Privacy Policy

Last updated: 1 June 2026  |  Version: 2.0

Introduction

Our privacy policy explains the information we collect and how we use it. Twenty Peaks is headquartered in Israel and our services are provided to you by Twenty Peaks. We handle personal data in accordance with the data-protection laws applicable to us. If you are a resident of the European Economic Area (“EEA”), Twenty Peaks is the controller of your personal data for the purposes of General Data Protection Regulation (GDPR).

Twenty Peaks
Kerem Ben Shemen
7311100
Israel
Tel: +972-72-2458211
info@twentypeaks.com

This Privacy Policy is provided in English. Any translation that may be offered is for your convenience only; in case of any discrepancy, the English version prevails.

Contents

Age Requirement and Children’s Privacy

Twenty Peaks is intended for adults. You must be at least 18 years old to create an account or use the services. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a person under 18, we will delete it and close the account. If you believe a minor has provided us with personal information, please contact us at info@twentypeaks.com.

Information Twenty Peaks Collects

Twenty Peaks collects information about you, including information that directly or indirectly identifies you, if you choose to share it with Twenty Peaks. We receive this information when you open an account, enroll to one of the events published on the Twenty Peaks platform, provide information necessary for the purpose of shipping items to you, such as your address, and when you connect your Twenty Peaks account to third party services to automatically upload your activities with them to the Twenty Peaks platform. Twenty Peaks also collects information about how you use the services.

Account, Profile, Activity, and Use Information

We collect basic account information such as your name, email address, date of birth, gender, username and password that helps secure and provide you with access to our services. Profile, activity and use information is collected about you when you choose to upload a picture, join an event or upload activity (including date, time and geo-location information as well as your speed). We use your contact information so we can respond to your support requests and possibly deliver items to you as part of your enrollment to one or more events.

Location Information

We process location information in two ways, both with your permission: (a) when you actively connect a third party service (such as Strava, Garmin, Polar, or Wahoo; the list of supported services may change as new integrations are added) so we can import your activities, and (b) when you use map features that access your device’s current location to show you the map and nearby content. We use your device’s current location only while you are using those map features and do not store it. We ask for your device-location permission before using it, and you can revoke it at any time through your browser or device settings.

Content You Share

We gather information from the photos and comments you share on the platform.

Connected Devices and Apps

Twenty Peaks collects information from devices and apps you connect to Twenty Peaks. For example, you may connect your Garmin cycling computer or Strava account to Twenty Peaks and information from these devices and services will be passed along to Twenty Peaks. Supported services may include Garmin, Strava, Polar, and Wahoo, and the list may change as new integrations are added. You can disconnect any connected service at any time, which withdraws your consent for future imports from it.

Payment Information

When you make a payment on Twenty Peaks, you may provide payment information such as your payment card or other payment details. We use PCI-compliant (Payment Card Industry) third-party payment providers — such as our credit-card clearing provider or PayPal — and we do not have access to nor store your credit card information.

Contacts Information

Twenty Peaks does not collect nor store your contacts information.

Technical Information and Log Files

We collect information from your browser, computer, or mobile device, which provide us with technical information when you access or use the services. This technical information includes device and network information, cookies, log files and analytics information.

Cookies and Tracking

Our website uses cookies and similar technologies. We use (a) essential cookies needed to operate the site and keep you signed in; (b) analytics cookies that help us understand how the services are used; and (c) advertising and social-media cookies, set by us and by third-party partners, to measure and promote our services. You can manage or block cookies, including analytics and advertising cookies, through your browser settings; blocking some cookies may affect how the site works.

How Twenty Peaks Uses Information

Twenty Peaks uses the information we collect and receive to operate the services and to customize your experience. For example, with your consent we use your activities recorded by third party services to verify the routes that you have completed and give you credit for them on Twenty Peaks. Part of the information you provide in your profile, such as your name, photo and age will show up on the Twenty Peaks website for example, on a certain route or activity page that you have completed or on the standings page (individual or club).

We also use the information we collect to process payments, provide support related to the services and to communicate with you (including to send marketing material) where you have opted in to receive such messages. We also use the information we collect to analyze, develop and improve the services. To do this, Twenty Peaks may use third-party analytics providers to gain insights into how our services are used and to help us improve the services. We may also use the information we collect to market and promote the services, activities on Twenty Peaks, and other commercial products or services. This includes customizing your Twenty Peaks experience. For example, we may tell you about new in-season challenges that involve climbs close to you or show you sponsored content related to your sport. Any phone number you provide is used only to fulfil and deliver your order and for related order contact; we do not use it to send you marketing messages.

Some of these uses involve profiling — for example, using your activity, location, and preferences to personalize content and show you relevant challenges or sponsored content. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Where we rely on your consent for such personalization, you can withdraw it at any time.

Aggregate Information

We do not sell your personal information. Twenty Peaks may aggregate the information you and others make available in connection with the services and post it publicly or share it with third parties. Examples of the type of information we may aggregate include information about equipment, usage, demographics, routes and performance. Twenty Peaks may use and share de-identified or aggregated information that cannot reasonably be used to identify you with third parties for research and business purposes, such as to help our partners understand more about athletes, including the people who use their products and services. We do not attempt to re-identify such information.

How We Share Personal Information

In addition to sharing aggregated data about our members as described above, we may also share personal information only to the extent needed to run our business and provide the services as detailed below, and where required for legal purposes.

We share personal information only with limited categories of recipients: event organizers you choose to register with; service providers that support, host, secure, analyze, process payments for, or fulfil orders for the services; advertising and social-media partners; our affiliates; and authorities or others where required by law. We do not sell your personal information.

Event Organizers

We may share your personal information with organizers who create events on the Twenty Peaks platform (organizers may be Twenty Peaks or a third party) that you actively sign in for and upon your explicit consent during the registration process to such events. Your consent to share your personal information with the event organizer may be mandatory in order for you to participate in such an event and you will have the option to opt out and not share your personal information should you wish to.

If you create a community or event and act as an organizer yourself, you may receive personal information about participants who register with you. You may use that information only to operate your event and must handle it lawfully and in accordance with this Privacy Policy.

Service Providers

We may share your information with third parties who provide services to Twenty Peaks such as supporting, improving, promoting and securing the services, processing payments, or fulfilling orders. These service providers only have access to the information necessary to perform these limited functions on our behalf and are required to protect and secure your information. We may also engage service providers to collect information about your use of the services over time on our behalf so that we or they may promote Twenty Peaks or display information that may be relevant to your interests on Twenty Peaks or other websites or services.

Shipment and delivery

If you choose a registration option that includes apparel, shipping will be handled directly by our apparel and fulfilment partners. Your shipping details, including name, address, and phone number, will be shared with the relevant partner solely for the purpose of fulfilling your order.

Publicly Available Information

When you join the Twenty Peaks community, your profile and your activities are set to be viewable by everyone by default. Your name and other profile information is viewable by other Twenty Peaks members and the public. For example, your name and photo may show up on a route page if you have completed that specific route.

Affiliates and Acquirers of our Business or Assets

We may share your information with affiliates under common control with us, who are required to comply with the terms of this Privacy Policy with regard to your information. If Twenty Peaks becomes involved in a business combination, securities offering, bankruptcy, reorganization, dissolution or other similar transaction, we may share or transfer your information in connection with such a transaction.

We may preserve and share your information with third parties, including law enforcement, public or governmental agencies, or private litigants, within or outside your country of residence, if we determine that such disclosure is allowed by the law or reasonably necessary to comply with the law, including to respond to court orders, warrants, subpoenas, or other legal or regulatory process. We may also retain, preserve or disclose your information if we determine that this is reasonably necessary or appropriate to prevent any person from death or serious bodily injury, to address issues of national security or other issues of public importance, to prevent or detect violations of our Terms of Use or fraud or abuse of Twenty Peaks or its members, or to protect our operations or our property or other legal rights, including by disclosure to our legal counsel and other consultants and third parties in connection with actual or potential litigation.

How We Protect Information

We take several measures to safeguard the collection, transmission and storage of the data we collect, and we employ reasonable technical and organizational protections that are appropriate to its sensitivity. These include encryption of personal information in transit (such as TLS) and access controls that limit who can reach your information. No method of transmission or storage is completely secure, so while we work to protect your information we cannot guarantee its absolute security.

If a personal-data breach occurs that affects your information, we will take appropriate steps to address it and will notify you and the relevant authorities where required by applicable law.

Managing Your Settings

The settings and controls below let you manage your privacy, your communications, and the information held in your account.

Privacy Controls

When you join, your profile and activities are public by default. You can manage your email and notification preferences as described below. Additional controls over the visibility of your profile and activities are planned for a future version of the platform.

Adjust Email Preferences

You can choose to opt in or out from receiving certain emails and notifications by indicating your preference in your private area on the Twenty Peaks website. You may also unsubscribe by following the instructions contained at the bottom of each email. Any administrative or service-related emails (to confirm a purchase, or an update to this Privacy Policy or our Terms of Use, etc.) do not offer an option to unsubscribe as they are necessary to provide the services you requested.

Updating Account Information

You may correct, amend or update profile or account information at any time by adjusting that information in your account settings. If you need further assistance correcting inaccurate information, please contact Twenty Peaks at info@twentypeaks.com. Twenty Peaks aims to respond without undue delay and in any event within the period required by applicable law.

Deleting Information and Accounts

You can delete your account at any time directly from your account settings on the Twenty Peaks website; if you prefer, you can also request deletion by email to info@twentypeaks.com. When you delete your account, your displayed identity — your name and profile photo — is masked immediately (your name is shown as “Deleted User” and your photo is removed) and you are signed out. Your account is then deactivated and hidden, but it is not erased right away: for 90 days you can recover it simply by logging back in, which restores your account and history. If you do not log back in within 90 days, your account is permanently anonymized and can no longer be reinstated. It may take up to 90 days to remove your personal information and system logs from our active systems, and residual copies may persist in routine encrypted backups for up to one year, until those backups are overwritten or expire in the normal course, after which they are no longer accessible. Your past results and standings are retained in anonymized form — the record and your position on individual or club standings remain, but they are no longer associated with your name. We otherwise retain information only where we are required or permitted by law to do so.

Note that content you have shared with others, such as photos, or that others have copied may also remain visible after you have deleted your account or deleted specific information from your own profile. Your public profile may be displayed in search engine results until the search engine refreshes its cache.

Your Legal Rights

If you are habitually located in the EEA, you have the right to access, rectify, receive a portable copy of (data portability), or erase your information, as well as the right to restrict and object to certain processing of your information. You can exercise your right to erasure yourself at any time by deleting your account from your account settings, as described above. To request a copy of your data or to exercise any of your other rights, contact us at info@twentypeaks.com. We respond without undue delay and in any event within the period required by applicable law (generally within one month). You also have the right to withdraw your consent at any time where we rely on consent — this does not affect processing already carried out — and the right to lodge a complaint with your local data-protection supervisory authority. Learn more.

Wherever you live, you can contact us to access, correct, or delete your personal information, and we will honor the privacy rights that apply to you under the law of your country — including, for residents of Israel, the rights provided under applicable Israeli privacy law.

Twenty Peaks relies on a number of legal bases to collect, use, share, and otherwise process the information we have about you for the purposes described in this Privacy Policy, including:

• as necessary to provide the services and fulfill our obligations pursuant to the Terms of Use;

• where you have consented to the processing;

• where necessary to comply with a legal obligation, a court order, or to exercise and defend legal claims;

• to protect your vital interests, or those of others, such as in the case of emergencies; and

• where necessary for the purposes of Twenty Peaks’s or a third party’s legitimate interests, such as our interests in protecting our members, our partners’ interests in collaborating with our members, and our commercial interests in ensuring the sustainability of the services.

Transfers

Twenty Peaks operates from Israel, and your information may be processed and stored in Israel and in other countries where we or our service providers operate. These countries may have data-protection laws that differ from those in your country. Where we transfer personal data internationally, we rely on a lawful basis for the transfer — such as a recognized adequacy decision or appropriate safeguards — and we take steps to keep your information protected in accordance with this Privacy Policy.

Retention of Information

We retain information as long as it is necessary to provide the services to you and others, subject to any legal obligations to further retain such information. Information associated with your account will generally be kept until it is no longer necessary to provide the services or until your account is deleted. When you delete your account, your displayed identity is masked immediately and the account is deactivated and hidden. It remains recoverable for a 90-day grace period — logging back in within that time restores it — after which the account is permanently anonymized; it may then take up to 90 days to fully delete your personal information and system logs from our systems. Your past results and standings are retained in anonymized form. Additionally, we may retain information where deletion requests are made to comply with the law, prevent fraud, collect fees, resolve disputes, troubleshoot problems, assist with investigations, enforce the Terms of Use and take other actions permitted by law. The information we retain will be handled in accordance with this Privacy Policy. Information connected to you that is no longer necessary and relevant to provide our services may be de-identified or aggregated with other non-personal data to provide insights which are commercially valuable to Twenty Peaks, such as statistics of the use of the services as discussed above.

Different categories of information are kept for different periods depending on why we hold them and any legal requirements; for example, account information is kept while your account is active, and transaction records may be kept longer where required for legal or accounting purposes.

Privacy Policy Information

Twenty Peaks reserves the right to modify this Privacy Policy at any time. Please review it occasionally. If Twenty Peaks makes changes to this Privacy Policy, the updated Privacy Policy will be posted in a timely manner and, if we make material changes, we will provide a prominent notice by email. If you object to any of the changes to this Privacy Policy, you should stop using the services and delete your account.