This is a translation provided for convenience. In case of discrepancy, the French version prevails.
Privacy policy
Finishers SAS · Finishers (finishers.com)
Version in force since 10 November 2026
1. Who processes your data
The finishers.com website and its services (account, race registrations, bibs sold by Finishers, bib resale, reviews, newsletters) are published by Finishers, a French simplified joint-stock company (société par actions simplifiée) with a share capital of 32,624.90 euros, registered with the Lyon Trade and Companies Register under number 891 456 758, whose registered office is at 20 rue Lortet, 69007 Lyon, France ("Finishers", "we").
Finishers is the controller of the processing described in this policy. For any question or to exercise your rights, write to us at privacy@finishers.com or by post to the address above, marked "Personal data".
When you buy a bib sold by Finishers, we are the controller of your order data and we pass on to the organiser, in your name, the information and choices needed for your registration, in accordance with the mandate provided for in our terms of sale.
When you register for a race, the organiser of that race is also responsible for the data required to organise it: participant management, timing, results, safety, and checks of licences and medical certificates. For these purposes, we act on its behalf, as a processor, and its own privacy policy applies. It is available on its website or on request from the organiser. The same applies to the resale of bibs between participants, which we offer on behalf of the race organiser: the organiser is responsible for sellers' and buyers' data, and we process it on its behalf, as a processor.
When you register, we also process, on our own behalf and as a controller, the participant's identity and contact details, date of birth, gender, the order and the history of their registrations and results, including when you register another person, whom you must inform of this. We use them for the purposes described below, in particular managing your account and history, preventing fraud, our statistics and, in accordance with your choices, our communications. The emergency contact, licence, club, medical documents and answers to event-specific questions are processed solely on behalf of the organiser.
The Finishers Memories photo service is governed by the terms specific to each event, presented on its platform, which describe how data is processed, including facial recognition search where it is offered. This policy does not cover third-party websites we link to either, including those of organisers.
2. What data, why and for how long
We only collect the data necessary for each purpose below. We do not sell your data and do not take any decision about you based solely on automated processing.
| Purpose | Data concerned | Legal basis | Retention period |
|---|---|---|---|
| Creating and managing your account | Username, surname, first name, e-mail, telephone, date of birth, gender, profile picture, disciplines, language, login identifier (Google, Facebook or e-mail), favourites, alerts, race list, saved participants, order history and results. If you log in with Google or Facebook, we only receive your name, e-mail address, where applicable your profile picture, and a technical identifier, never your contacts or posts. The picture received may be displayed next to your username in your area, and you may ask us to delete it at any time at privacy@finishers.com | Performance of the contract (terms of use) | Until your account is deleted, or 3 years after your last login. You are notified by e-mail before an inactive account is deleted |
| Registering for a race and managing your order | Identity and contact details of the participant, date of birth, gender, emergency contact, answers to the organiser's form, options chosen, amounts, order history | Performance of the contract (terms of sale) and, for people registered by someone else, our legitimate interest in keeping a record of registrations and preventing fraud | 5 years after the race, as evidence. Accounting records are kept for 10 years |
| Payment and fraud prevention | Customer and payment identifiers, amount, date, status. Card data is processed directly by Stripe or, for registrations managed by our ticketing partner, by its payment provider (Worldline), and is never sent to us | Performance of the contract, and our legitimate interest in combating fraud | 5 years after the transaction as evidence, 10 years for accounting records |
| Bibs sold by Finishers | Participant's identity and contact details, date of birth, gender, emergency contact, answers to the organiser's form, choices made when ordering, including your consent to receive the organiser's communications | Performance of the contract (terms of sale). The data are passed on to the organiser to complete your registration, in your name, and your choices are carried over unchanged | 5 years after the race, 10 years for accounting records |
| Proof of your acceptance of our terms | Date and time of acceptance, version of the terms accepted, sign-up method | Our legitimate interest in proving that the contract was concluded | Duration of the account or relationship, then 5 years |
| Reviews, ratings and comments, where these features are offered | Username, content published, rating, date, race concerned, verification of your participation where applicable | Performance of the contract (terms of use) | Duration of publication, then 1 year after deletion as evidence |
| Reports and content moderation | Identity and contact details of the person reporting, content reported, reasons, decision taken and challenges | Our legal obligations, in particular under the EU Digital Services Act, and our legitimate interest in moderating the platform | 1 year after the decision, or duration of proceedings in the event of a dispute |
| Reselling and buying bibs between participants | For the seller: identity, e-mail, bib listed for sale and data needed to pay them (the IBAN is sent directly to Stripe). For the buyer: identity, e-mail, telephone, emergency contact, date of birth, gender | Processing carried out on behalf of the race organiser, on the basis of the resale contract | 5 years after the race, 10 years for accounting records |
| Sending e-mails and text messages about your orders | E-mail, telephone, content of messages, delivery and opening status | Performance of the contract | 1 year for sending logs |
| Customer support and complaints | Identity, contact details, content of your exchanges with our customer service | Performance of the contract, and our legitimate interest in answering your requests | 3 years after the last exchange |
| Newsletters: news, races and offers from Finishers, including offers from its partners, without passing your data on to them | E-mail, surname, first name, language, interests (disciplines, favourite races), date of birth, gender, opens and clicks | Your consent, which you can withdraw at any time via the unsubscribe link | Until you unsubscribe, or 3 years after your last interaction |
| Personalised e-mails about races and services similar to those you have used (waiting lists, favourite races, registration openings) | E-mail, surname, first name, races viewed, favourited or already run | Our legitimate interest, for customers, in offering them similar services. You can object at any time, in one click | 3 years after your last order or last login |
| Audience measurement and site improvement | Pages viewed, referrer, device type, country, in aggregated form (Plausible, without cookies). With your consent: detailed browsing statistics and recording of registration journeys to fix difficulties | Our legitimate interest for cookie-free measurement, your consent for the rest | Aggregated statistics with no data identifying you. 13 months maximum for data subject to your consent |
| Personalised advertising and affiliation | Cookie identifiers, pages viewed, purchases made and, for Meta, your e-mail, surname, first name, gender and date of birth, sent in encrypted form to measure the effectiveness of our campaigns | Your consent | 13 months maximum for cookies. Advertising partners then keep this data according to their own policies |
| Security and error fixing | IP address, browser, operating system, pages and errors encountered, your account identifier | Our legitimate interest in securing the platform and fixing malfunctions | 90 days |
| Protection against automated extraction of our content and databases | IP address, user agent, frequency and nature of requests, timestamps, account identifier where applicable | Our legitimate interest in protecting our content and databases, and in establishing evidence of unlawful extraction | 12 months, or duration of proceedings where unlawful extraction is found |
| Relations with organisers and business customers | Surname, first name, position, e-mail, telephone and exchanges of organiser contacts | Performance of the contract, and our legitimate interest in developing our business | Duration of the business relationship, then 3 years |
| Handling disputes and complying with our legal obligations | Data needed to defend our rights, respond to authorities or keep our accounts | Our legitimate interest in defending our rights, and our legal obligations | Duration of the proceedings or obligation concerned |
Mandatory fields are indicated at the time of collection. Without them, we cannot provide the service requested, for example creating your account or confirming your registration.
When you register another person, in particular a child, you undertake to inform them of this policy and, for a minor, to act as holder of parental authority. Finishers accounts are reserved for people aged 15 or over, who declare this by accepting the terms of use. Below this age, registration for a race is made through a legal representative. We do not knowingly collect, on their own behalf, data from people under 15. If we learn that an account has been created by a person under 15, we delete it and the associated data.
3. Who receives your data
Your data is only accessible to the people at Finishers who need it. It may also be disclosed:
- to the organiser of the race you register for, or for which you buy a bib, to organise it and, if you have consented, to send you its own communications;
- to Finish Line Media, our subsidiary which publishes marathons.com, mytrails.com, triathlons.com and stadion.com, only if you have agreed to receive its communications;
- to our ticketing partner Njuko, when your registration is managed through its platform. Some registrations are completed there, in particular to upload licences and medical certificates, which are never kept by Finishers;
- to our service providers, who act on our instructions under a GDPR-compliant contract;
- to administrative or judicial authorities, where required by law;
- to an acquirer or a company of our group, in the event of a merger, sale or restructuring, in accordance with this policy.
We do not disclose your data to business partners for their own marketing without your consent, obtained through a separate, unticked box naming the recipient.
Our main service providers are:
| Provider | Role | Data location |
|---|---|---|
| Google Cloud | Hosting of the database, files and backups | Belgium |
| Vercel Inc. | Website hosting, performance measurement | United States |
| Neon, Upstash | Databases and cache | Germany |
| Typesense | Site search engine | France |
| Google Firebase | Authentication and sign-in with Google or Facebook | United States |
| Stripe | Payment, transfers, fraud prevention | United States and European Union |
| Twilio (SendGrid) | Sending e-mails and text messages | United States |
| Brevo | Sending newsletters | European Union |
| Emailable | Checking the validity of e-mail addresses | United States |
| Zendesk, Front | Customer service | United States |
| Sentry, LogRocket | Error tracking and, with your consent, journey analysis | United States |
| Plausible | Cookie-free audience measurement | European Union |
| Cloudinary | Delivery of site images | United States |
| Inngest | Running technical tasks | United States |
| Mapbox, MapTiler, Google Maps | Maps and place search | United States and Switzerland |
| Google reCAPTCHA | Protecting forms against bots | United States |
When, with your consent, we use the advertising tools of Meta, Google, Criteo or Kwanko, these companies receive data about your browsing. For the collection and transmission of this data from our site, we are joint controllers with them. They then process it for their own purposes, according to their own privacy policies.
4. Transfers outside the European Union
The platform's database, files and backups are stored in the European Union. Some service providers, listed above, are established in or access data from countries outside the European Union, in particular the United States. These transfers are governed by the provider's certification under the EU-US Data Privacy Framework or, failing that, by the standard contractual clauses adopted by the European Commission. You can obtain information about these safeguards by writing to privacy@finishers.com.
5. Cookies and third-party content
On your first visit, a banner lets you accept or refuse non-essential cookies, just as easily either way, or choose by category. You can change your choices at any time via the "My cookies" link at the bottom of every page. Your choice is kept for 12 months.
| Category | Use | Consent |
|---|---|---|
| Strictly necessary | Logging in to your account, basket and order, security, remembering your cookie choices | Not required |
| Cookie-free audience measurement | Aggregated statistics (Plausible) and performance (Vercel Speed Insights) | Not required |
| Audience measurement and improvement | Finishers' detailed browsing statistics, analysis of registration journeys (LogRocket) | Required |
| Advertising and affiliation | Measurement and personalisation of advertising (Google Ads, Meta, Criteo) and attribution of sales to our affiliate partners (Kwanko) | Required |
| Third-party content | Playing YouTube videos embedded in pages | Required |
No cookie subject to consent is set before you have accepted it. YouTube videos are only loaded after your consent, in privacy-enhanced mode. The partners concerned process this data according to their own policies: policies.google.com/privacy for Google and YouTube, facebook.com/privacy/policy for Meta, criteo.com/privacy for Criteo and kwanko.com for Kwanko.
Some pages include services provided by partners, such as transport and accommodation booking or spaces supplied by sponsors. These services are provided under the responsibility of those partners, who may set their own cookies when you use them.
Links to our social media accounts are simple links: they do not send any data to these networks unless you click on them.
6. Your rights
Under the GDPR and the French Data Protection Act, you have the following rights over your data:
- access: knowing what data we hold and obtaining a copy;
- rectification of inaccurate or incomplete data, in particular from your account;
- erasure, in the cases provided for by law, including deletion of your account;
- restriction of processing, for example while a dispute is being checked;
- objection to processing based on our legitimate interest, and at any time to direct marketing;
- portability of the data you have provided to us;
- withdrawal of your consent at any time, without affecting processing already carried out;
- setting instructions for what happens to your data after your death.
To exercise these rights, write to privacy@finishers.com. We reply within one month, which may be extended by two months if the request is complex. If we have reasonable doubts about your identity, we may ask you for proof. Requests relating to the organisation of a race, in particular results, may also be sent to its organiser.
If you believe your rights are not being respected, you can lodge a complaint with the CNIL, the French data protection authority, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or online at cnil.fr.
7. Security
We implement appropriate technical and organisational measures to protect your data: encrypted connection (HTTPS), encryption of hosted data, access restricted to authorised people only, backups, and use of service providers offering sufficient security guarantees. Card data never passes through our servers.
8. Updates
We may amend this policy, in particular to reflect changes to our services or to regulations. The effective date of the current version is shown at the top of this page, and previous versions remain available. In the event of a significant change, we will inform you by e-mail or by a message on the site. The French version prevails.