Impact Marathon Series

Impact Marathon Series - Privacy policy

Last updated: 30 October 2026

We respect your privacy and are committed to protecting your personal data. This policy explains what we collect when you use our website, book or take part in one of our events, or hear from us, how we use it, who we share it with, and the rights you have.

WHO WE ARE AND HOW TO CONTACT US

The website impactmarathon.com is operated by Impact Marathon Series Ltd ("we", "us"), registered in England and Wales under company number 09561970, registered office The Stable, Cilgelynnen, Llanychaer, Fishguard, Wales, SA65 9TG. We are registered with the Information Commissioner's Office (application C2073136, 30 October 2026; registration number to follow).

Questions, requests or complaints about your data: info@impactmarathon.com, or write to the address above.

Our website runs on the Easol platform. Easol also collects some data when you use the site and has its own privacy policy.

We may update this policy from time to time. The date at the top tells you when it last changed.

THE DATA WE COLLECT

- Identity data: name, title, date of birth, gender.

- Contact data: billing address, email address, telephone numbers.

- Financial data: payment card details, processed by Stripe; we do not store full card numbers.

- Transaction data: what you have booked and paid.

- Technical data: IP address, browser, device and how you reached the site.

- Profile and usage data: your account, bookings, preferences, feedback and survey responses, and how you use the website.

- Marketing and communications data: your preferences for hearing from us.

- Travel data: passport number, nationality and expiry date, flight details, travel insurance provider and policy number, and emergency contact details, where you take part in an event.

- Health data: medical conditions, medications, allergies and dietary requirements you give us so we can run events safely.

- Images: photographs and film in which you appear, taken during our events.

If you do not give us data we need to run your event or meet a legal obligation, we may not be able to take you on the event. We will tell you if that is the case.

EVENT AND EXPEDITION DATA

When you take part in a race, expedition or challenge we collect the travel, health and emergency contact data above. We use it to plan for you, brief your leaders and medics, obtain permits, arrange transfers and respond if something goes wrong.

Health information is special category data. We collect it with your explicit consent, which you give when you complete the pre-event medical form, and we use it only to run the event safely. In a medical emergency where you cannot speak for yourself, we may share it with treating doctors to protect your life. You can withdraw consent at any time, but we cannot take you on an event without this information, so withdrawing it means withdrawing from the event under our booking terms.

Where you give us emergency contact details for someone else, please make sure they are happy for you to do so.

Where an event involves working with children or vulnerable adults we may ask for references or a DBS check. If we do, we tell you at booking, we ask only for confirmation that a satisfactory check is in place, and we do not keep certificates.

WHO WE SHARE EVENT DATA WITH, AND TRANSFERS OUTSIDE THE UK

We share event data only with those who need it to deliver the event safely: your event leaders, medics, our local operating teams in the host country, and the charity partner for your event where it is involved in running the trip.

Our events take place outside the UK, in countries that do not have UK adequacy decisions (currently Nepal, Rwanda, Jordan, Guatemala, Tanzania and the Democratic Republic of Congo). To run your event we must share limited data with our local operating teams there: your name, passport details for permits, flight details for transfers, dietary needs, and the health information your leaders and medics need. We transfer this because it is necessary to perform our contract with you. Each local team works to written instructions from us on what they may use the data for and when they must delete it, and where a partner is able to sign the UK International Data Transfer Agreement, we use it. We never send more than the event needs.

PHOTOGRAPHS AND FILM

We photograph and film every race, expedition and challenge. Our own team and freelance photographers and filmmakers working for us take the images. Where you can be identified in an image, that image is your personal data.

What we use it for: telling the story of the event and the community it supports, on our website, social media, films, printed material, press and in the channels of the charity partner for your event. Images are also shared with our local teams and partners in the host country where they help tell that story.

Lawful basis: our legitimate interest in documenting and promoting our events and the work they fund. We have balanced this against your rights and interests, and you can ask us for a copy of that assessment. We do not rely on your consent for this, which means you are not asked to agree to it in order to take part, and you can object at any time. We do not use your image in paid advertising for a third party without asking you first.

Translation and AI tools. We may caption, subtitle and translate interviews and footage so that the people in them can be understood by audiences in other languages; the words stay yours and we have translations checked by a speaker of the language. We do not use AI to change what you said, or to generate your voice, your face or a likeness of you, without your specific consent, which you can withdraw at any time. Where we publish content that has been altered by AI with your consent, we label it as such.

Your rights: object at any time by telling your event leader or emailing info@impactmarathon.com. We will stop using new images of you and will take down or stop using existing ones where we reasonably can. Where an image has already been published by a partner or in print, we will ask the partner to remove it, but we cannot guarantee removal everywhere.

Children: where a child takes part in an event on an adult's booking, a parent or guardian can object on their behalf. We take particular care with images of children in the communities we work with and follow our safeguarding policy and the local partner's rules on consent.

HOW WE COLLECT DATA

Directly from you: when you book, fill in a pre-event form, sign up for our emails, enter a competition, contact us or give feedback. Automatically: through cookies and analytics when you use the website (see Cookies below). From partners: where a charity partner recruits you for an event it runs with us (see below).

HOW WE USE YOUR DATA AND ON WHAT BASIS

We use your data only where the law allows:

- To perform our contract with you: taking your booking, running your event, dealing with your questions.

- For our legitimate interests, where these do not override your rights: running and improving the business, telling the story of our events through images, keeping records, preventing fraud, and sending you news about our events where you have booked with us before (you can opt out at any time).

- To meet legal obligations: accounting, tax, safety and safeguarding.

- With your explicit consent: health information, and marketing where you have signed up without booking.

- To protect your vital interests: sharing health information in a medical emergency.

WHO ELSE WE SHARE DATA WITH

We use trusted providers who process your data on our instructions: Easol (bookings and the website), Stripe (card payments), Kit (email), Xero (accounting), Microsoft 365 (email and files), Google Analytics (website statistics), Meta (social media and advertising measurement) and, for editing and translating footage, AI captioning and translation tools that process the material on our instructions and do not keep it. Each has its own privacy policy and may not use your data for any other purpose.

We may also share data where the law requires it, to establish or defend legal claims, to protect the safety of our participants, staff or others, or in connection with a sale or restructuring of the business.

We may share aggregated or anonymised information that cannot identify you.

CHARITY PARTNERS

Events you book with us. When you register for an event, your name, contact details and fundraising information may be shared with the charity partner named on the event page, so the charity can support your fundraising, keep in touch about the event and acknowledge your contribution. We share it once your booking is complete. The charity must handle your data in line with UK data protection law. If you would rather we did not share it, contact us; it may limit the support the charity can give you.

Events run for a charity partner. Some events are run on behalf of a charity that recruits its own participants (for example Street Child's Everest Base Camp trek and the Invictus Games Foundation's Kenya event). On those events the charity is the data controller for your booking and we process your data on its behalf to deliver the event, under a written agreement between us. The charity's privacy policy applies to how it uses your data; ours applies to what we do with it to run the event.

Our website uses cookies for things it cannot work without, and analytics and advertising cookies from Google and Meta that tell us how people find and use the site. You can block or delete cookies through your browser settings; doing so does not affect your booking.

HOW LONG WE KEEP DATA

- Booking, payment and correspondence records: seven years after the event, for accounting and legal obligations.

- Passport and travel document details: deleted 30 days after the event, or sooner once permits are issued, unless you book another event.

- Flight, insurance and emergency contact details: deleted 30 days after the event.

- Health information: deleted 90 days after the event, unless it relates to an incident during the event, in which case it is kept with the incident record for seven years.

- Marketing data: until you unsubscribe or three years after your last interaction with us.

- Photographs and film: kept as part of our archive; see Photographs and film above.

- Website analytics: as set by the provider, normally up to 14 months.

YOUR RIGHTS

You can ask us to: give you a copy of the data we hold about you; correct it; delete it where we have no good reason to keep it; restrict how we use it; give it to you or another organisation in a usable format; stop using it for marketing; and object to processing based on our legitimate interests, including the use of images of you. Where we rely on your consent you can withdraw it at any time, which does not affect what we did before.

Email info@impactmarathon.com. We will reply within one month. There is no charge unless a request is clearly unfounded or excessive.

You can complain to the Information Commissioner's Office at ico.org.uk. We would welcome the chance to sort things out first.