1. Data controller
NAX, a brand of THEBRG Enterprise (003120480-W), registered in Malaysia, is responsible for the personal data described in this Policy. Contact: legal@naxmarathon.com.
2. Data we collect
- Identity and contact: name, IC or passport number where required for race registration, date of birth, gender, nationality, email, phone number, address.
- Emergency and health: emergency contact details and any medical information you voluntarily disclose for your safety.
- Event data: category, bib number, timing and results, apparel size, GPS/tracker submissions for Virtual Run.
- Transaction data: order reference, amount, payment status and the last digits/card brand returned by our gateway. We do not collect or store full card numbers, CVV or banking passwords.
- Technical data: IP address, device and browser type, pages viewed and basic analytics.
3. Why we use your data
- To process registration, payment, and to issue confirmations and race information.
- To operate the Event: timing, results, race packs, safety and medical response.
- To verify Virtual Run submissions and issue entitlements.
- To send service messages, and — with your consent — event news and offers.
- To prevent fraud, resolve disputes, and comply with legal obligations.
4. Payments and HitPay
All payments made on this website are powered by HitPay Payment Solutions. When you pay, your card or wallet details are submitted directly to HitPay and its acquiring partners on their secured infrastructure. We receive only the transaction outcome and reference. HitPay's handling of your data is governed by their own terms and privacy policy.
5. Disclosure to third parties
We may disclose your personal data to: payment providers (HitPay), timing and results partners, race pack and merchandise logistics providers, medical and safety providers, IT/hosting and email service providers, event sponsors where you have consented, our professional advisers, and government or regulatory authorities where required by law. We do not sell your personal data.
6. International transfers
Some of our service providers may store or process data outside Malaysia. Where this happens, we take reasonable steps to ensure a comparable level of protection to the PDPA.
7. Retention
We keep personal data only as long as needed for the purposes above, and thereafter as required for accounting, tax, insurance and legal-claim purposes. Results and finisher records may be retained and published as part of the historical record of the Event.
8. Security
We apply reasonable technical and organisational measures — encrypted transport (HTTPS), access control, and vetted processors — to protect your data. No method of transmission or storage is completely secure, and you provide data at your own risk.
9. Cookies and analytics
We may use cookies and similar technologies for essential site functionality, preferences and aggregated analytics. You can block or delete cookies in your browser settings, though some features may then not work correctly.
10. Your rights
Under the PDPA you may request access to or correction of your personal data, limit its processing for marketing, or withdraw consent (which may prevent us from providing the service). Send requests to legal@naxmarathon.com. We may need to verify your identity and may charge a prescribed fee for access requests where permitted.
11. Children
Registration for participants under 18 must be made or authorised by a parent or legal guardian, who consents to this Policy on the minor's behalf.
12. Photography and media
Photographs and video captured at the Event may include your image and may be published for promotional and archival purposes, as set out in our Terms & Conditions.
13. Changes
We may update this Policy from time to time. The current version is always published on this website.
14. Contact
Privacy and data requests: legal@naxmarathon.com · Partnership and marketing: marketing@naxmarathon.com
15. Language
This Policy is issued in English. In the event of any inconsistency with a translated version, the English version prevails.