OptiTrack

Data Processing Terms

For clubs and event organisers · Last updated: September 2026

These terms apply whenever a club, class association or event organiser (“the Club”) uses OptiTrack to track and publish races. They set out how OptiTrack processes personal data on the Club's behalf, as required by Article 28 of the GDPR, and they form part of the agreement under which the Club uses the service. Using an OptiTrack administrator account to enter participants means the Club accepts these terms.

In one paragraph. The Club is the controller: it decides who is entered, what is shown, and for how long. OptiTrack is the processor: it stores and displays the data only as the Club instructs, keeps it in the EU, uses the sub-processors listed below, helps the Club answer requests from participants, and deletes the data when the Club asks or leaves. The Club is responsible for informing participants and, for minors, for parental consent. Suggested wording is at the end of this page.

1. Roles

The Club is the controller of participant data.
OptiTrack is the processor. OptiTrack is operated by Hans-Joachim Drescher, 52 Triq Il-Hemel, Swieqi SWQ 3054, Malta (info@optitrack.co).

2. Subject matter, nature and purpose

OptiTrack receives GPS positions from trackers fitted to boats, links them to the entries the Club has made, and publishes live and replay views, start lists and derived results on public web pages and in the OptiTrack app. Processing lasts for as long as the Club uses the service and until the data is deleted under section 8.

3. Data and data subjects

Data subjects	Race participants: helms, crews and skippers entered by the Club, including minors in youth fleets. Club administrators.
Categories of data	Sail number, boat name, participant name (if entered), club, class, division, rating; GPS position, speed and heading of the boat during the race; results derived from the track; tracker hardware identifiers. For administrators: username, hashed password, session data, login records.
Special categories	None. The Club must not enter health, financial or other sensitive data into OptiTrack.

4. The Club's obligations

Ensure a lawful basis for entering and publishing participant data, normally consent obtained through the entry form or the Club's legitimate interest in running and publicising the event.
Inform participants, before the event, that their sail number, positions and — if applicable — name will be published live and in replay, and refer them to the OptiTrack privacy notice.
For participants under the age of digital consent in the Club's country, obtain the consent of a parent or guardian.
Enter only the data needed. OptiTrack recommends publishing sail numbers rather than names, especially for youth fleets. Names should be entered only where the Club has a clear basis for publishing them.
Keep administrator credentials confidential and tell OptiTrack promptly if they may have been compromised.
Handle requests from participants (access, correction, removal) using the tools in the admin pages, and involve OptiTrack where needed.

5. OptiTrack's obligations

Process participant data only on the Club's documented instructions, which include these terms, the settings the Club makes in its admin pages, and the act of publishing a race. OptiTrack will inform the Club if it believes an instruction infringes data protection law.
Ensure the people operating OptiTrack are bound by confidentiality.
Maintain appropriate security: TLS on all connections, hashed passwords and API keys, access to data limited to the Club's own administrators and to OptiTrack's operators, servers hosted in the EU, and backups protected in the same way.
Engage sub-processors only as listed in section 6, and give the Club notice of any change on this page and by email to its administrators at least 30 days before the change takes effect, so the Club can object.
Assist the Club in responding to requests from data subjects, and in meeting its obligations on security, breach notification and data protection impact assessments, taking into account the nature of the processing.
Notify the Club without undue delay, and in any case within 48 hours of becoming aware, of a personal data breach affecting the Club's data, with the information the Club needs for its own notifications.
Delete or return the Club's data at the end of the service as set out in section 8.
Make available the information necessary to demonstrate compliance with these terms and allow for audits, on reasonable notice, by the Club or an auditor mandated by it.

6. Sub-processors

Sub-processor	Purpose	Location
Hetzner Online GmbH	Hosting of servers, databases and backups	Germany (EU)
Google Ireland Ltd — Firebase Cloud Messaging	Push notifications to viewers who opted in. No participant data is sent.	EU / USA, under the EU–US Data Privacy Framework and standard contractual clauses
Map tile providers (Esri, CARTO, OpenStreetMap Foundation)	Background maps loaded by the viewer's browser. They receive the viewer's IP address, not participant data.	EU / USA

The Club's own regatta management system, if it imports entries from one, is a source of data under the Club's control and not a sub-processor of OptiTrack.

7. Publication and transfers

By publishing a race, the Club instructs OptiTrack to make its start list, live and replay tracks and results available to the public without login, including through embedding on other websites and the OptiTrack app. The Club may withdraw a race from publication at any time by deleting it. Participant data is stored in the EU. The Club should be aware that public race pages can be viewed from anywhere.

8. Retention and deletion

Race data is kept for replay for as long as the Club uses OptiTrack.
The Club can, at any time and without OptiTrack's involvement, delete a race, delete the track of a single boat, or replace a participant's name with a sail number.
On request from the Club, OptiTrack deletes specified races or all of the Club's data within 30 days and confirms the deletion.
When the Club stops using OptiTrack, its race data is deleted within 90 days of the end of the service, unless the Club asks for an export first. Backups are overwritten in the normal rotation thereafter.

9. Requests from participants

Requests that reach OptiTrack directly — for example from a sailor or a parent asking for a name to be removed — are forwarded to the Club's administrators. Where the request concerns a minor's name and the Club does not respond within 7 days, OptiTrack may replace the name with the sail number on the Club's behalf and inform the Club.

10. Wording the Club can use

The Club may adapt the following paragraph for its Notice of Race, sailing instructions or entry form:

Tracking and publication of race data. Boats will be fitted with GPS trackers. Each boat's sail number, position, speed and heading during racing, and the results derived from them, will be published live and as a replay on optitrack.co and in the OptiTrack app, where anyone can view them. [Competitors' names will also be shown. / Only sail numbers will be shown.] The organising authority is responsible for this data; OptiTrack processes it on the organising authority's behalf. Its privacy notice is at optitrack.co/privacy. By entering, competitors agree to this publication. For competitors under [16] years, a parent or guardian must give this consent on the entry form. Competitors may ask the organising authority at any time to have their name removed from the published data.

11. General

These terms are governed by the GDPR and the law of Malta, where OptiTrack is established. If any part conflicts with a written agreement between the Club and OptiTrack, the written agreement prevails. OptiTrack may update these terms; changes that reduce the Club's protections take effect only after 30 days' notice to the Club's administrators.

Contact

OptiTrack is operated by
Hans-Joachim Drescher
52 Triq Il-Hemel
Swieqi SWQ 3054, Malta
info@optitrack.co

← Back to OptiTrack