Privacy policy

Last updated: 1 October 2026. The German version is legally binding.

Controller

The controller responsible for data processing on OCR Guide is Upscaled Media GmbH, Am Metternicher Bahnhof 10, 56072 Koblenz, Germany, registered as HRB 22822 at the Koblenz local court, represented by managing director Dirk Schmid. Contact: [email protected], phone +49 261 44547. Further details are in our imprint.

Hosting and content delivery network

OCR Guide is delivered via Cloudflare, Inc. (USA), using Cloudflare Pages for the static pages and Cloudflare Workers/Functions for server-side features such as the newsletter form. Server log files are generated at Cloudflare. This involves processing technically necessary data such as IP address, the page requested, timestamp and browser used. The legal basis is our legitimate interest in a stable, fast and secure delivery of the website under Article 6(1)(f) GDPR.

Fonts

All fonts are served locally from our own servers. No connection to Google or any other font provider is made when the page loads.

Cookies and tracking

OCR Guide currently sets no cookies and runs no tracking or analytics. A cookie banner is therefore not in use at present. Should we introduce analytics in future, we will update this notice beforehand.

Newsletter

Signing up via the newsletter form on OCR Guide triggers our own server function hosted at Cloudflare. It stores your sign-up, namely your email address, optional first name, language, timestamp and the page you were on, plus a truncated hash of your IP address, as proof of consent in a database at Cloudflare (Cloudflare D1), and passes the details to HighLevel (GoHighLevel / LeadConnector, HighLevel Inc., USA). We use a double opt-in process: you first receive a confirmation email with a link, and only after you click it do we send further newsletter emails.

Newsletter emails are sent by HighLevel, which uses the service provider Mailgun Technologies, Inc. (USA) for delivery. We send from the sender domain news.ocr-guide.com. Links in newsletters carry UTM parameters for evaluation, and HighLevel also records opens and clicks of the emails as part of its standard tracking. You can unsubscribe at any time via the link in every email or by writing to [email protected].

The legal basis for sending the newsletter is your consent under Article 6(1)(a) GDPR. We rely on Article 7(1) GDPR, together with our legitimate interest under Article 6(1)(f) GDPR, for storing the sign-up data as proof of consent. More on signing up is on our newsletter page.

Contact and reporting forms

If you write to us through the contact form, the form for submitting a race, or the form for reporting content, we send the data you enter by email via the delivery service Resend (Resend, Inc., USA) to our mailbox. As a safeguard against loss, we additionally store the same data temporarily in a database at Cloudflare (Cloudflare D1). The legal basis is Article 6(1)(b) GDPR where your enquiry relates to a contract or pre-contractual measures, and otherwise our legitimate interest in handling enquiries under Article 6(1)(f) GDPR.

Race reports and reviews with photos and videos

You can submit race reports and event reviews without an account. We process your text, your rating, your name, your email address and, if you attach any, your photos and videos. If published, your name appears next to your contribution unless you choose anonymous publication. Your email address is never published. The contribution is sent by email via Resend to our editors and you receive a confirmation. Nothing is published before it has been checked.

Photos and videos are uploaded directly when you select them, into non-public storage at Cloudflare (Cloudflare R2, data centre in the EU). They are given a random identifier there, your file name is only used to identify the file in the email to our editors. Please note that photos and videos may contain metadata such as the location where they were taken. We remove this before publishing. Files that are not published, or whose contribution was never sent, are deleted automatically after 90 days.

To protect these forms against automated submissions we use Cloudflare Turnstile. It transmits technical characteristics of your browser and your IP address to Cloudflare in order to detect bots. Turnstile does not set advertising cookies. To limit abuse we store, for each upload, a shortened hash of your IP address that cannot be reversed, together with file size and time.

The legal basis for contributions, photos and videos is the performance of the terms of use you accept when submitting (Article 6(1)(b) GDPR). For Turnstile and abuse limits it is our legitimate interest in secure operation (Article 6(1)(f) GDPR). Accounts and clubs are in preparation, we will update this notice before they launch.

Watchlist

The watchlist stores your selected races solely in your browser (localStorage). No cookies are set for this and no data is sent to our servers.

Map on race pages

Race pages may include a map using OpenStreetMap tiles (OpenStreetMap Foundation, United Kingdom). The tiles are only loaded once you actively click on the map, no connection to tile.openstreetmap.org is made beforehand. Once you click, your IP address is transferred to that service. An adequacy decision by the European Commission covers the United Kingdom. If you additionally use the location search, your browser will ask for permission first, and your position is not transferred to us.

Links to organisers and affiliate links

OCR Guide links to the registration page of the relevant organiser for individual races. Clicking such a link takes you away from OCR Guide, and the organiser’s own privacy policy then applies. Affiliate links to gear are not currently active, and we do not participate in any partner programme at this time.

Transfers to third countries

Cloudflare, HighLevel and Mailgun also process data in the USA. For transfers to the USA, where the respective provider is certified under the EU-US Data Privacy Framework we rely on the European Commission’s adequacy decision of 10 July 2023, and otherwise on the EU Standard Contractual Clauses (Article 46(2)(c) GDPR).

Retention period

We store personal data only for as long as necessary for the relevant purpose or as required by law. Newsletter sign-up data is kept until you withdraw your consent, data from contact and reporting forms is deleted once your enquiry has been fully dealt with, and server log files are automatically deleted after a reasonable period.

Your rights

Under Articles 15 to 21 GDPR you have the right to access, rectification, erasure, restriction of processing, data portability and objection to processing. You can withdraw any consent given at any time with effect for the future. Under Article 77 GDPR you also have the right to lodge a complaint with a data protection supervisory authority, which for us is the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz in Mainz.

For any questions about your data, reach us via our contact page or directly by email at [email protected].