Sprint Colombo
Privacy Policy
This policy explains what personal data we collect when you register for the Sprint Colombo Multisport Festival (the “Event”), why we need it, who we share it with, and your rights. We follow the Personal Data Protection Act, No. 9 of 2022, as amended by the Personal Data Protection (Amendment) Act, No. 22 of 2025 (the “PDPA”), and other applicable Sri Lankan law.
1. Who we are
The controller of your personal data is Serendib Multisport (Pvt) Ltd (Company Registration No. PV 00331384), 290/5 Weerasekera Mawatha, Thalawathugoda, Sri Lanka (“we”, “us”). We decide how and why your data is used. You can contact us about privacy at aes@serendibmultisport.com or +94 77 868 7488.
2. What we collect
- Booking contact: name, email address and mobile number of the person making the booking.
- Each participant: name, date of birth, gender, nationality, ID type and number (NIC, passport or birth certificate), T-shirt size, race format, relay team name (if any), and an emergency contact or parent/guardian name and phone number.
- Health information: if you tell us about a medical condition, or if you receive treatment from our medical team at the Event, health information will be recorded.
- Race data: race number, timing results, and photos and video taken at the Event.
- Payment details: payments are handled by a licensed third-party payment provider. We receive confirmation of the payment and a reference, but we do not see or store your full card number.
- Website data: basic technical information such as your device, browser and pages visited, collected through cookies and similar tools.
- Messages: anything you send us by email, phone or social media.
Fields marked as required on the registration form are needed to process an entry; without them we cannot register the participant. If you register other people, you must have their permission, or be their parent or legal guardian, before giving us their details, and you should show them this policy.
3. Why we use your data, and our legal basis
- To run your registration: to confirm entries, check age categories, issue race numbers and kit, and send confirmations and race-day information. (Basis: performing our contract with you.)
- For safety: to verify identity, contact your emergency contact, and help our medical team in an emergency. (Basis: contract, protecting vital interests and, for health information, your explicit consent or the need to protect life and health.)
- To manage payments and refunds and keep financial records. (Basis: contract and legal obligation.)
- To publish results (name, category, race number and time) and to report on and promote the Event with photos and video. (Basis: our legitimate interests in running and promoting a public sporting event; you can object, see section 9.)
- To meet legal obligations and respond to lawful requests from authorities. (Basis: legal obligation.)
- To improve the Event, for example by understanding how many people enter each category, using combined or anonymised figures where possible. (Basis: legitimate interests.)
- Marketing: we send news about future Serendib Multisport events only if you tick the opt-in box when registering. The box is never pre-ticked, and every message includes a free way to unsubscribe. (Basis: consent.)
4. Children’s data
Under the PDPA, personal data relating to children is a special category that needs extra protection. Participants under 18 can only be registered by a parent or legal guardian, who gives consent on the child’s behalf by ticking the consent box during registration. We use children’s data only to run the Event and keep them safe, publish results, and (unless the parent or guardian objects) share Event photos. We never use children’s data for marketing, and we do not send marketing messages to children.
5. Who we share it with
We do not sell your data. We share it only when needed, with:
- our registration platform provider and payment provider, to take bookings and process payments;
- service providers who help us run the Event, such as the timing company, medical services provider, insurers, photographers and kit suppliers;
- technology providers who host our website and send emails and messages for us;
- sponsors or partners, but only if you have given your separate consent;
- police, the authorities or our professional advisers, where the law requires or allows it.
Service providers acting for us (processors) may only use your data on our instructions, under written contracts that require them to keep it secure, as the PDPA requires.
6. Transfers outside Sri Lanka
Some of our service providers, such as cloud hosting, email and registration platforms, may store or process data outside Sri Lanka. When this happens, we transfer data only as permitted by section 26 of the PDPA, using the binding safeguards specified by the Data Protection Authority, or another lawful ground such as where the transfer is needed to perform our contract with you.
7. How long we keep it
- Registration and contact details: 12 months after the Event, so we can handle queries, results and safety matters.
- ID numbers: deleted within 3 months after the Event, once verification is complete.
- Health and incident records: kept only as long as needed for care, insurance claims or legal requirements.
- Published results and Event photos: kept as a public historical record of the Event.
- Financial records: kept for as long as Sri Lankan tax and company law requires.
- Marketing preferences: until you unsubscribe.
After these periods, data is securely deleted or anonymised.
8. How we protect it
We use technical and organisational measures such as access controls, encrypted connections (HTTPS), and limiting registration data to staff who need it. No system is completely secure, but if a personal data breach occurs, we will act quickly and notify the Data Protection Authority and affected people as the PDPA requires.
9. Your rights
Under the PDPA, you have the right to:
- ask for confirmation of, and access to, the personal data we hold about you;
- withdraw your consent at any time (for example, for marketing or photo use), and object to processing based on our legitimate interests;
- ask us to correct or complete data that is wrong or incomplete;
- ask us to delete your data where it is no longer needed or was processed unlawfully;
- ask for a review of any decision made solely by automated means (we do not make such decisions).
To use these rights, email aes@serendibmultisport.com. We may need to confirm your identity first. Requests are free of charge. We will respond within one month of receiving your request; if we need more time, we will tell you why within that month, and the total time will not exceed three months. If we refuse a request, we will explain why and tell you about your right to appeal. If you are unhappy with how we handle your data, you can complain or appeal to the Data Protection Authority of Sri Lanka (www.dpa.gov.lk).
10. Cookies
The registration platform uses cookies that are needed for it to work, such as keeping your booking in progress. We use analytics or advertising cookies only if you accept them in the cookie banner. You can change your choice, or block and delete cookies in your browser settings, though some parts of the site may stop working.
11. Changes to this policy
We may update this policy from time to time. The latest version is always on the registration platform, with the date it was last updated at the top. If we make a significant change, we will tell registered participants by email.
12. Contact us
For any privacy question or request:
Serendib Multisport (Pvt) Ltd (Company Registration No. PV 00331384)
14 Sir Baron Jayathilaka Mawatha, Colombo 00100, Sri Lanka
Email: aes@serendibmultisport.com | Phone: +94 77 868 7488