Privacy policy

Version 1 · Last updated: 12 October 2026

This policy explains what personal data Adthletics processes, why, and what rights you have. It applies to the website adthletics.com and to Adthletics accounts.

1. Who is responsible for your data

• Controller: [Full name or company name]
• Tax ID (NIF): [NIF]
• Address: [Postal address]
• Contact for privacy matters: hello@adthletics.com

2. What data we process

All accounts

• Your email address and password. We only store the password as a secure hash, so nobody can read it, not even us.
• Your account type (athlete or brand) and the dates you signed up and verified your email.
• Your acceptance of the Terms of use and this policy (version and date), and whether you chose to receive news about sponsorship opportunities.

Athletes

• First and last name, date of birth, sport, level, country and, optionally, city and Instagram handle.
• The events you join, the spots you open to brands at each, the events you add (name, date, city and country), and your answers to brands' requests.

Brands

• Company name, the name of the contact person, country and, optionally, website.
• Documents you send us to verify your company (for example a bill or a companies-register extract), which may show the name of a director or of the person acting for it.
• Your designs (logo files) and the requests you send athletes.

When you use the website

• Technical data your browser sends (IP address, browser, pages requested and when), kept in server logs for security.
• Anonymous visit statistics: which pages are visited, where visitors come from (the referring site), and the browser, device type, language and country. We count them with Umami, which runs on our own server and sets no cookies. Your IP address is used only to work out the country and to tell visits apart, and is never stored.
• The cookies that keep you signed in and protect your account (see the Cookie policy).
• The emails you send us.

You give us this data yourself when you sign up or edit your profile. We do not buy data or collect it from other sources.

Coming soon. Bookings, payments and tattoo shipping are not open yet. When they are, we will also need athletes' shipping addresses and billing details. We will update this policy, and tell you, before we collect them.

3. Why we use it, and on what legal basis

We do not sell your data, and we do not make decisions about you based solely on automated processing.

4. Who can see your data

• Brands on Adthletics see the athlete profile information they need to choose athletes: first name and the initial of the last name, gender (for the 3D figure), sport, level, country and city, Instagram handle, open spots and their prices, and events. They never see your email address, password or date of birth.
• Service providers that process data on our behalf, under a data processing agreement: website and database hosting (Hetzner Online GmbH, Germany) and email delivery ([Email provider]). When bookings open, the tattoo printing supplier and the courier will receive only what they need to make and deliver the tattoos (the design, and the athlete's name and shipping address), and a payment provider will process payments.
• Resources your browser downloads from third parties. Our typefaces come from Google Fonts (Google Ireland Limited) and the 3D viewer's code library from jsDelivr. When your browser loads them, these providers receive your IP address. See the privacy policies of Google and jsDelivr.
• Public authorities, when the law requires us to share data.

5. International transfers

We store your account data in the European Union. Google may process your IP address outside the European Economic Area, for example in the United States; those transfers rely on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses. jsDelivr works through global content delivery networks, so your request may be served from outside the EEA.

6. How long we keep it

• Unfinished sign-ups: the verification link expires after 24 hours, and then we delete the sign-up.
• Your account and profile: as long as your account exists. When you delete your account from your dashboard, we delete your profile, spots, events and consent records straight away.
• Sign-in sessions: up to 90 days, or until you log out.
• Verification documents: until we verify or reject the company; then we delete them and keep only which type of document it was, who reviewed it and when.
• Designs and requests: as long as the brand's company has an account on Adthletics.
• Server logs: [30 days].
• Emails you send us: as long as we need them to deal with your request, and at most [2 years].
• Where the law requires us to keep some data longer (for example invoices, once payments exist), we keep it blocked, only for that purpose and for the period the law sets.

7. Your rights

You can ask us to access, correct or delete your data, to restrict or object to its processing, and to receive it in a portable format. You can withdraw your consent to receive news at any time, without affecting anything we did before.

You can do much of this yourself: edit your profile or delete your account from your dashboard. For anything else, write to hello@adthletics.com from your account's email address. We will reply within one month.

If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

8. Minors

Athlete accounts are only for people aged 18 or over, and brand accounts are for businesses. We do not knowingly collect data from minors; if we find out we have, we delete it.

9. Security

We protect your data with encrypted connections (HTTPS), hashed passwords, sign-in cookies that scripts cannot read, limits on sign-in attempts and restricted access to our systems.

10. Changes to this policy

If we change this policy, we will update the version and date above. If the change is significant, we will tell registered users by email before it applies.