Privacy Policy

Trail Running NZ (“TRNZ”, “we”, “us”) is operated by Bradley Houghton, a sole trader based in New Zealand. This policy explains what personal information we collect, why, and what you can do about it. We handle personal information in line with the New Zealand Privacy Act 2020.

This is a plain-English summary, not legal advice. If anything's unclear, just ask.

What we collect

• Account details: when you register, your name, email address, and (optionally) phone number and profile photo.
• Things you submit: race listings, directory listings, run groups, stories and reports you send in, including any images and contact details you include.
• Payment information: if you buy a paid listing, a challenge entry or anything from the shop, payments are handled by Stripe. We don't see or store your full card number; we keep a record of what you bought, your subscription status and your invoices.
• Order and delivery details: if you buy gear, we keep your name, email address, phone number if you give one, and the delivery address you type in at Stripe's checkout, which Stripe passes back to us so we can post the parcel. This happens whether or not you have a TRNZ account, and most shop orders are placed by people who don't have one. If you're collecting the order in Porirua we're never given an address at all.
• Challenge / Strava data: if you take part in a challenge such as VERTual, we read activity information (such as activity name, distance, elevation and date, and your name as it appears in the Strava club) from Strava to work out the standings. We only do this for the club connected to the challenge.
• Newsletter: our newsletter is run on Substack; if you subscribe, Substack handles your email address under its own privacy policy.
• Technical information: basic logs and a session cookie needed to keep you signed in and keep the site secure.

How we use it

• To run your account and publish the listings, events and stories you submit (after a moderation check).
• To process payments and manage paid listings and challenge entries.
• To pack, address and post your shop order, and to email you about it.
• To calculate and display challenge standings.
• To contact you about something you've submitted, your account, or a challenge you've entered.
• To keep the site working, secure and free of spam.

Who we share it with

We don't sell your information. We share it only with the service providers we use to run TRNZ, and only as needed:

• Stripe: payment processing. For a shop order Stripe also collects your delivery address and passes it to us.
• New Zealand Post and other carriers: your delivery address goes on the parcel label, because that's the only way the gear reaches you. We don't sell it, rent it out, or use it to market anything at you.
• Strava: challenge activity data (with your participation).
• Substack: the newsletter.
• Hosting & email providers: to run the website and send transactional emails.
• OpenStreetMap / Nominatim: to turn event locations into map coordinates (no personal data involved).

Some of these providers are based overseas, so your information may be stored or processed outside New Zealand. We only use reputable providers with their own privacy protections. We may also disclose information if the law requires it.

Public information

Anything you submit for publication (directory listings, event details, stories, and challenge standings with your name and results) is intended to be shown publicly on the site. Please don't include personal details you don't want public.

Cookies

We use a small number of essential cookies to keep you logged in and to protect forms from abuse. We don't use advertising trackers.

How long we keep it

We keep your account and submissions while your account is active or while the content is published. You can ask us to delete your account and associated personal information at any time.

Orders are the exception. Order and payment records, including the delivery address on them, are business and tax records, and Inland Revenue requires those to be kept for seven years. So we hold on to them for that long even if you ask us to delete everything else, and even if you never had an account.

Your rights

Under the Privacy Act 2020 you can ask to see the personal information we hold about you and ask us to correct it. That applies whether or not you have a TRNZ account: if you bought something as a guest, email us from the address you used at checkout, or quote your order reference, and we'll sort it out. You don't need to make an account to ask. If you're not happy with how we've handled your information, you can contact the Office of the Privacy Commissioner.

Disconnecting Strava

You can stop sharing Strava data at any time by leaving the challenge club or revoking access in your Strava settings. Past results already recorded for a challenge may remain in the standings.

Security

We take reasonable steps to protect your information, including encrypted connections and hashed passwords. No online service is ever completely secure, so please use a strong, unique password.

Children

TRNZ isn't aimed at children under 16. If you believe a child has given us personal information, contact us and we'll remove it.

Changes

We may update this policy from time to time. We'll change the “last updated” date above when we do.