Privacy Policy

Drafting notes - remove before publishing

Still to confirm

• Confirm the entity that receipts donations is also the entity that organises the event. The details above came from the donations configuration; if the event sits under a different entity, section 1 must name that one.
• Registering the Information Officer with the Information Regulator is a separate standing obligation and is not satisfied by publishing this policy.

Questions for the organisers. Worded to be sent as they are.

1. Which registered entity is running the event - Calling Education NPC, or does Calling Cape Town exist as its own registered entity? If Calling Cape Town is a trading or event name under Calling Education NPC, we'll name Calling Education NPC in the policy and describe the event as one it organises.
2. If you're not certain, three things usually settle it: which entity's bank account receives entry fees, which entity signs supplier and venue contracts for the event, and which entity's name appears on the event insurance. If they all point to the same one, that's our answer.
3. Who is the head of that entity - the CEO, managing director or equivalent? POPIA makes that person the Information Officer by default, so we're identifying who it already is rather than appointing anyone new.
4. Has that person been registered as Information Officer with the Information Regulator? It's a short online registration and a standing obligation regardless of this policy.
5. Do you want a deputy Information Officer named as well - someone who handles requests day to day?
6. Who monitors support@callingcpt.com, and can privacy requests be flagged separately there? POPIA sets response deadlines and these shouldn't sit in a general support queue.
7. Does the entity already have a privacy policy or a PAIA manual? If there's an existing policy, this one needs to sit alongside it without contradicting it.
8. Who signs on behalf of the entity? We need a signature for the operator agreement with PlusPlusMinus covering Clubhouse.

Assumptions this draft makes. Correct anything wrong rather than leaving it.

• Entry is by application and the organiser decides whether to accept. Unsuccessful applications are handled separately in the retention section.
• Medical aid and travel insurance details: only the medical aid scheme and membership number are collected. Travel and medical insurance details are not, and have been removed from section 3. If you decide against the medical aid field as well, delete it from sections 3, 5 and 9.
• Entry is restricted to people aged 18 and over. Confirmed.
• Donations via donate.callingcpt.com are out of scope and will need their own notice.

This draft describes some behaviour that does not exist yet. The build changes it assumes are listed in the accompanying chat message. Publishing before those changes are made would mean the policy misdescribes the platform.

Not legal advice. The health data and consent provisions in particular warrant review by a qualified person before publication.

———————

1. Who we are

The Calling Cape Town Extreme Triathlon is organised by Calling Education NPC, a registered non-profit company, registration number 2016/126510/08, PBO number 930055017, of Plaas Veelverjaagt Annex Nr 408, Corner of Vlaeberg and Polkadraai Road, Stellenbosch, Western Cape, 7600, South Africa ("Calling", "we", "us").

Calling is the responsible party for the personal information described in this policy. That means we decide what information is collected and why, and we are accountable for how it is handled.

This policy is issued in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA).

For any questions about your information, or to exercise the rights set out in section 12, contact us at support@callingcpt.com.

2. What this policy covers

This policy applies to personal information we collect when you create an account, apply to enter, and take part in the Calling Cape Town Extreme Triathlon, including through our entry platform at apply.callingcpt.com.

Entry is by application. Submitting an application does not reserve a place; we decide which applications to accept.

This policy does not cover:

• Donations made at donate.callingcpt.com, which are covered by a separate notice.
• Other websites we link to, including those of our sponsors and partners. If you give information directly to another organisation, for example at a stand at registration, that organisation is responsible for it under its own privacy notice, not ours.

You should read this policy together with our Terms of Entry, which cover participation, safety rules and indemnity.

3. What we collect

When you create an account

Your name, email address and mobile number. We email you a code to confirm the address, and that email address is how you sign in.

When you apply to enter

Your date of birth, gender, country, telephone number, ID or passport number, and the category you are applying for.

Emergency and medical information

Your emergency contact's name, relationship to you and telephone number; your medical aid scheme and membership number; and anything you tell us in the medical declaration, such as allergies, medication or conditions the event medical team should know about. The medical declaration is optional and may be left blank.

If you take part

Your race number, timing and split data, and your position in the results. If we use tracking during the event, your location while you are on course.

Automatically

Standard technical information your browser sends when you use our site, such as IP address and browser type, used to keep the platform secure and working.

We do not collect or store copies of identity documents or passports. Where an entry fee applies, payment is handled by our payment provider and we do not store card details.

4. Why we collect it

• Creating and securing your account - to perform the agreement between you and us.
• Assessing your application and telling you the outcome - to perform the agreement between you and us.
• Identifying you at registration and on course - our legitimate interest in running a safe event.
• Keeping you safe, responding to a medical incident and getting you treated - your consent, and the protection of your life or health.
• Timing your race and publishing results - to perform the agreement between you and us.
• Contacting you about the event you have entered - to perform the agreement between you and us.
• Sending you news about future Calling events - your consent, which you can withdraw at any time.
• Meeting our legal, tax and insurance obligations - compliance with the law.

We do not use your information to make decisions about you by automated means alone.

5. Health information

Information about your health is treated as special personal information under POPIA and is handled more carefully than anything else we hold.

We ask for your consent separately. When you complete the medical declaration, you are asked to give specific consent to us holding and using that information for medical and safety purposes during the event. This is separate from accepting our Terms of Entry, and you can complete an entry without making a declaration.

Who can see it. Your declaration is stored encrypted and is not shown alongside your other details in our admin system. It sits behind a separate control that only named event staff may open, and every time it is opened this is recorded in an audit log. The event medical team may access it when treating you.

We may use it without asking you first in an emergency. If you are injured or unable to respond, we may share your declaration, emergency contact and medical aid details with emergency services and any hospital treating you. POPIA allows this where it is necessary to protect your life or health.

Carrying it between events. Your declaration is saved to your profile so you do not have to re-enter it every year. Each time you apply for an event we show you what we hold and ask you to confirm or amend it before you submit, and we record the date you confirmed it. We never carry a declaration into a new event without that confirmation, because out-of-date medical information is more dangerous than none. You can view, change or clear your declaration in your profile at any time.

What we do not do. We do not print medical information on race numbers, share it with sponsors, or use it for anything other than your safety and treatment.

6. Who we share it with

Our entry platform. The event runs on Clubhouse, a platform provided to us by PlusPlusMinus (Pty) Ltd. PlusPlusMinus processes your information only on our instruction and under a written agreement, and does not use it for its own purposes.

Service providers. We use other organisations to run parts of the event and the platform: hosting and infrastructure, timing, on-course tracking, payment processing and email. They receive only what they need for that task and may not use it for anything else.

Medical and emergency. The event medical team, emergency and rescue services, and any hospital treating you, as described in section 5.

Where the law requires it, we may disclose information where we are obliged to by law, or where it is necessary to establish, exercise or defend a legal claim, including to our insurers if an incident occurs.

We do not share entrant information with sponsors or partners. Our sponsors fund the event. They do not receive your name, contact details or any other information you give us.

We do not sell your personal information.

7. Results and event media

If you take part, we publish results showing your name, race number, category, nationality and times. Results are a permanent public record of the event and remain available after it ends. Please bear this in mind before entering if you would prefer your participation not to be public.

Photographs and video are taken during the event and may be used to promote Calling and future events. If you would rather an image of you was not used, contact us at support@callingcpt.com, and we will remove it from our own channels where we can.

8. Marketing

We will email you about the event you have applied for or entered, including confirmations, safety briefings and logistics. These are not marketing, and you cannot opt out of them while you hold an entry.

Separately, you can choose to hear about future Calling events. That choice is yours to make, and the box is never ticked for you. You can withdraw it at any time using the unsubscribe link in any such email or by contacting us. Withdrawing does not affect your entry.

This consent covers Calling events only. We do not use it to send you messages on behalf of anyone else.

9. How long we keep it

• Your account and profile - while your account is open. You can close it at any time.
• Medical declaration held in your profile - until you change or clear it, or 24 months after your last entry, whichever comes first.
• Medical declaration and medical aid details submitted for a specific event - 90 days after that event.
• Emergency contact details for a specific event - 90 days after that event.
• Unsuccessful applications - 90 days after the outcome, unless you ask us to remove them sooner.
• Acceptance of the Terms of Entry, and the version accepted - 3 years after the event.
• Records relating to an injury or incident - 3 years from the incident, or longer if a claim is brought.
• Results - published permanently as a public record of the event.
• Payment and tax records - as required by law.

We keep your medical declaration for a short time after each event because an injury may only come to light afterwards. Where nothing has happened, it goes.

10. Information processed outside South Africa

Our entry platform is hosted by providers based outside South Africa, so your information is stored and processed outside the country. We only use providers who are bound by agreements requiring a level of protection comparable to POPIA.

If you are in the United Kingdom or the European Economic Area, you have rights under the UK GDPR or the GDPR in addition to those below. Contact us at support@callingcpt.com, and we will apply whichever gives you greater protection.

11. How we protect it

We take reasonable technical and organisational steps to keep your information secure, including encryption in transit and at rest, access limited to staff who need it, and additional controls on medical information as described in section 5.

No system is completely secure. If a breach occurs that is likely to affect you, we will notify you and the Information Regulator as POPIA requires.

12. Your rights

You have the right to:

• Ask what personal information we hold about you and get a copy of it.
• Correct anything that is wrong or incomplete. Most of it you can edit yourself in your profile.
• Ask us to delete information we no longer have a reason to keep.
• Object to us using your information in a particular way.
• Withdraw a consent you gave, including the consent to hold your medical declaration and the consent to receive news about future events. Withdrawing does not affect anything we did before you withdrew.
• Complain to us, and to the Information Regulator.

To exercise any of these, email support@callingcpt.com. We will respond within a reasonable time and may ask you to confirm your identity first. There is no charge, though we may charge a reasonable fee for additional copies.

Some information we must keep even if you ask us to delete it, for example records relating to an injury, or financial records we are required by law to retain.

Information Regulator (South Africa)

• Complaints: POPIAComplaints@inforegulator.org.za, or through the Regulator's eServices portal
• General enquiries: enquiries@inforegulator.org.za
• Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• Website: inforegulator.org.za

13. Age

Entry is open only to people aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe someone under 18 has given us information, contact us, and we will delete it.

14. Changes to this policy

We may update this policy. The date at the top shows when it was last changed. If we make a change that materially affects how we use your information, we will tell entrants by email rather than relying on you to notice.

We keep previous versions, and a record of which version you accepted when you entered.

Questions: support@callingcpt.com