Privacy Policy

1. Who we are and what this policy covers

Racemate (racemate.in, and the booking forms organizers place on their own websites) is run by Racemate India Private Limited (“Racemate”, “we”, “us”), RZ-140 Kailash Puri, New Delhi, Delhi 110045, India. For the personal data described here we are the data fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDP Act”).

This policy applies to everyone who uses Racemate: people who register for events (“participants”), event organizers and their team members (“organizers”), and visitors. It explains what we collect, why, who we share it with, how long we keep it and the rights you have. It is part of our Terms & Conditions and follows the Information Technology Act, 2000, its rules on sensitive personal data, and the DPDP Act and its rules.

By using Racemate or giving us your information, you agree to its use as this policy describes.

2. Information we collect

What you give us

• Account: your name, email address and mobile number. You sign in with a one-time code sent to them; we do not ask you for a password. If you choose Google sign-in, Google shares your name, email address and profile picture with us. You may add a photo, date of birth, gender and address to your profile.
• Event registrations: for each participant, what the event’s form asks for: typically name, email, mobile number, date of birth, gender, nationality, address, T-shirt size, blood group, emergency contact name and number, and any medical information or answers to questions the organizer adds. We also record that the waiver was accepted, which version, and when.
• Purchases: what you bought, the amount, any coupon, donation or race-kit delivery address, cancellations and refunds, and, if you ask for a business invoice, your GSTIN and billing state.
• Organizers: business type, legal name, PAN, GSTIN, CIN where applicable, registered address, the name and identity details of an authorized signatory, bank account details for payouts, your event content, and the names and contact details of team members you invite.
• Messages: what you write to us, for example to support or the grievance officer.

What we collect automatically

• Device and log data: IP address, browser and device type, pages visited, and dates and times, which our servers and security systems record.
• Location, only if you ask: if you tap “Use my current location”, your browser asks your permission and gives us your device’s position, which is sent to a mapping service to find your city. We keep only the city, in a cookie on your device, to show events near you.
• Cookies: see Cookies.

What others give us

• Someone who registers you for an event, such as a family member or teammate, gives us your registration details.
• Our payment partners tell us whether a payment succeeded, its reference and the type of payment method. We never receive your full card number, CVV or UPI PIN.
• Our verification partners tell us whether an organizer’s PAN, GSTIN and bank account check out.

Some of this is sensitive personal data under Indian law: health information (blood group, medical details) and financial information (organizers’ bank details). We collect it only where the event or a payout needs it, and use it only for that.

3. How we use it

• to create your account, sign you in and keep it secure;
• to register you for events, take payment, and send your tickets, confirmations and event updates;
• to give organizers what they need to run the event you entered (see Sharing);
• to handle cancellations, refunds, payouts, chargebacks and disputes;
• to issue tax invoices and meet our duties under GST and income-tax law, including collecting and depositing TCS and TDS on organizers’ sales;
• to verify organizers, as our payment partners and the law require before money is paid out;
• to answer support requests and grievances;
• to detect and prevent fraud, abuse and security incidents;
• to understand how Racemate is used and improve it, through analytics you have agreed to;
• to tell you about events you may like, only if you have opted in (see Messages we send); and
• to comply with the law, court orders and lawful requests from authorities.

We process your data with your consent, given when you provide it for a purpose (such as registering for an event), or for the legitimate uses the DPDP Act allows, such as complying with the law. Medical and emergency-contact details may be used by an organizer to respond to a medical emergency at the event.

4. Who we share it with

We do not sell or rent your personal data, and we do not give your account or registration details to advertisers or sponsors. (If you accept marketing or analytics cookies, the services that set them learn about your visits to Racemate; see Cookies.) We share personal data only as follows.

• The organizer of the event you register for, and the team members they give access, receive your registration details and answers to run the event. They may pass them to people who help run it, such as timers, medical teams and kit-delivery partners. An organizer decides for itself how it uses this data, under its own privacy practices, and our Terms require it to use the data only for the event and as you agreed.
• Our service providers, who process data for us under contract and only on our instructions:
  • cloud hosting, database and file storage, on servers in India;
  • website security and delivery;
  • licensed payment aggregators: payments, refunds, payouts and organizer verification;
  • email and SMS delivery;
  • sign-in, if you choose to sign in with Google;
  • analytics, only if you accept analytics cookies;
  • maps, to find your city when you ask; and
  • video hosting, for an event’s video (its preview image loads with the page; the video itself only when you press play).
• Government and tax authorities, as the law requires. For example, GST returns and TCS and TDS statements include organizers’ PAN or GSTIN and their sales. We also share data with police, courts or regulators when a valid legal process requires it.
• A buyer or successor of Racemate’s business in a merger, acquisition or similar transaction, who must keep using the data as this policy describes.

What is public: event pages show organizers’ business names, logos, social links and event content. Event photos and results may show participants’ names and images, as our Terms describe.

5. Cookies

Cookies and similar browser storage are small pieces of data a website keeps on your device. We use three kinds:

• Strictly necessary: to keep you signed in and secure, remember your city, and remember your cookie choice. Racemate does not work without these, so they are always on.
• Analytics: to tell us how Racemate is used, in aggregate. These are set only if you accept them.
• Marketing: used only if we advertise Racemate on other websites, to measure that advertising. These are set only if you accept them.

On your first visit we ask which you accept, and nothing optional is set until you choose. You can change your choice at any time from Cookie Settings at the foot of every page, or clear cookies in your browser.

6. Where your data is stored

Our database and files are stored on servers in India. Some of our service providers may process data outside India. The DPDP Act allows this except to countries the Government of India restricts, and we will follow any such restriction.

7. How long we keep it

• Your account: until you ask us to delete it.
• Registrations, payments, refunds, invoices and organizers’ verification and payout records: as long as tax, accounting and other laws require us to, generally up to 8 years, and as long as needed to settle a dispute about them.
• Security logs: at least 180 days, as the Indian Computer Emergency Response Team’s directions require.
• Marketing preferences: until you change them; we keep a record of an opt-out so that we respect it.

After that we delete the data or anonymise it so that it no longer identifies you.

8. How we protect it

We use encrypted connections (HTTPS) throughout. Our database sits on a private network, and staff can reach personal data only when their work needs it. Card and UPI details go straight to our payment partners, which meet the payment card industry’s security standard (PCI DSS), and never reach our servers. Signing in with one-time codes means there is no password of yours for us to lose.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the Data Protection Board of India, and report it to the Indian Computer Emergency Response Team, as the law requires. If you find a security problem, please tell us at help@racemate.in.

9. Your rights

Under the DPDP Act you have the right to:

• access a summary of the personal data we hold about you, what we do with it, and who we have shared it with;
• correct, complete or update it. Most of it you can change yourself in your profile;
• erase it, by asking us to delete your account. We keep only what the law requires us to (see How long we keep it);
• withdraw your consent at any time, for example to marketing or analytics cookies. Withdrawing consent does not affect what was done before, and some services, such as registering for events, cannot work without the data they need;
• nominate someone to exercise these rights if you die or become unable to; and
• have your grievance addressed by us, and if you are not satisfied, complain to the Data Protection Board of India.

To use any of these rights, write to help@racemate.in from the email address on your account, or to our grievance officer (see Contact). We may ask you to confirm your identity first. We do not charge for this, and we reply within one month. For data an organizer holds for its event, you can also ask the organizer directly.

Please give us accurate information, and do not register anyone without their permission or impersonate anyone: these are your duties under the DPDP Act.

10. Children

Runners of all ages use Racemate. Under the DPDP Act anyone under 18 is a child, and we process a child’s personal data only with the consent of a parent or legal guardian: the parent or guardian registers the child for an event, or consents to the child using their own account, and we may ask them to confirm that they are an adult and the child’s parent or guardian. We use a child’s data only to provide Racemate and the events they enter. We do not track children’s behaviour, show them targeted advertising, or send them marketing. A parent or guardian can ask us to correct or delete a child’s data at help@racemate.in. If we learn that we hold a child’s data without that consent, we will delete it.

11. Organizers and embedded booking forms

Organizers can place Racemate’s booking form on their own websites. When you book through one, Racemate collects your details under this policy; the rest of the organizer’s website, and the organizer’s own use of your registration details, are covered by the organizer’s privacy policy. Racemate also links to other websites, such as maps and social networks, whose own policies apply when you use them.

12. Messages we send

We send service messages, such as sign-in codes, booking confirmations, receipts, refund updates and event updates, as part of running your account and bookings.

Event news, if you opt in. If you choose to receive it, we use your name, contact details, city, and the events and distances you have registered for to tell you about upcoming events on Racemate you may like, including organizers’ events we promote, by email, SMS or WhatsApp. Opting in is never a condition of registering. You can opt out at any time: from the link in the message, from our opt-out page, or by writing to help@racemate.in. We do not send event news to children.

13. Changes to this policy

We will post any change here with a new date. If a change significantly affects how we use your data, we will tell you by email or on Racemate before it takes effect, and ask for your consent again where the law requires it.

14. Contact and grievance officer

For questions about this policy or your data, write to help@racemate.in or see Contact us. For complaints, write to our grievance officer. We acknowledge complaints within 48 hours and resolve them within one month.

Grievance Officer
Sandeep Yadav, Manager
Racemate India Private Limited
RZ-140 Kailash Puri, New Delhi, Delhi 110045, India
Email: help@racemate.in

This policy is governed by the laws of India, and the courts at New Delhi have jurisdiction over disputes about it, without affecting your right to complain to the Data Protection Board of India.