Website Privacy and Cookie Notice
How to Read This Notice
This Website Privacy and Cookie Notice is issued by three related companies that together operate the Deadly Dozen fitness racing brand. Where a section of this notice applies specifically to one entity rather than all three, this is indicated using the tags below. Where no tag appears, the section applies equally to all three companies.
[Deadly Dozen Limited — ALL Races and Events]
[Deadly Dozen Gym Limited — Gym and Gym Races]
[Deadly Dozen Academy Limited — Academy Courses]
In many cases, the three companies work together and may share data between them under appropriate data-sharing arrangements. This notice explains when and why that happens.
1. Who We Are
This notice is issued jointly by the following three companies, all registered at George Street, Macclesfield, United Kingdom, SK11 6HS (together referred to as "the Deadly Dozen Group", "we", "us" or "our"):
Deadly Dozen Limited
Company Number: 15565498
Role: The primary operating company and website owner, responsible for track races, international event management, the global leaderboard and affiliate relationships.
Deadly Dozen Gym Limited
Company Number: 09491662
Role: Responsible for gym-based racing events, gym facilities and PT coach programmes.
Deadly Dozen Academy Limited
Company Number: 12270745
Role: Responsible for the Deadly Dozen Academy, delivering online and in-person courses, coaching education programmes and certification.
Deadly Dozen Limited operates the website at www.deadlydozen.com. Content and services relating to the gym and the Academy are also hosted on or linked from this website. Depending on which part of the website you use and which services you engage with, the relevant data controller will be one or more of the entities above. This notice sets out clearly which entity is responsible for each type of processing.
If you have any questions about this notice or how we handle your personal data, you can contact us at:
Email: info@deadlydozen.com
Post: Data Protection Enquiries, Deadly Dozen, George Street, Macclesfield, United Kingdom, SK11 6HS
2. What This Notice Covers
This notice explains how we collect, use and protect your personal data when you:
Visit our website at www.deadlydozen.com or any linked Deadly Dozen pages
Register for or participate in any Deadly Dozen race event, whether a track race or a gym race
Sign up for or engage with the Deadly Dozen Academy, including online or in-person courses and coaching programmes
Purchase products from our shop
Sign up to receive our newsletter or marketing communications
Apply to become an affiliate, sponsor or volunteer
Contact us by any means
This notice also sets out our Cookie Policy, explaining what cookies we use on this website, why we use them, and how you can manage your preferences.
If you are a member of our staff, an external contractor or a PT coach, a separate Staff, Contractor and Coach Privacy Notice applies to you and is available on request.
3. What Personal Data We Collect
The personal data we collect depends on how you interact with us. The following sets out the categories of data we may collect across our website and services.
3.1 Identity and Contact Data
Collected across all services.
Full name
Date of birth
Gender
Email address
Telephone number
Postal address
Emergency contact name and telephone number
3.2 Race Registration and Participation Data
[Deadly Dozen Limited — Races and Events]
[Deadly Dozen Gym Limited — Gym and Gym Races]
Race entry details, including event name, date, category and format
Race times, results, rankings and classifications
Performance data recorded during or in connection with events
Waiver and consent records
Photographs and video footage captured at events
3.3 Health and Medical Data
This is special category data under UK GDPR and is handled with additional care. We only collect health information where strictly necessary.
Responses to pre-participation health questionnaires and PAR-Q forms
Disclosed medical conditions, injuries or physical limitations
GP or other medical contact details provided for emergency purposes
3.4 Academy Data
[Deadly Dozen Academy Limited — Academy Courses and Coaching]
Course enrolment details, including course name, date and format
Assessment results, progress records and certification details
Attendance records for in-person sessions
Feedback, submissions and communications relating to course content
Login credentials for any online learning platform
3.5 Financial and Payment Data
Payment card details are processed securely via our payment provider — we do not store full card numbers
Transaction and payment history relating to race entries, shop purchases, Academy enrolments and gym access and memberships
3.6 Affiliate, Sponsor and Volunteer Data
Business name, contact details and company registration information
Details of your application, agreement and engagement with us
Correspondence and contractual records
3.7 Website and Technical Data
IP address and device information
Browser type and version
Pages visited, time on site, and click behaviour
Referring website or source
Cookie and tracking data — see Section 11 for full details
Login credentials where you create an account
3.8 Marketing and Communications Data
Your marketing preferences and opt-in or opt-out records
Records of communications between us
Survey and feedback responses
4. How We Collect Your Personal Data
Directly from you: When you register for an event or course, make a purchase, create an account, complete a health questionnaire, apply to become an affiliate, sign up for marketing, or contact us.
Automatically: When you visit our website, we automatically collect certain technical and usage data through cookies and similar technologies. See Section 11 for full details.
From affiliated gyms and event managers: Where a race or event is delivered through an affiliated gym or international event manager, they may share your registration and participation data with us to administer the event and publish results.
From third-party platforms: Including race registration platforms, payment processors, timing and results providers, and online learning platforms, where relevant to the services you use. When you register for a race through a third-party platform, that platform shares your registration data with us to administer your entry.
From photographs and video: We capture images and video at our events for documentation, safety review, and promotional purposes.
5. How We Use Your Personal Data
We use your personal data for the following purposes. Each purpose is supported by a lawful basis under UK GDPR.
5.1 Race Registration and Event Delivery
[Deadly Dozen Limited — Races and Events
[Deadly Dozen Gym Limited — Gym and Gym Races]
We use your identity, contact, health and race data to process your race entry, administer your participation, deliver results and manage the safe running of events. Lawful basis: performance of contract and legal obligation.
5.2 Global Leaderboard and Results Publication
[Deadly Dozen Limited — Races and Events]
Your name, nationality, age group and race results will be published on the Deadly Dozen global leaderboard at leaderboard-dd.vercel.app and on our website. The leaderboard is hosted on a third-party platform, and your results data is stored and processed by that platform provider on our behalf. This is an inherent part of participating in a competitive race event and forms part of our contract with you as a participant. If you have concerns about the publication of your results, please contact us before registering. Lawful basis: performance of contract and legitimate interests.
5.3 Health and Safety
We process health data to protect your safety during events and courses, to make reasonable adjustments where needed, and to comply with our legal obligations. We process this data on the basis of your explicit consent and, in emergencies, to protect your vital interests. Lawful basis: explicit consent, vital interests and legal obligation.
5.4 Academy Course Delivery
[Deadly Dozen Academy Limited — Academy Courses and Coaching]
We use your identity, contact and Academy data to process your enrolment, deliver course content, assess your progress, issue certifications and communicate with you about your studies. Lawful basis: performance of contract.
5.5 Payment Processing
We use your financial data to process payments for race entries, Academy enrolments and shop purchases. Payment card data is processed securely by our payment provider and is not stored by us in full. Lawful basis: performance of contract.
5.6 Photography and Video
We capture photographs and video at our events for race documentation, safety review, promotional purposes and the production of photo packages available for competitors to download. Where images are used for promotional or marketing purposes, we rely on our legitimate interests in promoting our events and brand, or where required, on your consent. Photo packages are made available to competitors as part of the event experience. You may request that images featuring you not be used for promotional purposes by contacting us. Lawful basis: legitimate interests or consent.
5.7 Website Operation and Improvement
We use technical and usage data to operate and improve our website and digital services, to ensure security and to understand how our services are used. Lawful basis: legitimate interests.
5.8 Marketing Communications
Where you have given your consent, or where we have a legitimate interest in doing so following a prior engagement with us, we may send you news, updates and information about upcoming races, events, Academy programmes and offers. You can opt out at any time using the unsubscribe link in any email or by contacting us. Lawful basis: consent or legitimate interests.
5.9 Affiliate and Sponsor Management
We use business contact and agreement data to manage our relationships with affiliates, sponsors and volunteers. Lawful basis: performance of contract and legitimate interests.
5.10 Legal and Regulatory Compliance
We may process your data where necessary to comply with a legal obligation, respond to regulatory enquiries, or defend or bring legal claims. Lawful basis: legal obligation and legitimate interests.
6. Who We Share Your Data With
We do not sell your personal data to any third party. We may share your data with the following categories of recipients where necessary and proportionate.
Within the Deadly Dozen Group: Deadly Dozen Limited, Deadly Dozen Gym Limited and Deadly Dozen Academy Limited may share data with each other where necessary for the administration of our combined services, under appropriate intra-group data-sharing arrangements.
International event managers and affiliated gyms: Where you participate in an event delivered by an affiliated gym or international event manager, relevant registration and participation data will be shared with them to enable delivery of the event and publication of results.
Race timing and results providers: To record and process race times and publish results on the global leaderboard.
Online learning platforms: Where Academy content is delivered through a third-party platform, your enrolment and progress data will be shared with that platform.
Payment processors: To securely process race entry fees, Academy enrolments and shop purchases.
IT and hosting providers: Including Squarespace, who host our website, and any cloud storage or system providers who maintain our data on our behalf. We use Google Workspace (including Gmail and Google Drive) as our central email and document platform across all three Group companies for day-to-day communications and data storage. Data processed through Google Workspace is subject to Google’s data processing terms.
Gym management and membership systems: Third-party systems used by Deadly Dozen Gym Limited to manage gym access, memberships and related participant data.
Race registration platforms: We use third-party race registration platforms to enable participants to enter events. When you register for a race through one of these platforms, your registration data including name, contact details, emergency contact and any health information you provide will be collected by that platform on our behalf and shared with us to administer your race entry. The platform provider acts as a processor for Deadly Dozen Limited in relation to this data.
Email and marketing platforms: Where you have opted in to marketing, we use third-party platforms to send communications.
Insurance providers: Where necessary to manage liability and participant cover.
Emergency services and medical providers: Where necessary to protect your vital interests or those of another person at an event.
Legal and professional advisers: Where necessary to obtain legal advice or manage any dispute.
Regulatory and government bodies: Where required by law.
All third parties who process data on our behalf are required to do so only on our instructions, under contractual data processing agreements, and in compliance with UK GDPR.
7. International Data Transfers
We operate internationally through a network of event managers in over 30 countries. Where participant data is collected at events outside the UK and transmitted to us centrally, or where we share data with service providers operating internationally, this may involve the transfer of personal data outside the United Kingdom.
We ensure that all international transfers are protected by an appropriate safeguard in accordance with UK GDPR. For transfers from countries within the European Union or European Economic Area, we rely on the adequacy decision granted to the UK by the European Commission. For transfers involving other countries, we use the UK International Data Transfer Agreement (UK IDTA), Standard Contractual Clauses, or other recognised transfer mechanisms as appropriate.
If you would like further information about the specific safeguards in place for any transfer relevant to your data, please contact us.
8. How Long Do We Keep Your Data
We retain your personal data only for as long as necessary for the purposes for which it was collected, taking into account legal, regulatory and operational requirements.
Race registration and results: Active participant records are kept for the duration of your engagement with us plus 3 years. Race results may be retained indefinitely in anonymised or aggregated form on the global leaderboard.
Health and PAR-Q data: Retained for 3 years from the date of the relevant event, or longer where required by health and safety or insurance obligations.
Academy enrolment and certification records: Retained for 6 years from the date of course completion or certification, to support any future queries about qualifications awarded.
Financial and payment records: 6 years from the date of the transaction, as required by HMRC.
Photography and video: Retained for up to 3 years for documentation and safety review. Promotional images may be retained for longer where consent has been given.
Website and technical data: Typically retained in identifiable form for up to 12 months, after which it may be retained in anonymised or aggregated form.
Marketing records: Retained until you opt out, plus 1 year thereafter to record the withdrawal of consent.
Affiliate and sponsor records: Retained for the duration of the relationship and for 6 years thereafter.
At the end of the relevant retention period, your data will be securely deleted or anonymised. You may contact us to ask about the retention periods applicable to your specific data.
9. Your Rights
Under UK GDPR, you have the following rights in relation to your personal data. We will respond to any valid request within one calendar month, though this may be extended by a further two months for complex requests.
Right of Access: You can ask us for a copy of the personal data we hold about you and information about how we use it. This is free of charge in most circumstances.
Right to Rectification: If the data we hold about you is inaccurate or incomplete, you can ask us to correct it.
Right to Erasure: In certain circumstances, you can ask us to delete your personal data, subject to any overriding legal obligations we may have to retain it.
Right to Restrict Processing: You can ask us to limit the way we process your data in certain circumstances.
Right to Data Portability: Where processing is based on consent or contract and carried out by automated means, you can ask us to provide your data in a portable format.
Right to Object: You can object to processing based on our legitimate interests at any time. You have an absolute right to object to direct marketing.
Right to Withdraw Consent: Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.
Rights re. Automated Decisions: You have the right not to be subject to decisions made solely by automated means that have a significant effect on you.
To exercise any of your rights, please contact us at info@deadlydozen.com or by post at the address in Section 1. We may ask you to verify your identity. Where we cannot fulfil a request, we will explain our reasons in writing.
10. Complaints
If you have a concern about how we have handled your personal data, please contact us in the first instance at info@deadlydozen.com, and we will do our best to resolve it promptly.
Please note that each of our three companies has its own separate Complaints Policy covering service-related complaints. Deadly Dozen Limited has a Complaints Policy covering race complaints for both track and gym races. Deadly Dozen Academy Limited has a separate Complaints Policy covering Academy-related complaints. These are available on our website or on request.
If you remain dissatisfied, you have the right to complain to the Information Commissioner's Office (ICO):
Website: www.ico.org.uk
Telephone: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5A