Total Race Timing (“we”, “us”) is based in the United Kingdom and processes personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy explains what we collect when you use our website and services (including race registration, payments, timing and results features), why we use it, who we share it with, and your rights.
Data controller
The data controller responsible for your personal data is Total Race Timing. You can contact us about data protection at
info@totalracetiming.co.uk or using the postal address at the end of this policy.
What personal data we collect
Depending on how you use our service, we may collect:
• Identity and contact details (for example name, email address, postal address, telephone number)
• Account and authentication data (including if you sign in with a third-party provider such as Facebook, Google or Strava, subject to their terms)
• Race and entry details (event, category, emergency contact where collected, club or team, date of birth or age category where needed for the event)
• Payment-related data processed by our payment providers (we do not store full card details on our servers)
• Technical and usage data (IP address, browser type, cookies and similar technologies, pages visited)
• Communications you send us (for example support requests)
• Optional runner profile photographs, if you choose to upload one (see Runner profile photographs below)
• An optional selfie or similar image used only for a gallery facial search request, if you choose to use that feature (see Facial search and event photo matching below). We do not keep that selfie after the search
• Biometric facial data processed for gallery facial search when you have consented, and face identifiers created from event photographs so that matching can work
Why we use your data (lawful bases)
We use personal data as follows:
• Contract — to register you for events, process entries and payments, provide timing and results features, and deliver the service you request
• Legitimate interests — to secure our systems, prevent fraud and abuse, improve the service, and communicate with you about your account or entries where proportionate
• Legal obligation — where we must comply with law, court orders, or requests from regulators
• Consent — where required (for example certain marketing messages, non-essential cookies, or optional gallery facial search); you may withdraw consent at any time
Who we share data with
We share personal data with trusted service providers who process it on our instructions (for example hosting, payment processing, email delivery), and with race organisers where necessary to run the events you enter. We may also disclose data if required by law or to protect rights, safety and security. We do not sell your personal data.
Runner profile photographs
If you upload a photograph for a runner profile (sometimes described as a “selfie”), we use it only for our own internal operational purposes in connection with your account and the services we provide (for example to help identify or match a runner where that is relevant to an event). We do not publish these images for general public browsing, sell them, or use them for third-party advertising or marketing. We do not share them with other users, event organisers, or partners for unrelated purposes. They are stored and processed with the same technical and organisational safeguards as other personal data in this policy; any hosting or infrastructure providers act only on our instructions, as described under Who we share data with above.
Race day / results photographs
At some events we (or photographers working with us) capture photographs on the course or at the finish. Where these are linked to your race entry, they may appear on the results pages and photo gallery for that event. You can opt out of having photos of you shown on public galleries and results pages in your account settings. Opting out hides the public “View Photos” link for your entries and prevents photos tagged to you from being shown on public galleries, share pages, selfie search, or offered for sale on this site. It does not by itself delete facial data already processed from event photographs (see Facial search and event photo matching below).
Facial search and event photo matching
Some race photo galleries offer an optional selfie or facial search so you can find photographs of yourself. This uses facial matching (biometric processing). You do not have to use facial recognition. You can browse through the photographs freely and, where available, search for your photos using your race number instead. If the race number search option is not displayed, this means the event organiser has not requested this feature.
Before you can search this way, you must tick an explicit consent box. The current consent wording is version facial_search_consent_v1_2026-10-06. We record that you consented (the wording version, the race, the date and time, and an anonymous search reference). We do not store the selfie, your IP address, or other extra personal data in that record.
What happens to your selfie:
• For that search request only, the image is sent to Amazon Web Services (AWS) Rekognition (SearchFacesByImage)
• It is compared with faces already indexed from event photographs for that race
• We do not store the selfie in our databases or in our file storage (including Amazon S3)
• AWS Rekognition does not create a face identifier (FaceId) from your selfie
• We may keep a list of matching event photographs in your browsing session so we can show the results
• If you are signed in and search using a runner profile photograph you have already saved, the same consent is required. That saved photograph remains stored as described under Runner profile photographs above. The search still sends it to Rekognition for the request only and does not create a FaceId from it
Event photographs:
• Race-day photographs may be processed with AWS Rekognition so that faces in those photographs can be indexed into a collection for that race
• A separate process may use text and face detection to help tag bib numbers
• Face identifiers created from event photographs are kept with the photograph and the race collection until we delete the photograph or otherwise remove them
• Deleting a photograph removes its associated Rekognition faces
Photo packs:
• If you buy a photo pack after a selfie search, we may keep the matched event-photograph face identifiers on the order so that later-matching photographs can be added to that pack (a “living” pack). That is not a copy of your selfie
Optional gallery facial search is based on your consent. Providing race photography and gallery services more generally is covered by the contract and legitimate interests bases described under Why we use your data above.
You can withdraw consent at any time by emailing
info@totalracetiming.co.uk, and you can continue to browse photographs freely and, where available, search using your race number. There is not currently a self-service control to delete your face from Rekognition. To exercise your rights or ask for erasure relating to facial search data, email us at the address above. We will handle those requests as described under
How to ask for erasure or exercise your rights below.
The account photo opt-out described under Race day / results photographs hides photos tagged to you from public galleries and search. It does not by itself delete Rekognition face data.
AWS (including Rekognition and hosting) processes this data on our instructions, as described under Who we share data with above. Where a provider is outside the UK, the safeguards under International transfers below apply.
International transfers
Some of our providers may process data outside the UK. Where we transfer personal data internationally, we ensure appropriate safeguards are in place (for example the UK “adequacy” regulations or standard contractual clauses approved for use in the UK).
How long we keep data
We keep personal data only as long as needed for the purposes above, including legal, accounting and reporting requirements, and to resolve disputes. Retention periods depend on the type of data and the nature of your relationship with us.
Security
We implement appropriate technical and organisational measures to protect personal data. Sensitive payment information is handled by PCI-compliant payment providers; card data is not stored on our servers in a way that duplicates their role as payment processor.
Cookies and similar technologies
We use cookies and similar technologies where necessary for the site to function, and where applicable for analytics or preferences. Non-essential cookies are used in line with the Privacy and Electronic Communications Regulations (PECR) and your choices (for example through your browser settings or any cookie banner we provide). If you disable cookies, parts of the site may not work as intended.
Marketing
We send marketing emails only where permitted under UK law (for example with your consent or, where applicable, the “soft opt-in” for existing customers in relation to similar services). You can opt out of marketing emails at any time using
this unsubscribe page (no login required), using the link in marketing emails where provided, in your account settings, or by contacting us at
info@totalracetiming.co.uk.
Children
Our services may be used by parents or guardians entering children for events. Where information society services are offered directly to children under 13 in the UK, parental responsibility and consent rules under UK GDPR apply. We do not direct marketing at young children.
Your rights
Under UK data protection law you may have the right to access, correct, erase or restrict processing of your personal data, to object to certain processing, to data portability, and to withdraw consent where processing is based on consent. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO):
https://ico.org.uk/make-a-complaint/.
How to ask for erasure or exercise your rights
To exercise your rights or ask for your data to be removed, email
info@totalracetiming.co.uk. We will respond without undue delay and within one month in most cases (we may extend this period where the law allows and will tell you if we do).
Automated decision-making
We do not use automated processing that produces legal or similarly significant effects solely by automated means, unless we tell you otherwise in a specific feature.
Third-party websites
Our site may link to third-party sites or sign-in services. Their privacy notices apply to their services; we are not responsible for their practices.
Changes to this policy
We may update this policy from time to time. The current version will be published on this page with an updated “last updated” date.
Contact
Questions about this privacy policy or our use of personal data:
Total Race Timing
The White House
Guestwick, Norfolk NR20 5QD
United Kingdom
Last updated: 13 October 2026