Back to Savage 100

Privacy notice

Draft for client review. The technical detail below accurately describes what the website collects and how long it keeps it. The organisational detail — legal entity name, registered address and named contact — must be supplied by the organisers, and the complete notice should be reviewed by a qualified adviser before launch. This page is excluded from search indexing until then.

Who collects this data

Registration enquiries submitted through this website are collected by Xtreme Adventures.

Client to supply: registered legal entity name, business address, and the name and contact address of the person responsible for data queries.

What is collected

There are two forms on this website: a registration form, and a contact form for general enquiries. What each stores is listed separately below.

Registration form

When a registration enquiry is submitted, the following is stored:

  • Name, as entered.
  • Phone number, normalised to international format.
  • Email address.
  • Emergency contact name and phone number.
  • The race category and entry type, and a team name if one is given.
  • The optional message, if one is written.
  • The event the enquiry relates to.
  • The date and time of submission, and of accepting the waiver.
  • A one-way cryptographic hash of the sending IP address. The address itself is never stored. The hash is used only to limit repeated submissions and to investigate abuse; it cannot be reversed to recover the original address.
  • The browser user-agent string, truncated.

Contact form

When a message is sent through the contact form, the following is stored:

  • Name, as entered.
  • Email address.
  • Phone number, if one is given. This field is optional.
  • The subject chosen from the list, and the message written.
  • The date and time the message was sent.
  • A one-way cryptographic hash of the sending IP address, and the truncated browser user-agent string, on the same basis as above.

Messages are held separately from registrations. Sending a message does not enter you into any event, and it is not added to any start list.

What is not collected

  • No advertising or tracking cookies are set.
  • No third-party analytics or social tracking pixels are loaded.
  • No payment card details are collected through this website.
  • No location data beyond the hashed IP described above.

Why it is collected

For a registration: to respond to the enquiry, confirm slot availability, arrange the deposit, and issue the waiver and medical declaration required before a runner may start.

For a contact-form message: to answer it, and nothing else. You are not added to a mailing list, and writing to us does not sign you up to anything.

In neither case is the data used for any other purpose, and it is not sold, rented or shared for marketing.

Anti-spam

Both forms use Cloudflare Turnstile to distinguish people from automated scripts. Turnstile processes limited technical signals from the browser to make that assessment. It does not track visitors across websites and does not serve advertising. See Cloudflare's privacy policy.

Who else processes it

  • The hosting provider, which operates the servers running this site.
  • The database provider, which stores the registrations and the messages.
  • The email provider, which delivers the confirmation or acknowledgement to you and the notification to the organisers.
  • Cloudflare, for the anti-spam check described above.

Client to confirm the chosen providers and their processing regions once the deployment target is fixed.

How long it is kept

Enquiries that do not result in a confirmed entry are deleted 24 months after submission. Records for confirmed entrants are retained longer for event-history and safety purposes.

Contact-form messages are deleted 24 months after they have been answered or closed.

Your rights

You may request a copy of the data held about you, ask for it to be corrected, or ask for it to be deleted. Deletion requests are honoured except where a record must be retained for safety or legal reasons.

Client to supply the contact address for these requests, and to confirm the applicable legal framework. For an operator based in Pakistan this is principally the Prevention of Electronic Crimes Act 2016 and the personal data protection legislation in force at launch — not the GDPR, though the handling described here is designed to meet that standard.

Security

All traffic is encrypted in transit. Submissions are validated on the server, rate-limited, and stored using parameterised queries. IP addresses are hashed before storage. Access to the registration database is limited to the organisers.

Contact

Questions about this notice can be sent via @xtreme.adventure100 until a dedicated contact address is published.