as the law requires.

Brechear's infrastructure (Vercel and Neon) and our payment and email providers (Stripe and Resend) run servers outside Mexico, mainly in the United States and the European Union. That means your data may be stored or processed in those countries. Where the promoter configured their own pixels, Meta and Google also receive data from your browser and process it outside Mexico.

The transmissions to our providers and the transfers necessary to give you the service and collect your entry or ticket payment — including handing your data to the event's promoter and, where applicable, to their insurer — fall within the cases set out in article 36 of the Law, which do not require your consent because they are necessary to perform the legal relationship you have with us and with the promoter. We require every provider to handle the data with a level of protection equivalent to this notice.

Article 35 clause. If, beyond the above, a transfer were needed that does require your consent, we will not make it without asking you first. By accepting this notice you state that:

• You do consent to the transfers described in this notice that are necessary to register you, charge you and run the event, including those made to the promoter and, where the event has insurance, to their insurer.
• Your data will not be transferred to third parties for purposes other than the above without your express consent; in particular, we do not sell it or hand it over for third-party advertising.

If you do not agree to the necessary transfers, we will not be able to process your entry or your purchase, because they are part of providing the service. You can register your refusal by writing to hola@brechear.com.

We may update this Privacy Notice when purposes, providers or the law change. The version in force is the one on this page, identified by the last-updated date shown above.

If a change is substantial — new purposes, new recipients, or transfers requiring your consent — we will email active accounts and, where relevant, note it on the event page itself, before it applies.