Privacy Policy

Welcome to the Professional Triathletes Organisation, organisers of T100 Triathlon World Tour and associated events. We are committed to protecting your privacy and keeping your personal data secure. This policy explains how we collect, use, and protect your data when you visit our website, interact with our digital platforms, or register for one of our events.

Who We Are (The Data Controller)

• Company: PTO Commercial Ltd
• Address: One Canada Square, Level 8, London, E14 5AA, United Kingdom
• Contact Email: [email protected]

Part 1: Website Privacy

1. Data You Provide to Us Our website is generally free to browse without providing personal data. However, if you choose to interact with us through specific forms (such as newsletter sign-ups, registering your interest in an event, applying for media accreditation, or entering competitions), we will collect the information requested on those forms (typically your name, email address, and any specific details required for the application).
2. How We Use This Data When you submit a form on our website, your data is securely transferred to our central data warehouse and subsequently pushed to our email marketing platform, ActiveCampaign. We use this data to send you the communications you requested or to process your specific application.
3. Cookies, Analytics, and Advertising Pixels While you do not log in to our primary website (t100triathlon.com), we use third-party tools and tracking technologies to understand how visitors use our site and to deliver relevant advertising to you on other platforms.

These tools include analytics services (such as Google Analytics) and social media marketing pixels (such as Meta and TikTok pixels). These technologies may collect your IP address, device identifiers, and information about your browsing behavior. We only deploy these non-essential marketing and analytics cookies if you provide your explicit consent.

Managing Your Consent (Cookiebot) To capture and manage your consent preferences, we use a Consent Management Platform called Cookiebot. When you make your selection on our cookie banner, Cookiebot will place a strictly necessary cookie on your device to remember your preference for future visits.

Part 2: Event Registration Privacy

When you register for a PTO event, the PTO acts as the Data Controller. We process your data to ensure the safe, successful, and professional delivery of our events.

1. Data Received from Third-Party Organisers In addition to the data you provide directly to us (via our own SSO portal or race registration platforms), we may receive or access personal data from third-party event organisers, platforms, or registration systems associated with events we have acquired or partnered with (for example, historical registration data from Challenge Family events or events where registration is operated directly by Local Organising Committees (LOCs)). In some instances, this data may remain stored on those third-party platforms and is accessed securely by the PTO under strict corporate data-sharing agreements. Alternatively, it may be fully ingested into our own databases under the same corporate data-sharing agreements. We process this data for the same operational delivery, safety, analytics, and service improvement purposes outlined in this policy.
2. Operational Data

• What we collect: Name, address, email address, date of birth, nationality, phone number, biological sex and gender, estimated swim times, t-shirt size, and emergency contact details. We also collect optional information such as your triathlon club, occupation sector, company, job title, and national federation membership status. Where explicitly required by local laws or host country regulations, we may also collect your passport number or national identification number.
• Emergency Contacts: When you provide emergency contact details, you are providing us with third-party personal data. By providing this, you confirm that you have informed that person and have their permission to share their contact details with us for use in a medical emergency.
• How we use it: To create and maintain your central Single Sign-On (SSO) user profile, which synchronises with our registration platforms to pre-populate future registrations to save you time, fulfil your race entry and experience (e.g. provide race packs, verify race licenses), ensure event safety (e.g., managing swim cut-off times), improve our services, and conduct operational analytics. Where required by local laws or government authorities, we may process your data to comply with public health safety screenings, contact tracing requirements, or local security and identification regulations.
• Our Lawful Basis: We process this data based on the performance of a contract (delivering the event experience you registered for), our legitimate interests (understanding athlete engagement, platform usage, and operational analytics), and compliance with a legal obligation (where local laws dictate the collection of specific health or identification data).

3. Financial and Transactional Data

• What we collect: When you pay for race registrations or merchandise, we collect transactional information such as your purchase history, the amount paid, and unique transaction IDs. We do not collect, store, or have access to your full credit card or payment card details. All payments are processed securely by our third-party payment gateways within the registration platforms.
• How we use it: We store this transactional information in our registration platforms and central database to process your registration, facilitate any necessary refunds, and fulfil our internal financial accounting, auditing, and tax reporting requirements.
• Our Lawful Basis: We process this data based on the performance of a contract (processing your payment to secure your race entry) and compliance with a legal obligation (maintaining accurate financial records for tax and accounting purposes).

4. Special Category Data (Medical & Health) Triathlon is an endurance sport, and your safety is our priority.

• What we collect: Medical conditions and severe allergens.
• How we use it: To provide vital information to event-specific medical teams in case of an emergency. If required for your immediate care, this information (along with incident reports) may be shared with external healthcare providers, emergency services (such as hospitals or paramedics), and relevant insurance carriers for treatment and billing purposes. We also use this data for incident reporting and general anonymised operational analytics.
• Our Lawful Basis: We process this data to protect your vital interests (health and safety) and with your explicit consent provided at registration.

5. Data Sharing with Partners to Deliver the Event To operate the event seamlessly, we must share specific data points with trusted third-party partners:

• • Event Timing & Results: We share your email, bib number, age-group band, date of birth, country, triathlon club, and sex/gender with our timing partners to facilitate on-site check-in, race timing, and post-race results.
  • Bib Printing: We share your name, age-group band, country, triathlon club, and bib number with our printing partners.
  • Start Lists, Live Tracking, and Public Results: To deliver a professional sporting event, certain data will be made public before, during, and after the race. Your name, biological sex/gender, age-group band, country, triathlon club, and bib number will be published on public start lists and live athlete-tracking platforms (e.g. T100 Athlete Tracker app). Following the event, your split and finish times and overall results will also be made public and retained for historical records.
  • Event Photography: If you consent during registration, we share your name, bib number, and email address with our official photography partners so they can match your images to you and send you your finisher pictures and product offers.
  • Medal Engraving: If you choose to purchase medal engraving or similar customised products during registration (e.g. iTab), your name, bib number, delivery address, contact details and timing results will be shared with the supplier so they can process your order.

• National Federation: To ensure all athletes hold valid Federation licenses, we share your name, email address, date of birth, and Federation membership number solely for the purpose of verifying your membership status and confirming that you hold the appropriate credentials to compete.

6. Marketing and PR

• Event Imagery and Broadcast Footage: As a professional sporting organisation, our events are widely photographed, recorded, and broadcast. Images and video footage collected during events, broadcasts, or shared publicly may be used by the PTO for editorial, promotional, marketing, reporting, and archival purposes connected to the sport and our events. We process this imagery under our legitimate interests in promoting triathlon and the PTO. We do not use this imagery for advertising, third-party sponsorship, or other commercial exploitation that falls outside of the original sporting context. You retain the right to object to the use of your imagery for these purposes.
• Publicly Available Athlete Data: We may re-use publicly available athlete data (such as public race records or publicly accessible profiles) for purposes connected to sporting activity, reporting, analytics, historical records, and service improvement. We rely on our legitimate interests to process this data, ensuring our use aligns with what athletes would reasonably expect in a sporting context.
• Social Media and Celebrating Achievements: To report on our events and celebrate the achievements of our participants, we may combine publicly available results data (such as finish times, age-group categories, or transition times) with event imagery, videos and broadcast footage. We may use this combined data in promotional social media posts, newsletters, and other media to highlight notable performances (for example, celebrating a race winner, a category record, or the fastest transition). We process this based on our legitimate interests in promoting the sport, reporting on the event, and engaging our community, always ensuring it remains within the sporting context.
• User-Generated Content (Greenfly): We use a third-party platform called Greenfly to allow fans and athletes to share user-generated content (such as photos and videos) with us. If you choose to submit content via this platform, we will collect your name, email address, and social media handle. We use this information to contact you regarding your submission, properly credit you if we feature your content, and manage digital rights. We process this data based on your consent provided at the time of submission.
• Inspirational Stories: During registration, you may choose to share an inspirational story. If you do, and consent to its use, this may be used by the PTO or our charity partners for social media and publicity purposes.
• Marketing Opt-In: You will be given a clear opportunity to opt-in to our marketing communications during registration, which will be passed to our Database and on to our email marketing platform (ActiveCampaign).

Part 3: Data Sharing, Partners, and Third-Party Sources

The PTO operates a global ecosystem of events, broadcasts, and merchandise. To deliver this, we share data with, and receive data from, trusted partners.

1. World Triathlon & National Triathlon Federations The PTO works in close partnership with World Triathlon, the sport’s international governing body. Because of this partnership, we may receive race registration information directly from World Triathlon for events we co-operate. Additionally, we may share your contact information and race results with World Triathlon and your National Triathlon Federation to facilitate amateur World Championship qualification processes and to assist with their operational analytics (such as global triathlon participation figures). This data is not shared for marketing purposes without your additional explicit consent.
2. Event Sponsors and Commercial Partners During the event registration process, you may be offered the opportunity to opt-in to receive communications or special offers from specific event sponsors, travel partners, or other commercial partners associated with our races. We will only share your contact information with these third parties if you provide your explicit consent via the specific opt-in checkboxes provided at the time of registration. The specific identity of these partners will always be clearly listed at the point where you provide your consent, and you have the right to withdraw this consent at any time.
3. T100 Triathlon Store and Pressio Our official merchandise store (t100triathlon.store) is operated on our behalf by our apparel partner, Pressio. When you interact with the store or make a purchase, your data is collected by Pressio. We receive this e-commerce sales and customer data from Pressio. We use this data under our legitimate interests to understand purchasing trends, evaluate the performance of our merchandise store, and better understand our athletes’ preferences.
4. Broadcast and Streaming Analytics The TriathlonLive.tv streaming platform is currently operated by our partner, World Triathlon (utilising the StreamEngine platform, owned by WSC Sports). To help us improve our media offerings, we receive viewership and analytics data from this platform. We use this data to review broadcast figures, understand user viewing habits, and analyse the correlation between individuals who participate in our events and those who watch our broadcasts. We process this data based on our legitimate interests in growing the sport, improving our broadcast quality, and tailoring our services to our audience.
5. Local Organising Committees (LOCs) For events around the world, we work with Local Organising Committees who help deliver the event on the ground. We share strictly necessary operational data with them to ensure a safe and smooth race experience.
6. Digital and Technical Partners We use trusted third-party agencies to manage our digital services. For example, Admiral.Digital (based in Malaysia) manages our email communications, database connectors, database maintenance, SSO member portal and paid/targeted ads. They have restricted, necessary access to our databases strictly for these development and communication purposes.
7. International Data Transfers Because our events are global and we use international partners (such as Admiral.Digital in Malaysia, and US-based platforms like ActiveCampaign), your personal data may be transferred outside the UK and the European Economic Area (EEA). Whenever we transfer your data internationally, we ensure it is protected by appropriate legal safeguards, such as the UK International Data Transfer Agreement (IDTA) or Standard Contractual Clauses approved by the relevant authorities.

Part 4: Children’s Privacy

We welcome athletes of all ages at specific events. Where events allow entrants under the age of 18, we require and collect explicit confirmation of parental or guardian consent during the registration process in order to process the minor’s personal data.

Part 5: Data Retention & Security

1. How Long We Keep Your Data We only keep your personal data for as long as necessary to fulfil the purposes we collected it for:

• Athlete Profiles & User Portal: We retain your operational and registration data to maintain your athlete history, offer loyalty perks, and pre-populate future event registrations. If your account is inactive for three (3) years (meaning you have not logged in, opened an email from us, or registered for a race), we will securely delete or fully anonymise your personal data.
• Medical Data: Your medical data is strictly ringfenced within our database and protected with additional layers of authentication. We retain this to ensure your safety at future events, but you will be able to review and manage this data within your portal. Upon reaching the 3-year inactivity threshold, this medical data will be permanently deleted.
• Historical Results: Race results (including your name, age-group band, country, and time splits) are kept indefinitely for historical, statistical, and archiving purposes in the sporting public interest.
• Financial and Transactional Data: We retain basic transaction records (excluding credit card details) for up to seven (7) years to comply with our legal and tax accounting obligations.

2. Data Security and Storage We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. Your data is primarily housed securely in PTO-owned Amazon Web Services (AWS) database instances, our identity management provider (Auth0), and our dedicated registration platforms (such as Njuko) and marketing platforms (such as ActiveCampaign). For day-to-day business operations, our staff also process data using secure, cloud-based enterprise environments, including Google Workspace (e.g., Google Sheets and Docs). We ensure that all third-party cloud providers we use act as compliant Data Processors under strict agreements to keep your information secure.

Part 6: Your Data Protection Rights

Under data protection laws, you have rights relating to your personal data, including the right to:

• Request access to your personal data.
• Request correction of any inaccurate or incomplete data we hold about you.
• Request erasure of your personal data (where there is no good reason for us continuing to process it).
• Object to processing of your personal data (e.g., for direct marketing).
• Request restriction of processing your personal data.
• Request the transfer of your personal data to you or a third party.
• Withdraw consent at any time where we are relying on consent to process your personal data (such as for event photography, sponsor communications, or medical data).

If you wish to exercise any of these rights, or if you have any questions about this policy, please contact us at [email protected].