How OffTrail Events handles your data.
Last updated: 14 September 2026
This is a separate policy from the OffTrail app's privacy policy. It covers OffTrail Events — organising an event or registering for one through an Events page on offtrailapp.com, and the Events feature inside the OffTrail app. Events work differently from the rest of OffTrail: to register you give your name, email and phone, an organiser manages your registration, and the organiser decides what else their form asks. Read this before you register for an event or create one. It sits alongside each event's own participation terms, which the organiser sets and you accept separately at registration.
Who is responsible for what
Two parties are involved, with different responsibilities:
- OffTrail operates the Events platform — hosting, the registration flow, the core fields every event collects (name, email, phone), payment references, email delivery, and the live-location relay used during an event. Contact [email protected] for platform-level questions or requests.
- The event organiser — the club, team or business running the event you register for — decides what their event needs: any extra questions on the registration form, who on their organisation's team can see registrations and answers, payment instructions, and how the event itself is run. Organisers are shown their contact details on the event page; write to them directly about how they specifically use your registration, as well as to us.
Where an organiser configures what additional data to collect and who on their team can view it, they act as the party deciding that purpose for their event; OffTrail provides the infrastructure, access controls and required safeguards that make that possible, and keeps its own operational access limited to what's needed to run and support the platform.
What we collect when you register
- Name, email and phone — always required, to identify you, confirm your registration, contact you, and let you reach your personal event page.
- The participation terms you accepted — which version, so we can show what you agreed to.
- A payment reference generated for your registration and, if the event has a fee and you upload one, your proof of payment (a receipt image or PDF).
- Ticket type and add-ons you chose, and the total you agreed to.
- Language — so your confirmation emails and personal event page are in English, Portuguese or Spanish.
- Check-in status — whether and when the organiser checked you in.
- Any additional questions the organiser has added to their event's registration form. Organisers can pick from ready-made questions — for example date of birth, emergency contact, T-shirt size, ID or document number, nationality, vehicle/bike, licence plate, or dietary requirements — or write their own; a question can also ask you to attach a file. Not every event asks the same questions: check the registration form for the specific event you're joining.
Questions the organiser adds
Beyond name, email and phone, everything on a registration form is chosen by the organiser. They decide what to ask, why, and who on their team can see the answers — for their event, they are the one responsible for that information under data protection law, and we handle it on their behalf, on their instructions, and for no other purpose (see the data processing agreement).
Because the questions are theirs, we do not vet them one by one. Our terms require organisers to ask only for what they have a lawful basis to collect, to tell participants why they are asking, and to obtain any consent the law requires. If a question asks for something you are not comfortable answering, or that you believe the organiser has no reason to ask, raise it with them first; you can also contact us and we will look into it.
Please don't send us information nobody asked for — typing something into an unrelated free-text box means it lands in that event's registration, where only the organiser needs it.
Files you upload
- Proof of payment (a receipt or invoice, image or PDF) — stored privately, visible only to the organiser's team, on Cloudflare R2 (OffTrail's file storage).
- Any file a custom question asks you to attach (for example a document the organiser requires) — stored the same way, visible only to the organiser's team.
Live location during the event
If the event uses live tracking, the OffTrail app shares your position with the organising team while the event is active — the same way Group ride and Family Follow work in the app: over a short-lived, session-only connection to OffTrail's own servers. Other participants never see your position or the roster; only the organising team does, for the duration of the event. The session data is not kept after the event ends — it is discarded when the event is closed or expires.
Payments
OffTrail never processes your payment. You pay the organiser directly (bank transfer, MB Way, or whatever method they specify); the payment reference lets the organiser (or, for a bank statement, OffTrail's reconciliation tooling acting on the organiser's behalf) match your payment to your registration. OffTrail does not handle card numbers, bank credentials or other payment-instrument data.
Who sees your data
- The organiser's team — the people the organisation has given access to (owner and any invited team members) — through the event dashboard: your registration, your answers, your payment status, proof of payment, and check-in status.
- OffTrail (the platform operator) — for running the platform, technical support, security, billing/invoicing (where a fee applies) and legal compliance. We do not sell your data, and it is not used for advertising.
- No one else. Other participants never see your registration, answers or contact details.
Why we process this data
- Performing the registration you request — the core fields and your chosen answers, so the event can be organised and you can take part (legal basis: providing the service you asked for).
- Keeping the platform secure and reliable — limited technical information and rate-limiting to prevent abuse (legal basis: our legitimate interests).
- Contact — when you write to us or the organiser, to respond and deal with your request.
How long data is kept
- Your registration and answers are kept for the organiser to run the event: the roster, check-in and payment reconciliation. You can view, and delete, your own registration and its answers (including any uploaded file) at any time from your personal event page.
- Payment records (reference, proof of payment, invoicing) may be kept longer than the rest of your registration where needed for accounting, tax or legal record-keeping.
- Live-location session data is discarded when the event ends or expires — see "Live location during the event" above.
Where our implementation doesn't yet set a fixed, automatic period, we say so rather than invent one.
Service providers
OffTrail Events runs on Cloudflare (hosting, database, file storage and the live-location relay) and sends email via Amazon Web Services (SES). Where a fee applies, invoices may be issued via Moloni (Portuguese invoicing). These providers process technical or billing data needed to provide their services, under their own applicable terms. OffTrail does not sell personal data.
International transfers
Some service providers may process technical information in countries outside Portugal or the European Economic Area. Where privacy law requires safeguards for such transfers, OffTrail relies on the safeguards made available by the relevant provider, such as applicable contractual data-protection mechanisms.
Your privacy rights
Depending on where you live, privacy law may give you rights over personal data concerning you — including access, correction, deletion, restriction, objection and, where applicable, data portability or withdrawal of consent. For registration data, the quickest way to exercise access, correction or deletion is your personal event page; for anything else, contact us at [email protected] or the event's organiser. If you are in the European Economic Area, you also have the right to complain to a data-protection authority; in Portugal, the supervisory authority is the CNPD.
Children
OffTrail Events is designed for organisers and participants registering for adult-oriented off-road and adventure events, and is not specifically directed at children. Where applicable privacy law requires parental or guardian consent for a child's participation or registration, that consent must be obtained by whoever registers the child.
Changes to this policy
When we change what Events collects or how it's used, we update this page and its "Last updated" date. Material changes are also signalled where relevant (for example on the registration page or by email). Continued use is not treated as consent to every kind of processing; where processing relies on your consent, that stays separate.
Contact
Questions or requests about OffTrail Events: [email protected]. Questions about a specific event: contact its organiser, shown on the event's page.