Privacy Policy

Procam International Private Limited ("Procam", "Company", "we", "our" or "us") is committed to protecting the privacy of every participant using the HDOR – Hundred Days of Running ("HDOR") platform.

This Privacy Policy explains how we collect, use, disclose, store, retain and otherwise process your personal data when you access or use the HDOR website, mobile application and related services (collectively, the "Platform").

This Privacy Policy forms an integral part of the HDOR Terms of Service. Capitalised terms not defined herein shall have the meaning assigned to them in the Terms of Service.

By registering on or using the Platform, you acknowledge that you have read and understood this Privacy Policy.

1. Identity of the Data Fiduciary

For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Data Fiduciary responsible for processing your personal data is:

Procam International Private Limited

Registered Office:

14, James Court, Marine Drive, Mumbai – 400020, Maharashtra, India

Grievance Officer: Shruti Shidhaye

Email: grievance@hdor.com

2. Scope of this Privacy Policy

This Privacy Policy applies to personal data processed by Procam through the Platform in connection with:

• registration on HDOR;
• participation in virtual running Events;
• use of mobile applications;
• website access;
• customer support;
• leaderboards;
• badges;
• challenges;
• community features;
• promotional campaigns;
• communications;
• payment processing;
• fraud prevention;
• platform security.

This Privacy Policy applies only to the HDOR Platform.

It does not apply to third-party websites, payment gateways or fitness applications, each of which is governed by its own privacy policy.

3. Definitions

For purposes of this Privacy Policy:

• Account means your registered participant account.
• Activity Data means information relating to your physical activity including running distance, duration, pace, GPS route, cadence, elevation, calories, heart rate (where available), timestamps and similar metrics.
• Child means an individual below eighteen (18) years of age.
• Consent means the free, specific, informed, unconditional and unambiguous indication of your agreement to the processing of your personal data through a clear affirmative action.
• Event means any challenge, campaign or virtual running event organised through HDOR.
• Personal Data shall have the meaning assigned under the DPDP Act.
• Platform means the HDOR website, mobile application and associated services.
• Third Party Fitness App means any compatible activity-tracking application or wearable ecosystem integrated with HDOR.

3. Applicability

This Privacy Policy applies only to the HDOR Platform and r/w the Terms of Service/Use

It does not apply to third-party websites, payment gateways or fitness applications, each of which is governed by its own privacy policy.

4. Categories of Personal Data We Collect

Depending upon your interaction with the Platform, we may collect the following categories of personal data.

A. Registration Information

• full name;
• mobile number;
• email address;
• date of birth;
• gender;
• emergency contact (where collected);
• username;
• password credentials (stored in encrypted form).

B. Participation Information

• Event registrations;
• challenge participation;
• badges earned;
• certificates;
• leaderboard positions;
• completion history;
• rewards/points.

C. Activity Data

Where you choose to participate in Events, we may process Activity Data including:

• distance;
• duration;
• pace;
• cadence;
• elevation;
• running route;
• GPS coordinates;
• timestamps;
• calories;
• heart rate (where supported by your device);
• other running metrics generated by compatible fitness applications or wearable devices.

Activity Data is processed solely for operating the Platform,, verifying participation, preventing fraud, administering Events and providing participant features.

D. Device Information

We may automatically collect:

• device model;
• operating system;
• browser type;
• application version;
• IP address;
• language preferences;
• device identifiers;
• crash reports;
• diagnostic information;
• log files.

E. Payment Information

Where you register for paid Events, payments are processed through authorised third-party payment service providers.

Procam does not store your complete debit card, credit card, UPI PIN or banking credentials.

We may receive limited transaction information necessary for:

• confirming payment;
• issuing invoices;
• processing refunds;
• accounting;
• taxation;
• fraud prevention.

F. Communications

Where you contact us, we may process:

• customer support requests;
• emails;
• chat conversations;
• survey responses;
• feedback;
• complaints;
• correspondence.

G. Content You Upload

Where you voluntarily upload content, we may process:

• profile photographs;
• running photographs;
• videos;
• comments;
• reviews;
• testimonials;
• community posts.

6. Personal Data Received from Third Party Fitness Applications

If you choose to connect your Account with a Third Party Fitness App such as:

• Strava;
• Garmin Connect;
• Apple Health;
• Google Health Connect;
• Fitbit;
• Map My Fitness (Underarmour)

or any other compatible platform, Procam may receive Activity Data from that application based on the permissions granted by you. The categories of data imported depend upon the permissions you choose to grant and the capabilities of the Third Party Fitness App.

You may disconnect such integrations at any time through the relevant application settings. Disconnecting an integration will stop future imports but will not automatically delete Activity Data previously imported into HDOR.

Procam does not control the privacy practices of Third Party Fitness Apps and encourages you to review their respective privacy policies before connecting your account.

7. Children's Personal Data

HDOR is intended for participants aged thirteen (13) years and above.

Where the participant is below eighteen (18) years of age, registration must be completed by a parent or lawful guardian.

Procam processes a Child's personal data only after obtaining consent from the parent or lawful guardian in accordance with applicable law.

Parents or guardians may:

• review information relating to their Child;
• seek correction of inaccurate information;
• withdraw consent;
• request deletion, subject to applicable legal requirements.

Upon withdrawal of parental consent, Procam may suspend or terminate the Child's participation and delete or anonymise the Child's personal data, except where retention is required under applicable law or for the establishment, exercise or defence of legal claims.

Procam does not knowingly process Children's personal data for behavioural monitoring, profiling or targeted advertising.

8. Why We Process Your Personal Data

Depending on your interaction with the Platform, Procam processes personal data for one or more of the following purposes:

• creating and managing your Account;
• registering you for Events;
• verifying eligibility;
• verifying participation;
• preventing fraud and manipulation;
• maintaining leaderboards;
• issuing badges and certificates;
• administering rewards;
• communicating Event updates;
• providing customer support;
• processing payments and refunds;
• maintaining platform security;
• improving Platform performance;
• complying with legal and regulatory obligations;
• resolving disputes;
• protecting the rights, safety and legitimate interests of Procam and participants.

We process only such personal data as is reasonably necessary for the relevant purpose.

9. Consent

Where required under applicable law, Procam seeks your Consent before processing your personal data. You may withdraw your Consent at any time through the Platform or by contacting the Data Protection Officer.

Withdrawal of Consent shall not affect processing already undertaken prior to such withdrawal. However, you agree that withdrawal of the Consent makes it impossible for Procam to continue to provide the service.

10. Disclosure of Personal Data

Procam does not sell or rent your personal data. We disclose personal data only where reasonably necessary for the purposes described in this Privacy Policy, where required by law, or where you have provided your consent.

Recipients of personal data may include:

• service providers and processors;
• payment service providers;
• cloud hosting providers;
• technology vendors;
• analytics providers;
• customer support providers;
• communication service providers;
• Event sponsors and partners;
• government authorities;
• law enforcement agencies;
• courts and regulatory authorities;
• professional advisers.

Each disclosure is limited to the personal data reasonably necessary for the relevant purpose.

11. Service Providers and Data Processors

Procam engages carefully selected third-party service providers ("Processors") to assist in operating the Platform. Processors may include providers of:

• cloud hosting;
• application infrastructure;
• payment processing;
• SMS services;
• email communications;
• customer support;
• fraud detection;
• analytics;
• data storage;
• notification services;
• software maintenance;
• cybersecurity;
• technical support.

Where a Processor processes personal data on behalf of Procam, Procam requires such Processor, through appropriate contractual arrangements, to:

• process personal data only on documented instructions from Procam;
• implement appropriate technical and organisational security measures;
• maintain confidentiality;
• restrict access to authorised personnel;
• notify Procam of personal data breaches without undue delay;
• return or securely delete personal data upon termination of services, where applicable;
• comply with applicable law.

12. Event Sponsors and Commercial Partners

Certain Events may be organised in association with sponsors, institutional partners or promotional partners. Where a sponsor is responsible for:

• prize fulfilment;
• winner verification;
• tax compliance;
• shipping rewards;
• travel arrangements;
• promotional campaigns;

Procam may share only such personal data as is reasonably necessary for that purpose.

Unless expressly disclosed at the time of registration and consented to by you, Procam will not share your personal data with Event sponsors for their independent marketing purposes. Where your personal data is shared with a sponsor acting as an independent Data Fiduciary, such processing shall thereafter be governed by that sponsor's own privacy policy.

Nothing in this Clause permits unrestricted sharing of participant databases with sponsors.

13. Leaderboards, Community Features and Public Profiles

HDOR is a community-driven platform that includes public participation features. Subject to your privacy preferences, the following information may be displayed to other participants:

• display name;
• profile photograph;
• city;
• Event participation;
• badges;
• achievements;
• leaderboard ranking;
• Activity Data associated with the relevant Event.

You may manage certain visibility settings through your Account.

However, where public display of limited information is necessary for the administration or integrity of an Event (including leaderboards or prize verification), Procam may continue to display such information to the extent reasonably necessary for those purposes.

Withdrawal of consent to public display may affect your eligibility for certain community features, competitions or rankings.

14. Cookies, SDKs and Similar Technologies

The Platform uses cookies, software development kits ("SDKs"), local storage objects and similar technologies to operate efficiently.

These technologies help us:

• authenticate users;
• maintain secure sessions;
• remember preferences;
• analyse Platform performance;
• improve user experience;
• detect fraud;
• diagnose technical issues.

Cookies used by the Platform may include:

• essential cookies;
• functional cookies;
• analytics cookies;
• performance cookies.

Certain SDKs or analytics tools may collect limited technical information necessary for application functionality and performance measurement. You may control certain cookies through your browser or device settings.

Disabling some technologies may reduce Platform functionality or prevent certain features from operating correctly.

15. Security of Personal Data

Procam maintains appropriate technical, organisational and administrative safeguards designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.

While Procam endeavours to implement commercially reasonable security measures, no method of electronic transmission or storage is completely secure. Accordingly, Procam cannot guarantee absolute security of personal data.

Participants are responsible for maintaining the confidentiality of their Account credentials and promptly notifying Procam of any suspected unauthorized access.

16. Cross-Border Processing

Certain Processors engaged by Procam may process or store personal data outside India where operationally necessary.

Where personal data is processed outside India, Procam shall take reasonable steps to ensure that such processing is undertaken in accordance with the Applicable local laws, governmental notifications and appropriate contractual safeguards.

17. Data Retention

Procam retains personal data only for as long as reasonably necessary to fulfil the purposes described in this Privacy Policy or as required under applicable law.

Where retention is no longer necessary, personal data will be securely deleted, anonymised or irreversibly de-identified, unless continued retention is required by law or for the establishment, exercise or defence of legal claims.

18. Account Closure and Deletion

You may request closure of your Account through the Platform or by contacting the Grievance Officer.

Upon closure of your Account:

• your access to the Platform will cease;
• your profile will no longer be active;
• future participation in Events will not be possible unless a new Account is created.

Closure of an Account does not necessarily result in immediate deletion of all personal data.

Procam may retain certain information where reasonably necessary for:

• compliance with applicable law;
• taxation;
• accounting;
• fraud prevention;
• dispute resolution;
• enforcement of legal rights;
• audit purposes.

Archived backup systems may retain residual copies of personal data until such backups are overwritten in accordance with Procam's backup lifecycle.

19. Business Transfers

In the event of:

• merger;
• acquisition;
• restructuring;
• amalgamation;
• demerger;
• sale of business;
• transfer of assets;
• insolvency proceedings;

or any similar corporate transaction, personal data may be transferred to the acquiring or successor entity, subject to applicable law. Any successor entity shall continue processing personal data in accordance with this Privacy Policy or provide an updated privacy notice where required by law.

20. Fraud Prevention and Platform Integrity

To preserve the fairness and integrity of Events, Procam may process Activity Data, technical information and related records for the purposes of:

• detecting manipulation of Activity Data;
• preventing fraud;
• investigating suspicious activity;
• verifying eligibility;
• protecting the Platform;
• enforcing the Terms of Service.

Such verification may involve automated analysis, manual review or a combination of both. Appropriate decisions affecting participation will involve human review where required under applicable law or Procam's internal processes..

21. Your Rights

Subject to the DPDP Act and other applicable laws, you may exercise the following rights in relation to your Personal Data.

21.1 Right to Access Information

You may request:

• a summary of the Personal Data processed by Procam;
• the processing activities undertaken in relation to your Personal Data;
• the categories of Personal Data processed;
• the categories of recipients with whom your Personal Data has been shared, in accordance with applicable law.

21.2 Right to Correction, Completion and Updating

You may request correction, completion or updating of inaccurate or incomplete Personal Data.

Where reasonably practicable, you may also update certain Personal Data directly through your Account.

21.3 Right to Erasure

You may request deletion of your Personal Data. Procam will erase your Personal Data where required under applicable law. However, Procam may refuse or defer deletion to the extent retention is necessary for:

• compliance with applicable law;
• taxation;
• accounting;
• fraud prevention;
• security investigations;
• enforcement of contractual rights;
• establishment, exercise or defence of legal claims;
• compliance with orders issued by competent authorities.

21.4 Right to Withdraw Consent

Where processing is based upon your Consent, you may withdraw such Consent at any time.

Withdrawal of Consent shall not affect the lawfulness of processing undertaken before such withdrawal.

Where withdrawal of Consent prevents Procam from providing certain services, you acknowledge that:

• your participation in Events may cease;
• your Account may be suspended or closed;
• certain Activity Data may no longer be displayed;
• you may become ineligible for badges, rankings, rewards or certificates.

21.5 Right to Grievance Redressal

You may submit complaints regarding the processing of your Personal Data in accordance with Clause 24 of this Privacy Policy.

21.6 Right of Nomination

You may nominate another individual to exercise your rights under applicable law in the event of your death or incapacity.

Procam may require reasonable evidence before acting upon such requests.

22. Your Responsibilities

You are responsible for ensuring that:

• Personal Data provided to Procam is accurate;
• contact information remains updated;
• your Account credentials remain confidential;
• you promptly notify Procam of unauthorised access;
• Personal Data relating to another individual is provided only where you are legally authorised to do so.

Providing false or misleading Personal Data may result in suspension or termination of your participation in accordance with the Terms of Service.

23. Personal Data Breach

Procam maintains internal procedures for identifying, assessing, containing and responding to actual or suspected Personal Data Breaches. Where a Personal Data Breach is likely to trigger notification obligations under applicable law, Procam shall notify:

• the Data Protection Board of India; and/or
• affected Data Principals,

in the manner and within the timelines as prescribed under applicable law.

Nothing contained in this Clause shall require disclosure of information that would prejudice ongoing security investigations or compromise the security of the Platform.

24. Grievance Redressal

If you have any questions, concerns or complaints regarding this Privacy Policy or the processing of your Personal Data, you may contact the Grievance Officer.

Grievance Officer

Name: Shruti Shidhaye

Email: grievance@hdor.com

Postal Address:

Procam International Private Limited

14, James Court, Marine Drive, Mumbai – 400020, Maharashtra, India.

Procam shall endeavour to:

• acknowledge complaints within the period prescribed under applicable law;
• investigate complaints fairly and objectively;
• respond within the timelines prescribed under applicable law.

Before responding to a request relating to Personal Data, Procam may require verification of the identity or authority of the requesting individual. Where a complaint relates to a Child's Personal Data, Procam may verify the authority of the parent or lawful guardian before processing the request.

Nothing contained in this Clause limits any statutory remedies available to you under applicable law.

25. Changes to this Privacy Policy

Procam may amend this Privacy Policy from time to time. Where changes materially affect the processing of Personal Data or require fresh Consent under applicable law, Procam shall provide appropriate notice through the Platform, email or other electronic communication and seek such Consent where legally required.

26. Third-Party Websites

The Platform may contain links to third-party websites, applications or services. Such third-party platforms operate independently of Procam.

Procam neither controls nor is responsible for the privacy practices, content or security of third-party platforms. Participants are encouraged to review the privacy policies of those third-party platforms before providing Personal Data.

27. Business Continuity and Corporate Transactions

In the event of any merger, acquisition, restructuring, business transfer, insolvency proceeding or similar corporate transaction involving Procam, Personal Data may be transferred to the successor entity in accordance with applicable law.

Any successor entity shall continue to protect Personal Data in a manner substantially consistent with this Privacy Policy unless otherwise permitted or required by law.

28. Governing Law

This Privacy Policy shall be governed by and construed in accordance with the laws of India. Nothing contained in this Privacy Policy shall prejudice any statutory rights available to a Data Principal under applicable law.

29. Contact Us

For questions relating to this Privacy Policy or your Personal Data, please contact:

Procam International Private Limited

14, James Court, Marine Drive, Mumbai – 400020, Maharashtra, India.

Email: privacy@hdor.com

30. Acknowledgement

By creating an Account, registering for an Event or otherwise using the Platform, you acknowledge that:

• you have read this Privacy Policy;
• you understand how your Personal Data will be processed;
• where applicable, you have provided your Consent for such processing;
• you understand your rights under applicable law and the mechanisms available for exercising those rights.

Schedule A

Categories of Personal Data and Processing Purposes

Schedule B – Categories of Recipients

Depending upon the purpose of processing, Personal Data may be disclosed to:

• cloud hosting providers;
• payment gateways;
• customer support vendors;
• communication service providers;
• logistics partners;
• Event sponsors (only where necessary and/or separately consented);
• fraud detection vendors;
• analytics providers;
• statutory authorities;
• law enforcement agencies;
• courts and tribunals;
• professional advisers;
• auditors.

Procam does not sell participant Personal Data to third parties.