Privacy Policy

We use your data to provide the BRR 5K Series service:

• Processing race entries and recording results
• Calculating age-graded performance using your date of birth, sex, and finish time
• Scoring prediction accuracy against your submitted predictions
• Generating and displaying series standings and rankings
• Sending transactional emails (account verification, password resets)
• Authenticating your identity and securing your account

The following information is displayed publicly on the website and included in our sitemap:

• Your name and profile avatar (if uploaded)
• Race results: finish time, age-graded percentage, prediction accuracy, race position
• Series standings and overall rankings
• Race photos uploaded by any user

Your email address, date of birth, and exact age are never displayed publicly. Only your age category (derived from your date of birth) is shown.

We do not sell, licence, or share your personal data with advertisers or data brokers. Your data is only processed by:

• Cloudflare Turnstile — processes IP address and browser fingerprint during registration and login to prevent bot abuse. See Cloudflare's Privacy Policy.
• Cloudflare R2 — stores uploaded profile avatars and race photos
• Transactional email provider — delivers account verification and password reset emails on our behalf
• Infrastructure providers — our hosting and database providers process data on our behalf under appropriate data processing agreements

We employ commercially reasonable measures to protect your data, including:

• All data transmitted over HTTPS/TLS encrypted connections
• Passwords are hashed using bcrypt and never stored in plain text
• Access to production systems is restricted and authenticated
• Regular security updates to application dependencies

We retain your data for as long as your account is active and as necessary to maintain the historical results record of the 5K Series.

When your account is closed, your personal data (name, email, date of birth, password, profile photo) is permanently deleted. Your race results (finish times, scores, positions) are retained to preserve the integrity of series standings, but are fully anonymised — your name is replaced with "Anonymous Runner" and no personally identifiable information remains linked to the results.

Guest runner data (name and results) is retained as part of the race record unless removal is specifically requested.

Under UK data protection law, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — request correction of inaccurate data
• Deletion — request closure of your account and removal of personal data from your profile settings, or by emailing us
• Portability — request your data in a portable format
• Object — object to processing of your data in certain circumstances
• Photo removal — request removal of any photo in which you appear

To exercise any of these rights, email [email protected].

The BRR 5K Series welcomes junior runners of all ages. However, for runners under 13 years of age, a parent or guardian must register the account on their behalf. By registering an account for a child under 13, the parent or guardian confirms they have parental responsibility and consent to the data processing described in this policy.

Runners aged 13 and over may create their own accounts. If you believe a child's data has been collected without appropriate consent, please contact us and we will address it.