RAZA respects your privacy. This policy explains what personal data we process when you use the RAZA mobile app, the website somosraza.com, and our community training sessions and events (together, the “Services”); why we use it; who we share it with; and how to exercise your rights. It is issued under Colombian Statutory Law 1581 of 2012, Decree 1074 of 2015 (Chapter 25) and other applicable data protection laws.
1. Data controller
| Legal name | PENDIENTE – Razón social (ej. RAZA S.A.S.) |
|---|---|
| Tax ID (NIT) | PENDIENTE – NIT |
| Address | PENDIENTE – Dirección, PENDIENTE – Ciudad, Colombia |
| Privacy contact | privacidad@somosraza.com |
| Phone | PENDIENTE – Teléfono / WhatsApp |
2. Scope
This policy applies to everyone whose personal data we process: athletes, coaches, club administrators, attendees of training sessions and events, and website visitors. RAZA acts as the controller of the data collected through the Services, including data received from Garmin and other platforms you connect.
3. Data we process
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Name, email, phone, date of birth, city, profile photo | You, at sign-up |
| Athletic profile | Sex, height, weight, level, goals, personal bests, heart-rate zones | You (optional) |
| Physical activity | Activity type, date, duration, distance, pace, speed, cadence, elevation, calories, heart rate during activity, GPS track | Garmin, Strava, Apple Health, Health Connect or manual entry |
| Health and wellness (sensitive) | Daily steps, heart rate and resting heart rate, heart-rate variability, sleep, stress, Body Battery™, respiration, SpO2 | Garmin, Apple Health or Health Connect, only if you connect them |
| Club participation | Training attendance, event registrations, challenges, conquered territories, rankings | App usage |
| Payments | Registration and payment history. Card data is handled by the payment gateway; RAZA does not store it | App usage |
| Technical | Device identifier, OS, app version, push token, crash logs, IP address | Automatically |
We do not collect background location. GPS data comes only from activities you record or import.
4. Sensitive (health) data
Health and wellness data is sensitive data under Article 5 of Law 1581 of 2012. We process it only with your prior, express and informed consent, given in the app when you connect a device or platform. Providing it is optional: you can use RAZA without connecting health data, and basic Services are never conditioned on it. You can withdraw consent at any time. RAZA is not a medical service; information is provided for sport and wellness purposes, not for diagnosis or treatment.
5. Purposes
- Create and manage your account and authenticate you.
- Show your activities, progress, metrics and goals.
- Let your coach see your progress and assign or send workouts to you, only if you turn this on.
- Record training attendance and manage event registrations and payments.
- Calculate community challenges, rankings and territories (using your profile name or alias, per your privacy settings).
- Produce aggregated, anonymous club statistics for RAZA administration.
- Send service notifications. Marketing messages are sent only with your consent and you can opt out.
- Provide support, keep the Services secure, prevent fraud and meet legal obligations.
We do not use health data or data received from Garmin for advertising or commercial profiling, and we do not sell or transfer it to third parties.
6. Garmin Connect™ integration
If you own a Garmin device you may link your Garmin Connect account to RAZA. Linking is optional.
6.1 Authorization
- Before linking, the app shows which data we will receive, why, and a link to this policy. You must expressly accept.
- Authorization happens on Garmin’s official page using Garmin’s authorization system (OAuth). RAZA never requests, sees or stores your Garmin username or password.
- On Garmin’s consent screen you choose which permissions to grant. We receive only the data you approve.
6.2 Data we receive from Garmin
| Garmin API | Data | Purpose |
|---|---|---|
| Activity API | Activities: type, date, duration, distance, pace, speed, heart rate, cadence, elevation, calories and GPS track | Show your history and progress, weekly goals, challenges, territories and training attendance |
| Health API | Daily summaries: steps, heart rate and resting heart rate, sleep, stress, Body Battery™, HRV, respiration, SpO2 | Recovery and training-load indicators for you and, if you allow it, your coach |
| Training API | Structured workouts and their calendar scheduling | Send the workouts your coach assigns to your Garmin device |
6.3 Data RAZA sends to Garmin
If you use the “send workout to my watch” feature, RAZA transfers the workout description (name, steps, duration, intensity, pace or heart-rate targets) and its scheduled date to your Garmin Connect account, so you can run it on your device. The transfer is automated through Garmin’s API and only happens with your express consent, which the app requests before the first transfer.
- Once in Garmin, that data is governed by the Privacy Policy for Garmin Connect and Compatible Garmin Devices, and Garmin may use it under its own terms.
- You must not upload data to your Garmin Connect account if you are legally or contractually restricted from doing so.
6.4 Our commitments regarding Garmin data
- We do not sell, rent or transfer data received from Garmin.
- We do not modify your Garmin data other than formatting it for display in the app.
- We do not share Garmin data with third parties, except the infrastructure providers listed in section 9 (under confidentiality agreements) and your coach if you enable it.
- When we display Garmin device-sourced data, we attribute it to Garmin in accordance with Garmin’s API Brand Guidelines.
- Garmin is not responsible for RAZA’s processing of your data. Data you submit to RAZA is processed by RAZA, not Garmin.
6.5 Disconnection and deletion
You can disconnect Garmin at any time in the app (Profile → Devices → Disconnect Garmin) or from Garmin Connect’s connected-apps settings. When you disconnect, we (a) stop receiving data immediately, (b) revoke access tokens, and (c) delete data obtained from Garmin within 30 days, unless you ask us to keep your history. You can also request deletion without disconnecting by writing to privacidad@somosraza.com.
7. Strava, Apple Health and Health Connect
- Strava: if you connect via Strava’s official authorization, we import your activities (type, date, duration, distance, pace, heart rate and route) for your progress and club challenges. Subject also to Strava’s privacy policy.
- Apple Health (HealthKit): on iPhone, with your permission, we read workouts, heart rate, steps and sleep. HealthKit data is never used for advertising or shared with third parties for commercial purposes.
- Health Connect: on Android, with your permission, we read workouts, steps, heart rate and sleep, in line with Google’s Health Connect data use policy.
8. Artificial intelligence
If we ever wish to use artificial intelligence with your data, we will first: (i) update this policy describing the nature and purpose of that processing; (ii) ask for your explicit, separate and optional consent; and (iii) let you withdraw it easily at any time in the app.
9. Who we share data with
We do not sell personal data. We share it only:
- With your coach and club: your assigned coach sees your progress only if you enable “Share with my coach”. Administrators see aggregated statistics and the attendance and registration data needed to run sessions.
- With other members: only what you choose to make visible (name or alias, rankings, territories).
- With service providers (processors) under contract and only on our instructions:
| Provider | Service | Country |
|---|---|---|
| Vercel Inc. | Website and application API hosting | EE. UU. / USA |
| PENDIENTE – Proveedor de base de datos (ej. Supabase / Firebase) | Database and user authentication | PENDIENTE |
| Apple Inc. / Google LLC | App distribution (App Store / Google Play) and push notifications | EE. UU. / USA |
We do not use third-party analytics, advertising networks, or machine learning / AI platforms to process your data. If we add a provider that processes personal data, we will update this list.
- Authorities: when required by law or a competent authority’s order.
- Corporate transactions: in a merger, acquisition or asset sale, with equal protection and prior notice.
10. International transfers
Some providers host data outside Colombia (for example, in the United States). They are contractually bound to protect it to standards equal to or higher than Colombian law (Article 26 of Law 1581 of 2012).
11. Retention and deletion
| Data | Retention |
|---|---|
| Account and profile | While your account is active; deleted within 30 days of account deletion. |
| Garmin, Strava, Apple Health, Health Connect data | While the connection is active; deleted within 30 days of disconnection. |
| Backups | Overwritten within a maximum 90-day cycle. |
| Payment and registration records | As required by accounting and tax law (up to 10 years), without health data. |
| Aggregated statistics | May be kept in anonymous form. |
Step-by-step instructions: somosraza.com/en/data-deletion.
12. Security
We apply reasonable technical, human and administrative safeguards: encryption in transit (TLS/HTTPS) and at rest, encrypted storage of third-party access tokens, role-based least-privilege access, strong authentication for administrative accounts, audit logs, and periodic provider review. If a security incident affects your data, we will notify Colombia’s Superintendence of Industry and Commerce (SIC), affected users and, where applicable, the partners whose platforms supplied the data (such as Garmin), within the applicable legal and contractual deadlines.
13. Your rights
You have the right to know, update and rectify your data; request proof of consent; be informed of how it is used; withdraw consent and request deletion where no legal duty to retain applies; access your data free of charge and obtain an exportable copy; and file complaints with the SIC after first contacting RAZA. Many of these actions are available in the app under Profile → Privacy.
14. Requests and complaints
Email privacidad@somosraza.com with your name, ID, RAZA account email and a description of your request. Inquiries are answered within 10 business days (extendable by 5); complaints within 15 business days (extendable by 8), with prior notice of any extension.
15. Minors
The Services are intended for adults (18+). Teenagers aged 14–17 may use RAZA only with prior authorization from a parent or legal guardian. We do not knowingly collect data from children under 14 and will delete any such account we identify.
16. This website and cookies
somosraza.com does not use tracking cookies, third-party analytics or advertising. Our host (Vercel) logs technical data such as IP addresses for security and operation. Fonts are served by Google Fonts, which receives your IP address to deliver the files.
17. Changes
This policy is effective as of November 5, 2026. We will notify you in the app or by email before material changes take effect and, where required, ask for consent again. Spanish version: Política de privacidad; in case of discrepancy, the Spanish version prevails.