UTMB WORLD SERIES PRIVACY NOTICE

UTMB® World Series is a set of international trail running events hosted around the world for star and amateur athletes. UTMB World Series events may be hosted directly by SAS UTMB Group or its subsidiaries (collectively “UTMB Group”), World Triathlon Corporation and its subsidiaries (collectively, “IRONMAN"), or by UTMB Group’s third party licensees. References to “we,” “us,” or “our” refer to UTMB Group.

UTMB Group is dedicated to protect your privacy and your personal data. In such, we value each one of our existing and potential athletes and aim to maintain appropriate protection of your personal data (“Data”).

The present Privacy Notice has been thought so as to comply with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”). This regulation was drafted and passed by the European Union (EU) and imposes obligations about privacy and security data law onto organizations anywhere, so long as they target or collect data related to people in the EU. The regulation was put into effect on May 25, 2018.

According to article 2 of the GDRP, personal data means any information relating to identified or identifiable natural person. An identifiable naturel person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

This Privacy Notice describes our processing of personal information (i) obtained through the UTMB World Series website, https://utmb.world; (ii) collected in relation to UTMB World Series events hosted directly by the UTMB Group, and (iii) received from third parties or IRONMAN in relation to the UTMB World Series. UTMB Group may share personal information subject to this Privacy Notice with IRONMAN or with third party hosts of UTMB World Series events in accordance with this Privacy Notice and applicable law. This Privacy Notice does not govern how third parties, including independent hosts of UTMB World Series events and IRONMAN, process your personal information.

This Notice explains how the UTMB GROUP collects and processes your Data when you use utmb.world website (the “Website”) and all UTMB related sites, applications and other medias (the “Sub-sites”) (collectively named “Websites”).

List of the Sub-sites concerned:

• xxx.utmb.world
• accounts.utmb.world
• in.register-utmb.world/xxx
• endurancecui.active.com/new/events/xxx
• shop.utmb.world
• eushop.utmb.world
• live.utmb.world

By purchasing a product, including merchandise, or otherwise accessing, visiting or using the Websites, you acknowledge your understanding of this Privacy Notice. If you do not agree with the contents of this Privacy Notice, you should not access, visit and/or use the Websites, or request a product.

UTMB Group has other privacy policies which may supplement or supersede this Privacy Notice, including but not limited to:

• Our California Privacy Policy, for California residents please refer on https://utmb.world/tig-privacy-policy-california.
• Our Virginia Privacy Policy, for Virginia residents https://utmb.world/tig-privacy-policy-virginia

We acquire personal information from you directly, automatically, and from other sources. We may combine information that we receive from you with information from other sources.

1. INFORMATION WE COLLECT DIRECTLY FROM YOU

You may directly provide us personal information, such as when you create an account on our Websites, register for an event, or contact us through email or social media platforms. The categories of personal information that we may collect include personal details (e.g. name, title, last name, middle name, maiden name, suffix, date of birth, nationality); biographic information (e.g. age, gender); contact details for you and your emergency contacts (e.g. phone number, email address, postal address, postcode, state/country or mobile number); identity information (e.g. passport, ID card, residence permit…); financial information; purchase data (e.g. purchase history, such as the transaction date, customer ID, transaction ID, shop ID, total quantity, delivery amount, taxes, net sales amount, number of products purchase…), including payment history for races and events; loyalty program data; your connection data (IP address); social media data; and anything else that you provide to us.

2. INFORMATION WE COLLECT AUTOMATICALLY

Certain information may be collected automatically, i.e. without your express consent, such as when you interact with our Websites, some of which may be deemed personal information. The information may include, for example, information about your device including device identifiers, , IP address, webpages visited and actions taken on webpages (See Strictly Necessary Cookies)

The following cookies may be exempt from your consent and your information will be collected automatically:

• Cookies that preserve users’ expressed choices about the deposit of trackers;
• Cookies intended for authentication to a service, including those intended to ensure the security of the authentication mechanism, for example by limiting robotic or unexpected access attempts;
• Cookies designed to keep track of the contents of a shopping basket on a shopping site or to invoice the user for the products and/or services purchased;
• Cookies for personalising the user interface (e.g. for the choice of the language), where such personalization is inherent element and an expected one for the service given;
• Cookies allowing paying sites to limit free access to a sample of content requested by users;
• Certain cookies measuring the audience on our Websites.

3. INFORMATION WE COLLECT FROM OTHER SOURCES

We may also acquire your personal information from third parties as long as your Data has been collected in compliance with the GDPR. For example, we may receive your personal information from IRONMAN or from third party hosts of World Series events, from data supplementation services, or from social media. The categories of information that we may receive include personal details (e.g. name, date of birth); biographic information (e.g. age, gender); contact details for you and your emergency contacts (e.g. phone number, email address, postal address or mobile number); financial information or purchase history, including payment history for races and events; and loyalty program data.

We may use your personal information for various purposes depending on the nature of your relationship with UTMB Group. For example, we may process personal information for the following purposes:

• Organizing and hosting events, including offering registration, pre-event communications, check-in, and post-event communications and rankings to perform our contract with you or in furtherance of our legitimate interests in pursuing our commercial activities;
• Marketing and advertising in furtherance of the legitimate interests in pursuing commercial activities or with consent where required;
• Recording or photographing events, which might include your likeness, in furtherance of our legitimate interests in memorializing our events;
• Analyzing data about individuals who interact with our offerings in furtherance of our legitimate interests in understanding the interests and demographics of people who interact with our offerings;
• Sharing the results of World Series events, including publishing results publicly, as necessary to perform our contract with you or in furtherance of legitimate interests in supporting the global endurance race ecosystem;
• Improving our operations and offerings and developing new offerings in furtherance of our legitimate interests of pursuing our commercial activities;
• Providing our Running Stones program as necessary to perform our contract with you or, where required, based on your consent;
• Supporting event participants before, during, and after an event, including to arrange for medical services where necessary or processing refunds, as necessary to perform our contract, to protect the vital interests of a natural person, or in furtherance of our legitimate interests in providing a positive customer experience;
• Communicating with individuals regarding subjects that we think may be of interest, including with respect to World Series and related events, in furtherance of the legitimate interests in promoting content of interest or with consent where required;
• Seeking sponsorship for events in furtherance of our legitimate interests of pursuing our commercial activities;
• Complying with applicable legal requirements.
• Processing purchases -- including initiating payment processes, shipping products, coordinating with participating partners to ship products, and managing returns and reimbursements -- initiated via shop.utmb.world to perform our contract with you or in furtherance of our legitimate interests in pursuing our commercial activities

We will also use personal information for any other purposes that are necessary to fulfil our contract with you or that are agreed upon with you and where we determine in good faith that it is reasonably necessary to protect, restore, or preserve the rights, property, health, safety, or vital interests of any person or to prevent, investigate, or prosecute illegal conduct.

Where we rely on your consent to process your personal information, you may withdraw your consent by clicking on the Cookies Management tab on our Websites.. We may also use your information to prepare anonymous, deidentified, or aggregate information.

To the extent permitted by the law and in regards to the protection of your rights and freedom with respect in the processing of your Data and the consent you have given, we may share each of the categories of personal information described above with the following third parties:

• Our affiliates: We may provide your personal information with affiliated corporate entities for the purposes described in this Privacy Notice.
• IRONMAN: As mentioned above, we may provide your personal information to IRONMAN. IRONMAN will use that information as described in its Privacy Policy.
• Service providers and professional advisors: We may share your personal information with our service providers such as data storage providers, digital service tool providers, email messaging providers and more generally in relation to IT maintenance, and entities that conduct marketing on our behalf.
• Business partners: We may share your personal information with business partners such as those who host UTMB World Series events or provide related services.
• When required to do so by law.
• Where reasonably necessary for the rights, safety, or vital interests of us, you, or a third party.
• In the context of a corporate transaction.
• At your direction or with your consent.
• In the event of a merger or sale, your Data will permanently be transferred to the successor company.

You may have certain rights regarding our processing of your personal information. These rights may include rights to:

• give your consent on whether we process your personal information;
• access your personal information, including potentially in a portable format;
• receive information about our processing of your personal information as well as receive the data you have provided to us
• rectify, correct, or supplement the information we hold about you;
• delete, block, or anonymize your personal information;
• withdraw your consent at any time, without affecting the legality of the previous processing and transfer to your Data to third parties;
• opt out of certain disclosures of your personal information to third parties;
• opt out of certain profiling activities
• restrict or limit our use of your personal information;
• object to our use of your personal information;
• not be unlawfully discriminated against for exercising your rights;
• lodge a complaint with your local data protection authority.

If you are a French resident, you have the right to determine what happens to your data after your death.

These rights may be limited or denied in some circumstances within the scope of the article 23 of the GDPR. For example, we may retain your personal information where required or permitted by law even if we receive a request to delete.

You may refer to the section CONTACT DETAILS to exercise your rights or, where permitted by law, to appeal how we have handled your request.

Your consent to process your personal information will be saved for a period of 6 months.

We will keep your Data for the period during which it is necessary to fulfil the aforementioned purposes, and with regard to the data used in the context of UTMB World Series events marketing communications if you have consented to it, for a maximum period of 3 years after your last interaction with us.

At the end of these periods, your Data will, if necessary, be archived for a period not exceeding the legal limitation periods or the applicable archiving obligations or for the duration of the proceedings in the event of litigation. Once these deadlines have expired, we will destroy the Data.

We and our third-party partners automatically collect certain types of usage information when you visit our Websites, apps or social networking pages, when you read our e-mails, or when you otherwise engage with us. Cookies, flash objects, web beacons, file information and similar technologies (“Cookies”) are used to distinguish you from other users of our Websites and other digital offerings. You can usually change the settings of your browser to modify the permissions you give to us and third parties for the storing of and gaining access to cookies on your device.

Cookies are pieces of code that allow for personalization of our Website experience by saving some of your personal data, such as user ID and preferences. A cookie is a small data file that is transferred to your device's hard disk (such as your computer or smartphone) for record-keeping purposes. Cookies and similar technologies do lots of different jobs, like helping us understand how our Websites are being used, letting you navigate between pages efficiently, remembering your preferences and language settings and generally improving your browsing experience. Cookies can also help us to ensure that marketing you see online is more relevant to you and your interests.

The types of Cookies used on our Websites can generally be put into one of the following categories: strictly necessary; analytics; functionality; advertising; and social media.

• Strictly Necessary: These Cookies are essential to make our Websites work. They enable you to move around the Websites and use their features. Without these Cookies, services that are necessary for you to fully use our Websites may not be available. We do not provide you with the ability to disable strictly necessary Cookies. Blocking these Cookies through your browser may impair the functionality of our Websites.

• Functionality Cookies: These Cookies allow us to remember choices you make and tailor our Websites to provide enhanced features and content to you. For example, these Cookies can be used to remember your username, language choice or country selection, and they can also be used to remember changes you have made. We may ask for your consent to deploy these cookies, where required by law.

• Analytics Cookies: These Cookies collect information about how people are using our Websites, for example which pages are visited the most often, how people are moving from one link to another and if a user experiences error messages on certain pages. All information these Cookies collect is grouped together with information from other people's use of our Websites. Overall, these Cookies provide us with analytical information about how our Websites is performing and additional information on the users of our Services. We may ask for your consent to deploy these cookies, where required by law.

• Advertising Cookies: These Cookies are used to deliver advertisements that are more relevant to you and your interests. We may ask for your consent to deploy these cookies, where required by law.

• Social Media Cookies: In order to enhance your internet experience and to make the sharing of content easier, some of the pages on our Websites may contain tools or applications that are linked to third-party social media service providers such as Facebook or Twitter. Through these tools or applications, the social media service provider may set its own Cookies on your device. We do not control these Cookies and you should check the social media service provider's website for further details about how they use Cookies. We may ask for your consent to deploy these cookies, where required by law.

If you enter our Websites or apps via a mobile device with activated location-based services, we may collect information about your current location as well as the kind of mobile device in use. Most of the mobile devices provide the possibility to disconnect from location-based services or to deactivate those.

If you would prefer not to accept Cookies, browsers will allow you to (i) change your browser settings to notify you when you receive a Cookie, which lets you choose whether or not to accept it; (ii) disable existing Cookies; or (iii) set your browser to automatically reject Cookies. Please note that doing so may negatively impact your experience using our Websites and apps, as some features and services on our Websites and apps may not work properly. Depending on your mobile device and operating system, you may not be able to delete or block all Cookies. Your Cookie settings can typically be adjusted in the "options" or "preferences" menu of your browser. In order to understand these settings, the following links may be helpful, otherwise you should use the "Help" option in your browser for more details.

• Cookie settings in Internet Explorer

• Cookie settings in Firefox

• Cookie settings in Chrome

• Cookie settings in Safari web and iOS

We also use clear gifs in HTML-based e-mails sent to our newsletter subscribers to track which e-mails are opened and which links are clicked by them. The information allows for more accurate reporting and improvement of our Services. You can set your e-mail options to prevent the automatic downloading of images that may contain these technologies that would allow us to know whether you have accessed our e-mail and performed certain functions with it.

In order to obtain your consent, you will have to expressly consent to the deposit of cookies by a clear positive act from you. Thus, you will have to click on ‘I accept’ in the cookie banner you will find once you enter on the Websites.

If you do not consent, no non-essential cookies will be placed on your device.

If you refuse, no non-essential cookies will be placed on your device.

On the same banner, you will have the choice on the types of cookies to be applied (analytics, functionality, analytics, advertising and social media cookies).
You can also choose to opt out of the collection of information about your online activities over time and across third-party Websites for online interest-based advertising purposes by participating organizations through industry opt out tools.

If you want to place an "opt-out" cookie on your device indicating that you do not want to receive interest-based advertisements click here and follow the advices. The effectiveness of the industry tool might be limited if your browser is configured to block third party cookies.

Opt-out cookies only work on the internet browser and device they are downloaded onto. Please note that when you "opt-out" of receiving interest-based advertisements, this does not mean you will no longer see advertisements from us or on the Services. It means that the online ads that you do see should not be based on your interests. We are not responsible for effectiveness of, or compliance with, any third-parties’ opt-out options or programs or the accuracy of their statements regarding their programs. In addition, third parties may still use cookies to collect information about your use of the Services, including for analytics and fraud prevention

To limit interest-based advertising on your mobile device, you can review and adjust the settings provided by your device manufacturer, such as “Limit Ad Tracking” for iOS or “Opt-out of interest-based ads” for Android.

We have implemented reasonable technical and organizational security to protect personal information. However, no information shared online can be guaranteed 100% safe at all times. We will retain personal information as reasonably necessary to fulfil the purposes for which it we collected it, including for any legal requirements.

Your personal information may be processed in servers and databases located outside of the jurisdiction in which you reside and where the privacy laws may not be as protective as your jurisdiction of residence. Where legally required we have put in place appropriate safeguards (such as contractual commitments) to protect your data. We rely on the European Union’s standard contractual clauses to send data that is subject to the EU General Data Protection Regulation to a recipient located in a country that is not deemed to provide “adequate” safeguards to that information.

You can contact our data protection officer at the following contact details if you have queries or complaints regarding the way in which your personal information has been used and generally to exercise your rights :

• By post, to the following address: DPO UTMB SAS UTMB 31 rue du Lyret 74400 Chamonix France

• By sending an email to the following address: dpo@utmb.world. Any request for access, modification or deletion of personal data will be processed as soon as possible after receipt of the request, within a maximum period of 1 month.

You are reminded that we may, in accordance with the regulations, be required to refuse to grant certain requests concerning some of these rights (in particular the right of erasure), for legitimate reasons such as the need to defend legal claims or the requirements of a legal obligation to retain certain data.

If you have any unresolved issues, you may lodge a complaint with the competent supervisory authority, which is, in France, the National Data Protection Authority (CNIL).

We also inform you that if you are a French consumer, you can register on the Bloctel cold calling opposition list.

In addition, if you wish to assert your rights with the recipients of your data as listed in paragraph 3, it is your responsibility to contact them in accordance with the procedures indicated in their privacy policies.

We may update this Privacy Notice from time to time. The updated Privacy Notice will be available on each of the Websites. We invite you to regularly consult our Privacy Notice, the date of the last online publication of which will appear at the top of this document. Your continued use of our Websites constitutes acceptance to the updated Privacy Notice.