PR0TOCOL ("we", "us") is a competitive sports platform operated by GOCLOUD GLOBAL SDN BHD. This policy explains what personal data we collect through protocolracing.com and the PR0TOCOL app (together, the "Service"), how we use it, and the choices you have. We process personal data in accordance with the Personal Data Protection Act 2010 (Malaysia).

1. Data we collect

• Account details — name, email address, phone number, gender, nationality, club, and your identity card (IC) number, which we use for event check-in and prize verification. Your date of birth is filled in from your IC number (you can correct it) and your age is calculated from it, for age categories. Only the last digits of your IC are shown in the app.
• Sign-in data — if you sign in with Google or Apple, we receive your name and email address from that provider (Apple may give us a private relay email instead). If you use a password, we store it only in encrypted (hashed) form.
• Race data — races you join, results you submit, finish times, bib numbers, categories, and race e-certificates or proof images you upload.
• Profile and community — club membership, your season goal, Running Clinics you sign up for, and race requests you send us.
• Payment data — when you register for a paid event, payment is processed by Stripe. We receive payment status and amount; we never see or store your full card number.
• Usage data — on our website and in the PR0TOCOL app, pages viewed, interactions, device and browser identifiers (cookies), and approximate location (city or country, inferred from your IP address) collected through analytics tools (Google Analytics, Meta Pixel) to understand how the Service is used and to measure our advertising. We do not use GPS or your precise location. On iPhone, the app asks for your permission before any tracking for advertising, and you can say no.

2. How we use your data

• To operate your athlete account, race registrations, race passes and check-in.
• To verify and publish race results and leaderboards. Your name, member number, finish time and ranking may be displayed publicly on event leaderboards and the PAI season index. This is inherent to competitive sport.
• To let other members find you. By default other signed-in members can search for you by name or member number and see your public profile (name, nationality, club, label, verified races and badges). Your email, phone, IC and date of birth are never shown. You can turn this off at any time in Settings → Public profile.
• To run Running Clinics. When you tap “I’m going”, the clinic leader can see your name and member number on the going list. Your phone number is never shown to them.
• To review submitted results. Automated tools (including AI-assisted checks) may help compare your submission against your uploaded e-certificate; final verification decisions are made by our team.
• To send you service messages by email or in-app notification, for example result verification updates, password reset links, clinic reminders and event information.
• To improve the Service and measure marketing.

3. Sharing

We do not sell your personal data. We share data only with service providers needed to run the Service: Cloudflare (hosting and storage), Stripe (payments), Google (sign-in and analytics), Apple (sign-in), Meta (website and app analytics and advertising measurement; Meta receives usage data and device identifiers, not your name, email, phone or IC), and Resend (email delivery). Event-day partners (for example timing or venue crew) may access entrant lists strictly for running the event.

4. Storage and security

Data is stored on Cloudflare infrastructure. Access is limited to authorised administrators. Uploaded proof images are stored privately and used only for verification.

5. Retention

We keep account and verified result data while your account is active, because results form a permanent competitive record. Password reset links expire after 30 minutes. If you delete your account, your data is removed as described below.

6. Your rights and account deletion

• You can view and edit your personal details at any time in the app (Settings → Edit Personal Info).
• You can delete your account yourself at any time in the app: Settings → Delete account. This takes effect immediately and cannot be undone.
• When you delete your account we delete your name, email, phone number, IC number, date of birth, nationality, club, profile, submitted results and uploaded e-certificates, goals, clinic sign-ups and race requests, and you are removed from the PAI index and member search.
• We keep, without your name, records of PR0TOCOL-organised events you registered for, paid for or raced in, because they are needed for payment records and official results. These show as “Deleted member”.
• Can’t open the app? Email jen@protocolracing.com from the email address on your account with the subject “Delete my PR0TOCOL account” and we will delete it within 7 days.
• You can also request a copy of your data or a correction by emailing us.
• You may opt out of non-essential communications at any time.

7. Children

The Service is not directed at children under 13. Minors may only enter events with the consent of a parent or guardian, in line with each event's rules.

8. Changes

We may update this policy from time to time. The latest version will always be available at this page, with the effective date shown above.

9. Contact

GOCLOUD GLOBAL SDN BHD · Kuala Lumpur, Malaysia
Email: jen@protocolracing.com