PRIVACY NOTICE

Escape from Alcatraz Triathlon

Updated as of September 10, 2026

We are committed to protecting the Personal Information of those individuals whose data we collect and process.

Who are we?

We are Earl US, LLC, and we operate the Escape from Alcatraz Triathlon (the “Event”) on behalf of PTO Commercial LLC (“PTO” or the “Professional Triathlon Organization”). Earl US, LLC is also part of MARI Group and its affiliated entities (collectively, “MARI”). We will collectively refer to ourselves as the “Company,” “we,” “our,” or “us”.

What is this privacy notice about?

This Privacy Notice (“Notice”) describes how we collect, use, and disclose Personal Information when you register for or apply to participate in the Event, when you visit our website (the “Site”), when you buy merchandise from us, when you subscribe to our newsletter or mailing list, when you link a fundraising page to the Event, when you attend the Event in person, and when you otherwise interact with us, including through our social media, marketing, contests, and surveys (collectively, our “Services”).

“Personal Information” has the meaning given in the California Consumer Privacy Act (“CCPA”), Cal. Civ. Code §§ 1798.140(v), and means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a person. Personal Information includes “Sensitive Information” (as described below) and data regulated as “personal data” or “personally identifiable information” under the law of other jurisdictions from where our participants may register. Personal Information does not include de-identified data from which we cannot reasonably identify any individual person.

If you provide us with Personal Information about another person — for example, an emergency contact — you must be authorized to do so, ensure that person has consented to their Personal Information being shared with us and used as described in this Notice, and make sure they are aware of this Notice.

Where permitted by applicable law, you accept the terms of this Notice by using the Site, registering for or participating in the Event, and/or receiving Services from us.

What personal information do we collect?

Category	Types of Information
Personal and online identifiers	first and last name, username, online identifiers (such as IP address)
Contact information	email address, phone number, address, and the components of those data elements, such as zip code, area code, and state or province
Race registration information	race selected, and date of birth and gender ( used to allocate you to the correct category for reporting results)
Emergency and health information	Emergency contact name and contact details, health information relevant to the race, such as pre-existing medical conditions, allergies, or information you voluntarily provide to us or on-course medical staff to prepare for the race, keep you safe, and provide you with medical treatment
Optional registration information	Optional information that you may share about your racing history, interests, and the country you wish to represent (used to have country flags at the event and reflect the international nature of the race)
Billing information	credit/debit card numbers and associated data (such as expiry date), bank account information, payment account information, information for other forms of payment that you made provide
Customer profile	your preferences (such as information about events you enjoy or entertainment you are interested in or a language preference)
Race result information	Race category, starting time, time results, bib number, timing chip data
Fundraising information	Name of a linked charity, amounts raised, donations provided
Transactional information	Ticket buying history, attendance at events, memberships, subscriptions, other purchase history
Communications with or by you	emails that you send seeking assistance and any response, information you post in a public space on our website or on a third-party social media site that tags or mentions our event or company
Online activity	browsing history, search history, video viewing history, interactions with our Site, email, or advertisement, IP address, general location (such as country or area) based on IP address
Photographs and recordings	Pictures taken at the Event, recordings of the Event
Other information that you may voluntarily share with us	Feedback or comments you may provide while at an event and any other information that you choose to share

We do not collect Personal information from children. You are required to be 18 to participate in the Event. If we become aware that we have collected a minor’s Personal Information, we will take reasonable steps to delete that information.

We may collect deidentified or pseudonymized information from you that may not by itself reasonably identify you as the source of the information (“Deidentified Information”). This Deidentified Information is collected when you navigate the Site and may include:

device type;
device operating system;
internet browser type;
internet service provider;
referring/exit pages;
date/time stamp; and
clickstream information.

We will take reasonable measures to ensure that Deidentified Information we collect is not reasonably identifiable and may not later be easily used to identify you.

How do we collect personal information?

Directly from you. You may provide us with your Personal Information when you:

register for the Event via our Site or a third-party registration platform;
communicate with us by email, phone, or in person;
subscribe to our emails and/or newsletters;
report a problem or request support;
buy merchandise or event photography;
link a fundraising page to your entry;
interact with our social media accounts or take part in contests, promotions, or surveys; and
attend the Event, including bib collection, timing chip scanning, and other on-course interactions.

From other sources. We may also receive information about you from:

Through our third-party registration, technology and timing partners. We engage third-party providers to operate race registration, entry fee payment, timing, and results services on our behalf. Those providers collect Personal Information from you and share it with us so that we can administer the Event, communicate with you, and produce results.
Event partners and sponsors, who we work with to host the Event. We may share your personal information with event partners and sponsors to provide you with Services that you seek, provide you with customer service, and to offer you information and the opportunity to take advantage of promotions and offers. We may also share your feedback with event partners and sponsors to resolve an issue, improve the Event and Services, and share positive news with our partners and sponsors.
Medical and health providers, to the extent relevant and necessary for keeping you safe and providing you with medical care connected to or at the Event.
Venues and local authorities, who host or authorize parts of the Event and provide safety, medical, and traffic management services.
Photography and media partners, who capture and supply Event photography and footage.
Charity fundraising platforms. If you set up or link a fundraising page through a third-party fundraising platform in connection with the Event, that platform may share your personal information, and information about your donors, with us.
Through your use of our website. We may collect Personal Information that your browser transmits when you visit the Site and Deidentified Information about how you interact with the Site through cookies and similar tracking technologies, as described in “How do we use cookies or other tracking technologies?” below.
From our affiliates. We may receive information from other MARI companies about your participation in other races indicating that you may have an interest in this Event.
From social media platforms. If you use a social media login for our Services or interact with our content, such as by using one of our promoted hashtags.

We may combine Personal Information we receive from these sources with Personal Information you give to us directly and Personal Information we collect about you.

For what purposes do we use personal information?

We use Personal Information for the following purposes:

Purpose	Categories of Personal Information Used	Legal Basis
To Provide Our Services: We may use your Personal Information to manage the Event, provide the Services you seek, and deliver support related to the Event. This includes using your payment information and other Personal Information to process your registration, and sell you merchandise, activities, and other content. This may include reporting about and management of related charitable contributions.	Any Personal Information	As necessary for the performance of a contract
For Race Administration: We may use your Personal Information to record, verify, and publish official race results. This includes processing your Personal Information for analytics, research and development related to the race and similar events.	Personal and online identifiers, contact information, race registration information, optional registration information, race result information	Where applicable, as necessary for the performance of a contract Otherwise, legitimate interest
Customer Service and Communications: We may use your Personal Information to notify you about race updates and logistics, and to respond to your inquiries, questions, requests, and support your needs more efficiently.	Any Personal Information	Where applicable, as necessary for the performance of a contract Otherwise, legitimate interest
User Experience Personalization: We may use Personal Information and/or Deidentified Information in the aggregate to analyze browsing and usage activities and patterns to understand interests and preferences with respect to the Site and our Services. This will help us optimize your experience at an event and on the Site, for example, by displaying content based upon your preferences.	Personal and online identifiers, race registration information, optional registration information, fundraising information, customer profile, communications with and by you, online activity, other information that you may voluntarily share with us	Legitimate interest
Safety, Security, Fraud Prevention and Cybersecurity: We may use your Personal Information and/or Deidentified Information to protect your health, safety and security and the health, safety and security of others. For example, we may use the information to authenticate users, facilitate secure payments, respond to a legal request or claim, conduct audits, enforce our terms and policies, and to ensure health and physical safety in the case of an emergency, medical or otherwise. We may use Personal Information to detect and prevent fraud and ensure the security of our electronic networks and systems.	Any Personal Information	Where applicable, to comply with applicable local law Otherwise, legitimate interest
Event Photography and Recordings: We may use your Personal Information to capture photos and recordings of the Event and allow you to participate in optional interviews and other activities connected to the Event.	Personal and online identifiers, race registration information, race result information, photographs and recordings
Marketing and Targeted Advertising: We may use your Personal Information to send you promotional materials and event reminders and to conduct targeted advertising. We obtain consent in advance where required by law. Otherwise, you have the right to opt out from receiving marketing messages as described below.	Personal and online identifiers, contact information, customer profile information, communications with you, online activity	Where required by law, consent Otherwise, legitimate interest
Business Optimization: We may use your Personal Information to improve the content on and layout of our Site, and in managing our everyday business needs. We use data about the events and Services we provide to determine what aspects people enjoy and what improvements we can make. We may also use your feedback to improve the Site and our Services. All of this is done with the intention of making the Site and Services more enjoyable and useful for you.	Personal and online identifiers, contact information, race registration information, race result information, customer profile, transactional information, communications with or by you, online activity, other information that you may voluntarily share with us	Legitimate interest
For incidents and injuries: If there is an incident or injury at an Event, we may use your Personal Information to address the issue, including, where applicable, in making claims to insurance providers.	Any Personal Information	Where applicable, legal obligation or as necessary for the performance of a contract Otherwise, legitimate interest
Legally Required: We may use Personal Information as may be required to fulfill our legal obligations or protect our legal rights.	Any Personal Information	Where applicable, legal obligation Otherwise, legitimate interest

Unless required to do so by law, we will not collect additional categories of Personal Information or use Personal Information we collected for materially different, unrelated, or incompatible purposes without providing you notice and seeking your consent.

Where do we store personal information?

We are based in the United States and primarily store and process Personal Information in the United States. Because participants register for the Event from many countries, and because we are part of MARI Group, an international group of companies, we may also transfer or disclose your Personal Information to MARI Group entities and service providers located outside the country in which you reside and outside of the United States.

If you are registering for the Event from outside of the United States, by providing your Personal Information to us you acknowledge that it will be collected, held, and processed in the United States and, where relevant, transferred overseas as described in this Notice, and that the privacy laws of your own country may also apply to our handling of your Personal Information. If you have any questions about our data transfer practices, please contact us as described in the section titled “How can you contact us?” at the end of this Notice.

To whom might we disclose personal information?

We may disclose your Personal Information to the following third parties only as necessary for one of the purposes listed above:

Event partners: In connection with the Event, there are various activities, opportunities, and dining options, which may be provided by business partners, suppliers, and sub-contractors. You may share your personal information directly with our event partners to participate and/or make a purchase. We may also share your personal information to facilitate your participation, such as sharing ticketing information to enable you to receive the Services that you have purchased. If you provide feedback about any of the offerings at the Event, we may share that feedback with the relevant business partner, supplier, or sub-contractor to allow them to remedy any concerns, improve their services, and/or receive positive feedback.
Event sponsors: We work with business partners to sponsor our event. We may share your personal information with these sponsors so that they may share relevant information with you about promotions and offers related to the Event.
Registration, Timing, and Results Providers: We share Personal Information with the third-party providers who operate our registration, entry fee payment, timing, and results systems.
Medical and Emergency Services: We may disclose Personal Information, including health information and your emergency contact’s details, to on-course medical teams, first responders, ambulance services, or hospitals where necessary to provide medical treatment to you during the Event.
Public Results Publication: We publish Event results, which may include your name, age category, gender, nationality or country represented, bib number, and finish time, on our Site and through media partners. If you would prefer your results are not published, please contact us using the details at the end of this Notice.
Charity and Fundraising Platforms: Where you link a fundraising page to your entry, we may share relevant Personal Information with the fundraising platform and the charity you are supporting.
Photography and Media Partners: We may share Event photography and footage that includes you with media outlets and partners for promotional and reporting purposes.
Service providers: We use suppliers to provide, improve, and tell you about the Services. These service providers include, for example, technology vendors, advertisers, marketing and social media consultants, analytics consultants, and search engine providers. These service providers may assist us:
- With business operations, such as e-commerce and payment platform providers;
- To provide you with information about promotions and offers;
- To select and serve relevant advertisements to you and, in some cases, to others; and
- In the improvement and optimization of the Services.
Our Affiliates: We may disclose your Personal Information to other legal entities in the MARI Group, including our parent company and other subsidiaries and affiliates of our parent company.
Law Enforcement, Safety, and Legal Processes: We may disclose your Personal Information to outside counsel, law enforcement or other government officials if it relates to a criminal investigation or alleged criminal activity. We may also disclose your Personal Information: (i) if required to do so by law; (ii) for fraud protection and credit risk reduction purposes; (iii) in the good-faith belief that such action is necessary to protect our rights, interests, or property; (iv) in the good-faith belief that such action is necessary to protect your safety or the safety of others; or (v) to comply with a judicial proceeding, court order, subpoena, or other similar legal or administrative process. This may include sharing your Personal Information with insurance companies.
Sale or Acquisition of Assets: If we become involved in a transaction involving the sale of some or all of our assets, such as a merger, acquisition, or bankruptcy, or if we are transferred to another company, we may disclose and/or transfer your Personal Information as part of the transaction. If the surviving entity in that transaction is not us, the surviving company may use your Personal Information pursuant to its own privacy notice, which may be different from this Notice.
As you direct: We may also disclose your Personal Information to any other third party at your direction or with your prior consent.

As further detailed in the section below about your legal rights and choices, you can opt-out of sharing with any party for marketing or advertising by contacting us as indicated in the “How can you contact us?” section at the bottom of this Notice.

How do we protect personal information?

The security and confidentiality of your Personal Information is very important to us. We use commercially reasonable security measures to protect your Personal Information. We use a variety of administrative, physical, and technological solutions to protect your information from unauthorized access, loss, or misuse. Because there is always some risk in transmitting information over the internet and otherwise processing information, we cannot guarantee or warrant that your Personal Information will be completely secure from misappropriation by hackers or other criminal actors, or in the event of a system or network compromise.

How long do we retain personal information?

We will retain your Personal Information while you maintain an account with us or to the extent necessary to provide the Services. Thereafter, we retain your Personal Information for as long as reasonably necessary: (1) to respond to any queries; (2) to log a response to a request related to your legal rights; (3) for ordinary business continuity procedures; or (4) to comply with any applicable laws. We delete Personal Information within a reasonable period after we no longer need the information for the purposes set out in this Notice.

What are your legal rights and choices about your personal information?

If you ever wish to access, update, change, delete, opt-out of us sharing, or otherwise control your Personal Information, you may do so by contacting us using one of the methods in the “How can you contact us?” section. To help us process your request, please provide sufficient information to allow us to identify you in our records. We reserve the right to ask for additional information verifying your identity prior to disclosing any Personal Information to you. Should we ask for verification, we will only ask to confirm Personal Information that we already have about you and the information you provide will be used only for verification purposes. We will make commercially reasonable efforts to respond to opt-out requests and handle requests to access, update, change, or delete Personal Information without unreasonable delay.

Marketing messages. We ensure that we obtain consent in advance in those jurisdictions that require it for marketing communications. If you want to opt-out of marketing communications, you can:

Emails: use the “unsubscribe” option at the bottom of the message
Text messages: reply “STOP” to the message
All communications: contact us using one of the methods in the “How can you contact us?” section

Please be aware that although you may opt-out of marketing communications, we may still need to send you operational or administrative messages. Also, we can only opt you out of marketing communications from the email address or text number that you provide to us, as a search for your name be relate to another individual with the same name.

Targeted Advertising. We use your Personal Information to tailor our marketing and advertising efforts. In using this information, we utilize our cookies banner to provide you with options and we respect the choices that you make. Where you allow us, we provide your information to third party advertising networks (such as Google DoubleClick) and social media companies (such as Facebook

Opting Out of the Sale of your Personal Information. Sometimes we share your data with sponsors, vendors, other MARI companies, and third-party advertising networks. These transfers, which are used to provide you with certain Services and/or to more effectively provide you with personalized Services (including advertising), can be deemed a sale under some data privacy laws.

Depending on your jurisdiction, you may have the right to opt out of the sale of your personal information by clicking on the “Your Privacy Choices” link available here and at the bottom of our Site. You may also email dataprivacy@marigrp.com.

You will be asked to provide certain information to us in order to exercise this option so we can verify your identity and locate your records with us.

EU, UK, and Switzerland residents and those residing in other countries with a GDPR-similar law: You have the right to:

Access your Personal Information (to request a copy);
Ask that we correct any mistakes in your Personal Information;
Request that we delete your Personal Information;
Object to or restrict the processing of your Personal Information partially or completely, including to any automated individual decision-making or profiling; and
Obtain the Personal Information that you provided to us in a structured, commonly used, and machine-readable format.

To exercise your rights, please use one of the methods mention in the “How can you contact us?” section. Please be aware that your rights (including those enumerated elsewhere in this Notice) may be limited by other applicable legal rights and obligations. You also have the right to lodge a complaint with your national regulatory authority (also known as a supervisory authority).

UK residents: If you have a complaint about how we have handled your personal data, you may submit a complaint using the contact methods listed below in the “How can you contact us?” section. We will endeavor to acknowledge receipt within 30 days, may request additional information to verify your identity or clarify the scope of your complaint, and will keep you updated on the investigation and its outcome without undue delay. If you are not satisfied with the outcome, you have the right to complain to the Information Commissioner's Office (ICO), which can be contacted at https://ico.org.uk/.

EU residents: You also have the right to lodge a complaint with your national or state data protection authority (supervisory authority). You can find contact information for the EU data protection authorities at https://www.edpb.europa.eu/about-edpb/our-members_en.

US residents: If you are a resident of certain states in the United States, you have the following rights:

Right to know about the Personal Information we have collected about you and how it is used and shared;
Right to delete Personal Information collected from you (with some exceptions);
Right to opt-out of the sale or sharing of your Personal Information;
Right to not be discriminated against for exercising your privacy rights;
Right to correct inaccurate Personal Information if we have incorrect Personal Information about you; and
The right to limit the use and disclosure of sensitive Personal Information collected, however, this right does not apply as we do not collect sensitive Personal Information.

California residents: California’s “Shine the Light” law permits California residents to request certain information regarding our disclosure of Personal Information to third parties for their direct marketing purposes. To make such a request, please use one of the methods mention in the “How can you contact us?” section.

How do we use cookies or other tracking technologies?

A cookie is a small data file that is transferred to an internet browser, which enables the Site to remember and customize your subsequent visits. Additionally, we may use web beacons (also called tracking pixels), which are single-pixel, electronic images embedded in the Site that allow us to gather information about your browsing activities on the Site. We use cookies and web beacons to enhance your browsing experience, serve personalized content, and analyze our traffic. You can choose which types of cookies to allow by selecting “Manage Preferences” in the banner on our Site.

Global Privacy Controls. We recognize user-initiated opt-out preference signals sent by your web browser, such as the global privacy control (“GPC”), as a valid request to opt-out of the sale and sharing of personal information processed on this website (i.e., through cookies and tracking technologies). For more information about GPC and how to implement it on your browser, please visit globalprivacycontrols.org.

Do Not Track. Please note that certain web browsers may also transmit “do-not-track” signals to the websites with which the user communicates. Because there currently is no industry standard concerning what, if anything, websites should do when they receive such signals, we do not alter our practices when the website receives a “do-not-track” signal from a visitor’s browser.

What should you know about third party links?

Our Services, newsletters, email updates and other communications may contain links to other websites or applications (“Linked Sites”), including our partner networks, retail partners, advertisers and affiliates. These Linked Sites are not owned or controlled by us. We do not control the collection or use of any information, including Personal Information, which occurs while you visit Linked Sites. If you follow a link to any of these websites, please note that the Linked Sites likely have their own privacy notices and that we do not accept any responsibility or liability for these notices. Therefore, we make no representations or warranties for —and will not in any way be liable for—any content, products, services, software, or other materials available on Linked Sites.

You may be able to use social sharing features and other integrated tools on the Site such as the Facebook "Like" button. These features and tools may permit you to share actions you take on our Services with other media, and vice versa. Your use of such features enables the sharing of information with your friends or the public, depending on the settings you establish with the service that provides the social sharing feature. Please remember that use of the information you share on social media sites will be governed by the privacy notices of the social media provider, and we are not responsible for how they treat the information.

How will we keep this notice up to date?

We reserve the right to update this Notice from time-to-time in our sole discretion. If our privacy practices change materially in the future, we will post an updated version of this Notice to the Site. It is your responsibility to review this Notice for any changes each time you use the Site. We will not lessen your rights under this Notice without your explicit consent. If you do not agree with the changes made, we will honor any opt-out requests made after the effective date of a new privacy notice.

What is the effective date of this notice?

This Notice was last modified as of the effective date printed above. This version of the privacy policy replaces and supersedes any prior privacy policies applicable to the Site.

How can you contact us?

You can exercise your data privacy (data protection) rights (make a “Request”), ask a question about this Notice, inquire about our privacy compliance program, or ask any other question about your Personal Information by:

Using our webform; or
Emailing dataprivacy@marigrp.com and reference that your communication pertains to the Escape from Alcatraz Triathlon.
To unsubscribe from our newsletter or any marketing messages, you can use the unsubscribe feature at the bottom of the email or type “Stop” in response to a text message.

Only you, or someone legally authorized to act on your behalf, may make a Request related to your Personal Information. Making a Request does not require you to have or create an account with us. Some states impose a limit on the number of Requests you can make in a year.

Your Request must:

Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information (or that person’s authorized representative); and
Describe what you are seeking with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your Request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. We will only use Personal Information provided in a Request to verify the requestor’s identity or authority to make the request and to process the Request.

We will acknowledge receipt of a Request within ten (10) days. We endeavor to respond to Requests within thirty (30) days of receipt. If we require more time (up to ninety (90) days), we will inform you of the reason and extension period in writing. If we cannot comply with a Request in whole or in part, we will explain the reason. If we do not grant your request, you have the right to appeal to us directly, using any of the contact methods (other than the unsubscribe options). In your appeal, you must state the reason for your appeal and what you are seeking. If you appeal, we will provide a written reply within 60 days of receipt of your appeal.

We do not charge a fee to process or respond to a Request, unless it is excessive, repetitive, or unreasonable. If we determine that the Request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your Request.

We may retain certain information for recordkeeping or to complete transactions initiated before your request.