This policy explains what personal data ShadowPass collects, why, who it is shared with, how long it is kept and what your rights are. It applies to the site, the app and related services, in accordance with Regulation (EU) 2016/679 (GDPR).
1. Data we collect
- Identity and account: last name, first name, email address, password (encrypted), date of birth where applicable.
- Dancer profile: dancer name, crew, dance styles, profile photo, city.
- Participation: events, categories, tickets, teams, results, points and rankings.
- Payment: transactions processed by Stripe and PayPal. No bank card data is stored by ShadowPass.
- Authentication: credentials managed through our identity provider and, where applicable, Google and Apple sign-in.
- Technical data: IP address, connection logs, device type, push notification token (Firebase) if you accept it.
2. Purposes and legal bases
- Management of accounts, registrations and ticketing — performance of the contract.
- Rankings, points and public profiles — contract and legitimate interest.
- Push notifications and non-essential communications — consent.
- Security and fraud prevention — legitimate interest.
- Accounting and tax obligations — legal obligation.
3. Anonymity: what is public and what stays private
ShadowPass strictly separates public data from private data.
- ✅ Public: dancer name and crew (profiles, rankings, search, organizer views).
- ❌ Private: legal name and email address, never displayed publicly.
→ Learn more about participant anonymity
4. Transfers outside the European Union
Some processors may process data outside the European Union. These transfers are covered by appropriate safeguards (European Commission standard contractual clauses or an adequacy decision).
5. Retention periods
- Account and profile: kept while the account is active, then deleted or anonymized.
- Registrations and results: kept to ensure ranking consistency, with identifying elements that can be anonymized.
- Billing: statutory accounting retention period (generally 10 years).
- Technical logs: a few months to one year.
6. Security
Encrypted communications and passwords (HTTPS/TLS), role-based access control, multi-city partitioning for organizers, use of certified payment providers (no card data stored).
7. Cookies
We use cookies that are strictly necessary for operation (session, authentication, security). Non-essential trackers, if any, are only set after your consent.
8. Your rights
Under the GDPR, you have the following rights:
- Access and rectification.
- Erasure (right to be forgotten).
- Restriction and objection.
- Portability of your data.
- Withdrawal of consent at any time.
- Instructions regarding your data after your death.
To exercise these rights, write to support@shadowpass.digital. You can also delete your account directly from the Service.
9. Complaints
You may lodge a complaint with the CNIL (3 place de Fontenoy, 75007 Paris, www.cnil.fr) or with the authority of your country of residence.