Privacy Policy

RunClub HQ Privacy Policy

Last updated: 11 October 2026

RunClub HQ is a trading name of SymNex Consulting Ltd (registered in England and Wales under company number 10006091). This policy explains how we handle personal data when you use our club management platform.

The basics

RunClub HQ provides software that helps running clubs manage their members, events and communications. Under Data Protection legislation:

  • Your running club is the data controller – they decide what data to collect and why
  • RunClub HQ is the data processor – we process data on behalf of your club according to their instructions

If you have questions about how your data is used, your first point of contact should be your running club. They control your membership and can tell you exactly what they collect and why.

What data we process

When your club uses RunClub HQ, we may process the following on their behalf:

Member information

  • Name and contact details (email, phone, address)
  • Date of birth, gender and emergency contact details
  • Profile picture (may be visible to other members of your club and club officials)
  • Membership status and history
  • England Athletics registration numbers (where applicable)

Emergency and health information

  • Emergency contact names and phone numbers
  • Medical conditions, allergies or health information relevant to your participation in club activities

Performance and results

  • Event entries and race results (including times and positions)
  • Club records and best performances
  • Personal bests and running history

Payment information

  • Payment history and transaction records
  • Partial bank account references (e.g. bank name and last two digits of account number)
  • Direct Debit mandate status and subscription details

Junior members (under 18s)

  • The information above may also be collected for junior members
  • Parent/guardian contact details and consent records

Activity data

  • Event registrations and attendance
  • Communication preferences
  • Login and authentication details
  • Messages and notifications sent to you by your Club or by you to the Club

Technical data

  • Device and browser information
  • IP addresses and access logs
  • Error reports (to fix problems)

How we use data

We only process personal data to provide the RunClub HQ service to your club. This includes:

  • Running the platform and keeping it secure
  • Sending emails and notifications on behalf of your club
  • Generating reports and insights for club administrators
  • Fixing bugs and improving the service
  • Complying with legal obligations

We never sell personal data or use it for our own marketing purposes.

AI features. Some features use an AI service, Amazon Bedrock, run by AWS in its London region. When you send a help message to your club, AI may sort it by topic and urgency and write a short summary for the club's inbox. A volunteer can also ask it to draft a suggested reply. A person reads your message and decides what to send. If your club uses result checking, a result or club record claim you submit may be compared with the results page it links to. A club official makes the decision. Your data is not used to train the AI models.

Health and medical information

Your club may ask you to provide medical information (such as health conditions, allergies or medications) that could be relevant to your safety during club activities. This is "special category" data under UK GDPR and receives extra protection.

  • We only process health information with your explicit consent, which you provide when entering or updating this information
  • This data is only accessible to authorised club officials who need it (e.g. run leaders, welfare officers)
  • You can withdraw consent and request deletion of health information at any time through your club
  • Health information is never used for any purpose other than member safety during club activities

Junior members (under 18s)

Running clubs welcome junior members, and we take extra care with children's data:

  • Membership for under-18s requires parent or guardian consent
  • Parent/guardian contact details are collected alongside the junior member's information
  • Access to junior member data is restricted to authorised club officials
  • We don't knowingly collect data directly from children – registration is managed through parents/guardians or the club
  • Parents/guardians can request access to, correction of, or deletion of their child's data through the club

Clubs are responsible for ensuring appropriate safeguarding policies are in place. RunClub HQ provides the tools to manage junior memberships securely, but safeguarding decisions remain with the club.

Performance data and club records

Running clubs naturally track results and celebrate achievements. We process performance data to help clubs:

  • Record event results and race times
  • Maintain club records and best performances
  • Track members' personal bests and running history

Public display: Some performance data (such as club records, race results and league tables) may be displayed publicly on your club's pages or shared with third parties like leagues and England Athletics. Your club determines what is made public. If you have concerns about your results being published, please speak to your club directly.

Gender data: We collect gender to enable accurate record-keeping (e.g. male/female club records) and for reporting to governing bodies. We recognise this can be sensitive information and handle it with care.

Location

The app asks for your device's location when you check yourself in to an event. It sends your position to us so we can confirm you are at the venue. We use it for that check and then discard it. We don't store where you were when you checked in. When a volunteer checks people in, the volunteer's position is not stored either.

If you turn on arrival reminders, your phone notices when you reach a venue and shows a reminder. This works entirely on your phone and sends no location to us. We only record whether reminders are switched on.

Distances to events and to nearby clubs are worked out on your phone.

Payments and Direct Debits

Many clubs use RunClub HQ to collect membership fees via Direct Debit, powered by GoCardless. Where your club accepts cards, card payments are handled by Stripe.

How this works:

  • When you set up a Direct Debit, you provide your bank details directly to GoCardless through their secure payment pages
  • When you pay by card, you enter your card details on Stripe's secure payment page
  • GoCardless and Stripe process your payments as separate data processors, with a direct relationship with your club
  • RunClub HQ keeps your mandate status and payment history

RunClub HQ stores limited details to help you recognise your Direct Debit: the bank name and the last digits of the account number. We don't store any details of a card you pay with. We never see or store your full account number, sort code or card number. These are held by GoCardless or Stripe.

GoCardless is authorised by the Financial Conduct Authority (FCA) and operates under their own privacy policy. For questions about how GoCardless handles your bank details, see gocardless.com/privacy.

Stripe Payments UK Ltd is authorised by the FCA as an electronic money institution and operates under its own privacy policy. For questions about how Stripe handles your card details, see stripe.com/gb/privacy.

Our sub-processors

We use trusted third-party services to deliver RunClub HQ. Your data may be processed by:

Provider Purpose Location
Hetzner Server hosting, database, file storage and error reports (our own error tracking service) Germany (EU)
Cloudflare DNS, security, caching, bot checks on contact forms and encrypted backup storage Global network; backups stored in the EU
Amazon Web Services Sending and receiving emails, and AI features such as sorting help messages and checking results UK
GoCardless Direct Debit payments UK/EU
Stripe Card payments, where your club accepts them Global (including US)
Google Firebase Push notifications to the app EU/US
Google Maps Platform Finding and checking your address as you type it Global (including US)
Apple Push notifications to iPhones and iPads EU/US
Mapbox Maps on event and venue pages (receives the viewer's IP address, not member records) US

All sub-processors are bound by data processing agreements and maintain appropriate security measures. We regularly review our sub-processors and will update this policy if they change.

England Athletics. If your club checks England Athletics registrations, we send your name and date of birth, or your England Athletics registration number, to England Athletics to find and check your registration. England Athletics is not one of our sub-processors. It is a separate organisation that handles this data under its own privacy policy.

Data security

We take security seriously. Our measures include:

  • Encryption of data in transit (TLS/HTTPS)
  • Sensitive health and medical data encrypted at rest using AES-256
  • Encrypted backup storage
  • Secure authentication including passwordless login options
  • Regular security updates and monitoring
  • Access controls limiting who can see what data
  • Automated backups with secure storage

Data retention

We retain data for as long as your club needs it to manage your membership. When a club closes their account or asks us to delete data, we remove it within 30 days (except where we're legally required to keep it longer).

We keep as little technical data as we can:

  • Everyday records, such as help messages, consents and event activity, don't store your IP address.
  • Security events keep your full IP address for 90 days, then it is removed. These are signing in and out, failed sign-ins and lockouts, sign-in tokens being created or revoked, passkeys being added, removed or used, and changes to your email address.
  • Your Security page shows the IP address of the session you are using. Expired sign-in tokens are cleared.
  • Consent records keep the time, the account and how consent was given as evidence. They don't keep an IP address.
  • When an official views or changes emergency or medical information, we keep a record of who did it, when and why for 6 years. Their IP address and browser details are removed from that record after 12 months.

Financial and billing records are kept for 6 years. Other records follow your club's own retention policy. Contact your club for details.

Individual members should contact their club directly to request data deletion or correction.

Your rights

Under UK GDPR, you have rights including:

  • Access – request a copy of your data
  • Correction – ask for inaccurate data to be fixed
  • Deletion – request your data be removed
  • Portability – receive your data in a standard format
  • Objection – object to certain types of processing

To exercise these rights, contact your running club first. They control your data and can action most requests directly. If you believe we've mishandled your data, you can also contact us or lodge a complaint with the Information Commissioner's Office (ICO).

International transfers

Some of our sub-processors operate outside the UK/EU. Where this happens, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or equivalent protections recognised under UK data protection law.

Cookies and tracking

RunClub HQ uses essential cookies to keep you logged in and remember your preferences. We don't use advertising or tracking cookies.

We record which pages of our app and websites are viewed, so we can improve the service, unless your browser uses Global Privacy Control to tell us not to. Each record is linked to your account if you are signed in, and to your browsing session. It also notes the type of device and browser. We keep these records for 90 days. After that we keep only daily totals, which don't identify anyone.

Club officials with access to the club's analytics can see these usage totals. They can also see which pages a signed-in member viewed in the last 90 days.

We don't use any third-party analytics or advertising trackers.

When you contact us or book a demo

Most of this policy covers data we process for clubs. When you contact us through our website, or ask about RunClub HQ for your club, SymNex Consulting Ltd is the data controller for your details.

Our contact and demo forms ask for your name, email address, club name and message. The demo form also asks about your club, such as its size and the software it uses now. We note how you found our website, such as the page you arrived on and the site that sent you. We use these details to reply to you and to follow up about RunClub HQ.

Demo calls are booked through Cal.com, which receives the details you enter when you book.

We keep enquiries for 2 years after our last contact with you, unless your club becomes a customer. You can ask us to delete them sooner by emailing hello@runclubhq.com.

Changes to this policy

We may update this policy from time to time. Significant changes will be communicated through the platform. The "last updated" date at the top shows when changes were last made.

Contact us

RunClub HQ (a trading name of SymNex Consulting Ltd)

For data protection queries about RunClub HQ:

For queries about your membership data, please contact your running club directly.

This policy is designed to be clear and readable. If anything is unclear, please get in touch and we'll explain.