Privacy Policy

Who is responsible for your data

This Policy applies to personal data processed for the Sekhon Indian Air Force Marathon 2026 (“SIM 2026”, “we”, “us”, or “our”), including through this website, the embedded registration platform, participant support, bib collection, and race-day operations.

The SIM 2026 Organising Team is responsible for deciding why and how participant data is used. The event is organised by the Indian Air Force in association with the Air Force Sports Control Board and Fit India, with CYRUNS Sports as Race Management Partner. Authorised technology and operational providers process data only to deliver the services described in this Policy.

Our handling of personal data is guided by applicable Indian law, including the Digital Personal Data Protection Act, 2023 and related rules as and when their provisions apply.

Personal data we collect

Depending on your race category, age, payment method, and how you interact with us, we may collect the following:

• Identity and contact data: name, email address, mobile number, date of birth or age, gender, address, city, organisation, and emergency-contact details.
• Race and eligibility data: selected race, participant category, team or group details, age eligibility, T-shirt size, bib number, check-in status, timing data, finish time, and result.
• Verification data: information needed to verify eligibility for a category or concession, such as Defence status. Original Defence ID may be checked at the Bib Expo. We do not retain a copy unless it is specifically required and you are informed.
• Health and safety data: blood group and any medical, allergy, disability, accessibility, or emergency information requested by race rules or voluntarily provided for race medical preparedness. This information does not replace professional medical advice or your responsibility to assess your fitness to participate.
• Payment and transaction data: registration fee, discounts, payment status, invoice details, transaction reference, refunds, and reconciliation records. Payment credentials such as complete card or bank details are entered with the payment service provider; we do not intentionally collect them.
• Support and communication data: messages, enquiries, complaints, consent choices, and records of essential event communications.
• Website and device data: IP address, browser and device type, access time, referring page, security logs, and limited browser storage used for site functions such as dismissing notices or saving a local game score.
• Event records: photographs and videos captured at the event or expo, and official race results associated with your name and bib number.

We normally collect this data directly from you or, for a minor, from a parent or lawful guardian. For an authorised corporate or group registration, we may receive a participant roster from the organisation or group coordinator. The person submitting data for others must be authorised to do so and must share this Policy with those participants.

Why we collect and process it

• To create, verify, administer, and support your registration.
• To apply race rules, age limits, category eligibility, discounts, and team requirements.
• To allocate bibs and timing chips, prepare T-shirts and participant kits, manage the Bib Expo, and record attendance.
• To plan first-aid and emergency support. Age, blood group, emergency contacts, and relevant health information may be made available to authorised medical personnel when reasonably necessary for participant safety.
• To collect fees, confirm payments, issue invoices, reconcile transactions, and process refunds.
• To send essential communications about confirmation, payment, race rules, bib collection, schedule changes, safety, and results.
• To provide timing and results, resolve disputes, detect duplicate or fraudulent registrations, enforce event rules, and maintain event security.
• To respond to enquiries, privacy requests, complaints, emergencies, and legal obligations.
• To publish official results and document the event through photography and video, subject to event terms, reasonable participant requests, and applicable law.
• To produce anonymous or aggregated statistics that do not identify individual participants.

We use personal data with your consent where consent is required, to provide the event service you request, for participant safety, and where processing is required or permitted by applicable law. We do not use medical or blood-group information for advertising.

Who may receive participant data

We do not sell or rent participant personal data. Access is limited to authorised team members and service providers who need information for a defined event function. These may include:

• Registration and race-management technology providers that host the registration journey, participant records, communications, and operational tools.
• Payment service providers that process payments, verify transactions, prevent fraud, and manage refunds.
• Bib, timing, and results providers that receive only information needed to produce or allocate bibs and chips, record timing, and prepare official results.
• T-shirt and participant-kit providers that receive only the quantity, size, fulfilment identifier, and other minimum details needed to prepare or distribute items.
• Medical, safety, venue, security, and emergency personnel when access is necessary to protect participants or respond to an incident.
• Communication, hosting, and technical support providers that keep event systems available and deliver essential participant messages.
• Government, regulatory, judicial, or law-enforcement authorities where disclosure is required by law or reasonably necessary to protect rights, safety, and event integrity.

Bib and T-shirt organisations are not given full registration records. They receive only the fields necessary for their assigned work and must not use the data for their own marketing. We require service providers to keep data confidential, apply appropriate safeguards, and delete or return it when their task and permitted retention period end.

The registration experience may display a third-party platform or payment page. Where a provider determines its own purposes for information you submit directly to it, its privacy notice also applies. Please review any notice shown at the point of collection.

How we store and secure data

Participant records are stored in access-controlled event and registration systems. We and our authorised providers use reasonable administrative, technical, and organisational safeguards appropriate to the nature of the data and the risk. These safeguards include, as appropriate:

• encrypted connections when data is transmitted;
• restricted, role-based access and authentication controls;
• confidentiality obligations and staff access limited to event duties;
• system monitoring, logs, backups, updates, and vulnerability management;
• vendor due diligence and data-protection requirements; and
• incident-response and data-restoration procedures.

Blood-group and other health or emergency data are treated as higher-risk operational information and access is limited to personnel who need it for safety or emergency response. No method of electronic storage or transmission is completely risk-free, but we review safeguards and take reasonable steps to prevent unauthorised access, use, alteration, disclosure, or loss.

How long we keep data and how it is deleted

Registration and operational participant records are retained only for the event and post-event support period. They are deleted or irreversibly anonymised within 180 days after the race is completed. For the event currently scheduled on 4 October 2026, that period would ordinarily end on 2 April 2027. If the event date changes, the 180 days runs from the date the rescheduled race is completed.

Limited exceptions apply:

• payment, tax, invoice, dispute, insurance, fraud-prevention, and legal records may be retained for the longer period required by applicable law or until a live claim is resolved;
• official published results and event photographs or video may be retained as part of the event’s historical and public record; and
• anonymous statistics that can no longer identify a participant may be retained for planning and reporting.

Data scheduled for deletion is removed from active systems and is allowed to expire from protected backups according to the applicable backup cycle. We also instruct processors holding our participant data to delete or return it, subject to their legal obligations. You may request earlier deletion; we will honour the request unless the data is still needed to provide your registration, protect safety, resolve a matter, or comply with law.

Participants under 18

Race categories may permit participants below 18 only where the applicable age and eligibility rules are met. A parent or lawful guardian must review the registration information, provide any required verifiable consent, and authorise the processing of a minor’s personal data before registration is completed. We do not knowingly use a child’s personal data for targeted advertising or behavioural profiling.

A parent or lawful guardian may exercise the privacy rights in this Policy on the minor’s behalf. We may ask for information reasonably necessary to verify the relationship and the request.

Your choices and privacy rights

Subject to applicable law and reasonable identity verification, you may ask us to:

• confirm whether we process your personal data and provide information about that processing;
• correct inaccurate or misleading data, complete incomplete data, or update outdated data;
• delete personal data that is no longer needed or where consent has been withdrawn, unless retention is required for a specified purpose or by law;
• withdraw consent for future consent-based processing;
• raise a question or grievance about how your data has been handled; and
• nominate another individual to exercise applicable rights in the event of death or incapacity, where this right applies.

Withdrawing consent does not affect processing already carried out lawfully. If information is necessary for eligibility, safety, payment, bib fulfilment, or race administration, withdrawal or deletion may make it impossible to complete or continue your participation. We will explain the consequence before acting on the request where practicable.

Send a request to [email protected] with the subject “Privacy Request”. Please include your name, registered contact detail, and registration or bib number if available. Do not send a full identity document by email unless we specifically request a secure verification method.

How we handle a personal-data breach

If we become aware of unauthorised access, disclosure, alteration, loss, or destruction affecting personal data, we will investigate, contain, and remediate the incident. We will notify affected participants and the appropriate authority when and in the manner required by applicable law, including information on the nature of the incident, likely consequences, steps taken, and actions a participant can take to reduce harm.

Changes to this Policy

We may update this Policy to reflect event operations, service providers, or legal requirements. The current version will be posted on this page with its effective and last-updated dates. If a change materially affects how already-collected participant data is used, we will provide an appropriate notice and seek consent where required.

Privacy questions and grievances

Contact the SIM 2026 Privacy and Grievance Contact for questions, requests, or complaints about participant personal data. We will acknowledge and address the matter within the period required by applicable law.