Privacy Policy

Welcome to the Professional Triathletes Organisation, organisers of T100 Triathlon World Tour and associated events. We are committed to protecting your privacy and keeping your personal data secure. This policy explains how we collect, use, and protect your data when you visit our website, interact with our digital platforms, or register for one of our events.

Who We Are (The Data Controller)

• Company: PTO Commercial Ltd
• Address: One Canada Square, Level 8, London, E14 5AA, United Kingdom
• Contact Email: [email protected]

Part 1: Website Privacy

1. Data You Provide to Us Our website is generally free to browse without actively providing personal data. However, if you choose to interact with us through specific forms (such as newsletter sign-ups, registering your interest in an event, applying for media accreditation, or entering competitions), we will collect the information requested on those forms (typically your name, email address, and any specific details required for the application).
2. How We Use This Data When you submit a form on our website, your data is securely transferred to our central data warehouse and subsequently pushed to our email marketing platform. We use this data to send you the communications you requested or to process your specific application.
3. Cookies, Analytics, and Advertising Pixels While you do not log in to our primary website (t100triathlon.com), we use third-party tools and tracking technologies to understand how visitors use our site and to deliver relevant advertising to you on other platforms.
   

   These tools include analytics services (such as Google Analytics) and social media marketing pixels (such as Meta and TikTok pixels). These technologies may collect your IP address, device identifiers, and information about your browsing behavior. We only deploy these non-essential marketing and analytics cookies if you provide your explicit consent.

   Managing Your Consent (Cookiebot) To capture and manage your consent preferences, we use a Consent Management Platform called Cookiebot. When you make your selection on our cookie banner, Cookiebot will place a strictly necessary cookie on your device to remember your preference for future visits.

Part 2: Event Registration Privacy

When you register for a PTO event, the PTO acts as the Data Controller. We process your data to ensure the safe, successful, and professional delivery of our events.

1. Data Received from Third-Party Organisers In addition to the data you provide directly to us (via our own SSO portal or race registration platforms), we may receive or access personal data from third-party event organisers, platforms, or registration systems associated with events we have acquired or partnered with (for example, historical registration data from Challenge Family events, World Triathlon or events where registration is operated directly by Local Organising Committees (LOCs)). In some instances, this data may remain stored on those third-party platforms and is accessed securely by the PTO under strict corporate data-sharing agreements. Alternatively, it may be fully ingested into our own databases under the same corporate data-sharing agreements. We process this data for the same operational delivery, safety, analytics, service improvement purposes and, where permitted, marketing purposes, outlined in this policy.
2. Operational Data

• What we collect: Name, address, email address, date of birth, nationality, phone number, biological sex and gender, estimated swim times, t-shirt size, and emergency contact details. We also collect optional information such as your triathlon club, occupation sector, company, job title, and national federation membership status. Where explicitly required by local laws or host country regulations, we may also collect your passport number or national identification number.
• Emergency Contacts: When you provide emergency contact details, you are providing us with third-party personal data. By providing this, you confirm that you have informed that person and have their permission to share their contact details with us for use in a medical emergency.
• How we use it: To create and maintain your central Single Sign-On (SSO) user profile, which synchronises with our registration platforms to pre-populate future registrations to save you time, fulfil your race entry and experience (e.g. provide race packs, verify race licenses), ensure event safety (e.g., managing swim cut-off times), improve our services, and conduct operational analytics. Where required by local laws or government authorities, we may process your data to comply with public health safety screenings, contact tracing requirements, or local security and identification regulations.
• Our Lawful Basis: We process this data based on the performance of a contract (delivering the event experience you registered for), our legitimate interests (understanding athlete engagement, platform usage, operational analytics, improving our services/events, and providing athlete support), and compliance with a legal obligation (where local laws dictate the collection of specific health or identification data).

3. Financial and Transactional Data

• What we collect: When you pay for race registrations or merchandise, we collect transactional information such as your purchase history, the amount paid, and unique transaction IDs. We do not collect, store, or have access to your full credit card or payment card details. All payments are processed securely by our third-party payment gateways within the registration platforms.
• How we use it: We store this transactional information in our registration platforms and central database to process your registration, facilitate any necessary refunds, and fulfil our internal financial accounting, auditing, and tax reporting requirements.
• Our Lawful Basis: We process this data based on the performance of a contract (processing your payment to secure your race entry) and compliance with a legal obligation (maintaining accurate financial records for tax and accounting purposes).

4. Special Category Data (Medical & Health) Triathlon is an endurance sport, and your safety is our priority.

• What we collect: Medical conditions and severe allergens.
• How we use it: To provide vital information to event-specific medical teams in case of an emergency. If required for your immediate care, this information (along with incident reports) may be shared with external healthcare providers, emergency services (such as hospitals or paramedics), and relevant insurance carriers for treatment and billing purposes. We also use this data for incident reporting and general anonymised operational analytics.
• Our Lawful Basis: We process this data to protect your vital interests (health and safety) and with your explicit consent provided at registration.

5. Data Sharing with Partners to Deliver the Event To operate the event seamlessly, we may be required to share specific data points with trusted third-party partners:

• • Event Timing & Results: We share your email, bib number, age-group band, date of birth, country, triathlon club, and sex/gender with our timing and results partners to facilitate on-site check-in, race timing, and post-race results including results analysis, rankings systems or other results processing.
  • Bib Printing: We share your name, age-group band, country, triathlon club, and bib number with our printing partners.
  • Start Lists, Live Tracking, and Public Results: To deliver a professional sporting event, certain data will be made public before, during, and after the race. Your name, biological sex/gender, age-group band, country, triathlon club, and bib number will be published on public start lists and live athlete-tracking platforms (e.g. T100 Athlete Tracker app). Following the event, your split and finish times and overall results will also be made public and retained for historical records.
  • Event Photography: If you consent during registration, we share your name, bib number, and email address with our official photography partners so they can match your images to you and send you your finisher pictures and product offers.
  • Medal Engraving: If you choose to purchase medal engraving or similar customised products during registration (e.g. iTab), your name, bib number, delivery address, contact details and timing results will be shared with the supplier so they can process your order.
  • National Federation: To ensure all athletes hold valid Federation licenses, we share your name, email address, date of birth, and Federation membership number solely for the purpose of verifying your membership status and confirming that you hold the appropriate credentials to compete.

6. Marketing and PR

• Event Imagery and Broadcast Footage: As a professional sporting organisation, our events are widely photographed, recorded, and broadcast. Images and video footage collected during events, broadcasts, or shared publicly may be used by the PTO for editorial, promotional, marketing, reporting, and archival purposes connected to the sport and our events. We process this imagery under our legitimate interests in promoting triathlon and the PTO. We do not use this imagery for advertising, third-party sponsorship, or other commercial exploitation that falls outside of the original sporting context. You retain the right to object to the use of your imagery for these purposes.
• Publicly Available Athlete Data: We may re-use publicly available athlete data (such as public race records or publicly accessible profiles) for purposes connected to sporting activity, reporting, analytics, historical records, and service improvement. We rely on our legitimate interests to process this data, ensuring our use aligns with what athletes would reasonably expect in a sporting context.
• Social Media and Celebrating Achievements: To report on our events and celebrate the achievements of our participants, we may combine publicly available results data (such as finish times, age-group categories, or transition times) with event imagery, videos and broadcast footage. We may use this combined data in promotional social media posts, newsletters, and other media to highlight notable performances (for example, celebrating a race winner, a category record, or the fastest transition). We process this based on our legitimate interests in promoting the sport, reporting on the event, and engaging our community, always ensuring it remains within the sporting context.
• User-Generated Content (Greenfly): We use a third-party platform called Greenfly to allow fans and athletes to share user-generated content (such as photos and videos) with us. If you choose to submit content via this platform, we will collect your name, email address, and social media handle. We use this information to contact you regarding your submission, properly credit you if we feature your content, and manage digital rights. We process this data based on your consent provided at the time of submission.
• Inspirational Stories: During registration, you may choose to share an inspirational story. If you do, and consent to its use, this may be used by the PTO or our charity partners for social media and publicity purposes.
• Marketing Opt-In: You will be given a clear opportunity to opt-in to our marketing communications during registration, which will be passed to our Database and on to our email marketing platform.

Part 3: Data Sharing, Partners, and Third-Party Sources

The PTO operates a global ecosystem of events, broadcasts, and merchandise. To deliver this, we share data with, and receive data from, trusted partners.

1. World Triathlon & National Triathlon Federations The PTO works in close partnership with World Triathlon, the sport’s international governing body. Due to this partnership, we may receive race registration information directly from World Triathlon for events we co-operate. Additionally, we may share your personal information and race results with World Triathlon and your National Triathlon Federation to facilitate amateur World Championship qualification processes and to assist with their operational analytics (such as global triathlon participation figures). This data is not shared for marketing purposes without your additional explicit consent.
2. Event Sponsors and Commercial Partners During the event registration process, you may be offered the opportunity to opt-in to receive communications or special offers from specific event sponsors, travel partners, or other commercial partners associated with our races. We will only share your contact information with these third parties if you provide your explicit consent via the specific opt-in checkboxes provided at the time of registration. The specific identity of these partners will always be clearly listed at the point where you provide your consent, and you have the right to withdraw this consent at any time. General anonymised data may also be shared with event sponsors or commercial partners.
3. T100 Triathlon Store and Pressio Our official merchandise store (t100triathlon.store) is operated on our behalf by our apparel partner, Pressio. When you interact with the store or make a purchase, your data is collected by Pressio. We receive this e-commerce sales and customer data from Pressio. We use this data under our legitimate interests to understand purchasing trends, evaluate the performance of our merchandise store, and better understand our athletes’ preferences.
4. Broadcast and Streaming Analytics The TriathlonLive.io streaming platform is currently operated by our partner, World Triathlon with the PTO acting as an independent Data Controller. To evaluate our broadcasts and improve our media offerings, we receive both anonymised broadcast performance metrics and personal data regarding subscriber viewing habits and customer behaviour from World Triathlon. We use this data to understand user viewing habits and analyse the correlation between individuals who participate in our events and those who watch our broadcasts. We process this data based on our legitimate interests in growing the sport, improving our broadcast quality, and tailoring our services to our audience.
5. Local Organising Committees (LOCs) and Licensees For events around the world, we work with Local Organising Committees or Licensees who help deliver the event on the ground. We share strictly necessary operational data with them to ensure a safe and smooth race experience. Depending on these partners’ levels of involvement in events, they may capture the kinds of event registration data outlined in Part 2 above and share this with us for operational improvements, analytical purposes, and other purposes set out in this privacy policy.
6. Digital and Technical Partners We use trusted third-party agencies to manage our digital services, such as managing our email communications, database connectors, database maintenance, SSO member portal and paid/targeted ads. Digital and Technical Partners have restricted, necessary access to our databases strictly for these development and communication purposes.
7. Group companies PTO Commercial Ltd is owned by PTO Commercial LLC, and we work closely with other businesses and companies within our group (including Challenge Family with legal entities Challenge Family Holdings BV and Challenge Family GmbH). We may share and transfer your personal data with such group companies for the purposes set out in this privacy policy. This may include sharing information for the purpose of a transaction (as outlined below), relating to customer services, health and safety, where permitted – for marketing purposes, and to meet legal and regulatory requirements. Group companies may also capture the kinds of event registration data outlined in Part 2 above and share this with us for operational improvements, analytical purposes, and other purposes set out in this privacy policy.
8. Where required by law We may share your personal data with law enforcement agencies, regulators, courts, other government authorities or other third parties where we believe necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights or the rights of any third party.
9. In the context of a transaction We may share your personal data with potential transaction partners, service providers, advisors, and other third parties (including group companies such as where a new group company is established or operated under common ownership) in connection with any actual or proposed sale, transfer or merger of all or part of our business or assets, or a reorganisation, acquisition or merger. If a change happens to our business, the new owners may use your personal data in the same way as set out in this privacy policy.
10. International Data Transfers Because our events are global and we use international partners (such as in Malaysia and the US), your personal data may be transferred outside the UK and the European Economic Area (EEA). Whenever we transfer your data internationally, we ensure it is protected by appropriate legal safeguards, such as the UK International Data Transfer Agreement (IDTA) or Standard Contractual Clauses approved by the relevant authorities.
11. Marketing opt in and opt outs We reserve the right to process personal data for marketing purposes and in certain limited circumstances to provide this to our third party partners for the purpose of marketing to you where you have provided your explicit consent for this. Thereafter, you can choose not to receive marketing / promotional material at any time by opting-out or clicking the unsubscribe link from promotional material being received or by contacting us at [email protected].

     

    If you have opted in to receive promotional material from the PTO, we may occasionally send you similar offers (using the contact methods you stated) from other brands and/or group companies of the PTO which will cease if you opt-out.

Part 4: Children’s Privacy

We welcome athletes of all ages at specific events. Where events allow entrants under the age of 18, we require and collect explicit confirmation of parental or guardian consent during the registration process in order to process the minor’s personal data.

Part 5: Data Retention & Security

1. How Long We Keep Your Data We only keep your personal data for as long as necessary to fulfil the purposes we collected it for:

• Athlete Profiles & User Portal: We retain your operational and registration data to maintain your athlete history, offer loyalty perks, and pre-populate future event registrations. If your account is inactive for three (3) years (meaning you have not logged in, opened an email from us, or registered for a race), we will securely delete or fully anonymise your personal data.
• Medical Data: Your medical data is strictly ringfenced within our database and protected with additional layers of authentication. We retain this to ensure your safety at future events, but you will be able to review and manage this data within your portal. Upon reaching the 3-year inactivity threshold, this medical data will be permanently deleted.
• Historical Results: Race results (including your name, age-group band, country, and time splits) are kept indefinitely for historical, statistical, and archiving purposes in the sporting public interest.
• Financial and Transactional Data: We retain basic transaction records (excluding credit card details) for up to seven (7) years to comply with our legal and tax accounting obligations.

We may also retain records to investigate or defend against potential legal claims.

2. Data Security and Storage We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. Your data is primarily housed securely in PTO-owned database instances, our identity management provider, and our dedicated registration platforms and marketing platforms. For day-to-day business operations, our staff also process data using secure, cloud-based enterprise environments, including Google Workspace (e.g., Google Sheets and Docs). We ensure that all third-party cloud providers we use act as compliant Data Processors under strict agreements to keep your information secure.

Part 6: Your Data Protection Rights

Under data protection laws, you have certain legal rights relating to your personal data we hold about you. These rights are not absolute and may only apply in certain circumstances. For example, subject to applicable laws, you can ask us to:

• Request access to your personal data.
• Request correction of any inaccurate or incomplete data we hold about you.
• Request erasure of your personal data (where there is no good reason for us continuing to process it).
• Object to processing of your personal data (e.g., for direct marketing).
• Request restriction of processing your personal data.
• Request the transfer of your personal data to you or a third party.
• Withdraw consent at any time where we are relying on consent to process your personal data (such as for event photography, sponsor communications, or medical data).

If you wish to exercise any of these rights, or if you have any questions about this policy, please contact us at [email protected]. The website of the Information Commissioner’s Office (“ICO”), available at https://ico.org.uk/, includes additional information you may find helpful in order to understand to your rights under applicable data protection laws.

Part 7: Profiling and Personalisation

We use your personal data to understand your preferences and characteristics, for example by considering factors such as your experience in triathlon, participation history and preferred event types. We use this information to group customers into different segments and to personalise our services, including recommending events or content that may be relevant to you.

We may also use information you provide (for example through questionnaires or similar tools) to suggest events or experiences that may be suitable for you.

This type of processing is referred to as “profiling”. It helps us tailor your experience and improve our services, but it does not involve making decisions about you that have legal or similarly significant effects.You have the right to object to our use of your personal data for profiling in accordance with Part 6 above.

Part 8: Complaints

If you have concerns about how we use your personal data, you have the right to raise a data protection complaint with us at any time using [[email protected]]. We will acknowledge receipt of your complaint and investigate it in line with our internal complaints handling process. This is separate from your right to complain to the ICO as set out below.

We encourage you to raise any concerns with us first so we can try to resolve them quickly, however, if you believe we have not been able to assist with your complaint or concern, or you remain dissatisfied after we have responded, you have the right to make a complaint to the Information Commissioner’s Office (ICO) (0303 123 1113 or at https://ico.org.uk/make-a-complaint/), the UK regulator for data protection issues (www.ico.org.uk). You can contact the ICO at any time.