Data Protection & Privacy Notice
Last updated: 22 October 2026
At Canalrace C.I.C., we respect your privacy and take care of the personal information you share with us.
This notice explains what information we collect, why we use it, who we share it with and your rights. It covers our website, enquiries, volunteers and events, including GUCR 145, KACR 145, LLCR 130 and MBCR 40.
1. Who is responsible for your information?
Canalrace C.I.C. is the data controller responsible for the personal information described in this notice.
Company number: 10059659
Contact address: 2 Beechcrest, Back Road, Gilwern, NP7 0DA
Email: hello@canalrace.org.uk
We handle personal information in accordance with applicable UK data-protection law, including the UK GDPR and Data Protection Act 2018.
2. Information we collect
Depending on your involvement with us, we may collect:
- Identity and contact details: name, address, email address, telephone number and date of birth.
- Entry information: event choices, support category, club affiliation, previous participation and information needed to assess ballot or guaranteed-place eligibility.
- Emergency contact details: the name, relationship and telephone number of someone we can contact if necessary.
- Relevant health and support information: information you provide about medical conditions, allergies, dietary requirements or reasonable adjustments.
- Participation records: race number, checkpoint times, results, withdrawals, awards and incident reports.
- Volunteer information: availability, preferred roles, relevant experience and information needed to organise your involvement.
- Booking records: payment status, transaction references, cancellations and refunds.
- Communications: enquiries, feedback, complaints and correspondence.
- Images: photographs or video footage taken at events.
- Website information: technical information such as IP addresses, device details and cookie preferences, where collected by our website systems.
We aim to collect only what is necessary for the relevant purpose.
3. Where information comes from
We collect information when you:
- Enter an event through SiEntries or another booking service we identify.
- Complete a form or contact us.
- Volunteer with us.
- Take part in an event.
- Subscribe to updates.
- Use our website.
We may also receive relevant information from someone authorised to enter you, your emergency contact, event officials, timing providers or medical personnel.
If you provide another person’s details, please tell them and direct them to this notice. Emergency contacts do not become marketing subscribers.
4. How and why we use information
We use personal information for the following purposes and lawful bases.
| Purpose | Lawful basis |
|---|---|
| Processing entries, payments, support choices and booking communications | Performance of our contract with you, or steps requested before entering a contract |
| Managing ballots, eligibility checks, checkpoints, results and event administration | Contract where necessary to deliver your booking; otherwise legitimate interests in running fair, safe and organised events |
| Organising volunteers | Legitimate interests in coordinating and supporting our volunteer team |
| Answering enquiries and handling complaints | Legitimate interests in providing assistance and resolving concerns; contract or legal obligation where applicable |
| Keeping financial records and complying with legal requirements | Legal obligation |
| Maintaining safety records and handling insurance matters or legal claims | Legitimate interests and, where applicable, legal obligation |
| Contacting emergency contacts and arranging urgent assistance | Legitimate interests in participant safety; vital interests where necessary to protect someone’s life |
| Publishing results, achievement records and appropriate event photographs | Legitimate interests in documenting our events and recognising participation, subject to your rights |
| Sending optional marketing emails | Your consent |
| Protecting and maintaining our website | Legitimate interests in providing a secure, functioning website |
Where we rely on legitimate interests, we consider the purpose, whether the processing is necessary and its effect on your rights and reasonable expectations.
5. Health and other sensitive information
Health information is special category personal data and receives additional protection.
For routine collection and use of health information supplied for event support, we will seek your explicit consent, separately from acceptance of the event terms, unless another applicable legal condition has been identified and explained.
We limit access to people who need the information for their role, such as designated organisers and relevant medical personnel.
In an emergency, information may be used or shared where necessary to protect someone’s vital interests and they are physically or legally unable to consent. Other conditions may apply to healthcare professionals or the establishment, exercise or defence of legal claims.
You may withdraw consent by contacting us. This does not affect processing already carried out lawfully. We will explain whether withdrawal affects our ability to provide a requested adjustment or safely accommodate your participation.
Please avoid sending sensitive information through public comments or social media.
6. Information needed to participate
Certain information is necessary to administer your booking and operate the event, including identity, contact, eligibility and emergency contact details.
If you do not provide essential information, we may be unable to accept or complete your entry. We will explain which information is required and why.
Optional marketing consent is not a condition of entering or volunteering.
7. Who we share information with
We share information only where necessary and appropriate, including with:
- SiEntries and payment providers, to process entries, payments and refunds.
- Authorised organisers and volunteers, who receive information needed for their responsibilities.
- Timing and tracking providers, where used for your event.
- Medical providers and emergency services, where necessary for care, safety or incident management.
- Website, hosting, email and IT providers, to operate our systems.
- Insurers, accountants and professional advisers, where necessary.
- Authorities, where disclosure is required or otherwise lawfully justified.
Some providers process information on our instructions. Others, including certain booking, payment and medical providers, may act as independent data controllers and have their own privacy notices.
We do not sell personal information.
8. Results and achievement records
We may publish names, race numbers, finishing times, positions, relevant competition categories and achievement records to document our events.
Published results may be viewed, downloaded or referenced by others. We do not publish emergency contact details or private medical information as part of results.
Contact us if you have concerns about a published record. We will consider requests in light of your circumstances, data accuracy and the legitimate purpose of maintaining event records.
9. Photography and filming
Photographs and videos may be taken to document and promote our events.
Where we rely on legitimate interests, we consider the context and your reasonable expectations. We will seek separate consent where appropriate, particularly for sensitive situations or uses outside ordinary event coverage.
Please contact us before the event, or speak to an organiser on the day, if you have concerns about identifiable images of you. We will explain what arrangements are possible.
You may also contact us about an image we control after publication. We will consider your request, although we may not be able to retrieve printed materials or copies independently shared by others.
10. Marketing and event communications
With your consent, we may email you about future events and Canalrace news.
You can unsubscribe using the link in a marketing email or by contacting hello@canalrace.org.uk. Withdrawing consent does not affect your entry or volunteering.
We may still send essential communications about an existing booking, such as registration details, safety instructions or event changes. These are service messages rather than optional marketing.
We may retain a minimal suppression record to ensure we respect your marketing preferences.
11. How long we keep information
We keep personal information only for as long as necessary for its purpose.
Retention depends on the type of information:
- Entry and booking records: for event administration, follow-up enquiries, refunds and relevant contractual or legal requirements.
- Financial records: for the applicable accounting and tax retention periods.
- Routine health and emergency contact information: for the period needed to prepare for, deliver and conclude the relevant event, unless a specific incident or legal requirement justifies longer retention.
- Incident, insurance and complaint records: for the period needed to investigate, resolve and deal with relevant claims or obligations.
- Volunteer records: while needed to coordinate your involvement and for appropriate follow-up.
- Results and achievement records: potentially long term as part of the event’s historical record.
- Marketing records: until you withdraw consent or we determine they are no longer needed, subject to keeping a minimal suppression record.
We review retained information and delete or anonymise it when it is no longer required. You can contact us for further details about the retention criteria applicable to your information.
12. Keeping information secure
We use appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse or disclosure.
Access is limited according to role and need. People handling personal information are expected to follow our confidentiality and data-protection procedures.
No system can guarantee absolute security. If a personal data breach occurs, we will assess it and notify the Information Commissioner’s Office and affected individuals where legally required.
13. Processing outside the UK
Some service providers may process information outside the UK.
Where this happens, we will ensure the transfer meets applicable UK data-protection requirements, such as an adequacy regulation or appropriate contractual safeguards.
Contact us for details of any relevant overseas processing and the safeguards used.
14. Cookies and external websites
Our Cookie Notice explains the cookies and similar technologies used on our website and how to manage your choices.
External websites, including booking and mapping services, have their own privacy notices. Please review those when using their services.
15. Anonymous information
We may use genuinely anonymised statistics to understand participation and improve our events.
Information is anonymous only where individuals cannot reasonably be identified. Removing a name alone does not necessarily make information anonymous.
Any identifiable equality-monitoring information requires a suitable lawful basis and, where relevant, an additional special category condition. Optional monitoring questions will be explained separately.
16. Your rights
Depending on the circumstances, you may have the right to:
- Obtain a copy of your personal information.
- Correct inaccurate or incomplete information.
- Request deletion.
- Restrict how information is used.
- Object to processing based on legitimate interests.
- Receive certain information in a portable format.
- Withdraw consent where processing relies on it.
You have an absolute right to object to the use of your information for direct marketing.
Other rights are subject to conditions and exceptions. We will explain our response to any request.
To exercise your rights, email hello@canalrace.org.uk. We may ask for reasonable information to verify your identity.
We normally respond within one month. Where the law permits additional time, we will explain the reason and applicable timescale.
17. Concerns and complaints
Please contact us if you have concerns about how we use your information.
You also have the right to complain to the Information Commissioner’s Office, the UK’s data-protection regulator:
Website: ico.org.uk
You do not have to contact us before approaching the ICO, although we welcome the opportunity to resolve concerns.
18. Changes to this notice
We may update this notice to reflect changes in our activities, systems or legal requirements.
The latest version will appear on our website with its revision date. We will bring significant changes to your attention where appropriate.
19. Contact us
Canalrace C.I.C.
2 Beechcrest
Back Road
Gilwern
NP7 0DA
Email: hello@canalrace.org.uk