What we collect, and what we don't.

What we collect.

At booking (the form on the site):

• Your full name, email, WhatsApp number
• Your distance choice (FM or HM) and bundle SKU
• Your SPL Run Club tee size (and your partner's, for two-person packages)
• Your partner's name, email, and WhatsApp (if booking a Couple or Runner + Supporter package)
• Your pairing preference (if booking Solo Paired)
• How you heard about us (marketing attribution)

In early September, before we submit your race registration to the race organiser:

• Passport number (required by the race organiser for international entries)
• Date of birth, gender, nationality (required by the race organiser)
• Emergency contact name, relationship, and phone number
• Bib name and estimated finish time
• Any dietary requirements or accessibility needs you tell us about

We collect these by email, with a short follow-up form.

From your bank transfer:

• The receipt screenshot you upload (we store this securely; deleted 12 months after the event)

What we do not collect: credit card details (we don't process card payments at all), individually-identifying browsing behaviour, cookies for advertising, or anything you don't actively type into our forms.

Why we collect it.

• To submit your race registration to the Vietnamese race organiser. Without your passport details, DOB, gender, nationality, emergency contact, and other required registration fields, they cannot enter you into the race.
• To allocate hotel rooms. We share names and check-in/out dates with the hotel cluster operator so they can prepare your booking.
• To match Solo Paired runners: same-gender pairing requires that we know who's who.
• To contact you for payment confirmations, race-week briefings, and the WhatsApp group invite.
• To verify your bank transfer by matching your booking reference and amount in our RHB account.

We do not use your data to send marketing about other events, sell you anything beyond what you booked, or share with third-party advertisers.

Where it's stored.

• Booking data: our private database, encrypted at rest, accessed only by SPL operators with multi-factor authentication.
• Receipt screenshots: our private object storage, encrypted at rest, same access controls.
• Bank-transfer records: on the receiving end, in SPL Running Team Trading's RHB business account.
• Email contact: through our transactional email provider, used only for race-related communications.

All servers and storage are encrypted at rest.

Who else sees it.

• The Vietnamese race organiser: we share registration data with them so they can enter you into the race. Their own privacy policy applies to data they hold.
• The hotel(s) we book: they receive your name and check-in/out dates only.
• The Sunday-night dinner venue: aggregated headcount and dietary requirements only, no names.
• SPL operators: the small team running the bundle has access to booking records to reconcile payments, communicate with you, and resolve issues.

We do not share your data with: marketing partners, advertising networks, AI training datasets, data brokers, or any party not directly necessary to deliver the bundle.

Cross-border transfer to Vietnam: some of your data is transferred to the Vietnamese race organiser as required for race registration. Under the 2024 PDPA amendments, this transfer is permitted because it's necessary for performing the contract you've booked with us.

How long we keep it.

• Booking and registration data: 12 months after the race (i.e. deleted by ~December 2027) unless you ask us to delete it sooner.
• Receipt screenshots: 12 months after the race, then deleted.
• Payment records: 7 years, per Malaysian tax and audit requirements.
• Email communications: retained while needed for support; archived or deleted after the event.

Your rights (PDPA).

Under Malaysia's Personal Data Protection Act 2010 (as amended in 2024), you can:

• Request access to the data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (subject to retention legally required for tax/audit)
• Request a portable copy of your data in a structured, commonly used format (added under the 2024 PDPA amendments)
• Withdraw consent for any communications (note: we do not send marketing anyway, so this rarely applies)
• Lodge a complaint with Malaysia's Personal Data Protection Commissioner if you feel we've mishandled your data

To exercise any of these rights, email hello@splrunclub.my or DM us on Instagram (@splrunclub). We respond within 14 working days.

If there's a data breach: under the 2024 PDPA amendments, if we discover that your data has been improperly accessed, lost, or disclosed in a way that could harm you, we will notify the Personal Data Protection Commissioner within 72 hours and notify you directly as soon as practicable.

Cookies and tracking.

We do not use tracking cookies, advertising tags, or third-party analytics that profile visitors. The site uses session storage (a temporary in-browser store that's cleared when you close the tab) to carry your booking reference between the booking form and the confirmation page.

For aggregate visibility we run two cookieless, non-personal telemetry signals: Cloudflare Web Analytics (page-view counts and basic performance metrics) and an outbound affiliate-link click counter. Neither stores your IP address, name, or email, and neither is combined with your booking data. We keep these counts for as long as the relevant partnership or site is live.

Children's data.

The bundle is not directed at people under 16. The race itself has age limits (Marathon: 18+, Half-Marathon: 16+) so participants are above that threshold. We do not knowingly collect data from anyone under 16.

Updates to this policy.

If we change anything material, we will email all confirmed bookers and post a new "Last updated" date here. The latest version is always at splrunclub.my/privacy.html.