Event Information Privacy and Consent
How your personal information is handled when you provide it for an event
Effective Date: September 14, 2026
Version 1.0
1. Introduction and Scope
This Event Information Privacy Notice and Consent (“Notice”) explains how your personal information is collected, used, shared and protected when you provide event specific information through the Mountain Bike United platform and mobile application (together, the “Services”).
You are seeing this Notice because the organiser of an event you have entered, or are entering, requires additional information from you in order to run that event safely and to administer your participation. We call this information your “Event Information”. Event Information is separate from the account and profile information you provide when you register with Mountain Bike United, which is dealt with in the Mountain Bike United Privacy Policy.
In this Notice, “Mountain Bike United”, “us”, “our” or “we” means H&I Adventures Ltd, trading as Mountain Bike United, of No1 Bunchrew, Bunchrew, Inverness, IV3 8TA, Scotland. “Event Organiser” or “Organiser” means the business, club or individual running the event for which you are providing Event Information. “You” and “your” means the person providing the Event Information.
Please read this Notice before completing the event information form. You will be asked to tick a box confirming that you have read it and that you agree to your Event Information, including any health information you provide, being handled in the way described. You should also read the Mountain Bike United Privacy Policy, the End-User Licence Agreement and Terms and Conditions, and the terms and conditions of the Organiser and the venue, which are available on the event page and www.mtbutd.com.
2. Who Is Responsible for Your Event Information
Two organisations are involved in handling your Event Information, and it is important that you understand what each of them does.
The Event Organiser
The Organiser decides what Event Information is required for its event, why it is required, and what is done with it. In data protection law the Organiser is therefore the “data controller” for your Event Information. The name and contact details of the Organiser are shown on the event page.
Mountain Bike United
Mountain Bike United collects your Event Information through the app on the Organiser’s behalf, stores it securely, and makes it available to the Organiser. In relation to Event Information, Mountain Bike United acts as a “data processor”. This means that we handle your Event Information only on the Organiser’s documented instructions and in accordance with our written agreement with them. We do not use your Event Information for our own purposes. We do not sell it, we do not use it for marketing or advertising, and we do not publish it on your profile or make it visible to other Mountain Bike United users.
Mountain Bike United remains a data controller in its own right for the account, profile, activity, location and usage information described in the Mountain Bike United Privacy Policy. This Notice does not change that.
What the Organiser has agreed with us
Under its agreement with Mountain Bike United, every Organiser is required to comply with data protection law, to request only the Event Information it genuinely needs for its event, to restrict access to authorised personnel, and to keep your Event Information confidential. Organisers are expressly prohibited from collecting excessive or unnecessary personal data through the platform.
If you have a question about why a particular piece of information is being requested, or about what the Organiser does with it, please contact the Organiser directly using the details on the event page. If you are unable to reach them, contact us and we will help.
3. What Event Information Is Collected
The Event Information requested varies from event to event and is set by the Organiser. Each field is marked as either mandatory or optional, and you can see exactly what is being asked for before you submit anything. Depending on the event, Event Information may include:
- Participant and contact details — name, date of birth, age category, gender, postal address, email address, telephone number, governing body membership or racing licence number, club or team affiliation, and the category or class you are entered in
- Health and medical information — pre-existing medical conditions, injuries, allergies, medication you are taking, blood group, disabilities, accessibility requirements, and any other information about your physical or mental health that the Organiser needs in order to keep you safe or to arrange appropriate medical treatment for you
- Dietary requirements — food allergies, intolerances and dietary preferences, which in some cases may indicate a religious or philosophical belief
- Emergency contact and next of kin — the name, relationship, telephone number and, where requested, email address of a person to be contacted on your behalf in an emergency
- Insurance and cover — insurance provider, policy number, and confirmation of any cover the Organiser requires as a condition of entry
- Consents, declarations and waivers — acknowledgements of risk, participation agreements, declarations that you are fit to take part, acceptance of event rules, photography and filming permissions, and any parental or guardian consent required
- Equipment and logistics — bike type and specification, kit or clothing sizes, transport, parking and accommodation requirements, arrival and travel arrangements
- Other information the Organiser reasonably requires — which will be described on the form at the time you are asked for it
In this Notice we refer to health and medical information, and to dietary information that reveals a religious or philosophical belief, as “Sensitive Information”. Data protection law calls this “special category” personal data and gives it additional protection. Section 5 explains how it is handled.
4. Why Your Event Information Is Used, and the Legal Basis
Data protection law requires that there is a valid legal basis for every use of your personal information. The table below sets out the purposes for which your Event Information is used and the basis relied on for each.
| What your information is used for | The legal basis relied on |
|---|---|
| Administering your entry and participation — registration, categorisation, start lists, timing, check-in and results. | Necessary for the performance of the contract between you and the Organiser for your place at the event, or to take steps at your request before entering into it. |
| Keeping you and others safe — risk assessment, planning first aid and medical cover, briefing safety personnel, and giving your information to medical staff so that you can be treated appropriately. | Where you are unable to give or communicate consent in an emergency, protection of your vital interests or those of another person. |
| Meeting accessibility, dietary and other reasonable adjustment needs. | Your explicit consent for Sensitive Information. For information that is not sensitive, the Organiser’s legitimate interests in running a well organised and inclusive event, and, where relevant, compliance with its obligations under equality legislation |
| Contacting your emergency contact or next of kin if something happens to you. | Protection of your vital interests or those of another person. |
| Complying with legal obligations on the Organiser — health and safety, safeguarding, insurance conditions, and the recording and reporting of accidents. | Compliance with a legal obligation to which the Organiser is subject. For Sensitive Information, processing necessary for reasons of substantial public health interest, an individual’s vital interests (medical emergency), or for the establishment, exercise or defence of legal claims. |
| Keeping records to deal with incidents, complaints, insurance claims and legal claims. | The Organiser’s legitimate interests in protecting its position, and the establishment, exercise or defence of legal claims. |
| Collecting, storing, securing and making the Event Information available to the Organiser through the platform. | Mountain Bike United’s performance of its contract with the Organiser, acting as the Organiser’s data processor. |
Mountain Bike United does not use your Event Information for any purpose other than providing the platform to the Organiser. In particular, we do not use it to market to you, we do not add it to your public profile, and we do not disclose it to other Mountain Bike United users.
5. Sensitive Information and Your Explicit Consent
Health and medical information, and dietary information that reveals a religious or philosophical belief (“Sensitive Information”) , is given extra protection by law. The Organiser and Mountain Bike United rely on your explicit consent to handle this information, except where it is needed to protect your life or someone else’s life, or where the law requires it.
By ticking the box you are giving your explicit consent to:
- your Sensitive Information being collected through the app and stored securely by Mountain Bike United on the Organiser’s behalf;
- your Sensitive Information being made available to those personnel of the Organiser who need to see it in order to run the event; and
- your Sensitive Information being disclosed to medical, first aid, safety and emergency personnel at, or responding to, the event, where this is necessary for your safety or the safety of others.
Your consent is voluntary and is given separately from anything else you agree to. You do not have to give it in order to hold a Mountain Bike United account or to use the rest of the Services.
An Organiser may, however, require certain health information as a condition of entry, because it cannot run its event safely without it. If you would prefer not to provide that information, please contact the Organiser before completing your entry.
You can withdraw your consent at any time. Section 10 explains how.
6. Information About Other People
Where you give us the details of another person, such as an emergency contact or next of kin, you confirm that you are entitled to provide their information and that you have told them:
- that their name and contact details have been given to the Organiser and to Mountain Bike United in connection with that event;
- that they will only be contacted in connection with an emergency or serious incident involving you; and
- where they can read this Notice.
An emergency contact’s details will not be used for any other purpose and will not be added to any mailing list.
If you are entering an event on behalf of, or together with, another participant, you must have their authority to provide their information and, where required, to give consent on their behalf.
7. Participants Under the Age of 18
Where a participant is under 18, the entry and the Event Information must be provided by a parent or legal guardian, or by another adult with parental responsibility, who gives consent on the child’s behalf. The Organiser may also require a separate signed parental consent or waiver.
Health information relating to a child is treated with particular care and is made available only to those personnel of the Organiser who need it for the child’s safety. If you are a parent or guardian and you wish to see, correct or withdraw information provided about your child, please contact the Organiser, or contact us using the details in section 13.
8. Who Your Event Information Is Shared With
Your Event Information is shared only with the following:
- The Event Organiser you are providing it to. Access is limited to those authorised business users within the Organiser’s organisation who need it to run the event. Your Event Information is not visible to other Organisers on the platform, and it is not visible to other Mountain Bike United users.
- Personnel engaged by the Organiser for the event, such as medical and first aid providers, safety officers, marshals, timing providers and, where relevant, the venue operator or landowner — in each case only to the extent needed for your safety and for the running of the event.
- Emergency services and healthcare professionals, if you require medical assistance at or in connection with the event.
- Mountain Bike United’s service providers, such as our hosting, storage, security and technical support providers, who act on our behalf under written contracts requiring them to keep the information confidential and secure and prohibiting them from using it for their own purposes.
- Insurers, legal advisers, regulators, governing bodies and law enforcement, where the Organiser or Mountain Bike United is required or permitted by law to disclose the information, or where it is needed to establish, exercise or defend legal claims.
Your Event Information is not sold, and it is not used by Mountain Bike United for advertising or targeted marketing. The Organiser is not permitted to use it to send you marketing unless you have separately opted in to hear from that Organiser.
Where an Organiser exports your Event Information from the platform — for example by downloading a participant list or using a check-in application — the Organiser becomes responsible for the security and use of that copy, and the Organiser’s own privacy notice applies to it.
9. Storage, International Transfers and Retention
Where your information is stored
Event Information is stored on servers in the United Kingdom. If an Organiser is based outside the United Kingdom, or the event takes place outside the United Kingdom, your Event Information will be accessed from, and may be transferred to, that country. Where information is transferred outside the United Kingdom, appropriate safeguards required by UK data protection law are put in place. You may ask us for a copy of the safeguards that apply.
How long it is kept
The Organiser decides how long it needs to keep your Event Information and must be able to justify that period.
As a guide, Event Information is generally retained until the end of the event and then for as long as is needed to deal with any incident, insurance claim, complaint or legal claim arising from it. In the United Kingdom a claim for personal injury can generally be brought for up to three years from the date of an incident, and longer where the participant is a child, so Organisers commonly retain participation records, health declarations and incident records for that period.
Mountain Bike United holds your Event Information on the platform for as long as the Organiser instructs, and will delete or return it when the Organiser’s use of the Services ends or when the Organiser instructs us to delete it. Deletion from our live systems may take up to seven days, with up to a further thirty days for deletion from backups. Health information that is no longer needed is deleted or anonymised rather than retained.
How your information is protected
Mountain Bike United applies appropriate technical and organisational measures to protect Event Information, including encryption in transit and at rest, access controls that limit visibility of Event Information to authorised users of the relevant Organiser, authentication requirements for account access, access logging, and binding confidentiality obligations on our personnel. Health information is subject to additional access restrictions within the platform.
No transmission of information over the internet can be guaranteed to be completely secure. If a personal data breach occurs that affects your Event Information, we will notify the Organiser without undue delay so that it can meet its own obligations to notify you and the Information Commissioner’s Office where required.
10. Withdrawing Your Consent
You can withdraw your consent to the handling of your Sensitive Information at any time, without giving a reason, by:
- amending or deleting the relevant information in the event information section of the app, where the Organiser has enabled this;
- contacting the Organiser using the details on the event page; or
- contacting Mountain Bike United at info@mtbutd.com, in which case we will pass your request to the Organiser and act on the Organiser’s instructions.
Withdrawing your consent does not affect the lawfulness of anything done with your information before you withdrew it.
Please be aware that if you withdraw consent to health information that the Organiser requires as a condition of entry, the Organiser may not be able to allow you to take part, and its cancellation and refund terms will apply. Withdrawing consent may also mean that an adjustment you have asked for cannot be made. There may also be a limited amount of information the Organiser must keep after you withdraw consent, for example an accident record it is legally required to retain.
11. If You Choose Not to Provide the Information
Fields marked as optional may be left blank and this will not affect your entry, although the Organiser will not be able to accommodate a requirement it does not know about.
Where a field is marked as mandatory, the Organiser has determined that it needs that information in order to run the event safely or to administer your entry. If you do not provide it, you may not be able to complete your entry or take part in the event.
12. Your Rights
You have the following rights in relation to your Event Information under UK data protection law:
- Access — to be told whether your information is being used and to receive a copy of it.
- Rectification — to have inaccurate information corrected and incomplete information completed.
- Erasure — to ask for your information to be deleted in certain circumstances, including where you have withdrawn your consent and there is no other basis for keeping it.
- Restriction — to ask that use of your information is limited in certain circumstances, for example while you contest its accuracy.
- Objection — to object to use of your information that is based on legitimate interests, and to object at any time to direct marketing.
- Portability — to receive information you have provided in a structured, commonly used and machine-readable format, and to have it transmitted to another organisation where technically feasible.
- Withdrawal of consent — as described in section 10.
- Automated decision-making — no decision producing legal or similarly significant effects for you is made about you by automated means using your Event Information.
Because the Organiser is the controller of your Event Information, these rights are exercised against the Organiser, whose details appear on the event page. You may also contact us at info@mtbutd.com and we will forward your request to the Organiser promptly and assist them in responding. There is normally no charge, and a response is due within one month.
If you are not satisfied with how your request or complaint has been handled, you may complain to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, www.ico.org.uk. You may also seek a remedy through the courts. We would ask that you raise the matter with the Organiser or with us first, so that we have the opportunity to put it right.
13. Changes to This Notice and How to Contact Us
We may update this Notice from time to time. The version of this Notice in force when you submitted your Event Information is recorded against your entry, together with the date and time of your agreement, so that there is a clear record of what you were told and what you agreed to. If an Organiser later requires additional information, or wishes to use your information for a new purpose, you will be asked to agree again.
Questions about the event or about what the Organiser does with your information
Please contact the Event Organiser using the contact details shown on the event page.
Questions about the platform, this Notice, or our Data Protection Officer
H&I Adventures Ltd, trading as Mountain Bike United
No1 Bunchrew, Bunchrew, Inverness, IV3 8TA, Scotland, United Kingdom
Email: info@mtbutd.com
Telephone: +44 1463 231 441