Privacy Policy

1. Controller

The controller for data processing on www.xcodata.com under the General Data Protection Regulation (GDPR) is:

Benjamin Schwan
Lottenhammer 40A
66386 St. Ingbert
Germany
Email: ben@xcodata.com

No data protection officer has been appointed, as there is no legal obligation to do so.

2. Overview

XCODATA is a database of mountain bike cross-country results, rankings and statistics. You can use the website without an account and without providing any personal information. We set no cookies unless you explicitly consent to advertising or embedded content.

We only process personal data where needed to run the website, answer your enquiries, send the newsletter, finance the site through advertising, or present sports results. Details are set out below.

Legal bases

Art. 6(1)(a) GDPR – your consent (e.g. newsletter, advertising, embedded content)
Art. 6(1)(b) GDPR – contract or pre-contractual steps (e.g. partnership enquiries)
Art. 6(1)(c) GDPR – legal obligations (e.g. retention duties)
Art. 6(1)(f) GDPR – legitimate interests (e.g. secure and stable operation, cookieless audience measurement)

Where information is stored on or read from your device, this is based on Section 25(1) TDDDG (consent) or, where strictly necessary for a service you requested, Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act).

Recipients and processors

We use service providers who process data on our behalf under data processing agreements pursuant to Art. 28 GDPR. They are named in the sections below.

Transfers to third countries

Some providers process data outside the European Economic Area, in particular in the USA. Transfers only take place where the European Commission has issued an adequacy decision (for the USA: the EU-U.S. Data Privacy Framework, where the recipient is certified) or where appropriate safeguards exist, in particular EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Retention

We keep personal data only as long as needed for the respective purpose or required by law. Specific periods are given for each processing activity.

3. Hosting and delivery of the website

Hosting (Koyeb)

The website is hosted by Koyeb SAS (France). The application runs in data centres in Frankfurt am Main (Germany) and Washington, D.C. (USA); your requests may be served from either location depending on load and your location. Processing in the USA is covered by EU Standard Contractual Clauses.

On every request the server automatically processes:

IP address
date and time of access
requested page or file, HTTP status code and amount of data transferred
referrer URL (previously visited page)
browser and operating system (user agent)

This data is technically required to display the website and to keep it stable and secure (Art. 6(1)(f) GDPR). Server log files are deleted after no more than 7 days unless needed to investigate a security incident.

More information: Koyeb privacy policy

Database (Aiven)

The website's content (results, rankings, rider and team data) is stored in a database run by Aiven Oy (Finland) in a DigitalOcean data centre in Frankfurt am Main (Germany). Visitor data is not stored there.

More information: Aiven privacy policy

Content delivery network (Bunny)

We deliver images, stylesheets, fonts and scripts (including htmx, MapLibre GL JS, Chart.js, Vega and the OpenPanel script) through the content delivery network of BunnyWay d.o.o. (Slovenia) at cdn.xcodata.com. Your IP address and the technical access data listed above are transmitted to Bunny to deliver the files quickly and reliably (Art. 6(1)(f) GDPR).

More information: Bunny privacy policy

Local browser storage

For faster navigation, the website keeps a cache of previously viewed pages ("htmx-history-cache") in your browser's local storage. This data never leaves your device and is strictly necessary for the navigation you use (Section 25(2) no. 2 TDDDG). You can delete it at any time in your browser settings.

4. External resources (map and flags)

We serve fonts, the analytics script and all JavaScript libraries (including htmx, MapLibre GL JS, Chart.js and Vega) ourselves through our CDN (section 3). Only the following files are loaded from third-party servers. Your browser transmits your IP address and technical access data to the respective provider. The legal basis is our legitimate interest in a consistent, working presentation (Art. 6(1)(f) GDPR).

OpenFreeMap – map tiles, map style and map fonts on map pages (tiles.openfreemap.org), provider: [[CHECK PROVIDER]]. Map data © OpenStreetMap contributors. OpenFreeMap website
flagcdn.com – country flags, provider: [[CHECK PROVIDER]]. flagcdn website

5. Audience measurement with OpenPanel

We use the open-source analytics tool OpenPanel, which we host ourselves on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (op.xcodata.com). The data stays in Germany and is not shared with OpenPanel or any other third party.

OpenPanel works without cookies and stores no information on your device. It records: pages viewed, clicks on external links, referrer and campaign parameters (UTM), browser, operating system, device type, screen size, and approximate country or region. Your IP address is used only briefly to determine location and to create an anonymous visitor identifier, and is not stored permanently. The identifier is recalculated daily, so you are not recognised across days.

The purpose is to understand which content is used and where visitors come from, so we can improve the site. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). You can object at any time (section 13), for example by using a tracking blocker in your browser. We serve the analytics script from our own CDN.

6. Contacting us

Contact form and email

When you write to us via the contact form or by email, we process your name, email address, subject, message and the time of sending to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract (e.g. advertising or partnerships), otherwise our legitimate interest in replying (Art. 6(1)(f) GDPR).

Our mailbox is provided by Heinlein Hosting GmbH (mailbox.org), Berlin, Germany. mailbox.org privacy policy

We delete your enquiry once it is fully dealt with and no follow-up is expected, at the latest after 12 months. Business correspondence is kept where statutory retention duties apply.

Spam protection (Cloudflare Turnstile)

To protect the contact form against spam and automated attacks we use Cloudflare Turnstile by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you open the contact form, your browser loads a script from Cloudflare that evaluates technical characteristics of your browser and your IP address to check whether the input comes from a human. According to Cloudflare, Turnstile does not set cookies for advertising purposes.

The legal basis is our legitimate interest in a secure contact form (Art. 6(1)(f) GDPR); reading information on your device is strictly necessary for the protected contact you requested (Section 25(2) no. 2 TDDDG). Cloudflare is certified under the EU-U.S. Data Privacy Framework. If you prefer, simply email us directly. Cloudflare privacy policy

Instagram, Threads and Telegram

If you contact us via Instagram, Threads or Telegram, the respective platform's privacy terms also apply (see section 10).

Sign-up and sending

If you subscribe to our newsletter, we process your email address and, optionally, your first name to send you regular news about races, results and XCODATA. The legal basis is your consent (Art. 6(1)(a) GDPR).

We use double opt-in: after signing up you receive an email with a confirmation link, and you are only subscribed once you click it. To prove your consent, we store the time and IP address of sign-up and confirmation.

Email service provider (Brevo)

Newsletters are sent with Brevo by Sendinblue SAS (France). Your data is stored on servers in the EU. Brevo privacy policy

Performance tracking

Our newsletters contain a tracking pixel and personalised links, which show us whether and when a newsletter was opened and which links were clicked. We use this to understand which content interests readers. This tracking is part of the consent you give when signing up.

Unsubscribing

You can unsubscribe at any time via the link in every issue or by email, which withdraws your consent for the future. We then delete your data. We may keep your email address on a block list so you receive no further newsletters (Art. 6(1)(f) GDPR).

8. Advertising

Google AdSense

To finance XCODATA we show ads via Google AdSense by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, with your consent. Google uses cookies and similar technologies and processes your IP address, device information and usage behaviour to deliver ads, personalise them (if you agree), measure reach and prevent fraud. Data may be transferred to the USA; Google is certified under the EU-U.S. Data Privacy Framework.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Without consent, only non-personalised ads are displayed.

How Google uses data · Google ad settings

Consent management

We obtain your consent through Google's consent management platform ("Privacy & messaging"), which follows IAB Europe's Transparency and Consent Framework (TCF). Your choice is stored in a cookie on your device (Section 25(2) no. 2 TDDDG, Art. 6(1)(c) GDPR). You can change or withdraw your consent at any time via the "Privacy settings" link at the bottom of every page.

Direct advertising and sponsors

Ads and sponsor logos agreed directly with partners are served as images from our own servers. No data is transmitted to the advertising partners. We may count clicks on such ads without personal reference using OpenPanel (section 5).

9. Embedded content (YouTube, Instagram)

Some blog articles embed videos from YouTube (Google Ireland Limited, Ireland) and posts from Instagram (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland). This content only loads when you click the placeholder ("two-click solution"). Only then are your IP address and technical data transmitted to the provider, which may set cookies and, if you are logged in, link the visit to your account. YouTube videos are embedded in privacy-enhanced mode (youtube-nocookie.com).

The legal basis is the consent you give by clicking (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Transfers to the USA are possible; Google and Meta are certified under the EU-U.S. Data Privacy Framework.

Google privacy policy · Instagram privacy policy

We run profiles on Instagram and Threads (@xco_data, both Meta Platforms Ireland Limited) and a channel on Telegram (Telegram FZ-LLC, United Arab Emirates). Our website only links to these profiles; no data is transmitted until you follow a link.

When you visit our profiles or interact with us there, the platform operator processes your data under its own terms. For the "Insights" statistics on Instagram and Threads we are joint controllers with Meta (Art. 26 GDPR). Meta provides a joint controller addendum and takes primary responsibility for handling your rights. We only receive aggregated, anonymous statistics. The legal basis is our legitimate interest in communicating with our community (Art. 6(1)(f) GDPR).

Meta privacy policy · Telegram privacy policy

11. Donations via PayPal

On the "Support" page you can voluntarily support XCODATA with a donation. We link to PayPal, operated by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Data is only transmitted to PayPal once you follow the link. If you pay, PayPal gives us your name, email address, amount, date and any message you add.

We use this data only to process and record the payment and, if you wish, to thank you (Art. 6(1)(b) GDPR), and keep it where statutory retention duties apply (Art. 6(1)(c) GDPR). PayPal privacy statement

12. Rider data (Art. 14 GDPR)

This information is for athletes whose results appear on XCODATA.

What data: name, nationality, gender, age category or year of birth, team and federation affiliation, transfers, race results, times, placings, UCI points and ranking positions, and statistics derived from them; where applicable, links to public social media profiles.

Sources: publicly available result lists from organisers, the UCI and national federations, and public announcements by teams and media.

Purpose and legal basis: We document and analyse mountain bike cross-country racing to make the sport accessible to fans, teams and coaches. The legal basis is our legitimate interest, and the public's interest, in information about public sporting competitions (Art. 6(1)(f) GDPR). Where we process data for journalistic purposes (e.g. blog articles and analyses), the special rules of Art. 85 GDPR in conjunction with Section 23 MStV apply.

Retention: Sports results are part of the sport's history and are generally kept permanently.

Your rights: You have the rights listed in section 13, in particular the right to rectification and to object. Please report incorrect data via the contact form and we will correct it promptly.

13. Your rights

You have the right at any time to:

access the data we hold about you (Art. 15 GDPR)
rectification of incorrect data (Art. 16 GDPR)
erasure (Art. 17 GDPR)
restriction of processing (Art. 18 GDPR)
data portability (Art. 20 GDPR)
withdraw any consent with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR): Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then stop processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

An email to ben@xcodata.com is enough for any request.

Right to lodge a complaint: You can complain to a data protection supervisory authority, in particular in the member state of your residence, place of work or the alleged infringement. The authority responsible for us is: Unabhängiges Datenschutzzentrum Saarland.

14. Changes

We update this privacy policy when the website or the law changes. The version published here applies.

Last updated: November 2026