--- title: "Grupify Personal Data Processing Policy" description: "Grupify is an end-to-end sports event management platform —registrations, payments, kit delivery, access control, timing and results, communications, sponsorships and artificial intelligence tools— op" canonical: https://www.grupify.com/en/cocora/politica-datos lang: en last-updated: 2026-10-14 markdown: https://www.grupify.com/md/en/cocora/politica-datos.md --- # Grupify Personal Data Processing Policy > The Spanish version of this document is the only binding one. Any translation is provided as a courtesy and has no legal effect. ## 1. Introduction and Legal Basis Grupify is an end-to-end sports event management platform —registrations, payments, kit delivery, access control, timing and results, communications, sponsorships and artificial intelligence tools— operated by GRUPIFY S.A.S. (NIT 901929426), committed to the privacy of its users. This personal data processing policy (or Habeas Data document) explains what data we collect, through which channels, how we use it, who we share it with, and your rights as the data subject. Grupify complies with current Colombian personal data protection regulations, especially Ley 1581 de 2012 (Colombia’s data protection law) and Decreto 1377 de 2013. In Colombia, the right of Habeas Data guarantees every person the constitutional right to know, update and rectify the information collected about them in databases. This policy follows those principles and seeks to ensure the full exercise of your rights. - **Acceptance:** by registering on Grupify or signing up for an event through our platform, you accept the terms of this Personal Data Processing Policy. If you disagree with any of its sections, we recommend refraining from using our services. Providing your personal data is free and voluntary, but necessary to register for events through Grupify. Grupify will always request your prior, express and informed authorization to process your data, in accordance with the principle of freedom enshrined in the law. ## 2. Who this Policy Covers - **Participants** registered in events, including minors (see section 4). - **Organizers** of events and the members of their teams with a platform account. - **Buyers and payers,** including a person who pays for someone else’s registration. - **Sponsors** and their contact persons, and visitors who leave their data at a sponsor’s activation during an event. - **Organizer vendors** who receive payments ordered through the platform. - **Visitors** of our websites and applications. ## 3. Personal Data Collected When you create a profile on Grupify (which happens automatically the first time you register for an event), we collect the data needed to manage your registration and participation: - **Identification data:** given names and surnames, identity document type and number (citizen ID, foreigner ID, minor’s ID, civil registry, DNI or passport), date of birth, sex and nationality. - **Contact data:** email, mobile number, landline, address, city and department. - **Health data (sensitive data):** where the event requires it for safety reasons: blood type, EPS (Colombian health provider), medical conditions, medications, allergies, and the name, relationship and phone number of your emergency contact. Answering these fields is optional, unless the organizer marks them as an event safety requirement, and their processing requires your explicit, separate authorization. You are not required to authorize the processing of sensitive data to use the platform in general. - **Sports and logistics data:** sports club, coach, shirt size, category and distance you take part in, and the answers to the custom fields each event configures. - **Image:** the profile photo you voluntarily upload and —only if you expressly authorize it at registration— the organizer’s use of your image captured during the event. - **Event data generated by the platform:** bib number, access QR code, timing chip code, times and splits, kit delivery status and participation certificates. - **Transactional data:** payment confirmation, amount and method, and the payer data reported by the payment gateway. Grupify does not store card numbers: those transactions are processed by secure payment gateways. We do store, on the organizer’s instruction, the bank account details of disbursement recipients (payments to event vendors). - **External sources authorized by you:** if you connect your Strava account, we receive your athlete identifier and your activities with read-only permission; you can disconnect it at any time. - **Technical data:** IP address, device and browser identifiers, and activity (audit) logs associated with each access to the platform. You provide this data directly, or it is provided on your behalf by whoever registers you with your authorization, or by the organizer that imports it into the platform (see section 5). All information is stored in a centralized database managed by Grupify, under strict security measures. ## 4. Data of Minors Events may admit underage participants (minor’s ID and civil registry documents). A minor’s registration may only be completed by their father, mother or legal guardian, who by completing it declares that they hold that representation and grants the processing authorization on the minor’s behalf, respecting their best interests and fundamental rights. Minors’ data is used exclusively for their safe participation in the event and never for commercial purposes aimed at them. ## 5. Collection and Processing Channels - **Web:** registration forms on our pages and forms embedded on the organizer’s sites. - **Organizer panel:** manual registration and spreadsheet imports. When an organizer imports data collected by its own means, it acts as controller of that collection and warrants that it has the data subjects’ authorization. - **WhatsApp, email and SMS:** confirmations, verification codes (OTP), event communications and organizer campaigns, always with an unsubscribe mechanism. - **Attendee app and digital wallet passes** (Apple Wallet and Google Wallet) with your access QR code. - **At the event:** reading your QR or chip for access control, kit delivery and timing. - **Conversational assistants:** web chat and messaging channels served with artificial intelligence (see section 8), including voice conversation when you initiate it. ## 6. Purposes of Processing - **Creation of your single profile:** when you first register, Grupify creates a profile that uniquely identifies you on the platform and saves you from re-entering your information for each new registration. - **Registration and participation management:** processing your registration, generating your participant number or code, assigning you to a category by age or gender (if applicable), sending you confirmations and facilitating your participation, including event communications (changes, instructions, results, certificates). - **Event operations:** access control with QR or chip, kit delivery, timing, publishing results and issuing certificates, according to the organizer’s configuration. - **Autofill in future events:** with your existing profile, the platform can autofill future registrations after verifying your identity through the authentication mechanism described in section 7. - **Authentication mechanism (OTP):** when registering for a new event with your existing profile, we send a one-time code to your registered email; only you can authorize the reuse of your data. - **Account administration and support:** enabling your user panel, validating your identity when you contact us and providing help. - **Organizer communications:** the organizer may send you, through the platform, operational communications about its event and —only with your authorization— informative or promotional campaigns by email, WhatsApp or SMS. Every campaign includes an unsubscribe mechanism and your opt-out is honored in future sends. - **Artificial intelligence assistance:** as per section 8. - **Statistics and service improvement:** we use aggregated information to improve the platform. It also generates automated analyses and suggestions for organizers; no decision with legal effects on you is made in an exclusively automated way: sensitive actions require human approval. - **Legal and regulatory compliance:** processing your data when required by legal obligations or requests from competent authorities, sharing only what is necessary. Grupify will not use your data for purposes other than those described here without obtaining your additional consent. Sharing with sponsors only occurs in the cases and with the safeguards of section 10. ## 7. Managing your Participant Account As a participant, Grupify offers you a persistent profile that makes future registrations easier. You can view and edit your personal data, see your registration history and configure your communication preferences. ### Passwordless authentication There is no traditional username-and-password system for participants. On your first registration your profile is created automatically; on later registrations, when you enter your document the platform detects that you already exist and sends a 6-digit verification code to your registered email. With that code you validate your identity and authorize the autofill. The code expires after use or after a few minutes. Only you, with access to your registered email, can authorize the use of your data. ## 8. Use of Artificial Intelligence - **What it does:** Grupify includes AI assistants that help the organizer query information about its own event, interpret registration spreadsheets, draft communications and receive suggestions; and they can answer participants’ questions about their own registration. - **What data it processes:** to answer, the assistant may access registration data of the queried event (for example, the name, document and status of a registration when the organizer looks it up, or your own data when you ask through a verified channel). Each user sees only what their permissions already allow: AI does not expand access. - **Providers:** the language and voice models are provided by third parties (mainly Google) under contracts that limit the use of the data to providing the service. The image and video generation tools process the files the organizer chooses to upload, through specialized providers. - **Human oversight:** actions with real effects (mass sends, changes to registrations, payments) require the express confirmation of an authorized person. We maintain technical safeguards against misuse of the assistant. ## 9. Data Sharing with Organizers When you register for an event, your data is shared exclusively with the organization responsible for that specific event. ### Restricted access principle - Organizers can ONLY see data of participants registered in their own events. - The organizer of another event canNOT view your information unless you also register for their event. - Each registration is an independent consent to share data with that specific organization. - No organizer sees your complete participation history. ### Technical controls The platform automatically filters by organization, validates on every query that the user holds an authorized role in the event’s organization, and logs all data access with user identification and timestamp. ### Information the organizer receives Identification data (name, document, date of birth, gender), contact (email, mobile), event data (category, distance, bib, size), basic medical information if applicable (EPS, emergency contact, conditions relevant to safety), answers to custom fields and payment status (confirmation, amount, method). ### Roles and permitted uses With respect to its event’s data, the organizer acts as data controller and Grupify as processor handling the data on its behalf; with respect to your single profile and the operation of the platform, Grupify acts as controller. The organizer may use your data for event logistics, related communications, safety measures during the competition and participation certificates. It may NOT transfer your data to third parties outside the platform mechanisms described in this policy, use it for unauthorized events, or send you unrelated advertising without your additional consent. ## 10. Sponsors - **Data you leave at an activation:** if you scan a sponsor’s QR code during an event and leave them your data, that submission is voluntary and requires your express acceptance of processing on that form; the sponsor is responsible for its subsequent use. - **Audience analytics:** sponsors can see aggregated event statistics (distributions by age, gender or city) that do not identify you individually. - **Transfer of registrant data:** only happens if the organizer expressly enables it for a sponsorship contract and if you were informed of and authorized that purpose when registering for the event. Without that authorization, your registration data is not handed to sponsors. Every enablement is logged with date and author. ## 11. Organization Model and Data Access Grupify operates under a multi-tenant model by organizations: each event belongs to a specific organization (sports club, organizing company, government entity, etc.). Within each organization there are roles with different access levels: owner (full control), admin (managing events and registrants) and member (read-only). There is no cross-access between organizations. Participants do not belong to any organization: their data is shared only with the organizations of the events they register for. ## 12. Processors and International Transfer To operate, Grupify relies on providers that process data on our behalf, under contract and only to provide us the service: | Category | Purpose | | --- | --- | | Infrastructure | Servers, databases and file storage (including Amazon Web Services and cloud deployment providers). | | Payment gateways | Payment processing and disbursements; they are the ones who process card data. | | Messaging | WhatsApp (Meta), transactional email and SMS. | | Artificial intelligence | Language, voice and content-generation models (mainly Google and specialized providers). | | Digital wallets | Apple Wallet and Google Wallet, if you choose to add your pass. | | Analytics and monitoring | Usage metrics, error diagnostics and experience improvement. | Several of these providers operate outside Colombia (mainly in the United States), so international data transmission exists under article 26 of Ley 1581 de 2012. We require each processor to provide security and confidentiality guarantees equivalent to those of this policy. ## 13. Cookies and Similar Technologies - **First-party and necessary:** session, security and preferences. - **Analytics:** we use measurement tools and anonymized session replay to understand how the platform is used and detect errors. - **Organizer pixels:** an organizer may install an advertising pixel (for example, Meta Pixel) on its event’s public page to measure its own campaigns; the organizer is responsible for that processing and for disclosing it. You can limit these technologies from your browser settings. ## 14. Data Retention We keep your data while your profile is active and while the purpose of each processing subsists: registration and results data, for the life of the event and the associated claim periods; transactional data, for the terms required by accounting and tax law; technical audit logs, for short internally defined periods. Once the period ends, data is deleted or anonymized. If you request deletion, it also reaches the operational copies of your data (such as registration snapshots), except what the law requires us to keep. ## 15. Information Security - **Secure storage:** servers with physical and logical protection measures, encryption of sensitive data in the database and transmission over HTTPS/SSL. - **Access control:** only authorized Grupify personnel and essential providers under contract access the data, solely for the permitted purposes; every access is authenticated and logged. - **Confidentiality:** all personnel, partners and organizers are bound by the duty of confidentiality. - **Sensitive documents:** are stored in private repositories and served through temporary access links; integration credentials are stored encrypted. - **Money operations:** disbursements require OTP verification by the authorized person. - **Backups and monitoring:** periodic backups, integrity checks, monitoring for unusual activity and continuous security patching. ## 16. Data Subject Rights As the subject of your personal data, the law grants you the Habeas Data rights, which Grupify fully guarantees: - **Access:** knowing which of your data we collect, store and process. - **Update and rectification:** updating your data and correcting what is outdated, incomplete or inaccurate. - **Cancellation/deletion:** requesting the removal of your data from our databases in the cases the law allows. - **Objection:** objecting to the processing or to a specific purpose, whenever the law allows it. - **Withdrawal of consent:** revoking at any time the authorization you granted, unless prevented by a legal or contractual obligation. - **Portability:** obtaining on request a structured copy of your personal data. - **Complaint before the authority:** filing complaints before the Superintendencia de Industria y Comercio (SIC, Colombia’s data protection authority) if you consider your rights violated. ### Procedure to exercise your rights For queries, requests or claims, contact us through the channels in section 18, providing the information needed to verify your identity. Queries are resolved within a maximum of 10 business days and claims within a maximum of 15 business days. Exercising your rights is free of charge. ## 17. Validity of the Policy and Changes This Personal Data Processing Policy takes effect from its publication date and remains in force until it is modified or replaced by an updated version. Grupify reserves the right to update it at any time; in case of substantial changes we will notify users. We invite you to review this document periodically. ## 18. Contact For more information, queries or to exercise your rights regarding your personal data, you can contact Grupify’s data protection area: - **Data Controller:** GRUPIFY S.A.S., identified with NIT 901929426. - **Address:** Circunvalar 35 #72-98, Bucaramanga, Santander, Colombia. - **Email (Data Protection):** proteccion@grupify.com - **Phone:** +57 (321) 9534796 (Service hours: Mon–Fri 9:00–18:00). --- HTML version: https://www.grupify.com/en/cocora/politica-datos · Agent guide: https://www.grupify.com/llms.txt · API: https://www.grupify.com/openapi.json · GRUPIFY S.A.S. (tax ID 901929426), Bucaramanga, Colombia.