Legal Notice & Privacy — Glaignes & Cie

Article 1 — Publisher and hosting The Glaignes & Cie application is published by Core Soft Development, a company registered in France, headquartered at 71 rue du Grand Ferré, 60126 Longueil-Sainte-Marie, France. Contact: contact@coresoftdevelopment.fr The application's data is hosted by Google (Firebase and Google Cloud Platform) in the europe-west1 region (Belgium), within the European Union. Article 2 — Purpose of the application Glaignes & Cie is the members' app of the Glaignes & Cie trail running school, located in Glaignes (Oise, France). It lets members view the calendar of races, club runs and club life events, declare their participation for a distance, suggest new races and receive notifications. The application is free. It contains no advertising and offers no purchases. The application does not register anyone for a race: registering with the race organizer remains each runner's responsibility. Declaring participation in the app only serves to inform other members. Article 3 — Acceptance of the terms Using the application implies acceptance of these terms. They may change; the last update date is shown at the top of this page. Users are informed in the app of any significant change. Continuing to use the application after being informed constitutes acceptance of the new terms. Article 4 — Access and account creation The application can be browsed without an account: visitors see a public showcase of races (name, town, date, distances) with no personal names. Anyone can create an account, with an email address and password or, where offered, with a Google or Apple account. The account remains pending until a club administrator approves it. Only approved members can see participants, tracks and club life, and interact with the application. Users agree to provide a name that lets the club identify them and to keep their credentials confidential. An administrator may decline a membership request or delete an account, in particular if the person is not a member of the club. A minor under 15 may only create an account with the consent of their legal guardian. Article 5 — Content published by members Approved members can suggest races (name, town, date, distances, description, recommended gear, Adeorun link) and attach GPX tracks. The author's name is displayed on the race ("Suggested by"). Authors guarantee that this information is accurate and that they hold the necessary rights to the files they upload. Race information is provided for guidance only. Only the information published by the race organizer is authoritative: times, course, entry requirements, cancellation. Administrators may edit, merge or delete a race, in particular in the case of duplicates or inappropriate content. Article 6 — User obligations Users agree to: • use the application for its intended purpose and in accordance with these terms; • not publish any unlawful, misleading or offensive content, or content infringing the rights of others; • not impersonate another person; • not attempt to bypass access rights, compromise or disassemble the application. Article 7 — Sports practice Trail running is a demanding physical activity. The application gives no medical or training advice. Each runner remains solely responsible for their fitness to take part in a race, their equipment and compliance with the race rules. Article 8 — Intellectual property The application, its code, design and graphic elements are the property of Core Soft Development. The Glaignes & Cie name and identity belong to the club. Any unauthorized reproduction or use is prohibited. Map backgrounds are provided by Mapbox and OpenStreetMap, whose attribution is displayed on the map. Article 9 — Availability and liability Core Soft Development strives to keep the application running properly but cannot guarantee uninterrupted availability. Maintenance or technical incidents may occur. Core Soft Development cannot be held liable for: • inaccurate information entered by users or extracted from third-party websites; • the cancellation or modification of a race by its organizer; • damage related to sports practice; • service interruptions beyond its control. Article 10 — Governing law These terms are governed by French law. In the event of a dispute, the parties will first seek an amicable solution. Failing that, the dispute will be brought before the competent courts of Compiègne (France).

Article 1 — Data controller The controller of personal data collected through the Glaignes & Cie application is: Core Soft Development 71 rue du Grand Ferré 60126 Longueil-Sainte-Marie, France Email: contact@coresoftdevelopment.fr Data is processed in accordance with the General Data Protection Regulation (GDPR — EU Regulation 2016/679) and the French Data Protection Act (loi Informatique et Libertés). The application only collects what is needed to know who is taking part in which race. Article 2 — Data collected 2.1 Data you provide • Your name and email address, when you create an account. If you sign in with Apple, the address may be a "Hide My Email" alias. Your password is handled by Firebase Authentication and is never accessible in plain text; • Your answers to races: "going", "maybe" or "not going" for a given distance and, for a club life event, the number of people expected; • The races you suggest and the GPX tracks you upload. A GPX track describes a race course, not your own movements; • Your notification preferences. 2.2 Data collected automatically • A device token, to send you notifications if you allowed them; • Usage and diagnostic data, through Firebase Analytics: screens viewed, actions taken, technical errors, app instance identifier, device model, OS version and approximate country. This data is used to improve the application and does not include your name or email address; • A Firebase installation identifier, used for the application's remote configuration; • When the map is displayed, technical data (IP address, device information) sent to Mapbox, along with anonymous map usage statistics. 2.3 Data not collected The application does not collect your location, photos or contacts. Adding a race to your calendar goes through your device's calendar: no information from it is transmitted. Your notification history and some settings stay stored on your device. Article 3 — Who can see your data • Visitors and accounts awaiting approval see no personal names; • Approved members see the names of participants for each distance and the name of a race's author; • Club administrators also see the name, email address and status of accounts, in order to approve memberships; • Core Soft Development, as publisher, only accesses data for maintenance and support. These restrictions are enforced by the server, not just by the application. Article 4 — Purposes and legal bases • Managing your account and approving your membership — performance of the contract (these terms); • Organizing participation and showing participants to other members — performance of the contract; • Sending notifications — consent, given through your device's permission and adjustable at any time in your profile; • Audience measurement and error diagnostics — legitimate interest in maintaining and improving the application; • Security and abuse prevention — legitimate interest. Article 5 — Processors and third-party services We do not sell your data and do not use it for any advertising purpose. It is processed by the following providers, solely to run the service: • Google (Firebase, Google Cloud) — authentication, database, server functions, GPX track storage, notifications, remote configuration and audience measurement; • Google and Apple — sign-in with your Google or Apple account, if you choose that option; • Mapbox — map display; • Base Adresse Nationale, IGN Géoplateforme and Open-Elevation — locating a race's town and computing a track's altitudes. No personal data is sent to them; • Adeorun — when a link is provided, our servers read the race's public page to pre-fill the form. No personal data is sent to it. Article 6 — Storage location and transfers outside the EU The database, server functions and GPX tracks are hosted in the European Union (europe-west1 region, Belgium). Some providers (Google, Apple, Mapbox) are based in the United States and may process data there, in particular for audience measurement and notification delivery. These transfers are covered by the EU–US Data Privacy Framework or by the European Commission's Standard Contractual Clauses (Article 46 GDPR). Article 7 — Retention periods • Account (name, email, preferences, notification tokens): until the account is deleted, by you or by an administrator. Notification tokens that become invalid are deleted automatically; • Participation: deleted 24 months after the event date; • Races: kept indefinitely in the club's history. The author's name is erased 24 months after the event date, or as soon as their account is deleted; • Analytics data: 14 months at most; • Notification history stored on your device: until the application is uninstalled. Article 8 — Your rights You have the following rights over your data: • right of access and rectification; • right to erasure — see the "Account and data deletion" section below; • right to restriction of processing and right to object; • right to data portability; • right to withdraw your consent at any time, for example by turning off notifications; • right to set instructions regarding your data after your death. To exercise these rights, write to contact@coresoftdevelopment.fr from the address linked to your account. We respond within one month. You may also lodge a complaint with the CNIL, the French data protection authority: www.cnil.fr Article 9 — Security • Encrypted communication (HTTPS/TLS) between the application and the servers; • Authentication handled by Firebase Authentication; • Access rights checked server-side by security rules, based on each account's status; • Administration restricted to administrators appointed by the club. Article 10 — Minors The application is intended for club members and is not directed at children. In accordance with Article 45 of the French Data Protection Act, a minor under 15 may only create an account with the consent of their legal guardian. If you notice that a child has created an account without such consent, contact us and their data will be deleted. Article 11 — Changes This policy may be updated to reflect changes to the application or to regulations. The last update date is shown at the top of this page; any significant change is announced in the application. Article 12 — Contact For any question about your data: • by email: contact@coresoftdevelopment.fr • by mail: Core Soft Development, 71 rue du Grand Ferré, 60126 Longueil-Sainte-Marie, France

This section explains how to delete your account in the Glaignes & Cie application, published by Core Soft Development, along with the associated data. From the application 1. Open the Profile tab; 2. Tap "Supprimer mon compte" (Delete my account); 3. Confirm the deletion. Without the application Write to contact@coresoftdevelopment.fr from the email address linked to your account, with the subject "Glaignes & Cie account deletion". Once we have verified that the request comes from the account holder, we process it within 30 days at most. You may also contact a club administrator. Data deleted • Your sign-in account; • Your name, email address and notification preferences; • The notification tokens of your devices; • Your name on the races you suggested. Data anonymized or kept • Your participation records are anonymized: your name and identifier are erased, they are shown as "Deleted member" and can no longer identify you. They are deleted at the latest 24 months after the event date; • The races you suggested (name, town, date, distances, tracks) remain in the club's history, with no link to you; • Participant counts per distance are kept: these totals cannot identify you; • Analytics data already collected, which contains neither name nor email, is kept until it expires, 14 months at most. Deleting part of your data Without deleting your account, you can at any time change your answer to a race, turn off notifications from your profile, or ask contact@coresoftdevelopment.fr by email to delete specific data, for example a race you suggested or a GPX track.