Privacy statement Istia

Last updated: October 16, 2026

ISTIA is a cloud platform for sports events: registrations, payments, participants, results and associated communication. In this statement, we explain which personal data we process, why, with whom we share it and what rights you have.

1. Who are we?

Istia Events in Motion B.V. (in formation), trading under the name Istia Midden Engweg 21
3882 TS Putten Netherlands
Email: info@istia.io
Website: https://istia.io

2. Our role: processor and responsible

It is important to know in which role we act.

• Participants, visitors, crew and other parties involved in an event: the organizer of the event determines why and how your data is used. The organiser is the data controller. Istia is a processor and processes the data exclusively on behalf of the organizer, on the basis of a processing agreement. For questions about your registration, your rights or the retention period at a specific event, you are primarily up to the organizer of that event.

• Contact form, customer relationship, support and own website (istia.io): Istia itself is the controller here.

3. What data do we process and why?

We only process the data that is minimally necessary for an event to take place, to process results and to be able to reach you by e-mail.

No other use. We only use personal data to make ISTIA work properly: providing, securing and supporting the platform. We do not sell data, use it for advertising or profiling, use it to train AI models, or give it to third parties for any other purpose. We can only use anonymised and non-traceable statistics to improve the platform.

3.1 Participants and registrants (on behalf of the Promoter)

*The basis is ultimately determined by the organizer as the controller.

We do not ask for more data than necessary. Additional data (e.g. date of birth, nationality or club name) will only be processed if the organiser has a clear reason for doing so, for example for class classification.

3.2 Contact form on istia.io

If you leave your details via the website, we will process your name, email address and the information you fill in about your event. We use this to contact you. Basis: legitimate interest (answering your question) or taking preparatory steps for an agreement.

3.3 Photos and Bib Number Recognition (ISTIA Media)

At events that use ISTIA Media, photos of the event are analyzed with artificial intelligence (AI) to recognize bib numbers . This allows participants to find their own photos.

• The recognition is based on the starting number, not on faces.

• We do not use facial recognition and do not process biometric data.

• For image analysis, we use Microsoft Azure (AI services). The analysis takes place within a Dutch Azure region.

• Microsoft acts as a subprocessor and does not use the images to train its own models.

• Photos are linked to a bib number and thus to the relevant participant within the event.

3.4 Email communication (ISTIA Comms)

To send e-mails (e.g. confirmations, results, practical information for the event) we use the SendPulse platform. For this purpose, we only share your name and email address, and the content of the message. These are service emails about the event you registered for. For commercial mailings or newsletters, we ask for permission in advance, and you can always unsubscribe via the link in the email.

3.5 Website visit

Our website only uses functional cookies that are necessary for its operation, such as your choice of language and display mode (light or dark). No permission is required for this. We do not place analytical or tracking cookies and do not show advertisements.

3.6 Customer relationship, support and consultancy (Istia as controller)

As an organiser or other business partner, we process the data of contact persons: name, position, organisation, email address, telephone number, billing information and the content of our communications, including support tickets and emails. If we support you remotely or on-site, we may temporarily see data on your screen. We use this to execute our agreement, to invoice, to provide support and advice and to comply with legal obligations. Basis: execution of the agreement, legal obligation (administration) and our legitimate interest in improving and securing our services.

4. Who do we share data with?

We never sell your data. We only share data with:

We have made agreements about security and confidentiality in a processing agreement with all our processors.

5. Where is data stored?

All personal data that we store in our platform (database and website) are stored on servers in the Netherlands at Snel.com B.V. We use SendPulse to send e-mail. They only process the data necessary to send the message (name, email address and content). SendPulse works with data centers in the EU, but the contracting party is a US company (SendPulse Inc.). This transfer is subject to the standard contractual clauses approved by the European Commission. Payment providers (SumUp, Mollie and Pay.nl) process payment data, such as your card or bank details, directly and under their own privacy notice. We do not see or store this data and only receive the status of the payment. The payment is made directly between you, the payment provider and the organiser; no money goes through Istia. If another service provider processes data outside the European Economic Area, we will only do so with appropriate safeguards.

6. How long do we keep data?

We do not store data longer than necessary. Below are our standard deadlines. The organiser, as the responsible party, can agree on a different term.

After the expiry of the period, data will be deleted or anonymised.

7. Security

We take appropriate technical and organizational measures, including encrypted connections (HTTPS), role-based access restriction, and limiting data to what is strictly necessary. Access to management environments is secured with multi-factor authentication (MFA/2FA). [Supplement with other measures that are really set up, such as backups and logging.]

Encrypted storage. Personal data is stored in encrypted form. As a result, they are not readable in our management environment and in the normal working methods of our support team. Data will only be shown legibly to the organizer of the event and to the persons who the organizer has authorized to do so within the platform, such as crew or volunteers.

Support. For support, our support team normally does not have access to readable personal data. Remote or on-site support is only provided with the organiser's permission. If the organiser makes data visible himself, for example by sharing a screen, we will only use it to solve the problem.

When data needs to be readable temporarily. Certain functions require data to be temporarily readable by the system performing the task, such as when sending an email (SendPulse) or recognizing bib numbers on photos (Azure). This is done automatically, only for that purpose and within the agreements with these processors.

8. Your rights

You have the right to:

• view your data;

• have inaccurate data corrected;

• Have your data deleted;

• have the processing restricted or objected;

• Have your data ported (data portability);

• permission you have given.

You can submit a request about a specific event to the organizer or to us via info@istia.io. If you contact us, we will pass on the request to the organizer if necessary. We will respond within one month.

9. Complaint

Can't work it out with us? Then you can file a complaint with the Dutch Data Protection Authority via autoriteitpersoonsgegevens.nl.

10. Changes

We may amend this privacy statement. The most recent version is always on istia.io. We will inform you directly in the event of important changes.