Tough Mudder UK Privacy Policy

PRIVACY POLICY

We at Spartan Race, Inc. (including our affiliates,”Tough Mudder”, “Spartan”, “we”, “us”, “our”) are strongly committed to protecting the privacy of your Personal Information. This privacy policy (“Privacy Policy”) is applicable to the primary Tough Mudder UK website and related Tough Mudder websites (the “Sites”). It also explains our collection and processing of Personal Information (as described in Section 4 below) that you may provide to us when purchasing a product, registering for or participating in an event, communicating with us, or otherwise interacting with Tough Mudder including use of the Sites (the “Services”).

Depending on the type of service or location where the services take place, different Spartan entities will be the data controller in relation to your Personal Information. The data controller is Spartan Race, Inc. and the Spartan affiliate(s) named when your Personal Information was collected or the affiliate(s) identified in the Spartan media source (website, email, etc.) that referred you to this Privacy Notice.

---

This Privacy Policy is intended to let you know: (1) the kinds of Personal Information we may gather during your visit to our Sites, (2) why we gather your information, (3) what we use your Personal Information for, (4) when we might disclose your Personal Information, and (5) how you can manage your Personal Information.

Please be advised that the practices described in this Privacy Policy apply only to the information we gather on our Sites. They may not apply to information you provide to third party sites such as ACTIVE.com, FitRankings.com or any other registration company we utilize for event registration purposes, to other third parties with links on our website, or to vendors, sponsors, partners, affiliates or social networking sites such as Facebook, YouTube, Twitter, etc. Please review their separate privacy policies.

---

WHO IS SPARTAN RACE UK OPERATIONS LTD.

Spartan Race UK Operations, Ltd. (trading as “Spartan” & “Tough Mudder”), is a wholly owned subsidiary of Spartan Race, Inc. Spartan Race UK Operations Ltd operates Spartan and Tough Mudder branded events in the United Kingdom and Ireland.

Full name of legal entity: Spartan Race UK Operations Ltd

Company Registration: 09556893

Postal Address: 25 Wilton Road, London SW1V 1LW

---

CONTACT

If you have any questions about this Privacy Policy, do not see your concerns addressed here, or wish to make changes to any Personal Information we have collected, you should contact us by email at [e-mail].

---

INFORMATION WE MAY COLLECT

Except as disclosed below, we do not sell, barter, give away, or license your Personal Information.

(a) Information You Provide to Us. If you have registered with Tough Mudder, or ordered items from us, you may have provided us with your name, email address, telephone number, postal address, postal code, gender, bank account details, and payment information. If you entered an event you may also have provided your date of birth, photograph, and information about the person who serves as your emergency contact. We also may collect and store your Personal Information that we receive from other sources, (e.g. the information we receive from ACTIVE.com, FitRankings.com or any race registration company we utilize when you register for an event or to be a spectator). Please be advised that ACTIVE.com and FitRankings.com have their own privacy policies and you should refer to them for any questions you may have about the information they may collect about you when you register for one of our events.

(b) Information We Collect Automatically. Even if you do not request a newsletter or fill-out a survey, when you interact with our Sites, we may collect certain information. For example, our servers keep an activity log that tracks all visitors to our Sites. The information our servers collect may include, but is not limited to: your IP address, your registered domain or home server, time of access, date of access, web page(s) visited, number of clicks, software crash reports, type of browser used, session identification number, search terms, search results, access times, and referring website’s addresses.

(c) Cookies and Spyware. We do not install spyware on your computer, nor do we use spyware to retrieve information from your computer.

Like many other websites, we, and/or our third party vendors may use cookies, which are small text files that are stored on your computer or equipment when you visit certain online pages that record your preferences (“Cookies”).We use Cookies to track your use of our Sites and their features. We may also use Cookies to monitor traffic, improve the Sites and make them easier and/or more relevant for your use.

You may occasionally get Cookies from companies with links on our website. We do not control these Cookies, and these Cookies are not subject to our Privacy Policy.

You have the ability to accept or decline Cookies. Most web browsers automatically accept Cookies, but, if you prefer, you can usually modify your browser setting to decline Cookies. For more information on Cookies and how to disable them, you can consult the information provided by the Interactive Advertising Bureau at www.allaboutcookies.org.

(d) Google Analytics. We use Google Analytics on our site. Google Analytics is a web analytics service provided by Google. Google Analytics uses cookies to collect anonymous traffic data to help us analyze how you use our Sites. The information generated by Cookies (including your IP address) will be transmitted to and stored by Google on servers in the United States. Google will use this information for the purpose of evaluating your use of the site, compiling user activity reports, and providing other services relating to our Sites’ activity and internet usage.

Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf. By using the website, you consent to the processing of data about you by Google in the manner and for the purposes described in this Privacy Policy.

(e) No Information Collected From Children. Our services are not directed to or intended for use by children, except for children who are registered for Tough Mudder events by their parents or guardians. We will only collect information about children when we have the express consent from the child’s parent or guardian. The information we collect will only be used by Tough Mudder and our partners to provide relevant event entries and participation, and to the extent we receive express consent from the child’s parent or guardian, to publish a child’s race results on our website or onsite at an Event. We need to use the information that you give us about your children to fulfil our agreement with you to provide our services. Consistent with the requirements of the US Children’s Online Privacy Protection Act, the GDPR, and all other applicable laws and regulations, if we learn that we have received information directly from a child under age 16 (or age 13 in certain jurisdictions) without his or her parent’s or legal guardian’s verified consent, we will use that information only to respond directly to that child (or his or her parent or legal guardian) to inform the child that he or she cannot use our services. Subsequently, we will delete such information.

---

HOW WE MAY USE YOUR INFORMATION

Except as otherwise provided in Privacy Policy, we do not use or disclose information about your individual visits to our Sites or your personal data/information (“Personal Information”) collected online to any parties other than those with whom we partner or are affiliated without your consent.

(a) Personal Data Obtained in Connection with the Services. We use your Personal Information in different ways, depending on the nature of the Services, communications, or other interactions between you and Tough Mudder. Below is a table describing how we use Personal Information we process, why we do it, and the legal basis for each category of use.

Categories of Personal Data	Purpose for Processing	Legal Basis under the GDPR
Name and contact details	Deliver or confirm a purchase	Performance of a contract
	Send service messages email and postal mail regarding the Services such as order updates	Performance of a contract
	Enable you to enter and participate in an event	Performance of a contract
	Enable you to enter and participate in an event	Performance of a contract
	Enable you to create a User Account	Performance of a contract; Consent
	Send information by email, sms messaging, and postal mail about new events and products	Legitimate interests or consent
	Third-parties to send information by email, sms messaging, and postal mail about their products or services	Consent
	Fraud prevention and detection	Legal obligation
	Provide customer services and support	Performance of a contract or legitimate interests
Date of birth information	Enable you to enter and participate in an event that have age restrictions	Performance of a contract
	Enable you to create a User Account	Performance of a contract; Consent
Photograph	Enable us to share publicly if you create a User Account	Consent
Purchase/financial account info.	Enable our Partners/Affiliates to process payment of goods and services we provide to you	Performance of a contract or legitimate interests
Emergency contact information	If an emergency arises during an event you are participating in	Performance of a contract or legitimate interests
Information we collect automatically	Enable us to perform website analytic; and to make our website and the advertising displayed on it, and the marketing messages we send to you more relevant to your interest	Consent

(b) Use of Anonymous Information. We may use information we collect automatically to help us determine how viewers use our Sites and who our users are in order to improve our Sites. We may also use this information to provide information in aggregated form to our partners and other third parties about how our users collectively use our Sites. We may also use or share this information (or other information, other than Personal Information) in any other manner that we deem appropriate or necessary, subject to your consent.

(c) Third-Parties. We may occasionally have third party representatives, agents, affiliates, and partners perform functions on our behalf, such as event registration, marketing, analytics, etc. These entities may have access to your Personal Information, but only as needed to perform their services.

(d) Emergency Situations. We may also use or disclose Personal Information if required to do so by law or in the good-faith belief that such action is necessary to: (a) conform to applicable law or comply with legal process served on us or our Sites; (b) protect and defend the our rights or property, our Sites or our users, and (c) act under emergency circumstances to protect the personal safety of us, our affiliates, agents, the users of our Sites or the public. For example, if an event participant is injured, it may be necessary for us to disclose personal data, including health status information to medical care providers.

---

HOW WE SHARE PERSONAL DATA

Your Personal Information will be used by other Tough Mudder affiliates for the purposes described above and for accounting, tax and other administrative purposes.

We may disclose some or all of your Personal Information to third parties in accordance with contractual arrangements we have in place with them, including representatives, agents, affiliates, and partners that perform functions on our behalf, such as event registration, timekeeping, race results processing, marketing, analytics, IT services, data storage, payment processing, survey and market research.

We may also share your Personal Information with third-parties so that they can send you communications about their products and services, however we will only share your Personal Information under these circumstances if we receive your prior express consent.

If we determine it to be necessary, we may also disclose your Personal Information to a third party: (i) to respond to an emergency or health incident; (ii) to comply with any law applicable to us, a court order, a request from law enforcement or other legal process; (iii) to protect the legitimate rights, privacy, property, interest or safety of Tough Mudder, our personnel, customers, business partners or the general public; (iv) in relation to a change in ownership or control of Tough Mudder such as a merger, sale, acquisition, or bankruptcy; or (v) to prevent, detect to actual or potential fraud or other illegal activities.

---

LINKING TO OR FROM OTHER WEBSITES

Our Sites contain links to other websites, and in some cases, frames other websites, operated by our affiliates, partners or third parties. Please be advised that the practices described in this Privacy Policy for us do not apply to information gathered through these other websites. These other sites may also send their own Cookies to you, collect your data or solicit your Personal Information. Always be aware of where you end up. We are not responsible for the actions and privacy policies of third parties and other websites. We encourage you to be aware of when you leave our Sites and to read the privacy policies of each and every website that you visit.

---

SECURITY

Tough Mudder will maintain appropriate security measures to minimize the risk that personal data will be lost, used without authorization, or accessed without authorization. We limit access to your Personal Information to those who have a legitimate business need to use it. Those who process your information will do so only in an authorized manner and are subject to a duty of confidentiality. We have implemented procedures to deal with suspected security incidents involving personal data and will notify the applicable regulators and you of such incidents as required by applicable law.

---

INTERNATIONAL TRANSFER OF YOUR PERSONAL DATA

We transfer your Personal Information to countries outside the European Economic Area. Spartan Race, Inc. is a United States based company that conducts data processing in the United States. Therefore, we will require that you consent the transfer of your Personal Information to Spartan Race, Inc. in the United States before providing you with the Services.

We have taken steps to protect your privacy and fundamental rights when your Personal Information is transferred to third parties the United States and other countries where no adequacy decision of the European Commission exists. Tough Mudder will make sure that the recipient is subject to a jurisdiction for which an adequacy decision of the European Commission (including the EU-US Privacy Shield where the recipient is a participant), or that there are adequate safeguards in place such as the Standard Contract Clauses or binding corporate rules.

---

YOUR RIGHTS

(a) GDPR. Under the European Union General Data Protection Regulation, residents of the European Economic Area have important rights regarding access to and control of your Personal Information, including:

Right of Access: You have the right to ascertain what type of Personal Information Spartan Race holds about you and to a copy of this Personal Information.

Right to Complain: You have the right to file a complaint regarding the processing of your Personal Information to the Supervisory Authority of your Member State.

Right to Erasure: In certain circumstances you may request that we delete the Personal Information that we hold about you.

Right to Object: When we rely on our legitimate interests to process Personal Information, you have a right to object to this use. We will stop processing your Personal Information unless we can demonstrate an overriding legitimate interest in the continued processing.

Right to Portability: You may request that we provide you with certain Personal Information which you have given us in a structured, commonly used and machine-readable format and you may request that we transmit your Personal Information directly to another data controller where this is technically feasible.

Right to Rectification: You have the right to have any inaccurate Personal Information which we hold about you updated or corrected.

Right to Restriction: You have the right to request that we stop using your Personal Information in certain circumstances including if you believe that the Personal Information we hold about you is inaccurate or that our use of your Personal Information is unlawful. If you validly exercise this right, we will store your Personal Information and will not carry out any other processing until the issue is resolved.

(b) Please bear in mind that your rights in relation to your Personal Information are not absolute and that we must be cognizant of our legal obligations. If you choose to exercise some of your rights, we may not be able to perform the actions necessary to provide the Services or otherwise achieve the purposes set forth above.

You can exercise these rights by contacting us using the information in the Contact Us section below. We may request that you provide proof of your identity for security reasons and in order to prevent the unauthorized disclosure or misuse of Personal Information. We will only charge you for requests to access your Personal Information where they are unreasonable, unfounded or excessive. If we are unable to honor your request, or before we charge a fee, we will let you know why.

---

RETENTION OF PERSONAL DATA

We will keep your Personal Information for the time necessary to fulfill the purposes for which it was collected, including any legal, accounting or reporting requirements. To determine the appropriate retention period, we consider the categories, amount, nature and sensitivity of personal data, the potential risk of harm from unauthorized use of disclosure of the personal data, the purposes for which we process the personal data, if we can achieve the purposes through other means, and the applicable legal requirements.

---

CHANGES TO THIS POLICY

This Privacy Notice became effective on May 25, 2018, and was last updated on November  17, 2020.

We may amend this Privacy Notice on occasion, at our sole discretion. Any change will be effective immediately. You should check this page from time to time to note any changes we make, as they will be binding on you. We will notify you of changes to this Privacy Notice by updating the version date. We may also notify you of changes in other ways, including by email.

---

CONTACT US, MANAGE YOUR PERSONAL DATA

You can contact us if you have questions about this Privacy Policy, do not see your concerns addressed here, or wish to make changes to any Personal Information we have collected. You may opt-out of receiving future email, SMS and postal mail marketing and other messages and newsletters from us or request that your Personal Information be deleted or corrected. To contact us please email to us at [e-mail].

While we hope that you will not need to, if you want to complain about our use of Personal Information please send an email detailing your complaint to Spartan Data Protection Officer at [e-mail].

If we are unable to resolve your query or complaint satisfactorily you can contact the Information Commissioner's Office. Please see further details below:

UK

Information Commissioner’s Office

Wycliffe House, Water Lane

Wilmslow

Cheshire

SK9 5AF

www.ico.org.uk

Tel: [phone]

Tel: [phone] (calls in Welsh)

Email: [e-mail]