IRONMAN Event Registration
and Participation Privacy Policy 

Privacy protection is important to us. This Ironman Event Registration and Participation Privacy Policy ("Privacy Policy") describes how we process personal data through your registration and participation in our Events. 

When we use the term "personal data" we mean any data that identifies you or makes you identifiable as a natural person.  

When we use the term "Events" we mean the sport events, races and competitions listed in Annex 1. These Events might be part of our Event series, including, without limitation, the IRONMAN and IRONMAN 70.3 series, Rock'n'Roll series, UTMB Series, Haute Route and Gravel Epic Events, the Epic Series, Velothon series and Cyclassic series.

Your Event registration is conducted by third-party event registration service providers (“Registration Partners”), in most cases Active Networks, which will give us access to the registration information after the registration form has been submitted. This Privacy Policy applies only to our processing your personal data after access has been granted. 

Please note that this Privacy Policy does not apply to Events which are organized by third party licensees. We maintain a separate privacy policy for the processing of data related to the use of our websites (such as ironman.com; runrocknroll.com; u.ironman.com), our marketing activities, and our social networking pages, profiles, and feeds. You can find this policy in the footer of our websites. For our merchandising activities, please see the policies on the Ironman store websites   (ironmanstore.com, runrocknrollstore.com and eu.ironmanstore.com). The policies for Ironman volunteer activities and media accreditation in Europe are provided at the volunteer registration or application for media accreditation.  

1. Who is data controller of your personal data?

World Triathlon Corporation, located at 3407 W. Dr. Martin Luther King Jr. Blvd., Suite 100, Tampa, Florida 33607  ("WTC") is the data controller for all Events. WTC is responsible for, and controls, the processing of your personal data. 

If you wish to contact WTC, you can find additional contact details at the end of this Privacy Policy. 

WTC organizes some of the Events alone, but there are many Events which are organized by WTC's local subsidiaries and affiliates ("Ironman Entities") with support from WTC. For these Events, the organizing Ironman Entity acts as joint controller together with WTC (WTC and the respective Ironman Entity collectively "Joint Controller", "Ironman", "we", "us" or "our"). Please see Annex 1 to check whether the Event for which you have registered is organized by WTC alone or by an Ironman Entity. 

Our Registration Partners process the payment for our Events independently. For this reason, this Privacy Policy does not apply to the payment processing by our Registration Partners, and we encourage you to check the privacy policy of our Registration Partners to learn about its privacy practices.  

2. What personal data do we collect? 

In the context of our Events, we collect personal data about you. Please see Annex 2 for a detailed description on the personal data we collect. On a more general level, the personal data we collect, can include the following: 

• If you register for an Event. Name, e-mail address, phone number, address, birth date, place of birth, gender, information on medical condition and medications, emergency contact information, relay information and other information you provide during registration. The Joint Controllers also have access to the last 4 digits of the credit card used for the registration in order to initiate refunds by the Registration Partner.  
• If, in the course of registration, you subscribe to our newsletter. Name, e-mail address, marketing campaign information such as your reaction to our marketing and your interest in our Services. 
• In the course of preparing the Event and during the Event, we might add other information, such as your registration number and the age group to which you are allocated as well as your performance in the Event. 

3. How do we collect your personal data?

• Personal data you provide to us: Most of the personal data we receive comes to us voluntarily from our athletes in the course of registering for an Event.  
  
  You are free to choose which information you want to provide to us or whether you want to provide us with personal data at all. However, some information, such as information requested in the registration procedure and information collected during the Event, may be necessary for the performance of our contractual obligations in the context of your Event participation. Without providing this personal data, you will not be able to enter into a contract with us by registering for our Events. 
• Personal data we receive from others: We may receive personal data about users from third parties. For relay registrations and registrations by a TriClub Manager, we might receive your basic contact information from the person registering the relay team or the TriClub Manager. We will use this personal data to send you a registration link. In the course of the Event we will receive personal data on your performance and on incidences in which you are involved by our services providers. 

4. Why and on which legal basis do we collect and use your personal data? 

The reasons for using your personal data may differ depending on the purpose of the collection. Please see Annex 2 for a detailed description on the purposes for which we use your personal data. On a more general level, we regularly use your personal data for the following purposes and on the following legal grounds: 

• We use your personal data for the performance of our contractual services or for the preparation of a contract with you. If you register for our Events or if you contact us to register for our Events, we use your personal data to conduct our Events and make your participation in our Events possible. We will use your personal data to organize your participation in the Events, for example by allocating a bib number to you and specifying your race category classification. We will send you e-mails with organizational information and communicate with you in case of questions. One of our paramount tasks is to make sure nothing happens to you during our Events. We will therefore monitor you during the Event and share your medical data with our medical teams to help you in case of a medical emergency.  
  
  Most of our Events are part of bigger Event series and are therefore interlinked. By participating in one Event, our athletes can qualify for other Events and accumulate points for our overall Ironman rankings. For this reason, personal data collected in one Event (such as the race results and ranking in this Event) will potentially be used for the qualification of other Events and in the context of our overall Event series.  

• We use your personal data if justified by our legitimate interests. The usage of your personal data may be necessary for our own business interests. For example, we may use some of your personal data to evaluate and review our Events, the demographics of our athletes and our overall business performance (such as Event participation, cancellations, Event related incidents) and improve and individualize your experience and enjoyment of our Events. If necessary, we may also use your personal data to pursue or defend ourselves against legal claims.  

• We use your personal data after obtaining your consent. In some cases, we may ask you to grant us separate consent to use your personal data. Where we ask you for your consent, you are free to deny your consent and the denial will have no negative consequences for you. You are also free to withdraw your consent at any time with effect for the future. If you have granted us consent to use your personal data, we will use it only for the purposes specified in the consent form. 
  
  This also includes our e-mail marketing activities. If you sign up to our e-mail newsletter during registration, we will use your personal data for our e-mail newsletters. You may unsubscribe from our e-mail newsletter at any time [unsubscribe from this list]. You may also contact us via e-mail, phone or mail at the address provided at the end of this document to request that we remove you from our e-mail list. 

• We use your personal data to comply with legal obligations. We are obligated to retain certain personal  data because of legal requirements, for example, tax or commercial laws or we may be required by law enforcement to provide personal data on request. 

We will only use your personal data for the purposes for which we have collected them. We do not use your personal data for automated individual decision-making. 

5. With whom do we share your personal data?  

As required in accordance with how we use it, we will share your personal data with third parties. Please see Annex 2 for a detailed description of the third parties and the personal data we might share with them. On a more general level, we share your personal data with the following categories of third parties: 

• Ironman Entities. WTC works closely together with the Ironman Entities around the world in regard to Event organization and marketing activities. If WTC or other Ironman Entities support other Ironman Entities in the organization of an Event, all registration data will be accessible to WTC and the Ironman Entities involved for the purposes of Event organization. If you would like to find out which Ironman Entities provide support for your Event, please contact [email protected]. 

• Service providers and advisors. Third-party vendors and other service providers that perform services for us, which may include marketing campaign services, providing mailing or e-mail services, medical support, Event surveillance, time keeping, services related to the registration and organization of our Events, payment processing, data enhancement services or fraud prevention. If applicable, such service providers will, by appropriate data processing agreements, be bound to process personal data only on our behalf and under our instructions. 

• Event photographers. If you participate in our Events and have given us consent to do so, we will disclose your bib number, name, e-mail address and phone number to the Event photographer, who may contact you with photos from the attended Event. 

• Purchasers and third parties in connection with a business transaction. Personal data may be disclosed to third parties in connection with a transaction, such as a merger, sale of our assets or shares, reorganization, financing, change of control or acquisition of all or a portion of our business, or in the event of a bankruptcy or similar proceedings. 

• Law enforcement, regulators and other parties for legal reasons. Personal data may be disclosed to third parties as required by law or subpoena or if we reasonably believe that such action is necessary to (a) comply with the law and the reasonable requests of law enforcement; (b) to enforce our legal claims or to protect the security or integrity of our Services; and/or (c) to exercise or protect the rights, property, or personal safety of WTC, the Ironman Entities, our partners, employees, athletes, visitors or others. 

• The public. The official rankings and information justifying the ranking will be disclosed to the visitors of our Events and on our websites. 

6. How long do we keep your personal data? 

We will store personal data for as long as necessary to fulfill the purposes for which we collect personal data, in accordance with our legal obligations and legitimate business interests. Afterwards, or at the end of the statutory retention times, the personal data  will be deleted as applicable. For example, national commercial or financial codes may require us to retain certain information for up to 10 years.  

7. How do we protect your information? 

We implement a variety of security measures to maintain the safety of your personal data. However, no system of security can be 100% secure and so we cannot guarantee in all cases the security of the information that we process. In the event we learn that personal data is compromised as a result of a breach of security, we will take steps to investigate and comply with notification obligations and take other steps, in accordance with applicable laws and regulations. 

8. How do we safeguard your personal data when there is an international transfer?  

As WTC is located in the United States, we transfer personal data from other countries to the United States. Depending on your place of residence or location, this may mean that your personal data will be stored in a jurisdiction that offers a level of protection that may, in certain instances, be less protective of your personal data than your resident jurisdiction.  

For this reason, we have entered into guarantees to ensure appropriate safeguards. WTC and Ironman Entities have entered into contracts based on the EU Standard Contractual Clauses for the benefit of the affected data subjects to safeguard any transfer of personal data from the European Union or the European Economic Area to other countries as well as the direct collection of such personal data by WTC. Please contact [email protected] for more information. 

Before transferring your personal data to a third party outside the European Union and European Economic Area, we will enter into contracts based on the EU Standard Contractual Clauses to safeguard your personal data. 

9. What rights and choices do you have?  

We want you to understand your rights and choices regarding how we may use your personal data.  

Individual Rights. You have specific rights under applicable privacy law in respect to your personal data that we hold, including a right of access and erasure and a right to prevent certain processing activities.  

Choices. If you do not want to participate in an Event using your real name, you can contact our data protection team at [email protected], which will discuss with you the possibility to participate under an alias. 

a) Your European Union Rights 
If you are located in the European Union or if your Event takes place in the European Union, you have the following rights in respect to your personal data that we hold: 

• Right of access. The right to obtain access to your personal data. 
• Right to rectification. The right to obtain rectification of your personal data without undue delay where that personal data is inaccurate or incomplete. 
• Right to erasure. The right to obtain the erasure of your personal data without undue delay in certain circumstances, such as where the personal data is no longer necessary in relation to the purposes for which it was collected or processed. 

• Right to restriction. The right to obtain the restriction of our data processing in certain circumstances, such as, where you contest the accuracy of your personal data, for a period of time enabling us to verify the accuracy of that personal data. 
• Right to portability. The right to portability allows you to move, copy or transfer personal data easily from one organization to another. It only applies to personal data that you have directly provided to us. 
• RIGHT TO OBJECT. YOU HAVE A RIGHT TO OBJECT TO ANY PROCESSING BASED ON OUR LEGITIMATE INTERESTS WHERE THERE ARE GROUNDS RELATING TO YOUR PARTICULAR SITUATION. YOU CAN OBJECT TO THE USE OF YOUR PERSONAL DATA FOR MARKETING ACTIVITIES FOR ANY REASON WHATSOEVER. 

If you wish to exercise one of these rights, please contact us using the contact details below.  

• E-Mail Settings and Preferences. If you no longer want to receive marketing e-mails from us, you may choose to unsubscribe at any time [unsubscribe from this list]. 

In addition to the foregoing listed rights, if you are located in the European Union, you also have the right to lodge a complaint with a data protection authority. Further information about how to contact your local data protection authority is available at  
http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm. 

b) Your Nevada Privacy Rights 
Under Nevada law, Nevada residents may opt out of the “sale” of their personal information, where the information is exchanged for monetary consideration.  If you are a Nevada resident, you may submit a request to opt out of potential future sales under Nevada law by sending a message to our data protection team at [email protected].  Please note we will take reasonable steps to verify your identity and the authenticity of the request.   

• The Right to Know.  The right to have us disclose to you any or all of the following information relating to your personal data we have collected and disclosed in the last 12 months, upon verification of your identity:  
  • The specific pieces of personal data we have collected about you;  
  • The categories of personal data we have collected about you;  
  • The categories of sources of the personal data;  
  • The categories of personal data that we have disclosed to third parties for a business purpose, and the categories of recipients to whom this information was disclosed;  
  • The categories of personal data we have sold and the categories of third parties to whom the information was sold; and  
  • The business or commercial purposes for collecting or selling the personal data. 
• The Right to Request Deletion.  The right to obtain the deletion of personal data we have collected from you, subject to certain exceptions. 
• The Right to Opt Out of Personal Information Sales.  Ironman does not “sell” personal data such as your name or email address to third parties for their direct marketing purposes.  However, we do allow certain third-party advertising partners to collect information about the users of our Services for the purposes of serving ads that are more relevant, for ad campaign measurement and analytics, and for fraud detection and reporting.  To the extent this practice is interpreted to constitute a “sale” under the CCPA, please see the Cookies and similar technologies section of the Privacy Policy for more information about how we share personal data within WTC and with a variety of third parties for our business purposes. Please also note that we partner with many other businesses in connection with Ironman Events, including Registration Partners, Photographers, and others and the personal information you provide to these third parties will be subject to their own privacy policies and practices.  

You also have the right to be free of discrimination for exercising these rights. However, please note that if the exercise of these rights limits our ability to process personal data (such as in the case of a deletion request), we may no longer be able to provide you our products and services or engage with you in the same manner. 

You may submit a request to exercise your California consumer rights through one of the mechanisms described below. We will need to verify your identity before processing your request, which may require us to request additional personal data from you or require you to log into your account, if you have one.  In certain circumstances, we may decline or limit your request, particularly where we are unable to verify your identity or locate your information in our systems, or as permitted by law. 

• To exercise your Right to Know, please contact us using the contact details below or call (844) 868-7727. 
• To exercise your Right to Request Deletion, please use the contact details below or call (844) 868-7727.  
• To exercise your Right to Opt Out of Personal Information Sales, please click the following link:  

Do Not Sell My Personal Information 

• To opt out or control the use of your personal information by social media, advertising and analytics partners, please see the Cookies and similar technologies section of the Privacy Policy.  

10. How to contact us? 

If you have any questions or concerns about our Privacy Policy or if you want to exercise your rights, please contact WTC using the address at the beginning of the Privacy Policy or contact the Ironman Entity involved in the organization of the Event, whose contact details you will find in Annex 1. You can also send an e-mail to [email protected]. 

11. Data Protection Officer 

Some Ironman Entities have appointed Data Protection Officers. Please find the names and contact details of the Data Protection Officers in Annex 1. 

12. Online Privacy Policy Updates 

We may make changes to our Privacy Policy from time to time. Please review our Privacy Policies regularly as updated Privacy Policies will apply to future Events. 

Date: 01/01/2020 

All Ironman Events are organized or supported by World Triathlon Corporation. Most of the Events are organized by local Ironman-affiliated entities. Check out which Ironman entities are involved in the EU Event for which you have signed up. If you’d like more information regarding an Event that is not on this list, please contact [email protected].  

Please note that this Privacy Policy does not apply to Ironman Events organized with the help of third parties.