Privacy
policy.

1. Information we collect

We also collect a self-declared fitness statement as part of entry. This may constitute special personal information relating to health under POPIA and is collected only with your explicit consent at entry.

• First name and surname
• Email address
• South African ID number
• Date of birth
• Running history and personal bio
• Race history and Instagram handle, if provided
• A profile photo, if provided
• Payment information processed through Paystack. We do not store card details ourselves.
• Technical information such as IP address and browser type, collected automatically when you use the website.

2. Why we collect it

• Verify eligibility to enter, including confirming that you are 18 or older
• Process entry and waitlist fees through Paystack
• Manage the entry cap and waitlist, including promotions when places become available
• Build your public entrant profile for storytelling and livestream production
• Communicate with you about your entry, the event and changes to it
• Meet our legal and safety obligations as an event organiser

3. What is made public

If your entry is confirmed, this information is published on your public event profile. Your ID number, date of birth, email address, phone number, payment details and waitlist position before confirmation are never made public.

• Your display name and slot number
• Your bio, running history and race history
• Your Instagram handle, if provided
• Your photo, if provided

4. Third parties we share information with

• Paystack, our payment processor, receives the information necessary to process your payment. Card details are handled directly by Paystack under its own privacy and security policies.
• Google Firebase and Google Cloud Platform host our database and backend infrastructure, subject to Google's security and data-processing terms.
• We do not sell your personal information to any third party.
• We may share information with law enforcement or regulators where legally required to do so.

5. Data security

No system is completely secure and we cannot guarantee absolute security, but we take your information seriously given its sensitivity.

• Restricting access to full entry records, including ID number, date of birth and email, to authorised event staff only
• Keeping private entry information entirely separate from public profile data at a system level
• Using secure, access-controlled cloud infrastructure for storage

6. How long we keep your information

• We retain entry information for as long as reasonably necessary for event operations, dispute resolution, and legal and financial record-keeping obligations, after which it will be securely deleted or anonymised.
• Public profile information remains live for a reasonable period after the event for storytelling and archival purposes, and can be removed on request.

7. Your rights

To exercise these rights, contact us at [PRIVACY CONTACT EMAIL].

• Ask us what personal information we hold about you
• Ask us to correct inaccurate information
• Ask us to delete your information, subject to legal and operational retention needs
• Withdraw consent for your fitness declaration or profile information where consent is the basis for that use
• Object to certain processing
• Lodge a complaint with the Information Regulator of South Africa if you believe we have handled your information unlawfully

8. Children

• THE 99 is only open to entrants aged 18 and over. We do not knowingly collect personal information from anyone under 18.

9. Changes to this policy

• We may update this policy from time to time. Material changes will be communicated to entered runners by email.

10. Contact us

For privacy-related questions or requests, contact:

Harties Trail Experience (Pty) Ltd
[PHYSICAL ADDRESS]
[PRIVACY CONTACT EMAIL]