Privacy policy

Last updated: 1 November 2026

1. Who we are

Muddy Roads organises trail running events and is responsible for the personal information described in this policy (the data controller).

For privacy questions or to exercise your rights, contact Victoria Fawcett at events@muddyroads.co.uk.

2. Information we collect

The information we hold depends on how you use our services. It may include:

• Your name, email address, telephone number and messages you send us.
• Runner details, including date of birth, sex used for race categories, club and affiliation details.
• Account, race entry and booking details, race numbers, entry choices, transfers, payment and refund records.
• Emergency contact details and any relevant medical information you choose to provide.
• Race times, finishing positions, categories and event photographs.
• When merchandise ordering is available, your order, delivery or collection details and any delivery address or instructions.
• Technical information, such as your IP address, browser information and website activity, needed to operate and protect the site.

We receive information from you, from someone authorised to enter or manage a runner on your behalf, and from payment and timing services. We also retain relevant records from earlier Muddy Roads events and booking systems.

If you give us another person's details, including an emergency contact's, please make sure they know and share this policy with them. A parent or guardian should arrange entries for junior runners and provide appropriate authority for their information to be used.

3. How and why we use information

We use personal information for the following purposes and lawful bases under UK data protection law:

• Providing our services: managing accounts, entries, payments, transfers, refunds, orders and essential communications. This is necessary to enter into or perform our contract with you. Where a booking is made for someone else, we also rely on our legitimate interests in administering their participation.
• Organising safe and fair events: checking eligibility and affiliation, assigning categories and race numbers, preparing start lists, timing races, publishing results and contacting emergency contacts when needed. We rely on our legitimate interests in running safe, accurate and well organised events.
• Supporting runners and protecting our services: answering enquiries, resolving problems, preventing misuse and maintaining reliable records. We rely on our legitimate interests in providing support and keeping our services secure.
• Meeting legal requirements: keeping necessary financial records and responding to lawful requests. We rely on our legal obligations. We also have a legitimate interest in retaining relevant information where necessary to establish, exercise or defend legal claims.

Medical information is optional. We need your explicit consent to use it for race safety and to share relevant details with first aiders where necessary. You can withdraw that consent by contacting us. In an emergency, we may use or share necessary information to protect someone's vital interests where they are physically or legally unable to consent. Health information may also be retained where necessary for legal claims.

You do not have to provide optional information. Without the details needed to administer an entry or order safely and correctly, we may be unable to provide that service.

4. Who we share information with

We share only information needed for the relevant purpose with:

• Authorised event organisers, race staff, first aiders and emergency services, where needed to deliver the event or respond to an incident.
• Timing and results services, including ChipTimed, and relevant sporting bodies where needed to administer races or verify affiliation.
• Service providers supporting the website and bookings: Google Cloud for hosting and storage, Stripe for online payments and Resend for service emails, when those services are used.
• Delivery providers where needed to fulfil a merchandise order, and professional advisers, insurers or authorities where necessary or legally required.

Card details are handled directly by Stripe; Muddy Roads does not store full card numbers or security codes. Earlier payment records may refer to the payment provider used when the original booking was made.

We do not sell your personal information. Booking or contacting us does not sign you up for marketing. Any optional marketing communications require a separate choice, which you can change at any time. Essential booking, safety and service messages are separate from marketing.

5. Results and photographs

Race results and series standings may be published on our website and retained in our race archive. They may include your name, club, race number, category, position and time. Public results do not include your contact details, full date of birth, emergency contact or medical information.

Event photographs may appear in our galleries and in Muddy Roads event publicity, including social media. We rely on our legitimate interests in recording and sharing our events, taking account of the people shown. Contact us if you have a concern or would like us to review a photograph or published result. Public material may be indexed by search engines or copied by others, which can limit our ability to remove every copy.

6. How long we keep information

We keep information for as long as it is needed for its purpose, taking account of legal, accounting, safety and insurance requirements. Our retention review periods are:

• Emergency contact and optional medical information: review for deletion within 90 days after the runner's last booked race, unless it is still needed for an incident or claim.
• Inactive accounts and runner profiles: review after 24 months of inactivity, keeping only information still needed for outstanding entries, enquiries or other justified purposes.
• Financial and transaction records: normally six years after the relevant financial year, or longer where required by law or an unresolved matter.
• Email and security records: review after 12 months, retaining relevant material longer only where needed to resolve an issue or meet a legal requirement.
• Public results and photographs: review annually for continued use as part of the event archive, and consider individual objections or removal requests.

These are review periods, rather than a promise of automatic deletion. Information no longer needed is deleted or anonymised. Backup copies may continue to contain information until they expire or are securely removed.

7. Cookies and website services

We use essential cookies to support sign-in, keep sessions secure and allow access to guest merchandise orders. The merchandise basket also uses browser storage to remember your selections and checkout progress. Runner sign-in cookies last up to 30 days, administrator sessions up to 12 hours and guest order cookies up to 90 days. Basket information remains until it is cleared or updated.

You can remove cookies and browser storage through your browser settings, although sign-in, basket or order access may then stop working. We do not currently use advertising cookies or optional analytics tracking. If that changes, we will update this information and ask for consent where required.

Payment services may use their own cookies and similar technologies when you use checkout. Course maps load from OpenFreeMap, which receives technical information such as your IP address when the map is displayed. See the Stripe privacy policy and OpenFreeMap privacy policy for their handling of this information. External websites, including social media and photographers' sites, have their own privacy policies.

8. Keeping information safe and international transfers

We use appropriate technical and organisational measures to protect personal information and limit access to people who need it for their role.

Some service providers process information outside the UK, including in the United States. Where this happens, we rely on applicable UK adequacy arrangements or approved contractual safeguards, such as the UK Addendum to the Standard Contractual Clauses. Contact us if you would like more information about the safeguards relevant to your information.

9. Your rights

Depending on the circumstances, you can ask us to access or correct your information, delete it, restrict its use, or provide a portable copy. You can object to uses based on legitimate interests, including the publication of photographs, and withdraw consent where we rely on it. Withdrawing consent does not affect earlier lawful use. You can object to direct marketing at any time.

Contact events@muddyroads.co.uk to make a request. We may need to confirm your identity or your authority to act for someone else. We normally respond within one month and do not charge a fee. If the law allows extra time or limits a request, we will explain why. Some records may need to be retained for legal obligations or claims even after an account is closed.

We do not make decisions with legal or similarly significant effects about you solely by automated means.

If you are unhappy with how we use your information, please contact Victoria Fawcett so we can investigate. You also have the right to complain to the Information Commissioner's Office (ICO).

10. Changes to this policy

We may update this policy as our services or legal obligations change. The latest version and its update date will appear on this page. We will bring significant changes to your attention where appropriate.