In short
To let you watch and to stop the stream being stolen, we process limited technical data — an access code, a short-lived session token, your IP address and the network it belongs to, and basic playback information. We use it to deliver your stream and to detect and stop unauthorised sharing or re-streaming. We never sell it. You can ask us to show, correct or delete what we hold, or withdraw your consent, at privacy@well.run.
1. Who is responsible for your data
The "data controller" — the party that decides how and why your data is processed — is the sole proprietorship behind Well Run:
Data controller
- Trading name
- Well Run
- Operated by
- Kostiantyn Moseichenko (sole trader)
- Registered address
- Laagland 13/bus 1001, 2930 Brasschaat, Belgium
- Enterprise & VAT no.
- BE 1012.851.234
- For privacy matters
- privacy@well.run
When the event you're watching is run by one of our business partners on their own audience, that partner and Well Run may act as joint controllers for the viewing data — Well Run providing the secure delivery, the partner deciding to hold the event. In that case this notice describes Well Run's part, and the partner's own privacy information covers theirs.
2. What we process when you watch
We only process what is needed to deliver the stream and keep it secure. We do not ask for special-category data (health, beliefs, etc.).
| Data | What it is |
|---|---|
| Access code | The one-time code you enter, checked against a stored one-way hash — we don't keep the code itself. |
| Session token | A short-lived signed token that authorises your playback and is bound to your viewing session. |
| IP address & network | Your IP address and the approximate location and network operator (ASN) derived from it — used to authorise playback and to spot a single session being watched from many places at once. |
| Playback & connection data | Technical details such as the number of simultaneous connections on your session, timestamps and basic device/browser information reported by the player. |
We do not use hidden device fingerprinting for this purpose. Any change to that would be reflected here first and, where the law requires, asked of you separately.
3. Why we use it, and our legal basis
Under the GDPR we may only process personal data where we have a lawful basis. Ours are:
| What we do | Why | Legal basis (GDPR Art. 6) |
|---|---|---|
| Deliver the stream to you | To provide the access you bought or were granted | Performance of a contract (6(1)(b)) |
| Keep the broadcast secure & prevent piracy | To stop unauthorised copying, re-streaming and account sharing that harms the rights-holder | Legitimate interest (6(1)(f)) |
| Monitor a session for signs of sharing | To detect and stop a single access being fanned out to many viewers | Your consent (6(1)(a)) and/or legitimate interest (6(1)(f)) |
Before you start watching, we ask you to confirm you've read this notice. Where we rely on your consent for the monitoring described below, you give it there and can withdraw it at any time — that won't affect processing already carried out, though we may then be unable to grant access. Where we rely on legitimate interest, you can object (see section 7).
4. Anti-piracy monitoring & measures
Live events are a frequent target for theft, and protecting them protects the people who produced them. So we're open about the measures we apply:
Your viewing session may be monitored for signs of unauthorised sharing — for example, one access token being used from an unusual number of different places or networks at the same time. Where a session shows that pattern, we may limit it or end it, so that a single paid access can't be turned into a free feed for many.
Our streams are protected by encryption and short-lived, session-bound access, and may in future carry an imperceptible forensic marker that lets a leaked copy be traced back to the session responsible. If we introduce such tracing we will update this notice first. These measures are about deterrence and attribution; they are not used for advertising or any purpose beyond protecting the broadcast.
5. Who we share it with
We do not sell or rent your data. We share it only where needed to run the service:
- Infrastructure providers that host our servers and deliver the video, each bound by a data-processing agreement to act only on our instructions.
- The event's organiser, where you're watching a partner's event powered by us, as described in section 1.
- Authorities or a rights-holder, only where we are legally required to, or where it is necessary to establish or defend a claim against piracy.
6. How long we keep it
We keep viewing and session data only as long as we need it: live session data lasts for the event and a short window afterwards for security and to resolve any dispute, after which it is deleted or reduced to anonymous statistics. Where we record that you agreed to this notice, we keep that record — separately from anything that identifies you more than necessary — as proof of your consent. We do not keep viewing data indefinitely.
7. Your rights & your consent
Under the GDPR you can ask us to give you a copy of the data we hold about you, correct it, delete it, restrict or object to how we use it, or receive it in a portable form. Where our processing rests on your consent, you can withdraw it at any time. To exercise any of these, email privacy@well.run; we'll respond within the legal time limit and free of charge in normal cases.
If you believe we've mishandled your data you can also complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), or the authority in your own EU country.
8. Changes & how to reach us
We may update this notice as our services or the law evolve — in particular before we introduce any new protection measure such as forensic tracing. When we do, we'll change the "last updated" date above. Questions or requests about your data? Email privacy@well.run or write to the registered address in section 1.
This notice is governed by Belgian law and the EU GDPR and complements our main Privacy Policy. It is provided in English; other language versions, once published, will carry equal weight.