PRIVACY POLICY

Ironman (Asia) Pte. Ltd. is the data controller in respect of the Services (“IRONMAN”, “we”, “us” or “our”). IRONMAN is responsible for and controls the processing of your personal data. If you wish to contact IRONMAN, you can find additional contact details at the end of this Privacy Policy.

In the context of rendering our Services, we may collect personal data about you. Please see Annex 1 for a detailed description on the data we collect. On a more general level, the personal data we collect can include the following:

• If you set up an account on our websites or digital applications. Username, password, name, e-mail address, birth date, gender and other information you provide during registration.
• If you contact us via e-mail, phone or mail. Name, e-mail address, phone number, address and other information you provide.
• If you subscribe to our newsletter. Name, e-mail address and marketing campaign information such as your reaction to our marketing and your interest in our Services.
• If you use our website. IP address, network file system, access times, domain name, browser data, browser type and language, device type, device ID, Uniform Resource Locators (URL), operating system, language preferences and information on your usage of our websites and online activities.
• Information we collect from social networks. When you interact with our Services through various social media, such as when you login through Facebook, or when you follow IRONMAN or share our content on Facebook, Twitter, Instagram or other websites, we may receive information from those social networks including your profile information, picture, user ID associated with your social media account, friends list, and any other information you permit the social network to share with third parties. The personal data we receive is dependent upon your privacy settings on the respective social media platforms.
• If you register for an Event. Name, e-mail address, phone number, address, birth date, place of birth, gender, medical data (including information about medical conditions, current medications, and allergies to medication), emergency contact information, relay information and other information you provide during registration. IRONMAN also has access to the last 4 digits of the credit card used for registration to facilitate refunds.
• In the course of preparing the Event and during the Event, we might add other information, such as your registration number and the age group to which you are allocated as well as your performance in the Event. When you check in to participate in the Event, we may examine your driver’s license and/or passport for identification purposes. During the Event, we may also collect photographs and videos of participants (with your consent), and your geolocation data for safety and reporting purposes.
• Optional information provided by you. The provision of some categories of personal data is optional in some instances, and in such instances does not impact your participation in the Event. Examples of the types of personal data which you may voluntarily provide to us include information about your gender, nationality, date of birth, occupation, employer, job title, purchasing information, donation to charity, and/or any information about your communications with us. The types of information which are optional to provide, and the purposes and reasons for which they are collected and used for are sent out in more detail in Annex 1.
• For athletes: Anti-doping tests may be conducted in compliance with the World Anti-Doping Code Information. Data collected in this context is only used to test for prohibited substances and, where applicable, impose sanctions on athletes using such prohibited substances.

We may combine all the information we collect from or receive about you for the outlined purposes. We may aggregate or deidentify your information and may use, share, rent or sell aggregated or deidentified information for any purpose, and such information is not subject to this Privacy Policy.

Personal data is collected in many ways and may include:

• Personal data you provide to us. Most of the personal data we receive comes to us voluntarily from (a) our users in the course of using our Services, such as when setting up or using their accounts on our websites, subscribing to our e-mail newsletter or communicating with us and/or (b) our athletes in the course of registering for an Event.
• Personal data collected via technology. As you use our websites and apps, we may collect information through the use of cookies and similar technologies. Please see Section 9 below for more information.
• Personal data we receive from others. We may receive personal data about users from third parties such as social media sites, data enhancement services, law enforcement agencies, or other third parties. In the course of the Event we will receive personal data on your performance from our service providers in connection with the Event,

The reasons for using your personal data may differ depending on the purpose of the processing. Certain jurisdictions require companies to tell you about the legal basis for processing your information. To the extent the laws of those jurisdictions apply, we may rely on the following legal bases to use, share, or disclose your information:

• We use your personal data for the performance of our contractual services or for the preparation of a contract with you. If you set up an account, we use your personal data to provide you with the account and its features. If you register for our Event or if you contact us to register for our Event, we use your personal data to conduct our Event and make your participation in our Event possible. We will use your personal data to organize your participation in the Event, for example by allocating a bib number to you and specifying your race category classification. We will send you e-mails with organizational information and communicate with you in case of questions.
• We use your personal data if justified by our legitimate interests. The usage of your personal data may be necessary for our own business interests when not outweighed by your rights and risks to you, and for providing you with our Services. For example, we may use some of your personal data to evaluate and review our business performance and identify potential cyber security threats. If necessary, we may also use your personal data to pursue or defend ourselves against legal claims.
• We use your personal data after obtaining your consent. In some cases, we may ask you to grant us consent to process your information in a certain way. This includes situations where we process sensitive data, such as information about your health and medical conditions, when we ask to collect personal information for our marketing purposes, such as when you sign up for our e-mail newsletter and when we use your personal data for email marketing campaigns, and when setting certain cookies.

Where we ask you for your consent, you are free to deny your consent and the denial will have no negative consequences for you except as we may disclose to you where the personal data is necessary for certain processing. You are also free to withdraw your consent at any time with effect for the future. If you have granted us consent to use your personal data, we will use it only for the purposes specified at the time that consent is provided. You may unsubscribe from our e-mail newsletter at any time [unsubscribe from this list]. You may also contact us via e-mail, or mail at the address provided at the end of this document to request that we remove you from our e-mail list.

• We use your personal data to ensure the safety of individuals and the public. We may use your personal data where it is reasonably necessary to lessen or prevent a serious threat to the life, health or safety of any individual (including yourself), or to public health and safety. For example, to ensure your safety during our Event we monitor you during the Event and share your medical data with our medical teams to help you in case of a medical emergency. We may also use your personal data to assist in the location of any person who has been reported as missing.
• We use your personal data to comply with legal obligations. We are legally obligated to retain certain personal data for tax reasons and commercial law requirements, We may also provide data to law enforcement, including but not limited to where we believe it is necessary in order to take action against unlawful activity or misconduct of a serious nature, or where required by law enforcement agencies. We may also use personal data to comply with any legal requirements or respond to court (or other similar) orders.

We will only use your personal data for the purposes for which it was collected or any other purpose you may authorise. We do not use your personal data for automated individual decision-making.

As required in accordance with how we use it, we will share your personal data with third parties. Please see

Annex 1 for a detailed description of the third parties and the personal data we might share with them. On a more general level, we share your personal data with the following categories of third parties:

• Our affiliates and subsidiaries. We work closely together with our affiliates and subsidiaries around the world to help better tailor services, products, marketing and advertising to you and to other existing and potential customers. Please see the full list of our affiliates and subsidiaries in Annex 2.
• Service providers and advisors. Third-party vendors and other service providers that perform services for us and on our behalf, which may include marketing campaign services, providing mailing or e-mail services, medical support, Event surveillance, time keeping, services related to the registration and organization of our Event, payment processing, data enhancement services, fraud prevention, web hosting, or providing analytic services. If applicable, such service providers will, by appropriate data processing agreements, be bound to process personal data only on our behalf and under our instructions.
• Event photographer. If you participate in our Event and have given us consent to do so, we will disclose your bib number, name, email address and phone number to the Event photographer, who may contact you with photos from the Event.
• Purchasers and third parties in connection with a business transaction. Personal data may be disclosed to third parties in connection with a transaction, such as a merger, sale of our assets or shares, reorganization, financing, change of control or acquisition of all or a portion of our business, or in the event of a bankruptcy or similar proceedings.
• Law enforcement, regulators, and other parties for legal reasons. Personal data may be disclosed to third parties as required by law or subpoena or if we reasonably believe that such action is necessary to (a) comply with the law and the reasonable requests of law enforcement; (b) to enforce our legal claims or to protect the security or integrity of our Services; and/or (c) to exercise or protect the rights, property, or personal safety of IRONMAN, our affiliates and subsidiaries, our partners, employees, or others.
• The public. The official rankings and information justifying the ranking will be disclosed to the visitors of our Event and on our websites.

Sale or transfer of all or part of our business or assets. In the event IRONMAN is involved in a merger, acquisition, transfer of control, bankruptcy, reorganisation or sale of assets, we may sell or transfer the information described in this Privacy Policy as part of that transaction

We will store personal data for as long as necessary to fulfill the purposes for which we collect the personal data, unless a longer retention is required or permitted by law. Afterwards, or at the end of the statutory retention times, the personal data will be deleted as applicable.

We implement a variety of security measures to maintain the safety of your personal data. However, no system of security can be 100% secure and so we cannot guarantee in all cases the security of the information that we process. In the event we learn that personal data is compromised as a result of a breach of security, we will take steps to investigate and comply with notification obligations and take other steps in accordance with applicable laws and regulations.

Depending on your place of residence or location, your personal data in connection with the Services or Event may be stored in another country. The laws in that country may differ from the privacy laws in your country, however, this does not change our commitment to safeguard your privacy and comply with all applicable laws related thereto.

As mentioned in Section 5, your personal data may be shared with our affiliates and subsidiaries in Annex 2, and other third parties, who may be located in a different country to you (“Overseas Recipients”). These Overseas Recipients may be located in various jurisdictions, such as those listed on Annex 2, which may not afford the same protections as in your country of residence.

Where your personal data is transferred to Overseas Recipients, we will take reasonable steps to ensure that the Overseas Recipients will handle your personal data as outlined below.

• If you are located in the European Union, United Kingdom, or Switzerland, the following applies:
  Before transferring your personal data to an Overseas Recipient, we use data processing agreements that apply the EU Standard Contractual Clauses and/or UK General Data Protection Regulation Standard Contractual Clauses to safeguard your personal data.
• If you are located in Australia or New Zealand, the following applies:
  Before transferring your personal data to an Overseas Recipient, we will take reasonable steps to ensure that the Overseas Recipients will handle your personal data in accordance with:
  Australian Laws: the Australian Privacy Principles (“APPs”) and the Privacy Act 1988 (Cth) (“Australian Privacy Act”).
  New Zealand Laws: the New Zealand Privacy Principles (“IPPs”) and the New Zealand Privacy Act (“NZ Privacy Act”).

These steps may include entering into contractual arrangements to safeguard your personal data where appropriate.

If you wish to inquire further about the safeguards we use, please contact us using the details set out at the end of this Privacy Policy.

We, and our third-party partners, automatically collect certain types of usage information when you visit our websites, apps or social networking pages, when you read our e-mails, or when you otherwise engage with us. Cookies, flash objects, web beacons, file information and similar technologies are used to collect this type of information. Most browsers can be set to detect browser cookies and to let you reject them, but refusing cookies may affect certain features of our website that are provided for your convenience.

• What are Cookies used for? Cookies are pieces of code that allow for personalization of our website experience by saving some of your personal data, such as user ID and preferences. A cookie is a small data file that is transferred to your device’s hard disk (such as your computer or smartphone) for record-keeping purposes. Cookies and similar technologies (“Cookies“) do lots of different jobs, like helping us understand how our website is being used, letting you navigate between pages efficiently, remembering your preferences and language settings and generally improving your browsing experience. Cookies can also help us to ensure that marketing you see online is more relevant to you and your interests.
• What types of Cookies are used by us and our partners? The types of Cookies used on our websites can generally be put into one of the following categories: strictly necessary; analytics; functionality; advertising; and social media.Strictly Necessary: These Cookies are essential to make our website work. They enable you to move around the websites and use their features. You can set your browser to block these Cookies, but without these Cookies, some of the services that are necessary for you to fully use our website may not be available or function properly.

We also place the following types of Cookies. If you are accessing our websites with an IP address that indicates that you are located in the European Union, the United Kingdom, or other jurisdictions where consent is required before placing the types of Cookies listed below, we will ask for such consent prior to placing such Cookies on your browser. You are free to deny consent.

• Functionality Cookies: These Cookies allow us to remember choices you make and tailor our website to provide enhanced features and content to you. For example, these Cookies can be used to remember your username, language choice or country selection, and they can also be used to remember changes you have made.
• Analytics Cookies: These Cookies collect information about how people are using our websites, for example which pages are visited the most often, how people are moving from one link to another and if a user experiences error messages on certain pages. All information these Cookies collect is grouped together with information from other people’s use of our website. Overall, these Cookies provide us with analytical information about how our websites is performing and additional information on the users of our Services.
• Advertising Cookies: These Cookies are used to deliver advertisements that are more relevant to you and your interests
• Social Media Cookies: In order to enhance your internet experience and to make the sharing of content easier, some of the pages on our website may contain tools or applications that are linked to third-party social media service providers such as Facebook or Twitter. Through these tools or applications, the social media service provider may in turn set its own Cookies on your device. We do not control Cookies set by social media service providers, and you should check the social media service provider’s website for further details about how they use Cookies.
• Mobile devices: If you enter our website or apps via a mobile device with activated location-based services, we may collect information about your current location as well as the kind of mobile device in use. Most of the mobile devices provide the possibility to disconnect from location-based services or to deactivate those.

We also use clear gifs in HTML-based e-mails sent to our newsletter subscribers to track which e-mails are opened and which links are clicked by them. The information allows for more accurate reporting and improvement of our Services. You can set your e-mail options to prevent the automatic downloading of images that may contain these technologies that would allow us to know whether you have accessed our e-mail and performed certain functions with it.

How can you manage Cookies? If you would prefer not to accept Cookies, most browsers will allow you to (i) change your browser settings to notify you when you receive a Cookie, which lets you choose whether or not to accept it; (ii) disable existing Cookies; or (iii) set your browser to automatically reject Cookies. Please note that doing so may negatively impact your experience using our websites and apps, as some features and services on our websites and apps may not work properly. Depending on your mobile device and operating system, you may not be able to delete or block all Cookies.

Your Cookie settings can typically be adjusted in the “options” or “preferences” menu of your browser. In order to understand these settings, the following links may be helpful, otherwise you should use the “Help” option in your browser for more details. You must take steps on each browser or device that you use.

Cookie settings in Internet Explorer
Cookie settings in Firefox
Cookie settings in Chrome
Cookie settings in Safari web and iOS

If the browser you use is not listed above, please refer to your browser’s help menu for information on how to manage Cookies.

To make choices about cookies placed by us or our third parties on our websites, you may do so by visiting Your Privacy Choices in the footer of the website, which may also appear, in certain jurisdictions, as “Do Not Sell My Personal Information”. If you do not/no longer want to have cookies placed on your browser by third parties, many of them also offer ways to opt out.

We do not serve targeted advertising on our Websites; however, when you use the Internet, we and our third parties including ad networks, web analytics companies, and social networking platforms may use tracking technologies such as those described above, to collect

We want you to understand your rights and choices regarding how we may use your personal data.

Individual Rights. Depending on your market, you have specific rights under applicable privacy laws in respect to your personal data that we hold, that may include, without limitation, a right of access and erasure and a right to prevent certain processing activities.

a) Your European Union Rights

If you are located in the European Union, you have the following rights in respect to your personal data that we hold:

• Right of access. The right to obtain access to your personal data.
• Right to rectification. The right to obtain rectification of your personal data without undue delay where that personal data is inaccurate or incomplete.
• Right to erasure. The right to obtain the erasure of your personal data without undue delay in certain circumstances, such as where the personal data is no longer necessary in relation to the purposes for which it was collected or processed.
• Right to restriction. The right to obtain the restriction of our data processing in certain circumstances, such as, where you contest the accuracy of your personal data, for a period of time enabling us to verify the accuracy of that personal data.
• Right to portability. The right to portability allows you to move, copy or transfer personal data easily from one organization to another. It only applies to personal data that you have directly provided to us.
• Right to object. You have a right to object to any processing based on our legitimate interests where there are grounds relating to your particular situation. You can object to the use of your personal data for marketing activities for any reason whatsoever. .

If you wish to exercise one of these rights, please contact us using the contact details below.

For Cookies or e-mail marketing, we provide the following easily usable options:

Cookies Settings and Preferences. You may disable cookies and similar technologies through the settings in your browser.

E-Mail Settings and Preferences. If you no longer want to receive marketing e-mails from us, you may choose to unsubscribe at any time [unsubscribe from this list].

In addition to the foregoing listed rights, if you are located in the European Union, you also have the right to lodge a complaint with a data protection authority. Further information about how to contact your local data protection authority is available at
http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm.

b) Your Nevada Privacy Rights

Under Nevada law, Nevada residents may opt out of the “sale” of their personal information, where the information is exchanged for monetary consideration. If you are a Nevada resident, you may submit a request to opt out of potential future sales under Nevada law by sending a message to our data protection team at [email protected]. Please note we will take reasonable steps to verify your identity and the authenticity of the request.

c) Your California Privacy Rights

California law requires us to disclose certain information regarding the categories of personal data we collect. Please see below for a detailed description of the categories of personal data we collect, the purposes for which we use your personal data and the third parties we might share personal data with.

If you are a resident of California, you have the following rights in respect to your personal data that we hold:

The Right to Know. The right to have us disclose to you any or all of the following information relating to your personal data we have collected and disclosed in the last 12 months, upon verification of your identity:

• The specific pieces of personal data we have collected about you;
• The categories of personal data we have collected about you;
• The categories of sources of the personal data;
• The categories of personal data that we have disclosed to third parties for a business purpose, and the categories of recipients to whom this information was disclosed;
• The categories of personal data we have sold and the categories of third parties to whom the information was sold; and
• The business or commercial purposes for collecting or selling the personal data.

The Right to Request Deletion. The right to obtain the deletion of personal data we have collected from you, subject to certain exceptions.

The Right to Opt Out of Personal Information Sales. Singapore Marathon and IRONMAN do not “sell” personal data about our customers as most people would typically understand that term. However, we do allow certain third-party advertising partners to collect information about the users of our Services for the purposes of serving ads that are more relevant, for ad campaign measurement and analytics, and for fraud detection and reporting. To the extent this practice is interpreted to constitute a “sale” under the CCPA, please see the Cookies and similar technologies section of the Privacy Policy for more information about how we share personal data within IRONMAN and with a variety of third parties for our business purposes.

You also have the right to be free of discrimination for exercising these rights. However, please note that if the exercise of these rights limits our ability to process personal data (such as in the case of a deletion request), we may no longer be able to provide you our products and services or engage with you in the same manner.

You may submit a request to exercise your California consumer rights through one of the mechanisms described below. We will need to verify your identity before processing your request, which may require us to request additional personal data from you or require you to log into your account, if you have one. In certain circumstances, we may decline or limit your request, particularly where we are unable to verify your identity or locate your information in our systems, or as permitted by law.

• • To exercise your Right to Know and/or your Right to Request Deletion, please submit a request using our Privacy Webform or call (844) 868-7727.
  • To exercise your Right to Opt Out of Personal Information Sales, please click the following link: Do Not Sell My Personal Information

To opt out or control the use of your personal information by social media, advertising and analytics partners, please see the Cookies and similar technologies section of the Privacy Policy.

If you have any questions or concerns about our Privacy Policy or if you want to exercise your rights, please send an e-mail to [email protected] or contact:

Privacy c/o Legal Department
World Triathlon Corporation
3407 W. Dr. Martin Luther King Jr. Blvd.
Suite 100
Tampa, Florida 33607
USA

We may make changes to our Privacy Policy from time to time. Please review our policies regularly as updated policies will apply to future events and your future use of our Services and Event. To the extent we make any material changes to our Privacy Policy, we will provide you with notice of these changes in a manner as required by applicable law.

Last Updated: June 2023

Annex 1 – Singapore Marathon