26.events
    My tickets

    Privacy Policy

    Last updated: 6 October 2026

    1. Introduction & Data Controller

    26.events is a platform and trading name operated by 26 Extreme Ltd (Company No. NI071634). References to "we," "our," or "us" mean 26 Extreme Ltd. We are committed to protecting your personal information and your right to privacy in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

    Data Controller: 26 Extreme Ltd (Company No. NI071634)
    Contact Email: privacy@26.events
    Address: Dublin, Ireland

    This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform for event registration, virtual challenges, and related services.

    2. Event Entrant Data – Purpose and Use

    When you register for an event through 26.events, the personal information you provide is collected for the purpose of registering for, paying for, administering and participating in that specific event.

    This may include information such as your name, address, email address, telephone number, registration details, payment information and other information reasonably required to administer your participation.

    2.1 Event-Specific Use

    Entrant information is event-specific. Your personal information may be used for communications that are materially connected with the event you have entered, including:

    • registration and payment confirmation;
    • essential event instructions;
    • changes to event arrangements;
    • safety or operational information;
    • participant support;
    • timing and results;
    • refunds, cancellations or transfers; and
    • other administration reasonably necessary to deliver or conclude the event.

    Providing your information to enter an event does not automatically enrol you in a marketing database and does not constitute permission for your information to be used as a reusable audience after the event.

    2.2 No Automatic Marketing Use

    26.events does not treat event registration as consent to receive marketing communications.

    Unless you have separately and expressly chosen to receive marketing communications, your event registration information will not be used by 26.events as a general marketing list for other events, products or services.

    Where marketing consent is requested, it will be separate from the event registration itself and will require a clear choice by the participant. Declining marketing will not affect your ability to register for or participate in an event.

    2.3 Organiser Access and Use

    Event organisers using 26.events must use entrant information only for legitimate purposes connected with the administration and delivery of the relevant event, or where another lawful basis for processing clearly applies.

    Access to entrant information through 26.events does not provide an organiser with unrestricted permission to:

    • create a reusable marketing database;
    • add entrants to mailing lists;
    • market unrelated events, products or services;
    • transfer entrant contact information into another marketing system; or
    • continue contacting entrants after the event for unrelated purposes.

    Where an organiser wishes to communicate with an entrant for marketing purposes, an appropriate lawful basis must exist and any consent relied upon must have been obtained separately and appropriately.

    2.4 After an Event

    Once an event has concluded, its active operational purpose also concludes. Event data may then be closed and archived in accordance with our retention, accounting, legal, security and operational requirements.

    Archived event information is not treated as an active marketing or audience database. Information may continue to be retained or processed where reasonably necessary to meet legal, accounting, fraud-prevention, dispute-resolution, safeguarding or other legitimate obligations.

    2.5 Marketing Integrations

    26.events may provide organisers with optional integrations that allow marketing preferences to be synchronised with third-party marketing systems. Where such functionality is available, only information that is eligible for that purpose will be capable of being transferred through the marketing integration.

    The existence of a marketing integration does not change the purpose for which ordinary event registration information was collected. Where a participant has not provided the required marketing permission, their ordinary event registration must not be treated as marketing consent simply because their details exist within 26.events.

    Where an organiser connects its own marketing system, the organiser is responsible for ensuring that its subsequent processing complies with applicable data protection and electronic marketing law.

    2.6 Our Principle

    Entering an event should not mean joining a mailing list. 26.events is designed around that principle.

    Information provided to participate in an event is used to deliver that event. Any materially different use of that information must have its own appropriate legal basis and, where required, the participant’s separate consent.

    3. Event Data Is Temporary and Event-Specific

    26.events is built on a simple principle:

    Entering an event does not create a reusable customer, audience or marketing record.

    Personal information provided through 26.events is collected for the administration and delivery of the specific event entered. This includes registration, payment processing, essential event communications, participant support, safety information, results and other matters reasonably necessary to operate and conclude that event. It is not collected for unrestricted future use.

    3.1 Organiser Access Ends After the Event

    Organiser access to entrant personal information is temporary. Once an event has concluded, organisers are provided with a maximum 14-day post-event administration period to complete legitimate matters directly connected with that event.

    After that period:

    • the event is closed;
    • organiser access to entrant personal information ends; and
    • the event data is moved into archived status.

    Archived entrant information is not available to organisers as a continuing contact list, customer database or marketing audience. The fact that an organisation created, sponsored, promoted or operated an event does not create an indefinite right of access to the personal information of the people who entered it.

    3.2 Archived Means Archived

    After the 14-day post-event period, personal entrant information is removed from normal organiser access within 26.events. Archived information is retained only in accordance with the 26.events retention policy and applicable legal, financial, security and operational requirements.

    Where participant-facing account functionality permits, an individual may continue to access information relating to their own account and exercise their applicable data-protection rights directly with 26.events.

    Archived information is not made available as an organiser marketing database or reusable audience. Access by 26.events personnel is restricted to circumstances where it is genuinely required for matters such as security, technical administration, regulatory obligations, accounting requirements, fraud prevention, disputes or legal claims.

    3.3 The Participant Remains in Control

    Participants may exercise their applicable data-protection rights at any time, including requesting access to, correction of, restriction of, or erasure of their personal information.

    Where a valid right to erasure applies, 26.events will remove the information without undue delay. Certain information may need to be retained where 26.events has a legal or regulatory obligation to retain it or another lawful basis requires continued retention.

    3.4 No Implied Marketing Permission

    Registering for an event through 26.events does not constitute consent to marketing. Event organisers must not assume that because a person entered an event they may subsequently:

    • add that person to a mailing list;
    • upload their details to a CRM;
    • build an advertising audience from entrant information;
    • promote future events to them;
    • transfer their information into a marketing platform; or
    • continue contacting them once the legitimate administration of their event has concluded.

    Event administration and marketing are separate purposes. Where a participant has not separately chosen to receive marketing, their event information remains event information only.

    3.5 Marketing Integrations

    26.events does not currently provide organisers with unrestricted synchronisation of entrant information into external marketing systems. Future versions of the platform may provide controlled marketing integrations. Where introduced, these integrations will distinguish between event administration data and marketing-authorised data.

    Only participants whose information may lawfully be processed for the relevant marketing purpose will be eligible for such synchronisation. There will never be a general “sync all entrants” entitlement simply because those individuals registered for an event.

    3.6 Our Commitment

    Your entry belongs to the event you entered — not to somebody’s future mailing list.

    26.events uses personal information to deliver the event for which it was provided. When that event concludes, organiser access concludes shortly afterwards. After the 14-day administrative period, entrant information is closed and archived. Participation in one event does not create an indefinite commercial relationship, reusable audience or marketing database.

    4. Information We Collect

    We collect information that you provide directly to us and information collected automatically:

    4.1 Information You Provide

    • Account Information: Name, email address, password, phone number
    • Profile Information: Profile picture, bio, preferences, running club
    • Event Registration Data: Full name, date of birth, gender, emergency contact details, IOC country code, running name, t-shirt size, medical conditions, dietary requirements
    • Address Information: Shipping address for medals and physical tickets
    • Payment Information: Processed securely through Stripe (we do not store full card details)
    • Activity Data: Activity files you upload or distances you log for virtual challenges
    • Communications: Support tickets, feedback, and messages

    4.2 Information Collected Automatically

    • Technical Data: IP address, browser type, device information, operating system
    • Usage Data: Pages visited, time spent, click patterns, navigation paths
    • Location Data: Approximate location based on IP address; precise location only with your consent for live tracking features
    • Cookies and Tracking: See our Cookie Policy for details

    6. How We Use Your Information

    We use the information we collect to:

    • Provide, maintain, and improve our services
    • Process your event registrations and payments
    • Track your progress in virtual challenges
    • Send you event updates, confirmations, and important notifications
    • Respond to your support requests
    • Prevent fraud and enhance security
    • Analyze usage patterns to improve our platform
    • Send marketing communications (only with your consent)
    • Comply with legal obligations

    7. Information Sharing

    We may share your information with:

    • Event Organizers: Your registration data for events you sign up for (name, contact details, emergency contact, etc.), for the administration of that event and for a maximum of 14 days after it concludes
    • Payment Processors: Stripe processes payments securely on our behalf
    • Service Providers: Hosting, email delivery, analytics, and customer support tools
    • Legal Authorities: When required by law or to protect our rights
    • Business Transfers: In connection with mergers, acquisitions, or asset sales

    We never sell your personal information to third parties.

    8. International Data Transfers

    Your data may be transferred to and processed in countries outside the European Economic Area (EEA). When we transfer data internationally, we ensure appropriate safeguards are in place:

    • Standard Contractual Clauses (SCCs) approved by the European Commission
    • Transfers to countries with adequacy decisions
    • Binding Corporate Rules where applicable

    9. Data Retention

    We retain your personal data for as long as necessary to:

    • Organiser Access to Event Entrants: Until the event concludes, plus a maximum 14-day post-event administration period
    • Active Accounts: For the duration of your account plus 3 years after closure
    • Event Registrations: 7 years for legal and tax compliance, in archived status
    • Payment Records: 7 years as required by financial regulations
    • Marketing Data: Until you withdraw consent
    • Support Tickets: 2 years after resolution

    After the retention period, we securely delete or anonymize your data.

    10. Your Rights Under GDPR

    As a data subject, you have the following rights:

    • Right of Access (Art. 15): Request a copy of your personal data
    • Right to Rectification (Art. 16): Request correction of inaccurate data
    • Right to Erasure (Art. 17): Request deletion of your data ("Right to be Forgotten")
    • Right to Restrict Processing (Art. 18): Request limitation of processing
    • Right to Data Portability (Art. 20): Receive your data in a portable format
    • Right to Object (Art. 21): Object to processing based on legitimate interests
    • Rights Related to Automated Decision-Making (Art. 22): Right not to be subject to decisions based solely on automated processing

    To exercise these rights, visit your Account Settings or contact us at privacy@26.events.

    11. Cookies & Tracking Technologies

    We use cookies and similar tracking technologies to improve your experience. You can manage your cookie preferences through our cookie consent banner or in your Account Settings.

    For detailed information, please see our Cookie Policy.

    12. Children's Privacy

    Our services are not directed to children under 13 (or 16 in certain EU jurisdictions). We do not knowingly collect information from children. If you believe we have collected data from a child, please contact us immediately.

    13. Data Security

    We implement appropriate technical and organizational measures to protect your personal information, including:

    • Encryption of data in transit (TLS/SSL) and at rest
    • Secure authentication and access controls
    • Regular security assessments and monitoring
    • Employee training on data protection
    • Incident response procedures

    However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

    14. Changes to This Policy

    We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page, updating the "Last updated" date, and where appropriate, notifying you by email. We encourage you to review this policy periodically.

    15. Contact & Complaints

    If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:

    You have the right to lodge a complaint with a supervisory authority. In Ireland, this is the Data Protection Commission (DPC). In the UK, this is the Information Commissioner's Office (ICO).