This Privacy Policy explains how personal data is collected, used, shared and protected when you use MyOneHundred, the official athlete portal of the One Hundred® Ultra Endurance Trail World Championship and Trail World Tour, available at https://www.myonehundredtrail.com (the "Platform"). It also explains the rights you have and how to exercise them.
We have written it to comply with the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, and the ePrivacy rules on cookies. Please read it together with our Terms of Service and Cookie Policy.
1. Who we are
The data controller responsible for your personal data is One Hundred Group Ltd, a company registered in England and Wales under company number 11958123, with registered office at 20-22 Wenlock Road, London, N1 7GU, United Kingdom ("OneHundred", "we", "us" or "our").
The Platform is developed, operated and hosted on our behalf by Stop and Go, our technology provider. Stop and Go acts as our processor: it only processes your personal data on our documented instructions, under a data processing agreement that meets the requirements of Article 28 GDPR, and may not use it for its own purposes.
Each race shown on the Platform is organised by a local event organiser. When you register for a race, the organiser receives the data needed to run that race and becomes an independent controller of that data (see section 6).
You can contact us about anything related to your personal data at support@onehundredtrail.com. We have not appointed a Data Protection Officer because we are not legally required to do so; requests sent to this address are handled by the person responsible for data protection at OneHundred.
2. Scope of this policy
This policy applies to personal data processed through the Platform, including when you:
- browse the public pages (events, course maps, rankings and results);
- create and manage an athlete account;
- register and pay for a race;
- create, join or manage a team;
- appear in race results or championship rankings;
- contact a coach or nutritionist, or apply to be listed as one;
- contact us by email.
It does not cover websites or services run by others that are linked from the Platform (for example the organisers' own websites, social networks or Stripe's payment pages), which have their own privacy policies. It also does not cover the information-only website at https://onehundredtrail.com, which has its own privacy policy.
3. Personal data we collect
3.1 Data you give us
| Category | Data |
|---|---|
| Account | First and last name, email address, password (stored only as a one-way hash), gender, date of birth, mobile phone number and country code, country of residence and preferred language. |
| Athlete profile | Optional nickname, profile photo, nationality, postal address, shirt size and athletics federation number (e.g. ATRP number). Where required for race insurance or eligibility checks, an identity document type and number (national ID card, tax number or passport). |
| Emergency contact | Phone number and/or email address of the person to contact in an emergency during a race. This is data about another person: please only give it after informing them and obtaining their agreement. |
| Race registration | The event, distance (track) and kit selected, name to print on the bib, shirt size, team, any notes you add, documents an organiser requires for a specific race, registration status, bib number and the date and version of the event rules and terms you accepted. |
| Payment | Amount, currency, discount code used, tax (VAT) number if you ask for an invoice, payment status and date, and the payment reference issued by Stripe. We never receive or store your full card details; these are entered directly on Stripe's secure pages. |
| Teams | Team name and logo, membership role (manager or member) and invitations sent, accepted or declined. |
| Coaches and nutritionists | If you apply to be listed: professional type, academic degree, professional experience, biography, fees and verification status. If you contact a professional: the subject and content of your messages and when they were read. |
| Consents and preferences | Whether you agreed to receive marketing emails, the versions of our Terms and Privacy Policy you accepted, when, and from which IP address and browser; your cookie choices; your display preferences (e.g. dark mode). |
| Correspondence | Any information you send us when you contact us by email. |
We do not ask for health data through the Platform. Some organisers may require a medical certificate or similar document for a particular race under their own rules; where that happens, the document is collected for the organiser, is used only to confirm your eligibility for that race, and is visible only to the people who need to validate it.
3.2 Data collected automatically
- Technical and security data: IP address, browser and device type (user agent), date and time of requests, pages requested and session identifiers. These are recorded in server logs and in our session store to keep you signed in and to protect the Platform.
- Error reports: if the Platform fails, a technical report of the error (which may include the page requested and your user ID) is sent to our error-monitoring provider so we can fix it. Passwords and authentication headers are removed from these reports and IP addresses are masked.
- Cookies: only the cookies that are strictly necessary for the Platform to work, plus the optional categories you accept. See the Cookie Policy.
We do not use advertising trackers, social-media pixels or third-party analytics on the Platform.
3.3 Data we receive from others
- Race results: after each race, the organiser or its official timing company sends us the results (name, gender, age category, bib number, team, finishing times and positions, and where available date of birth, nationality, email and identity document number so that results can be matched to the right athlete). We use them to publish results and calculate championship rankings. If you do not yet have an account, we may create a basic athlete profile for you from these results so that your points are counted; you can claim it by resetting the password with the same email address, or ask us to delete it.
- Organisers and our staff may create or update an account on your behalf, for example when you register at a race venue or ask for help by email.
- Stripe tells us whether your payment succeeded.
- Other athletes may give us your name or email address when they invite you to join a team.
4. Why we use your data and our legal bases
We only use personal data where we have a legal basis under Article 6 GDPR. The table below sets out each purpose.
| Purpose | Legal basis |
|---|---|
| Creating and managing your account, verifying your email, letting you sign in and resetting your password. | Performance of a contract (Art. 6(1)(b)). |
| Processing race registrations: reserving your place, assigning a bib, preparing your kit and shirt, and sending your details to the event organiser. | Performance of a contract (Art. 6(1)(b)). |
| Taking payments, issuing receipts and invoices, handling coupons and resolving payment disputes. | Performance of a contract (Art. 6(1)(b)); legal obligation for accounting and tax records (Art. 6(1)(c)). |
| Passing your emergency contact details to the organiser so they can reach someone if you are injured or lost. | Performance of a contract (Art. 6(1)(b)) and, in an emergency, vital interests (Art. 6(1)(d)). |
| Checking eligibility for a race or category (age, gender, federation number, identity document) where the race rules or insurance require it. | Performance of a contract (Art. 6(1)(b)); legal obligation where insurance or sports regulations require it (Art. 6(1)(c)). |
| Publishing race results and calculating and publishing the One Hundred® championship rankings, series standings and awards. | Legitimate interests (Art. 6(1)(f)) in running a fair, transparent international competition and in keeping a sporting record. You can object (see section 5). |
| Creating athlete profiles from imported results so that points are assigned to the right person. | Legitimate interests (Art. 6(1)(f)) in keeping accurate rankings. |
| Managing teams and team invitations. | Performance of a contract (Art. 6(1)(b)). |
| Listing verified coaches and nutritionists and forwarding messages between athletes and professionals. | Performance of a contract (Art. 6(1)(b)). |
| Sending service emails: email verification, password reset, team invitations, new message alerts, registration and payment notices (Stripe sends the payment receipt), and important changes to a race or to these policies. | Performance of a contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) for policy-change notices. |
| Sending news, race announcements and offers from OneHundred by email. | Your consent (Art. 6(1)(a)), which you can withdraw at any time in Settings → Privacy or via the link in each email. |
| Loading course maps from OpenStreetMap. | Your consent (Art. 6(1)(a) GDPR and the ePrivacy rules), given through the cookie banner. |
| Keeping the Platform secure: preventing fraud and abuse, limiting login attempts, logging and fixing errors, and making backups. | Legitimate interests (Art. 6(1)(f)) in protecting our users and our systems. |
| Answering your questions and requests, including requests to exercise your rights. | Performance of a contract (Art. 6(1)(b)) or legal obligation (Art. 6(1)(c)). |
| Keeping records of the consents you gave and the terms you accepted. | Legal obligation to demonstrate consent (Art. 7(1)) and legitimate interests (Art. 6(1)(f)). |
| Establishing, exercising or defending legal claims, and complying with lawful requests from authorities. | Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)). |
| Reorganising our business (for example, a merger or sale of the championship), in which case data may be transferred to the new owner under the same protections. | Legitimate interests (Art. 6(1)(f)). |
Where we rely on legitimate interests, we have balanced those interests against your rights and expectations. You can ask us for more information about that assessment.
Providing the data marked as required in our forms is necessary to create an account or register for a race. If you do not provide it, we cannot provide that service. Everything else is optional.
5. Information that is made public
Results and rankings are a core part of a sporting competition. The following information is visible to anyone on the Platform without signing in:
- Championship and series rankings: your name, profile photo (if you uploaded one), country, gender, age category, team, points and the races that counted towards your ranking.
- Race results: name, gender, category, team, bib number, times and positions.
Organisers and timing companies usually publish results on their own websites too, and results may be reported by the press and broadcast on One Hundred TV. Your email, phone number, date of birth, address, identity document and emergency contact are never published.
Inside the Platform, other members of your team can see your name and role, and the team manager can also see your email address so they can manage the team. Coaches and nutritionists you message can see your name and messages.
You have the right to object to the publication of your results and ranking. Contact us at support@onehundredtrail.com; we will then show your results under "Anonymous" unless there is a compelling reason not to (for example, if the result is needed to settle an ongoing dispute about prizes). Please note we cannot control copies published by organisers or third parties.
6. Who we share your data with
We do not sell your personal data. We share it only as described below.
6.1 Event organisers and timing partners
When you register for a race, the organiser of that race (and the timing company it appoints) receives the data needed to run it: your name, email, phone, gender, date of birth, nationality, country, team, shirt size, bib name and number, federation number, emergency contact, registration status and, where required, identity document or required documents. Organisers act as independent controllers and use this data under their own privacy notices and race rules, for example for insurance, safety, timing and sending race information. Organisers authorised to manage an event on the Platform can also see the list of registrants and participation statistics for their own events.
6.2 Stripe
Payments are processed by Stripe (Stripe Payments Europe, Ltd. and its affiliates). We send Stripe your email address, the description of what you are buying and internal references. Stripe processes your card details and may carry out fraud checks as an independent controller under its own privacy policy. Depending on the race, payment may be collected by OneHundred or directly by the event organiser through its own Stripe account.
6.3 Our service providers (processors)
We use carefully selected providers who process data only on our behalf and under contracts that meet Article 28 GDPR:
- our platform provider, Stop and Go, which develops, maintains and supports the Platform;
- data centre and hosting providers, which host our servers, databases, files and backups in the European Union;
- email delivery providers, which send our service emails;
- an error-monitoring provider, which receives technical error reports;
- OpenStreetMap tile servers, only if you accept external maps (they receive your IP address to deliver the map images).
6.4 Other people on the Platform
Team members and professionals you contact see the limited information described in section 5.
6.5 Group companies, partners and successors
We may share data with companies in our group that help us run the championship, and with a buyer or successor if the championship or our business is transferred. They will be bound by this policy or one offering equivalent protection, and we will inform you before your data becomes subject to a different policy.
6.6 Authorities and legal requirements
We may disclose data when required by law, by a court, or by a public authority, or where necessary to protect the safety of any person, to prevent fraud, or to establish, exercise or defend legal claims. In a medical emergency during a race, data may be shared with emergency services.
7. International transfers
The Platform is hosted in the European Union. OneHundred is based in the United Kingdom, which benefits from an EU adequacy decision, and the UK recognises the EU/EEA as adequate. Some data may be transferred elsewhere:
- Stripe may process data in the United States. Such transfers rely on the EU-U.S. Data Privacy Framework and/or the European Commission's Standard Contractual Clauses (and the UK Addendum).
- Races outside Europe. The championship takes place on several continents. When you register for a race held outside the EU/UK (for example in Brazil, Costa Rica, Argentina, Uruguay, Nicaragua, India or Tajikistan), your registration data must be sent to the organiser in that country. Where that country does not have an adequacy decision, the transfer is necessary for the performance of the contract you asked us to enter into (Art. 49(1)(b) GDPR) and, where possible, is also covered by contractual safeguards.
You can ask us for a copy of the relevant safeguards by writing to support@onehundredtrail.com.
8. How long we keep your data
We keep personal data only for as long as necessary for the purposes described above:
| Data | Retention period |
|---|---|
| Account and profile | Until you delete your account or ask us to delete it. Accounts that were created but never used (no registration, result, payment, team or message) may be deleted automatically after 30 days. |
| Race registrations | For as long as your account exists, so you can see your history. After the account is deleted, kept only in anonymised form, or for as long as linked payment records must be kept. |
| Payment and invoicing records | As long as tax and accounting laws require: in the UK 6 years after the end of the financial year, and up to 10 years where the law of the organiser's country requires it. After account deletion they are no longer linked to your profile. |
| Race results and rankings | Kept indefinitely as part of the historical sporting record. If you delete your account or object, your results are shown under "Anonymous". |
| Emergency contact | Kept with your profile and registration until you change it or delete your account; removed from registrations when the account is deleted. |
| Messages with professionals | Until the account of either party is deleted (the other party keeps their copy with your name removed). |
| In-app notifications | Read notifications are deleted after 12 months. |
| Consent and acceptance records | For as long as the consent is in effect and for up to 6 years afterwards, to be able to prove it. |
| Sessions | Expire after 2 hours of inactivity (or up to the "Remember me" period if you choose it). |
| Password reset links | Valid for 60 minutes and deleted daily. |
| Server logs and error reports | Up to 30 days, unless needed to investigate a specific security incident. |
| Backups | Overwritten on a rolling basis; deleted data disappears from backups at the end of the backup cycle. |
| Correspondence with us | Up to 3 years after the matter is closed. |
We may keep data for longer where it is needed to establish, exercise or defend a legal claim, for as long as that need lasts.
9. Your rights
Under the GDPR and UK GDPR you have the following rights:
- Access – to get confirmation of whether we process your data and a copy of it.
- Rectification – to correct inaccurate or incomplete data. Most of it you can edit yourself in your profile.
- Erasure – to have your data deleted ("right to be forgotten"), subject to legal retention obligations.
- Restriction – to ask us to temporarily limit how we use your data, for example while we check its accuracy.
- Portability – to receive the data you provided in a structured, machine-readable format and to have it sent to another controller.
- Objection – to object at any time to processing based on our legitimate interests, including the publication of your results, and absolutely to any direct marketing.
- Withdraw consent – at any time, without affecting the lawfulness of processing before withdrawal.
- Complain – to a data protection supervisory authority (see section 15).
You can exercise many of these rights yourself, at any time, from your account:
- Profile – view and correct your personal details;
- Settings → Privacy – download a copy of your data (JSON), manage marketing consent and delete your account;
- Cookie settings – change your cookie choices.
For any other request, email support@onehundredtrail.com. We will reply within one month. This can be extended by two further months for complex or numerous requests, in which case we will tell you why. We may need to verify your identity before acting on a request. Exercising your rights is free of charge, unless requests are manifestly unfounded or excessive.
When you delete your account, we erase your profile and personal data. Records we must keep by law (such as payments) and your race results are kept in anonymised form so they can no longer be linked to you. Data already sent to an event organiser for a past race is held by that organiser under its own policy; we will tell organisers about your request where required.
10. Minors
Accounts on the Platform are only for people aged 18 or over. We do not knowingly collect personal data from children. Registrations of minors for youth or kids races, where an organiser offers them, are handled by the organiser with the consent of a parent or legal guardian. If you believe a child has given us personal data, please contact us and we will delete it.
11. Security
We take appropriate technical and organisational measures to protect your data, including:
- encryption in transit (HTTPS/TLS) for all pages;
- passwords stored only as salted one-way hashes, and sensitive keys stored encrypted;
- role-based access, so that staff and organisers only see the data they need for their role;
- rate limiting of login attempts, protection against cross-site request forgery and secure, HTTP-only session cookies;
- hosting in secure data centres in the EU with regular backups;
- confidentiality obligations for everyone who has access to personal data.
No system is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the competent supervisory authority within 72 hours and, where the risk is high, inform you without undue delay. Please keep your password secret and tell us immediately if you suspect unauthorised use of your account.
12. Cookies and similar technologies
We use only strictly necessary cookies by default. Optional content (external maps) is loaded only if you accept it. Full details, including each cookie's name, purpose and duration, are in our Cookie Policy.
13. Automated decision-making
Championship points and rankings are calculated automatically from official results using the scoring rules published for each season. This does not produce legal effects or similarly significant effects within the meaning of Article 22 GDPR, and any result or ranking can be reviewed by our team on request. We do not use profiling for marketing.
14. Changes to this policy
We may update this policy to reflect changes to the Platform or to the law. The date and version at the top show when it was last changed. If we make material changes, we will tell you by email or by a notice on the Platform before they take effect and, where the law requires, ask for your consent again.
15. Contact and complaints
For questions about this policy or your personal data, contact:
One Hundred Group Ltd
20-22 Wenlock Road, London, N1 7GU, United Kingdom
Email: support@onehundredtrail.com
If you are not satisfied with our answer, you have the right to lodge a complaint with a supervisory authority, in particular in the country where you live, work or where the alleged infringement took place. In the UK this is the Information Commissioner's Office (ico.org.uk). In Portugal it is the Comissão Nacional de Proteção de Dados (cnpd.pt). A list of all EU authorities is available from the European Data Protection Board (edpb.europa.eu). We would, however, appreciate the chance to address your concerns first.