Privacy policy · MotoGP™ Access

1. Data controller

The controller is GUESTIN HOSPITALITY SOLUTIONS SL (“GUESTIN”), registered office at Calle Manuel Girona 6, 1 B, 08034 Barcelona (Spain), tax ID B56178569, email assistme@guestin.io. GUESTIN runs the guest platform of the hospitality programme of MotoGP events.

Guests’ data are provided by the hospitality programme organisers or the sponsor who invites you, or by you when you register, answer an invitation or use the app.

2. Data we process

• Guests: first and last name, email address, phone number, company, language, the experiences you are invited to and your guest profile, your answer (attending or not), your accesses and QR codes, access checks at the event, activity bookings and survey answers.
• Registration forms: in addition, your companions’ data (name and email) and, only if you provide them and with your explicit consent, health data (allergies, diet and mobility).
• Use of the app: an installation identifier, the system and the app and operating system versions, the session opened with your code, the notices you have read and when you view your pass; and, if notifications are enabled, the device’s notification identifier.
• Browsing: your IP address, stored pseudonymised to limit attempts, and technical cookies (language and form session). No advertising or analytics cookies are used.

3. Purposes

• Managing your invitation and your attendance at the event experiences.
• Sending you the event communications: invitation, confirmations, access and QR code, reminders and survey.
• Giving you access to the event and checking access at the door.
• Managing your activity bookings and showing you your schedule, your pass and the event notices in the app and the portal.
• Organising your attendance according to the health data you provide (allergies, diet and mobility).
• Protecting the service against misuse (attempt limits and anti-bot checks).
• Learning your opinion through the post-event survey.

Your data are not used for advertising or to build commercial profiles.

4. Legal basis

• Managing your invitation and attendance, which you accept by answering: Article 6(1)(b) GDPR.
• Your consent when you register through a form and, for health data, your explicit consent: Articles 6(1)(a) and 9(2)(a) GDPR. You may withdraw it at any time.
• Legitimate interest in the security of the service and in learning how the event was rated: Article 6(1)(f) GDPR.

5. Disclosure of data

Your data are only disclosed to the organisers of the event’s hospitality programme and, where applicable, to the sponsor who invited you, who only sees the data of their own invitations.

Service providers to GUESTIN also access them, always on behalf of GUESTIN and never for their own purposes: Amazon Web Services (hosting of the platform in the European Union, in Ireland), Twilio SendGrid (sending emails), Cloudflare (anti-bot checks on the forms) and Apple and Google (app distribution and, if enabled, notifications).

If you add your pass to Apple Wallet, Apple receives what is shown on it (your name, the experience, the group and the QR code) and keeps it in your Apple account while the pass remains in Wallet, under Apple’s privacy policy. Withdrawing your access on the platform does not delete that pass: you can remove it yourself from Wallet.

If you add your pass to Google Wallet, Google receives what is shown on it (your name, the experience, the group and the QR code) and keeps it in your Google account while the pass stays in Google Wallet, under Google’s privacy policy. Withdrawing your access on the platform does not delete that pass: you can remove it yourself from Google Wallet.

Your data are not sold or passed on to third parties, except to the authorities when required by law.

6. Automated decisions and profiling

GUESTIN does not make automated decisions with your data or build profiles.

7. International transfers

Some providers (Twilio SendGrid and Cloudflare) may process data outside the European Economic Area. In those cases, processing is protected by the standard contractual clauses approved by the European Commission or by the EU-US Data Privacy Framework.

8. Retention

• Your invitation data are kept while the event is prepared and held and for as long as needed to meet legal obligations; they are then deleted.
• Form answers and health data are deleted no later than 30 days after the event. Requests that are not accepted are deleted after 30 days.
• The app session ends when you log out or when the organisers change your code.

9. Security

All communication is encrypted (HTTPS). Form requests travel encrypted to the platform, health data are stored encrypted with a dedicated key and only authorised staff of the organisers can access the data.

10. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to assistme@guestin.io with a copy of an identity document. You can also log out of the app from your profile, which deletes your data from the device.

If you believe your data have not been processed correctly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

11. Minors

The app and the hospitality programme are intended for people invited by the organisers. Data of children under 14 are not knowingly processed without the consent of their parents or guardians.

12. How to ask for your data to be deleted

• Write to assistme@guestin.io from the address where you received the invitation, with the subject “Delete my data · MotoGP Access”, and tell us the event.
• GUESTIN checks that the request is yours and deletes your data within one month at the latest, informing the event organisers.
• We delete your guest data (name, contact details, company and language), your invitations, accesses and QR codes, your bookings, your form and survey answers, and the app sessions and devices.
• Only what the law requires us to keep is retained, blocked and for the legal period.
• To delete the data stored on your phone, just log out from your profile in the app.