Data controller
BluHartmann is the company responsible for the personal data covered by this policy. We work out of our offices in Bogotá, Colombia and Lisbon, Portugal.
This policy covers this website only. It does not cover the third-party platforms where the brand has a presence, which are governed by their own policies.
What data we process
It depends on what you do. If you only read the site, we collect no personal data about you: no analytics, no profiling and no cookie for browsing. There are three cases where we do collect data, all three voluntary and all three with their own section below: the cycling campaign route vote, registering for the competition, and creating an access account.
The 2027 Cycling Competition page served its registration form switched off, as a preview, until August 2026. Since then registration is open: the form really submits, and what it collects is described in its own section below.
Access accounts
This site lets you create an account, and sign-up is restricted to addresses on the bluhartmann.com domain: it is a door for the team, not an open register. When you sign up we collect your first name, your last name, your email and a password. The password is NOT stored: all we keep is an irreversible cryptographic digest of it, from which the original cannot be recovered. Alongside that we store the date the account was created and the date it was last modified.
To confirm the address is yours we send it a six-digit code. The code's value is not stored either, only its digest: it expires after 10 minutes, allows at most 5 failed attempts, and after that you have to request a new one. Delivery goes through an external transactional email provider. An account is created with no permissions and cannot sign in until the email is verified; permissions are granted afterwards by an administrator.
When you sign in, your browser receives a technical cookie named token, which is the only thing keeping the session open. It lasts 7 days, is not reachable from the page's code and is not used for analytics or tracking. Signing out deletes it, and changing an account's password invalidates all of its open sessions.
An administrator can list the people who hold an account, edit their details, change their password, change their permissions and delete an account. Deleting it also removes that person's verification codes and password reset requests.
Cookies
This site sets no analytics, advertising or tracking cookies, and it embeds no third-party players or widgets. There are therefore no third-party cookies to declare and no consent banner to show.
The only two cookies this site can issue are technical, and neither is set by browsing: the session one, only if you sign in, and the route vote one, only if you vote. Both are described in their own sections, with how long they last.
Like any web server, the hosting that serves these pages may record technical connection data (IP address and user agent) in its server logs, for security and diagnostics. Those logs are handled by the hosting provider under its own policies.
2027 Cycling Competition route vote
If you take part in the cycling campaign route vote, we store the option you voted for or the text of your proposal, together with an irreversible technical fingerprint derived from your connection. Your IP address is not stored in the clear, and that fingerprint cannot be reversed to recover it.
When you submit a vote, your browser receives a single technical cookie named voto-ruta, whose only purpose is to prevent duplicate votes. It lasts about a year and is not used for analytics or tracking. It is only issued when you vote: browsing the site does not set it.
The purpose of this data is the consultative tally of the vote — the organization makes the final call on the course — and the results are not published: only the organization consults them.
2027 Cycling Competition registration
If you register for the competition we store what you write in the form: name, ID document, date of birth, phone, email, city, category, gender, health insurance, blood type, emergency contact, any allergies or conditions you declare and the social handles you choose to leave. The age shown in the organizer’s statistics is calculated from your date of birth.
Registering requires ticking eight express authorizations, one per use; a submission without all of them is rejected. If you submit the form twice with the same email we keep the first registration and no second one is created. Submitting installs no cookie.
This data lives in the organizer’s campaign store and is consulted only by the organization, to manage registration and the event’s logistics and safety. It is not published and feeds no analytics. The store is campaign-scoped and expires with it: when the competition closes, the organization deletes it.
Purpose and legal basis
The purpose of this site is to inform visitors about what the company does. Access accounts have a different and narrow purpose: to identify whoever signs in, so as to grant or deny access to the areas that require a session.
The legal basis for the technical logs described above is our legitimate interest in running and protecting a corporate website. When you message us through a social profile, the legal basis is your own consent in starting that conversation, and whatever you share stays on the platform you chose.
Your rights as a data subject
You have the right to know, update and correct the information we hold about you, to ask for it to be deleted, to withdraw any authorization you have given, and to lodge a complaint with the competent data protection authority.
Article 8 of Colombian Law 1581 of 2012 grants those rights. If you are writing from the European Union, articles 15 to 22 of the General Data Protection Regulation also grant you rights of access, portability, restriction and objection.
How to exercise your rights
You can exercise any of those rights by writing to us through the official channels published on this site. Today those are our verified Instagram, LinkedIn and YouTube profiles, linked at the foot of this page and in the footer of every other one.
Tell us which right you want to exercise and which data it concerns, so that we can act on it. If we publish a further contact channel, it will appear on this site and this section will cover it too.
Retention and international transfers
Of people who only browse we keep nothing, because we collect nothing. An account's data is kept for as long as the account exists: there is no automatic deletion period, and an account goes away when an administrator deletes it. Verification codes expire after 10 minutes. The technical logs kept by the hosting provider are retained for as long as that provider determines.
Conversations you start on third-party platforms (Instagram, LinkedIn or YouTube) are governed by the policies of those platforms, which run servers outside Colombia and the European Union. Messaging us there may therefore involve an international transfer of your data, carried out by those platforms and not by us.
Changes to this policy
Any change is published on this same page and reflected in the update date that opens the document.
We send no notice of changes. The only email this site sends is the verification code for a new account: there is no mailing list and there are no subscribers.