Privacy policy

Last updated: 7 October 2026

We respect your privacy. This policy explains how PANGAEA (“we”) collects, uses and protects your personal data when you use runs.pangaeaclub.net and register for HAMAT RUN events, in line with the Personal Data Protection Law of the Kingdom of Saudi Arabia.

1. The data we collect

• Registration data: your name, e-mail address and mobile number, and a password if you create an account (stored encrypted, and never visible to us).
• Booking data: the event, the distance, your registration number, the payment status and amount, and the discount code, if any.
• Payment data: payments are handled by approved payment gateways. We do not collect or store card numbers or security codes. We receive only the result of the transaction and its reference.
• Signing in with Google: if you choose to sign in with Google, we receive your name, your verified e-mail address and your Google profile picture (shown only in your account). We never have access to your password. You can delete the picture at any time from your account, or by writing to us.
• Attendance data: the time your entry QR code is scanned at the gate.
• Technical and security data: your IP address, browser and device type and usage logs, used for security, fraud prevention and improving the service.

2. How we use your data

• To complete and confirm your registration, and to send your confirmation e-mail and entry QR code.
• To create your account and help you keep track of your registrations and upcoming events.
• To verify who you are when you log in (a code sent to your e-mail address, or your Google account).
• To contact you about the event: a change of date or venue, reminders or a cancellation, and customer service.
• To process payments and refunds and keep accounting records.
• To protect the website against fraud and misuse and keep it secure.
• To measure and improve the website’s performance and to analyse advertising campaigns in aggregate.

3. Legal basis for processing

We process your data to carry out your request (registering for the event), with your consent where it is needed, to comply with the applicable regulations, and for our legitimate interests in securing and improving the service, without harming your rights.

4. Who we share your data with

We do not sell your data. We share it only as far as necessary with:

• Payment providers (such as Tap and PayTabs) to complete and verify the transaction.
• Our e-mail provider to send confirmations and codes.
• Our hosting and infrastructure provider to run the website and store data.
• Google for Google sign-in and analytics, and Meta for measuring advertising, as described in the cookies section.
• The organising and gate team, as far as needed to verify your entry (name, distance and registration status).
• Official authorities where we are legally required to, or on a court order.

5. Cookies and analytics

We use cookies that are necessary to run the website, log you in and keep it secure. We may also use analytics and advertising tools such as Google Analytics, Google Tag Manager and the Meta Pixel to measure page visits and actions (such as choosing an event or completing a registration). We do not send your name, e-mail address or mobile number to these tools. You can control cookies from your browser settings.

6. Transfers of data outside the Kingdom

The servers of some of our service providers (such as hosting, e-mail and analytics) may be located outside the Kingdom. We choose providers that apply suitable protection measures, and we transfer your data only as far as needed to provide the service, in line with the applicable regulations.

7. How long we keep your data

We keep your data for as long as needed to provide the service, and for no more than 24 months after the last event you registered for, unless the law requires a longer period (for example accounting records) or you ask us to delete it and we are legally able to. After that it is deleted or anonymised.

8. How we protect your data

We apply suitable technical and organisational measures, including encryption in transit, restricted access to data, login protection, logging of sensitive operations, limits on login attempts, and signed entry codes that contain no personal data. No method of transmission or storage is 100% secure, but we work continuously to protect your data.

9. Your rights

Under the Personal Data Protection Law, you have the right to:

• see your personal data and ask for a copy of it.
• ask for your data to be corrected or updated.
• ask for your data to be destroyed or deleted once it is no longer legally needed.
• withdraw your consent where processing is based on it, without affecting processing already carried out.
• object to certain kinds of processing within the limits of the law.

To exercise any of these rights, write to sales@pangaeaclub.net from your registered e-mail address, and we will reply within 30 days. You also have the right to complain to the competent authority (the Saudi Data and AI Authority) if you believe your rights have not been respected.

10. Children

We do not knowingly collect data from anyone under 18 without a parent’s or guardian’s consent. A parent or guardian must register anyone under that age, or approve the registration. If you learn that we have collected a child’s data without consent, tell us and we will delete it.

11. The messages we send

We send only the operational messages you need, such as your registration confirmation, your entry QR code, verification codes and notices of changes to an event. We will not send you marketing messages without your consent.

12. Updates to this policy

We may update this policy from time to time. The latest version is published on this page with its date.

13. Contact

For any question about privacy or your data: sales@pangaeaclub.net