Privacy policy

Data controller: Guillem Pejó Vergara, trading as KM Poster. Contact: hola@kmposter.com. The address and tax ID are in the legal notice.

What data we process

• Order and contact details: email, name and delivery address (printed orders only). Used to process payment, generate and deliver your poster and give you support.
• Your route data (GPX file): the coordinates you upload are used only to generate your poster. We do not publish your route or share it with third parties for commercial purposes. Your route only leaves your browser when you place an order. If it starts at your home, you can move or zoom the framing so the start falls outside the poster.
• Design draft: when you go to pay, your design is saved only in your browser (session storage) so you do not lose it if you cancel the payment. It is deleted when you close the tab or complete the order.
• Browsing data: we measure how many visits reach each step (viewing the site, opening the editor, designing, paying) with our own cookie-free analytics: for measuring, we store nothing in your browser and do not keep your IP address; each visit carries a random number that is forgotten when you close the page. We only note the domain you came from, the campaign (utm_source) and whether you are on mobile or desktop. If your browser asks not to be tracked (Do Not Track or GPC), this analytics measures nothing. We also use Cloudflare Web Analytics, also cookie-free, which counts visits and measures how fast each page loads.
• Preferences: your browser keeps the light or dark theme and the currency you choose, only to remember them on your next visit. We do not receive them.
• Gift card: the recipient's name, the giver's name and the message are printed on the card and shown to whoever has the code. Whoever redeems it gives us an email address to receive the PDF.
• Route by stops: if you draw your route by searching for places, the names you type and the coordinates of the stops pass through our server to the place search (Photon, by Komoot) and the OpenStreetMap routing service (FOSSGIS). They only receive the search or the coordinates, never your IP address or who you are, and we keep the answers for a while to avoid repeating queries.
• Organisers and clubs: if you write to us from the organisers page, we keep your name, email, race and message only to reply to you.
• News and welcome code: if you sign up, we keep your email, language, the date you gave permission and whether you confirmed it. We send you the discount code and, only if you confirm with the link in the email, the news (at most once a month). Each email has a link to delete your address immediately.
• Discount codes: we keep each code, its percentage, its expiry date and the order that used it, so it only works once.
• Customer gallery (optional): if you tick the box when buying, we keep a copy of your poster without your name, bib number, time, splits, dedication or the texts of the stops to review it and, if it fits, show it in the gallery. The route is visible, which is why we review each one by hand before publishing it. You can ask us to remove it at any time.
• “Notify me”: if you ask us to notify you about a race, we keep your email, the race and the date you gave permission. We write to you once only (when the race has been run or its poster is ready) and each email has a link to delete your address immediately.
• Technical errors: if the site fails, we send the error message, the page and the browser type so we can fix it.

Legal basis

Performance of the contract (processing your purchase or redeeming a gift card), legal obligations (invoicing and tax), consent (“Notify me”, news and gallery, which you can withdraw with the link in each email or by writing to us) and legitimate interest (security and improving the service).

Processors (third parties)

• Stripe — payment processing.
• Printful — printing and shipping of physical orders (receives name, delivery address and the print file).
• Resend — sending transactional emails.
• IONOS — hosting of the website and files.
• Cloudflare — cookie-free visit statistics (Web Analytics), DNS and forwarding of contact email.
• OpenFreeMap — background map tiles. To draw the map, your browser (and our server, when generating the PDF) requests the tiles for the area of your route: it receives that approximate area and your IP address, not the route. Map data © OpenStreetMap.
• Fonts and libraries are served from our own server: we do not use Google Fonts or third-party CDNs. The only exception is Cloudflare's small statistics script.

Some of these providers may process data outside the European Economic Area. When they do, they apply the safeguards required by the GDPR, such as the European Commission's standard contractual clauses.

Cookies

This website uses no first-party or advertising cookies. When you pay you move to Stripe's page, which has its own terms.

Retention

We keep order data for the period required by tax law. “Notify me” addresses are deleted when you unsubscribe and at the latest one year after the race. News addresses, when you unsubscribe (and unconfirmed ones after six months at the latest). Gallery posters, when you ask us to remove them. Your poster files are kept for as long as needed for delivery and support.

Your rights

Access, rectification, erasure, objection, restriction and portability by writing to hola@kmposter.com. You can complain to the Spanish Data Protection Agency (aepd.es).

This is a translation for information purposes; the Spanish version prevails.

Last updated: 1 November 2026.