Privacy Policy

Pascal ROMBAUX is committed to protecting your personal data in accordance with EU Regulation 2016/679 of 27 April 2016 (GDPR) and the Belgian law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.

This privacy policy applies to all data collected in connection with the use of the RideComposer software and the ridecomposer.com website.

1. Data Controller

The data controller for personal data is:

Pascal ROMBAUX
Sole proprietorship (natural person) under Belgian law
Company number (BCE/KBO): 0533.706.965
Rue du Cimetière 22, 5640 Mettet, Belgium
Email: info@ridecomposer.com
Website: www.ridecomposer.com

2. Data Collected

Pascal ROMBAUX collects and processes the following categories of data:

2.1 Data you provide to us

• Free trial and newsletter: first name and email address.
• Online services (ride backup, playback on a phone or tablet) and support: email address, used to send you a single-use login code. No password is requested.
• Support requests: subject, description, messages exchanged and attachments (5 MB maximum per file).
• Rozália assistant (website chat): the messages you type.
• Emails: the content of the messages you send us, in particular via the contact and application forms, which open your own email program.
• Dealers and Master Instructors: name, email address, country, method taught, login credentials (hashed password) and information exchanged in the course of the partnership.

2.2 Billing data

Payments are handled by Lemon Squeezy as merchant of record (our authorised reseller), with card processing delegated to Stripe Inc. as payment sub-processor. Pascal ROMBAUX does not access or store bank card data on his servers. Only transaction information (amount, date, reference) is retained for accounting purposes.

The wireless remote control is paid for directly through Stripe, which collects your name, email address, delivery address and payment data; Pascal ROMBAUX receives the information needed for shipping, never bank card data.

2.3 Technical data

• Trial period: a technical identifier of the computer (an hashed fingerprint of the identifier assigned by the operating system, from which that identifier cannot be recovered), the installation date and the days of use, in order to apply the rule of a single trial per computer.
• Licence: the licence key, the computer name and the activation identifier, transmitted to Lemon Squeezy in order to activate and then revalidate the licence.
• Updates: the Software checks the number of the latest version published on ridecomposer.com.
• IP address: processed by our hosting provider Cloudflare at each connection to the website or to our services, and transmitted to Cloudflare Turnstile when a sign-up form is submitted.
• Origin of the visit: the website or campaign that brought you to ridecomposer.com, kept in your browser for the duration of the visit and associated with a free trial request.

The Software does not transmit any diagnostic or telemetry data.

2.4 Your rides

Your rides, annotations and pedagogical programmes are saved on your computer: Pascal ROMBAUX has no access to them.

If you use online backup (Pro and Pro+ plans), the following are stored for each ride backed up: the audio mix of the ride (audio file), its structure (the class score) and its metadata (title, discipline, average BPM, duration, number of tracks), up to a limit of 10 rides. This space is private: only you can access it, from the Software or from the Coach player on a phone or tablet. Nothing is shared with other users.

3. Purposes and Legal Bases for Processing

4. Data Retention Periods

• Online services account and rides backed up online: until you delete them, or until you request the deletion of the account.
• Trial period data: for as long as necessary to apply the rule of a single trial per computer.
• Newsletter and free trial onboarding emails: until you unsubscribe, which you can do in one click from each email.
• Support requests: for the time needed to handle them and to follow up the customer relationship, then for a maximum of 3 years for dispute management.
• Messages sent to the Rozália assistant: not retained by Pascal ROMBAUX. Anthropic may retain them temporarily, in accordance with its policy.
• Data after termination: retained for 3 years for dispute management and legal obligations.
• Billing data: retained for 7 years in accordance with Belgian accounting obligations.
• Audience measurement cookies: set only after you consent, and deleted as soon as you refuse audience measurement.

5. Processors and Data Recipients

Pascal ROMBAUX uses the following providers to deliver the service. Each is subject to contractual confidentiality and security obligations compliant with the GDPR:

Pascal ROMBAUX does not sell, rent or share your personal data with third parties for commercial purposes.

6. Transfers Outside the European Union

Several of our providers are established in the United States or may process data there, in particular Cloudflare, Supabase, Resend, Lemon Squeezy, Stripe, Anthropic and Google. These transfers are subject to the safeguards provided for by the GDPR: the European Commission's adequacy decision of 10 July 2023 (EU–US Data Privacy Framework) for providers certified under it or, failing that, the standard contractual clauses adopted by the European Commission.

7. Your Rights

In accordance with the GDPR, you have the following rights over your personal data:

To exercise your rights, contact us at: info@ridecomposer.com. We will respond within a maximum of 30 days. If you receive no response or an unsatisfactory one, you may lodge a complaint with the Belgian Data Protection Authority (DPA): www.dataprotectionauthority.be.

8. Data Security

Pascal ROMBAUX implements appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or disclosure:

• Encryption of data in transit (TLS 1.3)
• Encryption of data at rest (AES-256)
• HMAC-SHA256 licence mechanism
• Data access restricted to authorised personnel
• Regular security audits
• Security incident management policy

9. Cookies and Tracking Technologies

The ridecomposer.com website uses only:

• strictly necessary items, stored in your browser: your choice regarding audience measurement, your language choice, the origin of the visit (deleted when the tab is closed) and, if you log in to the support area, the online services or the dealer portal, your login session;
• Google Analytics 4 cookies, for audience measurement, only if you accept it.

No advertising or profiling cookies are used.

Audience measurement only runs if you accept it. Nothing is sent before you choose, and you can change your mind at any time:

You can also clear these cookies from your browser settings, or contact us.

10. Children

RideComposer is a professional software intended for indoor cycling instructors. We do not knowingly collect personal data from persons under the age of 18. If you believe that a minor has provided us with personal data, please contact us at the address below.

11. Amendments to this Policy

Pascal ROMBAUX reserves the right to amend this privacy policy at any time. Any material amendment will be notified by email at least 30 days before it comes into force. The current version is always available at ridecomposer.com/privacy.html.

12. Contact

For any questions regarding the protection of your personal data or to exercise your rights:

Pascal ROMBAUX — Data Controller
Email: info@ridecomposer.com
Website: www.ridecomposer.com