Speyside Challenge Privacy Notice
Last updated: 24 August 2026
Who controls your information
Moray Council is the data controller for the Speyside Challenge. You can contact the challenge team at activetravel@moray.gov.uk, or the Council’s Data Protection Officer at IG@moray.gov.uk. Moray Council Office is at High Street, Elgin, Moray, IV30 1BX, Scotland.
Information we collect
- Account details such as your name, email address, organisation and password.
- Journeys, notes and photos that you submit directly to the challenge.
- Survey responses and support messages that you choose to send.
- If you accept analytics, basic technical and privacy-friendly website analytics information.
- If you connect Strava: your Strava athlete ID, profile name, OAuth tokens, approved scopes, and summary details of non-private activities returned when you press “Refresh from Strava”.
How and why we use it
We use account and journey information to operate the challenge, show you your progress, administer prizes, prevent misuse and respond to support requests. Moray Council relies on its public task and legitimate administrative purposes where applicable. Optional Strava processing and optional website analytics are based on your consent.
Strava data is collected only through Strava’s OAuth and API services after you authorise access. The Strava activity list is displayed only to the authenticated athlete who supplied it. It is not copied into the challenge journey ledger, public totals, rankings or analytics.
Strava retention and your choices
Activity responses from Strava are kept in a private transient cache for 15 minutes and never for more than seven days. OAuth connection details are retained only while your Strava connection is active.
You can view and download the Strava data currently held for you from your dashboard. Select “Disconnect and delete Strava data” to withdraw consent. We will revoke access where possible, permanently delete your Strava connection and cached data, and email written confirmation. A revocation received from Strava’s webhook triggers the same deletion. You may also request access or deletion by emailing activetravel@moray.gov.uk.
Other retention
Account, manually submitted journey, survey and prize-administration records are retained only for as long as needed for the challenge and Moray Council’s applicable records-retention schedule, then securely deleted. Pending Strava registration data expires after 15 minutes.
Cookies and website storage
We use the minimum cookies and browser storage needed to operate the website. Optional analytics remains disabled unless you select “Accept analytics”. Rejecting analytics does not affect your ability to use the website.
- Essential session and security cookies: Laravel uses an encrypted session cookie to keep you signed in, remember form errors and protect requests. Session information normally expires after 120 minutes of inactivity. These cookies are necessary to provide the website and cannot be disabled through our cookie control.
- Cookie preference: your analytics choice and the date of that choice are stored in your browser’s local storage for up to six months. This is necessary to remember and respect your preference. We ask again if the notice changes or the preference expires.
- Fathom Analytics: if you accept analytics, we load Fathom to count visits and understand which pages are useful. Fathom does not use cookies or build individual profiles. It briefly processes technical information such as IP address and browser user agent on our behalf. It remains off if you reject analytics.
- Google reCAPTCHA: the email registration page uses Google reCAPTCHA to prevent automated and abusive submissions. Google may use cookies or similar technologies when that security check loads. It is loaded only where the security check is required.
You can change or withdraw your analytics choice at any time by selecting “Cookie settings” in the website footer. Withdrawal stops future analytics collection from that browser. You can also clear cookies and site data using your browser settings. For more information, read the Fathom Privacy Policy and Google Privacy Policy.
Sharing and service providers
We do not sell personal information. Authorised Council staff and contracted hosting, email, security and website-service providers may process the minimum information needed to operate the service under appropriate safeguards. Google reCAPTCHA helps protect forms, Fathom provides website analytics, and Postmark delivers transactional email.
Strava may monitor and collect information about this application’s use of the Strava API and may use that usage information for its business purposes, including improving the API, support and compliance. Strava processes information under the Strava Privacy Policy.
Your rights
Subject to data-protection law, you may ask to access, correct, restrict, object to, transfer or delete your personal information, and may withdraw consent at any time. Contact IG@moray.gov.uk. You may also complain to the Information Commissioner’s Office.
