Privacy Policy

Who we are

Running Mad is an independent non-profit organisation based in the United Kingdom. We run virtual running, walking, cycling and swimming challenges and send out medals and certificates to the people who take part.

For data protection purposes, Running Mad is the data controller. You can reach us at:

• Post: Running Mad, Mckenzie House (2nd Floor), 110-112 Leagrave Road, Luton, Bedfordshire, LU4 8HX, England
• Email: hello@runningmad.co.uk

The information we collect

Information you give us

• Order and delivery details such as your name, email address, billing address, delivery address and telephone number.
• Account details if you choose to create an account, including your username and password. Passwords are stored in an encrypted form and are never visible to us.
• Challenge and evidence details that you submit voluntarily, such as your activity, distance, time and any screenshot from an activity-tracking app.
• Messages you send us through a contact form, a support ticket or by email.
• Marketing preferences, including whether you have asked to receive our emails.

Information we collect automatically

• Technical data such as your IP address, browser type, device type and the pages you view. This is used for security, fraud prevention and to keep the site working.
• Cookies and similar technologies. These are explained in our Cookie Policy, and you can change your choices at any time through the cookie banner.

Information we never ask for

We do not need and do not ask for special category data such as health records, and we do not store your full card details on this website. Card payments are handled directly by our payment providers.

Why we use your information, and our legal basis

• To fulfil your order including taking payment, dispatching your medal and certificate, and sending order confirmations. Legal basis: performance of a contract.
• To provide customer support and answer your questions. Legal basis: performance of a contract, or our legitimate interests in running a helpful service.
• To feature you on the leaderboard, where you have chosen to submit evidence. Legal basis: consent, which you give by submitting it and can withdraw at any time.
• To send marketing emails about new challenges and medals, where you have asked us to. Legal basis: consent. Every email contains an unsubscribe link.
• To keep the website secure and prevent fraud and abuse. Legal basis: legitimate interests, and legal obligation.
• To meet our accounting and tax duties. Legal basis: legal obligation.
• To understand how the site is used so we can improve it. Legal basis: consent, given through the cookie banner.

Who we share your information with

We do not sell your personal information. We share it only with the organisations that help us run Running Mad, and only with what they need:

• Payment providers who process your card or wallet payment securely. Your card number is given to them, not to us.
• Delivery and postal partners so your medal can reach you.
• Email and marketing platforms used to send order emails and, where you have consented, our newsletter.
• Website hosting, backup and security providers who store and protect the site.
• Analytics providers, where you have accepted analytics cookies.
• Professional advisers and authorities where we are required to share information by law.

Sending information outside the UK

Some of our providers are based outside the United Kingdom. Where personal information is transferred abroad, we rely on UK adequacy regulations or on the International Data Transfer Agreement or Addendum approved by the UK Government, so that your information keeps an equivalent level of protection.

How long we keep your information

• Order and transaction records are kept for as long as we are required to keep them for tax and accounting purposes.
• Account information is kept for as long as your account is open. You can ask us to close and delete it.
• Marketing consents are kept until you unsubscribe or ask us to erase your details.
• Support messages are kept only as long as needed to resolve your query and to handle any follow-up.
• Website security logs are kept for a short period and then deleted automatically.

Keeping your information safe

This website is served over an encrypted HTTPS connection. We use firewall and malware protection, restrict administrative access to the people who need it, and take regular backups. No system can ever be completely secure, but we take these safeguards seriously and review them regularly.

Your rights

Under UK data protection law you have the right to:

• be told how your information is used, which is the purpose of this notice
• ask for a copy of the personal information we hold about you
• have inaccurate information corrected
• ask us to erase your information, where there is no overriding reason for us to keep it
• ask us to restrict how we use your information
• object to us using your information for our legitimate interests or for marketing
• ask us to transfer your information to another provider in a portable format
• withdraw your consent at any time, where we relied on consent

To exercise any of these rights, email hello@runningmad.co.uk. We will respond within one month. There is no charge for making a request.

Children

Our challenges are open to all ages, and younger participants are very welcome. However, an order must be placed by a parent or guardian aged 18 or over, and we do not knowingly collect personal information directly from children. If you believe a child has given us their details, please contact us and we will remove them.

Marketing and unsubscribing

We only send marketing emails to people who have asked for them. You can unsubscribe using the link at the bottom of any of our emails, or by emailing us. Unsubscribing from marketing will not stop the transactional emails you need, such as your order confirmation and dispatch notice.

Cookies

Full details of the cookies this site sets, what they do and how long they last are in our Cookie Policy. You can accept, reject or change your cookie choices at any time.

Complaints

If you are unhappy with how we have handled your personal information, please tell us first at hello@runningmad.co.uk so we have the chance to put it right. You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection, at ico.org.uk or on 0303 123 1113.

Changes to this notice

We may update this notice from time to time, for example if we start using a new provider or offer a new service. When we make a significant change we will update the date shown below and, where appropriate, let you know by email.

Connecting a fitness account (Google Health/Fitbit, Garmin and similar)

Some of our virtual challenges let you connect a third-party fitness account — such as Google Health (Fitbit), Garmin, or a similar service — so that the activities you record there can count automatically towards your challenge. Connecting an account is always optional: you can instead log your distance manually, and you can disconnect a connected account at any time.

When you connect an account you grant permission on that provider’s own screen. We then access only the activity information we need to score your challenge — specifically the distance, duration and type of the activities you record. We do not access your wider health, medical, location-history or profile data beyond what is necessary for this purpose.

We use this data solely to calculate your progress and show your standing on the challenge leaderboard, under the name and consent settings you choose. We store only the aggregated totals needed for the leaderboard, together with the secure access tokens that let us refresh your progress; those tokens are held encrypted. We do not sell this data and we do not share it with third parties.

Google user data — Limited Use. Running Mad’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Data obtained through Google Health is used only to provide the leaderboard feature you connected it for, is not used for advertising, and is not transferred to others except as necessary to provide that feature, for security, or to comply with the law.

Connected data is kept only while you take part in the relevant challenge, plus a short period afterwards for finisher and results purposes. If you disconnect an account or ask us to delete your event data, we remove the stored tokens, stop accessing the provider, and delete or anonymise your leaderboard entry on request. You can disconnect at any time from your account or by contacting us using the details below.