Stort10 is an event operated by Bishop’s Stortford Running Club. Bishop’s Stortford Running Club is committed to protecting and respecting your privacy. For any personal data you provide for the purposes of race entry, volunteering or receiving Stort10 communications, Bishop’s Stortford Running Club is the Data Controller and is responsible for storing and otherwise processing that data in a fair, lawful, secure and transparent way.
This policy applies to all data collected through the Stort10 website and associated systems. Where a parent or guardian provides data on behalf of a child, the same protections apply.
All queries regarding this policy, or requests to opt out, should be sent to stort10.webcontact@bsrc.org.uk .
________________________________________

What personal data we hold about you

You may provide data through forms on the Stort10 website, through our online race entry system, our volunteer form, our newsletter form or by corresponding with us by phone or email. Depending on how you engage with Stort10, we may collect the following:

Race entrants

• Name
• Date of birth
• Gender
• Address (if required by the registration provider)
• Email address
• Phone number
• Emergency contact details
• Running club affiliation (optional)
• Predicted finish time or wave information
• Medical information supplied for safety purposes
• Payment information (processed by a secure third party and not stored by us)

Volunteers

• Name
• Email address
• Phone number
• Emergency contact details
• Role preferences and availability
• Any relevant information you choose to provide to ensure safe role allocation

Newsletter subscribers

• Email address
• Optional subscription preferences

Participation and event data

• Race results and category placements
• Volunteer attendance records
• Photos and video taken at the event which may include participants and volunteers
• Communications related to the event

Website usage

We may collect basic analytics data such as IP address, browser type and pages visited to maintain and improve the Stort10 website.
________________________________________

Why we need your personal data

Our lawful basis for processing depends on your interaction with Stort10:
For race entry and event delivery (contractual obligation)

We use your personal data to:

• Manage and administer your race entry
• Communicate essential event information
• Prepare race packs, results and safety documents
• Publish race results
• Provide necessary information to timing services, medical teams or emergency services
• Store medical information with your explicit consent for race day safety

For volunteer management

We use volunteer data to:
• Allocate roles and shifts
• Communicate logistics and updates
• Maintain safety information including emergency contacts

For newsletters and marketing (consent)

With your explicit consent:
• Provide event updates
• Send information about promotions, partner offers or fundraising
• Share details of other BSRC related events

You may withdraw consent at any time by emailing stort10.webcontact@bsrc.org.uk .

For anonymised analysis and event planning

We may process anonymised and aggregated data listed above to:
• Analyse participation trends
• Review demographic patterns
• Monitor marketing performance
• Plan event capacity, volunteer allocation and logistics
• Produce anonymised summaries for grant or licence applications
All such data is anonymised and cannot identify individuals.

Holding email addresses of past participants (legitimate interests)

We may retain email addresses of past race entrants for future Stort10 communications under the lawful basis of legitimate interests. This enables us to inform previous participants about:
• future editions of the Stort10
• opening dates, price changes or major event updates
• similar events organised by BSRC
You may opt out of these communications at any time by emailing stort10.webcontact@bsrc.org.uk .
________________________________________

Special category data (medical information)

Any medical information you provide is processed solely to support your safety at the event. This is processed on the basis of your explicit consent. Medical information is shared with our first aid provider and emergency services prior, during or after the event to the event and retained for up to 30 days after the event before secure deletion unless linked to an incident record.
________________________________________

Other data processing, retention and third parties

Social media

Stort10 operates public and private social media pages. Each platform has its own privacy policy and Stort10 cannot accept responsibility for their data practices.
WhatsApp groups created informally by participants or volunteers are not managed by Stort10 or BSRC.

Use of Google Analytics and Meta Pixel

The Stort10 website uses Google Analytics and Meta Pixel to help us understand how visitors use the site and to improve the effectiveness of our marketing. These tools collect information such as:
• pages visited
• time spent on pages
• device and browser type
• referring websites
• anonymised IP addresses
• demographic and interest information where available
• interactions with forms and content

We use this data to:

• improve website performance and usability
• measure the effectiveness of advertising
• understand visitor behaviour
• ensure our content is relevant and useful
Google and Meta may process this data outside the UK but apply safeguards that comply with UK GDPR.
You may manage cookie preferences in your browser or through cookie consent tools on the website.
________________________________________

Who we share your personal data with

We may share necessary information with:
• Race timing providers
• Online registration and payment processors
• Medical services and emergency responders
• Local authorities where required
• Photography partners
• Governing bodies or insurers where necessary
We do not sell your personal data.
We may share data with official Government bodies where legally required.
________________________________________

How long we hold your personal data

• Race entrants: up to 12 months after the event unless required longer for insurance or incident reporting
• Volunteers: up to 12 months after the event
• Medical information: deleted within 30 days unless related to an incident
• Newsletter subscribers and email addresses of past participants: retained until you unsubscribe
• Event photos: retained indefinitely as part of event records unless you request removal
________________________________________

International transfers

We do not knowingly transfer your personal data outside the UK.
Where third parties do so, they must apply appropriate UK GDPR safeguards.
________________________________________

Data security

We implement appropriate technical and organisational measures to prevent your data from being lost, accessed without authorisation, misused, altered or disclosed.
We have procedures to address suspected data breaches and will notify affected individuals and regulators where legally required.
________________________________________

Your rights regarding your personal data

You have the right to:
• Request access to your personal data
• Request correction of inaccurate or incomplete data
• Request deletion where appropriate
• Object to processing based on legitimate interest
• Request restriction of processing
• Request transfer of your data to another provider
• Withdraw consent where consent is the lawful basis
To exercise these rights, contact stort10.webcontact@bsrc.org.uk .
You can also make a complaint to the Information Commissioner’s Office at www.ico.org.uk.
________________________________________

Use of email tracking pixels

Emails sent by our systems may contain a tracking pixel that records whether an email has been opened and when. This only activates when images are downloaded in your email client. No location data is collected.
________________________________________

Data processors

Stort10 uses trusted third party systems including race registration, timing, mailing and payment providers. These providers act as Data Processors and may only handle your personal data in accordance with our written instructions.
Each provider maintains its own privacy policy which may be accessed directly through their website.