MedalVault Privacy Policy

Last updated: July 2026

MedalVault Ltd ("we", "us", "our") is a private limited company registered in England and Wales. We are committed to protecting the personal data of our users in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights in relation to it. It applies to all users of medalvault.co.uk, including runners, race organisers, and public visitors.

Who We Are

Data Controller: MedalVault Ltd (company number 17276656), registered in England and Wales

Contact: hello@medalvault.co.uk

Website: medalvault.co.uk

What Data We Collect

Runners

• Name (first and last)
• Email address
• Race results data: race name, date, finish time, overall position, gender position
• Profile information you choose to provide (e.g. profile name)
• Payment information (when payments are activated — processed securely by Stripe, not stored by us)

Race Organisers

• Name and contact details
• Organisation name and logo (if added)
• Event details: race name, date, distance, website, description
• Finisher results CSV data uploaded by the organiser (organiser must have participant permission for data to be public)
• Billing information (when payments are activated)

All Users

• Usage data and log information (IP address, browser type, pages visited)
• Authentication data (managed securely via Supabase)

How We Use Your Data

• To create and manage your MedalVault account
• To deliver digital medals to runners' vaults based on race results
• To enable runners to view, share, and download their medals
• To allow race organisers to manage their events and results
• To process payments for downloads and subscriptions (when activated)
• To communicate with you about your account or our services
• To improve the platform and resolve technical issues

Legal Basis for Processing

We process your personal data on the following legal bases under UK GDPR:

• Contract: To fulfil our obligations to you as a user of MedalVault (e.g. delivering your medals, managing your account)
• Legitimate interests: To improve our services, prevent fraud, and maintain platform security
• Legal obligation: Where we are required to retain data by law
• Consent: Where you have given explicit consent (e.g. marketing communications, if applicable)

Race Results and Public Data

Race results (name, finish time, position) are provided to us by race organisers via CSV upload. This data is used solely to match runners to their medals and to display results within the platform. Runners' names and race results may be visible on their public vault page if they have chosen to make their vault public. Runners can set their vault to private at any time in their account settings.

Data Sharing

We do not sell your personal data. We share data only with the following parties where necessary to operate the platform:

• Supabase (database and authentication provider) — data is stored securely in accordance with Supabase's Data Processing Addendum, which we have signed. Supabase processes data in the US and Singapore under Standard Contractual Clauses.
• Stripe (payment processing, when activated) — payment data is handled directly by Stripe and is subject to Stripe's own privacy policy.
• Race organisers — may see the names of runners who have claimed medals from their events, for administrative purposes only.

International Data Transfers

Our database is hosted by Supabase, which may process data in the United States and Singapore. These transfers are made under appropriate safeguards including Standard Contractual Clauses (SCCs) approved by the European Commission, and are compliant with UK GDPR requirements for international data transfers.

Data Retention

We retain your personal data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it by law (e.g. financial records). Race results data uploaded by organisers is retained as part of event records. Organisers may contact us to request deletion of specific event data.

Your Rights

Under UK GDPR, you have the following rights:

• Right of access: to request a copy of the personal data we hold about you
• Right to rectification: to request correction of inaccurate data
• Right to erasure: to request deletion of your personal data ("right to be forgotten")
• Right to restrict processing: to request that we limit how we use your data
• Right to data portability: to receive your data in a structured, machine-readable format
• Right to object: to object to processing based on legitimate interests

To exercise any of these rights, please contact us at hello@medalvault.co.uk. We will respond within 30 days.

Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. This includes encryption at rest (AES-256) and in transit (TLS), Row Level Security controls on our database, and access controls limiting who can view your data.

Cookies

MedalVault uses essential cookies necessary for the platform to function (e.g. authentication sessions). We do not currently use tracking, advertising, or analytics cookies. We will update this policy if our cookie usage changes.

Children

MedalVault is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of significant changes by email or by displaying a notice on the platform. The date at the top of this policy reflects when it was last updated.

Complaints

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113

We would, however, appreciate the opportunity to address your concerns before you approach the ICO, so please contact us first at hello@medalvault.co.uk.

Contact Us

For any questions about this Privacy Policy or your personal data:

• Email: hello@medalvault.co.uk
• Website: medalvault.co.uk

MedalVault Ltd | Company number: 17276656 | medalvault.co.uk | hello@medalvault.co.uk