COUCH POTATO RUN CLUB
PRIVACY POLICY.
Version: 4.0 | Effective Date: 14 August 2026 | Last Updated: 14 August 2026 | Applies To: All Couch Potato Run Club programmes, events and services in South Africa and the United Kingdom.
This Privacy Policy is prepared in compliance with the Protection of Personal Information Act 4 of 2013 (POPIA) in South Africa and the UK General Data Protection Regulation (UK GDPR) together with the Data Protection Act 2018 in the United Kingdom.
We take your privacy seriously. This policy explains exactly what personal information we collect, why, how we use it, who we share it with, and what rights you have over it.
We will never sell your data. Ever.
SECTION 01
WHO WE ARE.
Couch Potato Run Club (“CPRC”, “we”, “us”) operates beginner running programmes, events and a running community in South Africa and the United Kingdom. We operate through the following legal entities:
Depending on where you take part, the relevant entity acts as the Responsible Party (POPIA) / Controller (UK GDPR) for your personal information – meaning we determine the purpose and means of processing it. Both terms are used interchangeably in this policy, and “data subject” means you.
Our designated privacy contact(s):
Our full contact details are in Section 20.
SECTION 02
SCOPE OF THIS POLICY.
This policy applies to all personal information CPRC collects, receives, stores, uses or shares in connection with:
2.1 Our website at couchpotatorunclub.com and any related subdomains or pages;
2.2 Registration for and participation in any CPRC programme, event or session, in South Africa or the UK;
2.3 Communications with CPRC via email, WhatsApp, telephone, contact forms or any other channel;
2.4 Our social media pages and accounts, including Instagram and Facebook;
2.5 Our online store and booking system (operated via WooCommerce on our website, with payments processed by Paystack);
2.6 Any WhatsApp groups operated by CPRC or its coaches.
This policy does not apply to third-party websites or platforms we link to. When you use a third-party platform such as Paystack, WhatsApp or a social network, you are subject to that platform’s own privacy policy.
SECTION 03
WHAT INFORMATION WE COLLECT.
We collect only personal information that is necessary, relevant and adequate for the purposes in this policy:
Where you choose the instalment payment option, Paystack securely stores a token representing your card so it can automatically process your scheduled second payment. CPRC never sees or stores your full card details.
Special / sensitive personal information. Health and medical information is classified as special personal information under POPIA and special category data under UK GDPR (Article 9), and is subject to a higher level of protection. We collect it only where you voluntarily disclose it for your own safety and the safety of others during a programme, and we rely on your explicit consent (and, in emergencies, your vital interests) as the condition for processing it. We will never request it unnecessarily.
SECTION 04
HOW WE COLLECT YOUR INFORMATION.
4.1 Directly from you – when you register, complete a form, email or WhatsApp us, respond to a survey, or communicate with a CPRC coach or team member.
4.2 Through our booking system – when you purchase a programme via our WooCommerce store; payment is processed by Paystack, which is subject to its own privacy policy.
4.3 Automatically via our website – through cookies and similar technologies (see Section 11).
4.4 Through social media – if you interact with or message our pages (Instagram, Facebook).
4.5 From third parties – in limited cases, e.g. where a friend registers on your behalf or refers you.
SECTION 05
WHY WE USE YOUR INFORMATION & LEGAL BASIS.
We use your personal information only for the purposes for which it was collected, or compatible purposes you’d reasonably expect. Under both POPIA and UK GDPR (Article 6), we rely on a lawful basis for each use:
SECTION 06
LAWFUL BASIS EXPLAINED.
Both POPIA and UK GDPR require a lawful basis (a “ground for processing”). We rely on:
6.1 Performance of a contract – to register you, fulfil our obligations, and administer your participation. This is our primary basis for core operations.
6.2 Consent – where you actively agree to a specific use (e.g. marketing, photography). You may withdraw consent at any time, without affecting prior processing.
6.3 Legitimate interests – for analytics, website improvement and certain safety communications, provided these do not override your rights and interests.
6.4 Legal obligation – to comply with SA and UK law (e.g. tax and company record-keeping).
6.5 Vital interests – in emergencies, to protect your life or health, or another person’s.
6.6 Explicit consent / Article 9 conditions – for special-category health data specifically.
SECTION 07
WHO WE SHARE YOUR INFORMATION WITH.
We will never sell, rent or trade your personal information to any third party for their own commercial or marketing purposes. Full stop.
We may share your information, strictly for the purposes in this policy, with:
7.1 CPRC Coaches – your name, contact number and any relevant disclosed health information, for programme delivery and safety. Coaches are contractually required to keep this confidential.
7.2 Payment processor – Paystack processes your payment. Card details are not stored by CPRC. For instalment payments, Paystack retains a secure card token in order to process your automatic second payment one month after the first. This is governed by Paystack’s own privacy and security terms.
7.3 Communication platforms – when you join a CPRC WhatsApp group, your name and number are visible to other members. WhatsApp groups are not entirely private; be mindful of what you share.
7.4 Social media platforms – where photos/videos featuring you are posted on our accounts, those platforms process your image under their own policies. You may request removal (Section 20).
7.5 Professional advisers – our legal, accounting and tax advisers, on a confidential basis, where necessary.
7.6 Regulatory authorities and law enforcement – where required by law, court order or lawful request.
7.7 Emergency services – in a medical emergency, we may disclose relevant (including health) information to emergency medical services to protect your life or health.
7.8 Between CPRC entities – our South African and UK entities may share information with each other where necessary to run the club and provide services to you, subject to the transfer safeguards in Section 08.
SECTION 08
CROSS-BORDER DATA TRANSFERS.
8.1 Some third-party platforms we use (payment processing, WhatsApp/Meta, social media, website analytics) may process or store your information on servers outside South Africa and/or the UK.
8.2 From South Africa (POPIA s72): personal information may be transferred across borders only where the recipient provides an adequate level of protection, or you have consented, or the transfer is necessary to perform a contract with you.
8.3 From the UK (UK GDPR Chapter V): international transfers are made only where the destination benefits from UK “adequacy” regulations, or where appropriate safeguards are in place (such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses), or another lawful exception applies.
8.4 Because CPRC operates in both South Africa and the UK, information may be transferred between our two entities. Where such transfers occur, we take reasonable steps to ensure they are lawful and that your information remains adequately protected.
8.5 By registering for a CPRC programme and using our services, you acknowledge that your information may be processed in the countries described above.
SECTION 09
HOW LONG WE KEEP YOUR INFORMATION.
We keep personal information only as long as necessary for the purpose collected, or as required by South African and UK law:
When information is no longer required, we securely delete or anonymise it. Anonymised data may be kept indefinitely for statistical purposes.
SECTION 10
HOW WE PROTECT YOUR INFORMATION.
10.1 Access controls – information is accessible only to coaches, staff and representatives who need it.
10.2 Confidentiality obligations – all coaches and team members must treat participant information as confidential.
10.3 Secure platforms – we use reputable third-party platforms (our WordPress/WooCommerce website, Paystack, WhatsApp, Google) that apply their own security standards.
10.4 Device security – team members must secure their devices and not share access.
Important limitation: no method of electronic transmission or storage is 100% secure. While we take reasonable steps, we cannot guarantee absolute security. If you believe your interaction with us is no longer secure, notify us immediately at hello@couchpotatorunclub.com.
SECTION 11
COOKIES & WEBSITE TRACKING.
Our website uses cookies and similar technologies. A cookie is a small file placed on your device to remember preferences and understand how visitors use the site.
11.1 Most browsers let you control and delete cookies. You can also use our cookie-consent tool to manage preferences. Disabling some cookies may affect functionality.
11.2 Our website runs on WordPress/WooCommerce and uses third-party services (e.g. Google, review widgets) that may set their own cookies; refer to their policies.
11.3 Under UK GDPR/PECR and POPIA, non-essential cookies are set only with your consent, which you give via our cookie banner.
SECTION 12
PHOTOGRAPHY & VIDEO.
12.1 By participating in a CPRC programme or session, you consent to being photographed or recorded in that context for marketing, social media, press and promotional use.
12.2 Opt-out – if you do not wish to be photographed or recorded, notify your coach in writing (including via WhatsApp) before your first session. We’ll make reasonable efforts to exclude you, but cannot guarantee complete exclusion from group media.
12.3 Removal requests – contact hello@couchpotatorunclub.com with a description or link; we’ll process within a reasonable time, subject to overriding legitimate interests.
12.4 We won’t knowingly use images in a manner that is unflattering, defamatory or harmful to your reputation.
12.5 Once shared on third-party platforms (Instagram, Facebook), media is subject to those platforms’ terms.
SECTION 13
CHILDREN’S PRIVACY.
13.1 Both POPIA and UK GDPR provide enhanced protection for children’s personal information. Under POPIA, a child is anyone under 18. Under UK GDPR, the age at which a child can consent to online services is 13; for anyone younger, and more generally for our programmes, we require parental/guardian consent.
13.2 Where a child participates, parental or guardian consent is required before the first session. By providing it, the parent/guardian agrees the child’s information may be processed under this policy.
13.3 Special care is taken with photos/video of minors – we will not knowingly publish identifiable images of children without explicit parental/guardian consent. If you believe we’ve done so inadvertently, contact us immediately and we’ll remove it without delay.
13.4 Parents/guardians may exercise the rights in Section 15 on a child’s behalf.
SECTION 14
WHATSAPP & MESSAGING.
14.1 We use WhatsApp as our primary programme-communications tool. By registering, you consent to being added to the relevant CPRC WhatsApp group and receiving programme-related messages.
14.2 Visibility – in a group, your name, profile picture and possibly your number are visible to other members. This is a WhatsApp feature we don’t control.
14.3 WhatsApp’s own processing (encryption, metadata, backups) is governed by WhatsApp’s Privacy Policy (Meta). We’re not responsible for it.
14.4 You may leave a group at any time; messages already sent remain visible to other members.
14.5 Direct messages to a coach are treated as confidential and not shared outside CPRC without your consent, except where required by law or in an emergency.
SECTION 15
YOUR RIGHTS.
Under POPIA and UK GDPR you have rights over your personal information. Exercise any of them via Section 20; we respond within one month (30 days).
To exercise a right, email hello@couchpotatorunclub.com with the subject line “Privacy Request — [your name]”. We may verify your identity first.
SECTION 16
MARKETING COMMUNICATIONS.
16.1 Where you’ve registered or engaged with us, we may send information about upcoming programmes, events and news. We rely on consent (including the “soft opt-in” for existing participants, as permitted under UK PECR) as our basis.
16.2 Opting out – unsubscribe any time via the link in any marketing email, by replying “STOP”/”UNSUBSCRIBE”, or by contacting hello@couchpotatorunclub.com. We process opt-outs promptly.
16.3 Opting out of marketing won’t stop essential operational messages about a programme you’re enrolled in.
16.4 We don’t share your contact details with third parties for their own marketing.
SECTION 17
DATA BREACHES.
17.1 If we become aware of a security breach affecting personal information, we’ll investigate promptly and take reasonable steps to contain and remedy it.
17.2 South Africa: where a breach creates a real risk of harm, we’ll notify the Information Regulator as required under POPIA s22, as soon as reasonably possible.
17.3 United Kingdom: where a breach poses a risk to individuals, we’ll notify the ICO within 72 hours of becoming aware of it, where feasible.
17.4 Where a breach is likely to cause you harm, we’ll notify you directly as soon as reasonably possible, with details and recommended protective steps.
17.5 If you believe your information has been compromised, contact us immediately at hello@couchpotatorunclub.com.
SECTION 18
CHANGES TO THIS POLICY.
18.1 We may update this policy to reflect changes in our practices, the law, or our services. The current version is always on our website with its “last updated” date.
18.2 Where changes are material, we’ll notify currently enrolled participants (email/WhatsApp) and give a reasonable opportunity to review before they take effect.
18.3 Continued participation or use of our website after the effective date constitutes acceptance of the updated policy.
SECTION 19
COMPALAINTS.
Please contact us first (Section 20) so we can try to resolve any concern; we respond within 30 days. If you’re not satisfied, you may complain to the relevant regulator:
South Africa – Information Regulator Website: inforegulator.org.za Email: POPIAComplaints@inforegulator.org.za / PAIAComplaints@inforegulator.org.za Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 Tel: 010 023 5207
United Kingdom – Information Commissioner’s Office (ICO) Website: ico.org.uk Helpline: 0303 123 1113 Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
SECTION 20
CONTACT US.
For all privacy related queries, requests or complaints:
Please include “Privacy Request” or “Privacy Complaint” and your full name in the subject line. We acknowledge receipt within 3 business days and aim to resolve requests within 30 days (one month).
