Privacy Policy

“Personal Information” means information relating to an identifiable, living natural person and, where applicable under POPIA, an identifiable existing juristic person. It includes the equivalent concept of “personal data” under another applicable data protection law.

“POPIA” means the Protection of Personal Information Act 4 of 2013, as amended or replaced from time to time.

“Kenya DPA” means the Data Protection Act, 2019 of Kenya, together with its applicable regulations, as amended or replaced from time to time.

“Golazo Group” means Golazo and its affiliated Golazo companies and operations from time to time.

“Processing” means any operation or activity concerning personal information, including collecting, recording, organising, storing, updating, retrieving, using, sharing, transferring, restricting, erasing or destroying it.

“Special Personal Information” includes information about health, biometric information used for identification, race or ethnic origin, religious or philosophical beliefs, trade-union membership, political persuasion, sex life and criminal behaviour, as described in POPIA.

“Platforms” means the websites, mobile sites, applications, registration and accreditation systems, ticketing or payment interfaces, timing and results systems, communication channels and other digital services owned, operated or used by Golazo.

“Events” means running, cycling and other sporting, participation, wellness, community, promotional, media or related events and initiatives organised, managed, promoted or supported by Golazo.

Golazo (Pty) Ltd, registration number 2025/196160/07 and referred to in this Policy as “Golazo”, is a South African member of the international Golazo Group. It is the responsible party under POPIA, and the data controller under another applicable law, when it determines why and how personal information is processed.

For some Events or services, Golazo may process information jointly with, or on behalf of, an event owner, client, rights holder, governing body, sponsor or other partner. The relevant registration page, event terms or collection notice will identify any additional responsible party where appropriate.

This Policy applies to participants, entrants, spectators, supporters, coaches, team managers, volunteers, marshals, officials, Event staff, customers, website and app users, emergency contacts and next of kin, representatives of corporate teams, sponsors, exhibitors, media representatives, partner and supplier contacts, job applicants and other individuals who interact with us.

Where Golazo processes personal data of an individual located in Kenya, including a participant who registers or interacts with a Platform while located in Kenya, the Kenya DPA applies to that processing to the extent provided by its territorial scope provisions. We will meet its additional requirements where it applies.

We process personal information primarily in accordance with POPIA. Where another privacy or data protection law applies to particular processing based on its territorial scope, including the Kenya DPA, the European Union General Data Protection Regulation, we will apply its additional requirements to that processing.

Where the Kenya DPA applies as described in clause 2.4, we will comply with its applicable additional requirements, including those concerning transparency, data-subject rights, security, breach notification and international transfers.

We aim to ensure that personal information is:

• processed lawfully and in a reasonable manner that does not unjustifiably infringe privacy;
• collected for specific, explicitly defined and lawful purposes;
• adequate, relevant and not excessive for those purposes;
• kept accurate and updated where reasonably necessary;
• retained only for as long as authorised or reasonably required;
• protected through appropriate technical and organisational safeguards; and
• processed transparently and in a way that supports the rights of data subjects.

Depending on how you interact with us, we may collect:

• identity and demographic details, such as name, title, date of birth, age category, nationality, gender and, where necessary, identity or passport information;
• contact details, such as email address, telephone number and postal or residential address;
• account, registration, entry, accreditation and preference information;
• Event and athlete information, such as sport or discipline, chosen distance, route or category, bib, race or participant number, timing-chip or transponder number, start group or wave, check-in or attendance, timing, live tracking or location where enabled, rankings, results, qualifications, penalties, participation history, personal bests, licences and athlete, federation or governing-body identifiers, including World Athletics identifiers and Union Cycliste Internationale (UCI) licences or IDs where applicable;
• organisational and affiliation information, such as a team, club, school, employer, sponsor, charity or other organisation connected with your participation;
• health, medical, disability, accessibility, dietary or emergency information where reasonably required for safe participation or support;
• transaction information, such as fees, purchases, refunds, billing details and payment status. Full payment-card details are generally processed by authorised payment providers rather than stored by us;
• communications, enquiries, complaints, survey responses and customer-support records;
• marketing choices, campaign responses and information about your interests;
• photographs, audio, video, interviews and other media captured at or in connection with an Event;
• technical and usage information, such as IP address, device and browser information, identifiers, log data, approximate location, referral source and interactions with our Platforms and communications;
• next-of-kin or emergency-contact information, such as name, contact details, relationship to a participant and information reasonably required to respond to an incident;
• business-contact, supplier, partner, media or sponsorship information;
• job-application information, such as work history, qualifications, references and eligibility information, where you apply to work with us; and
• other information you choose to provide or that is reasonably required for a stated purpose.

If you provide personal information about another person, such as an emergency contact or a minor participant, you confirm that you are authorised to do so and that you have given that person any notice required by law.

A collection form or accompanying notice may indicate that particular information is required by law, for a contract, for Event rules or for safety, and will explain relevant consequences where practicable. You may decline to provide optional information, but if required information is not provided we may be unable to complete an entry, provide a requested service or safely support participation.

We may collect personal information:

• directly from you when you register, create an account, enter an Event, make a purchase, complete a form, contact us, participate in a survey or promotion, apply for a role, or otherwise interact with us;
• automatically when you use our Platforms, open our communications or interact with cookies and similar technologies;
• during an Event through check-in, accreditation and access-control systems, timing and results systems, participant tracking or safety tools, medical and emergency response processes, photography and media coverage, Event apps and operational communications;
• from a parent, guardian, team manager, employer, club, charity, travel coordinator or other person authorised to act for you;
• from event owners, clients, governing bodies, federations, timing and registration providers, payment providers, medical service providers, sponsors, partners and affiliated Golazo entities; and
• from public or permitted sources, including public registers, published race records and public social-media content, where lawful and relevant.

Where we collect personal information indirectly, including information about an emergency contact or next of kin, we will provide any additional notice required by applicable law within the required period, subject to lawful exceptions.

We process Special Personal Information only where authorised by POPIA or another applicable law. This may include health or medical information needed to assess eligibility, provide reasonable support, manage safety or respond to an emergency.

Where information about a child is required, we will seek consent from a competent person, such as a parent or legal guardian, unless another legal authorisation applies. We will process the information in a manner that protects the child’s privacy, dignity, rights and best interests. Event rules may impose age limits or require adult supervision.

We may use proportionate measures to verify a child’s age and the identity and authority of a parent, guardian or authorised representative, and to obtain verifiable consent where required by applicable law.

Parents, guardians and authorised representatives must provide accurate information, use it only for the relevant child or represented person, and notify us if their authority changes.

We may process personal information to:

• create and administer accounts, entries, accreditations, purchases and contractual relationships;
• plan, organise, operate and improve Events, including logistics, access control, timing, results, awards and participant communications;
• verify identity, eligibility, qualifications, age, category or payment status;
• support safety, accessibility, medical and emergency arrangements;
• contact and communicate with next of kin or emergency contacts in connection with an accident, medical emergency, safeguarding concern or other incident affecting a participant;
• provide customer support and respond to enquiries, complaints and data-subject requests;
• process payments, refunds and reconciliations and maintain financial records;
• prevent fraud, misuse, security incidents and unlawful activity, and enforce applicable terms and rights;
• analyse performance, participation and engagement, produce statistics and improve our Platforms, Events and services;
• communicate operational, safety, service and Event information;
• provide live timing, participant tracking, rankings, safety features and Event updates through apps and other Platforms where applicable;
• send direct marketing and administer promotions where permitted;
• support sponsors, partners, clients, rights holders and governing bodies in delivering agreed Event-related activities, subject to appropriate notices and permissions;
• create, publish and archive Event results and legitimate Event media;
• recruit and assess applicants and manage business relationships; and
• comply with legal, tax, accounting, regulatory, insurance and governance requirements and establish, exercise or defend legal claims.

Under POPIA, and where applicable under another data protection law, we process personal information only where an applicable justification or lawful basis exists. Depending on the activity, this may include:

• your consent;
• processing necessary to take steps at your request before entering into a contract, or to conclude or perform a contract with you;
• compliance with an obligation imposed by law;
• protection of your legitimate interests under POPIA, including health and safety interests, or protection of a person’s vital interests where another applicable law provides for that basis;
• performance of a public-law duty by a public body, where relevant; or
• pursuit of the legitimate interests of Golazo or a third party, balanced against your rights and reasonable expectations.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that was lawful before withdrawal and may mean that we cannot provide an optional service that depends on the consent.

Running, cycling and other sporting Events are public-facing activities. Participant names, bib, race or participant numbers, categories, rankings, times, live performance or tracking information where enabled, results and related sporting records may be displayed publicly, shared with governing bodies, Event apps or results services, and retained as part of the Event’s sporting or historical record, subject to applicable law and Event-specific terms.

Photographers, broadcasters and content teams may capture images, audio or video in public Event areas. We may use appropriate Event media for reporting, promotion, communication and historical archiving where lawfully permitted. More specific information, choices or consent requests will be provided where required.

If you have a safety or privacy concern about publication of your information or image, contact us promptly using the details in section 20. We will consider the request in light of applicable law, public-interest considerations and practical limitations.

We may share relevant personal information with:

• operators and service providers supporting registration, accreditation, ticketing, timing, live tracking, results, Event apps, communications, hosting, cloud storage, analytics, IT security, customer support, security, venues, logistics and other operational functions;
• payment processors, banks, insurers, auditors and professional advisers;
• event owners, clients, rights holders, governing bodies, federations, venues, medical and emergency teams, officials, clubs and operational partners;
• authorised sponsors and activation partners where you have consented or another lawful basis applies;
• photographers, broadcasters, media and results providers for legitimate Event coverage and records;
• affiliated Golazo entities, including Golazo operations in Kenya and Belgium, where reasonably necessary for shared systems, event management, registration, timing and results, customer support, expertise, reporting, group administration or delivery;
• regulators, courts, law-enforcement bodies, revenue authorities and other public authorities where required or permitted by law; and
• a purchaser, successor or relevant adviser in connection with a proposed or completed restructuring, merger, acquisition or transfer of business, subject to appropriate safeguards.

Operators that process personal information for us must do so under appropriate contractual and security obligations. A recipient acting as an independent responsible party processes information under its own privacy notice.

We do not sell personal information.

Golazo operates internationally, and some affiliated entities, technology providers, service providers and partners may be located outside South Africa. Personal information may therefore be stored in or accessed from other countries.

We transfer personal information outside South Africa only where permitted by section 72 of POPIA or another applicable law, for example where the recipient is subject to adequate legal or contractual protections, the transfer is necessary for an applicable contract, or valid consent has been obtained.

Where the Kenya DPA applies to a transfer of personal data from Kenya, we will use the safeguards or other lawful transfer mechanism required by that Act and its regulations.

Where another data protection law applies, we will use any additional recognised transfer safeguards required by that law.

We may send information about Golazo Events, services, campaigns and relevant partner opportunities by email, SMS or similar electronic communication only with consent or where otherwise permitted by section 69 of POPIA and other applicable law.

You may opt out at any time by using the unsubscribe option in the communication or contacting us. Service, safety, entry and other non-marketing communications may still be sent where necessary.

We do not provide personal information to an independent third party for its own direct marketing unless you have consented or the disclosure is otherwise lawfully permitted and transparently explained.

We retain personal information only for as long as authorised or reasonably necessary for the purpose for which it was collected, including to deliver Events and services, maintain sporting records, comply with legal and financial obligations, resolve disputes, enforce agreements and maintain security.

Retention periods vary according to the type and sensitivity of the information, the purpose of processing, contractual requirements, limitation periods, legal duties and whether information can be safely anonymised. Event results and appropriate archival material may be retained for longer as part of the public sporting or historical record.

When information is no longer required or authorised, we will delete, destroy, de-identify or securely archive it in accordance with applicable law and our retention controls.

We use reasonable technical and organisational measures designed to protect personal information against loss, damage, unauthorised destruction, unlawful access or processing. Measures may include access controls, supplier due diligence, contractual protections, backups, monitoring and staff awareness.

We seek to embed data protection by design and by default into relevant systems and processes. Where required by applicable law, we will conduct a data protection impact assessment before processing that is likely to create a high risk to individuals, such as certain large-scale, sensitive, child-related, tracking or innovative-technology processing.

No system or transmission method is completely secure. You should protect account credentials, use secure channels and notify us promptly if you suspect misuse of your account or information.

If we reasonably believe that personal information has been accessed or acquired by an unauthorised person, we will investigate, contain and address the incident and notify the applicable regulator and affected data subjects where required by law and within any applicable statutory period.

Subject to POPIA, PAIA, the Kenya DPA where applicable, and other applicable law, you may:

• ask whether we hold personal information about you and request access to it;
• request correction or deletion of personal information that is inaccurate, irrelevant, excessive, outdated, incomplete, misleading, unlawfully obtained or no longer authorised to be retained;
• object, on reasonable grounds, to certain processing and object at any time to direct marketing;
• withdraw consent where processing depends on consent;
• request information about recipients or categories of recipients where applicable;
• request data portability where the Kenya DPA or another applicable law provides that right; and
• lodge a complaint with the Information Regulator or another competent data protection authority.

Additional rights, including erasure, restriction, objection, portability and safeguards concerning automated decisions, may apply if another jurisdiction’s law governs the processing.

To protect your information, we may need to verify your identity and authority before acting on a request. Rights may be subject to lawful grounds for refusal, record-retention duties and prescribed processes or fees.

We do not intend to make a decision that produces legal consequences for you, or substantially affects you, based solely on automated processing of a profile, unless the decision is permitted by law and appropriate safeguards are in place.

If such processing is introduced, we will provide any additional notice, opportunity for human intervention or reconsideration required by applicable law.

Our Platforms may use cookies, pixels, tags, local storage and similar technologies for security, functionality, preferences, analytics and, where permitted, marketing.

Our Cookie Policy explains the categories used, the choices available and how to manage preferences. Information obtained through these technologies will be processed under this Privacy Policy where it is personal information.

Our Platforms and communications may link to or integrate with websites, applications and services operated by third parties. Those third parties are responsible for their own privacy and security practices.

You should review the privacy notices and choices provided by a third party before giving it personal information. A link or integration does not by itself mean that we control or endorse the third party’s processing.

We may update this Privacy Policy to reflect changes in our activities, technology, legal requirements or privacy practices.

The updated version will be made available on the relevant Platform and will state its effective date. We will provide additional notice where required by law or where a change materially affects how we use personal information.

Questions, privacy requests and complaints may be addressed to the Information Officer of Golazo using the contact details below. Please use the subject “Data protection request” where the channel permits.

You may also lodge a complaint with the regulator: