Welcome to Challenge Family, part of the PTO Group, organisers of Triathlon World Tour and associated events. We are committed to protecting your privacy and keeping your personal data secure. This policy explains how we collect, use, and protect your data when you visit our website, interact with our digital platforms, or register for one of our events.

Who We Are (The Data Controller)

• Company: Challenge Family GmbH and Challenge Family Holdings BV

• • Address: Televisieweg 159, 1322BH Almere, The Netherlands

• • Contact Email: info@challenge-family.com

Part 1: Website Privacy

1. Data You Provide to Us
   Our website is generally free to browse without actively providing personal data. However, if you choose to interact with us through specific forms (such as contacting us, newsletter sign-ups, or applying for media accreditation), we will collect the information requested on those forms (typically your name, email address, and any specific details required for the application).
2. How We Use This Data
   When you submit a form on our website, your data is securely transferred to our central data warehouse and subsequently pushed to our email marketing platform, ActiveCampaign. We use this data to send you the communications you requested or to process your specific application.
3. Cookies, Analytics, Advertising Pixels, and Social Plugins
   While you do not log in to our primary website (https://challengefamily.com/), we use third-party tools and tracking technologies to understand how visitors use our site and to deliver relevant advertising to you on other platforms. These tools include analytics services (such as Google Analytics with IP anonymisation) and social media marketing pixels (such as Meta/Facebook Conversion Tracking, TikTok pixels, and AdRoll remarketing by Semantic Sugar, Inc.). These technologies may collect your IP address, device identifiers, and information about your browsing behavior. We only deploy these non-essential marketing and analytics cookies if you provide your explicit consent. Our website also employs social media components and plugins (e.g., Facebook, X/Twitter, Instagram, YouTube). When you access our site while logged into these respective social networks, information (such as the precise page you are viewing) may be transmitted to and associated with your personal social media account. To prevent this data transfer, you must log out of your social media accounts before visiting our website.
4. Managing Your Consent (Cookiebot)
   To capture and manage your consent preferences, we use a Consent Management Platform called Cookiebot. When you make your selection on our cookie banner, Cookiebot will place a strictly necessary cookie on your device to remember your preference for future visits. For full details on the specific cookies and pixels we use, please see our Cookie Policy.
5. Challenge Family Webshop (Shopify)
   Technically separated from our primary website, we offer an online webshop powered by Shopify. The personal data (such as name, address, and financial details) required to enter the webshop will be used for the fulfillment of shop orders. This data is also used for marketing purposes on an aggregated level to create profiles for analysis and campaign optimisations. Order data is shared with ActiveCampaign for analysis; it will not be shared with third parties for unsolicited mailings.

Part 2: Event Registration Privacy

When you register for a Challenge Family event, we act as the Data Controller. We process your data to ensure the safe, successful, and professional delivery of our events.

1. Data Received from Third-Party Organisers
   In addition to the data you provide directly to us, we may receive or access personal data from third-party event organisers, platforms, or registration systems associated with events we have acquired or partnered with (for example, events where registration is operated directly by Local Organising Committees (LOCs) or Licensees). We process this data for the same operational delivery, safety, analytics, service improvement purposes and, where permitted, marketing purposes, outlined in this policy.
2. Operational Data and Mobile Applications

• What we collect: Name, address, email address, date of birth, nationality, phone number, biological sex and gender, estimated swim times, t-shirt size, and emergency contact details. We also collect optional information such as your triathlon club, occupation sector, company, job title, and national federation membership status. Where explicitly required by local laws or host country regulations, we may also collect your passport number or national identification number. Through our mobile event applications (such as the Tracx App, Active.com EventApp or T100 Athlete Tracker app), we may also collect geolocation, application/device usage data, and physical activities/health-related information.
• Emergency Contacts: When you provide emergency contact details, you are providing us with third-party personal data. By providing this, you confirm that you have informed that person and have their permission to share their contact details with us for use in a medical emergency.
• How we use it: To fulfil your race entry and experience, ensure event safety, improve our services, and conduct operational analytics. Where required by local laws or government authorities, we may process your data to comply with public health safety screenings, contact tracing requirements, or local security and identification regulations.
• Our Lawful Basis: We process this data based on the performance of a contract (delivering the event experience you registered for), our legitimate interests (understanding athlete engagement, platform usage, operational analytics, improving our services/events, and providing athlete support), and compliance with a legal obligation (where local laws dictate the collection of specific health or identification data).

3. Financial and Transactional Data

• What we collect: When you pay for race registrations or merchandise, we collect transactional information such as your purchase history, the amount paid, and unique transaction IDs. We do not collect, store, or have access to your full credit card or payment card details. All payments are processed securely by our third-party payment gateways within the registration platforms.
• How we use it: We store this transactional information in our registration platforms and central database to process your registration, facilitate any necessary refunds, and fulfil our internal financial accounting, auditing, and tax reporting requirements.
• Our Lawful Basis: We process this data based on the performance of a contract and compliance with a legal obligation.

4. Special Category Data (Medical & Health)
   Triathlon is an endurance sport, and your safety is our priority.

• What we collect: Medical conditions, severe allergens, and health-related information provided during registration or App usage.
• How we use it: To provide vital information to event-specific medical teams in case of an emergency. If required for your immediate care, this information (along with incident reports) may be shared with external healthcare providers, emergency services, and relevant insurance carriers for treatment and billing purposes. We also use this data for incident reporting and general anonymised operational analytics.
• Our Lawful Basis: We process this data to protect your vital interests (health and safety) and with your explicit consent provided at registration.

5. Data Sharing with Partners to Deliver the Event To operate the event seamlessly, we may be required to share specific data points with trusted third-party partners:

• Event Timing & Results: We share your email, bib number, age-group band, date of birth, country, triathlon club, and sex/gender with our timing and results partners to facilitate on-site check-in, race timing, and post-race results including results analysis, rankings systems or other results processing.
• Bib Printing: We share your name, age-group band, country, triathlon club, and bib number with our printing partners.
• Start Lists, Live Tracking, and Public Results: To deliver a professional sporting event, certain data will be made public before, during, and after the race. Your name, biological sex/gender, age-group band, country, triathlon club, and bib number will be published on public start lists and live athlete-tracking platforms. Following the event, your split and finish times and overall results will also be made public and retained for historical records.
• Event Photography: If you consent during registration, we share your name, bib number, and email address with our official photography partners so they can match your images to you and send you your finisher pictures and product offers.
• Customised Products: If you choose to purchase customised products (e.g., iTab medal engraving) during registration, relevant and required details will be shared with the supplier so they can process your order.
• National Federations: To ensure athletes hold valid Federation licenses, we share your name, email address, date of birth, and Federation membership number solely for the purpose of verifying your membership status and confirming that you hold the appropriate credentials to compete.

6. Marketing and PR

• Event Imagery and Broadcast Footage: As a professional sporting organisation, our events are widely photographed, recorded, and broadcast. Images and video footage collected during events, broadcasts, or shared publicly may be used by us for editorial, promotional, marketing, reporting, and archival purposes connected to the sport and our events. We process this imagery under our legitimate interests in promoting triathlon. We do not use this imagery for advertising, third-party sponsorship, or other commercial exploitation that falls outside of the original sporting context. You retain the right to object to the use of your imagery for these purposes.
• Publicly Available Athlete Data: We may re-use publicly available athlete data for purposes connected to sporting activity, reporting, analytics, historical records, and service improvement. We rely on our legitimate interests to process this data, ensuring our use aligns with what athletes would reasonably expect in a sporting context.
• Social Media and Celebrating Achievements: To report on our events and celebrate the achievements of our participants, we may combine publicly available results data (such as finish times, age-group categories, or transition times) with event imagery, videos and broadcast footage. We may use this combined data in promotional social media posts, newsletters, and other media to highlight notable performances (for example, celebrating a race winner, a category record, or the fastest transition). We process this based on our legitimate interests in promoting the sport, reporting on the event, and engaging our community.
• User-Generated Content: We use third-party UGC platforms to allow fans and athletes to share user-generated content (such as photos and videos) with us. If you choose to submit content via this platform, we will collect your name, email address, and social media handle. We use this information to contact you regarding your submission, properly credit you if we feature your content, and manage digital rights. We process this data based on your consent provided at the time of submission.
• Inspirational Stories: During registration, you may choose to share an inspirational story. If you do, and consent to its use, this may be used by the PTO Group or our charity partners for social media and publicity purposes.
• Marketing Opt-In: You will be given a clear opportunity to opt-in to our marketing communications during registration, which will be passed to our Database and on to our email marketing platform.

Part 3: Data Sharing, Partners, and Third-Party Sources

The PTO Group operates a global ecosystem of events, broadcasts, and merchandise. To deliver this, we share data with, and receive data from, trusted partners.

1. World Triathlon & National Triathlon Federations
   We work in close partnership with World Triathlon. Due to this partnership, we may receive race registration information directly from World Triathlon for events we co-operate. Additionally, we may share your personal information and race results with World Triathlon and your National Triathlon Federation to facilitate amateur World Championship qualification processes and to assist with their operational analytics. This data is not shared for marketing purposes without your additional explicit consent.
2. Event Sponsors and Commercial Partners
   During the event registration process, you may be offered the opportunity to opt-in to receive communications or special offers from specific event sponsors, travel partners, or other commercial partners associated with our races. We will only share your contact information with these third parties if you provide your explicit consent. General anonymised data may also be shared with event sponsors or commercial partners.
3. Broadcast and Streaming Analytics
   The TriathlonLive.tv streaming platform is currently operated by our partner, World Triathlon (utilising the StreamEngine platform, owned by WSC Sports). To evaluate broadcasts and improve media offerings, we receive anonymised broadcast performance metrics and personal data regarding subscriber viewing habits from our streaming partners. We process this data based on our legitimate interests in growing the sport, improving our broadcast quality, and tailoring our services to our audience.
4. Local Organising Committees (LOCs) and Licensees
   For events around the world, we work with Local Organising Committees or Licensees who help deliver the event on the ground. We share strictly necessary operational data with them to ensure a safe and smooth race experience. Depending on these partners’ levels of involvement in events, they may capture event registration data and share this with us for operational improvements, analytical purposes, and other purposes set out in this privacy policy.
5. Digital and Technical Partners
   We use trusted third-party agencies to manage our digital services. For example, Admiral.Digital (based in Malaysia) manages our email communications, database connectors, database maintenance, SSO member portal, and paid/targeted ads. Technical Partners have restricted, necessary access to our databases strictly for these development and communication purposes.
6. Group Companies Challenge Family is part of PTO Group, organisers of T100 Triathlon World Tour and associated events, owned by PTO Commercial LLC, and we work closely with other businesses and companies within our group (including PTO Commercial Ltd). We may share and transfer your personal data with such group companies for the purposes set out in this privacy policy. This may include sharing information for customer services, health and safety, where permitted – for marketing purposes, and to meet legal and regulatory requirements. Additionally, we share historical Challenge Family registration information with PTO based on legitimate interest to ensure a smooth transition of Challenge Family events, continued event improvement, generalised analytics and customer service continuity.
7. Where required by law & Transactions We may share your personal data with law enforcement agencies or regulators where we believe necessary to comply with a legal or regulatory obligation. We may also share your personal data with potential transaction partners in connection with any actual or proposed sale, transfer or merger of all or part of our business or assets.
8. International Data Transfers Because our events are global and we use international partners (such as Admiral.Digital in Malaysia, and US-based platforms like ActiveCampaign and Active.com), your personal data may be transferred outside the UK and the European Economic Area (EEA). Whenever we transfer your data internationally, we ensure it is protected by appropriate legal safeguards, such as the UK International Data Transfer Agreement (IDTA) or Standard Contractual Clauses.
9. Marketing opt in and opt outs We reserve the right to process personal data for marketing purposes and in certain limited circumstances to provide this to our third party partners for the purpose of marketing to you where you have provided your explicit consent for this. You can choose not to receive marketing material at any time by opting-out or by contacting us at info@challenge-family.com. If you have opted in, we may occasionally send you similar offers from other brands and/or group companies of the PTO Group which will cease if you opt-out.

Part 4: Children’s Privacy

We welcome athletes of all ages at specific events. Where events allow entrants under the age of 18, we require and collect explicit confirmation of parental or guardian consent during the registration process in order to process the minor’s personal data. Furthermore, only users over 13 years of age may give their permission for the use of social media tracking pixels on our websites.

Part 5: Data Retention & Security

1. How Long We Keep Your Data We only keep your personal data for as long as necessary to fulfil the purposes we collected it for:

• Newsletter Subscriptions: Your newsletter subscription preference is saved for five (5) years, after which we will ask for re-confirmation. If you re-subscribe within those 5 years, a new 5-year period begins.
• Athlete Profiles & User Portal: We retain your operational and registration data to maintain your athlete history, offer loyalty perks, and pre-populate future event registrations. If your account is inactive for three (3) years, we will securely delete or fully anonymise your personal data.
• Medical Data: Your medical data is strictly ringfenced within our database and protected with additional layers of authentication. Upon reaching the 3-year inactivity threshold, this medical data will be permanently deleted.
• Historical Results: Race results are kept indefinitely for historical, statistical, and archiving purposes in the sporting public interest.
• Financial Data: We retain basic transaction records (excluding credit card details) for up to seven (7) years to comply with our legal and tax accounting obligations.

2. Data Security and Storage We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way. Your data is primarily housed securely in PTO Group-owned Amazon Web Services (AWS) database instances, our identity management provider (Auth0), and our dedicated registration platforms (such as Njuko and Active.com) and marketing platforms (such as ActiveCampaign). For day-to-day business operations, our staff also process data using secure, cloud-based enterprise environments, including Google Workspace (e.g., Google Sheets and Docs). We ensure that all third-party cloud providers we use act as compliant Data Processors under strict agreements to keep your information secure.

Part 6: Your Data Protection Rights

Under data protection laws, you have certain legal rights relating to your personal data we hold about you. Subject to applicable laws, you can ask us to:

• Request access to your personal data.
• Request correction or erasure of your personal data.
• Object to processing or request restriction of processing.
• Request the transfer of your personal data.
• Withdraw consent at any time where we are relying on consent.

If you wish to exercise any of these rights, or if you have any questions about this policy, please contact us at info@challenge-family.com.

Part 7: Profiling and Personalisation

We use your personal data to understand your preferences and characteristics, for example by considering factors such as your experience in triathlon, participation history and preferred event types. We use this information to group customers into different segments and to personalise our services. This type of processing is referred to as “profiling”. It helps us tailor your experience and improve our services, but it does not involve making decisions about you that have legal or similarly significant effects. You have the right to object to our use of your personal data for profiling.

Part 8: Complaints

If you have concerns about how we use your personal data, you have the right to raise a data protection complaint with us at any time using info@challenge-family.com. We encourage you to raise any concerns with us first so we can try to resolve them quickly; however, you also have the right to make a complaint to the relevant data protection regulator in your jurisdiction.