1. Who is responsible for your data

The responsible party (data controller) for your information is XPLR South Africa (Pty) Ltd, registration number 2026/309433/07. For any privacy request, including access, correction or deletion, contact us at [email protected].

2. What we collect and why

We collect only what we need to run a safe, self-supported adventure rally and to fulfil your entry:

• Identity & contact details (full name, surname, ID or passport number, age, province/town, cell number, email) — to register you, verify eligibility (riders and pillions must be 18+), communicate with you and account for every rider.
• If someone books on your behalf: the person who books and pays for a room gives us the name and email of each rider or pillion they invite, so we can email each of you a private link. You then provide your own details and sign your own indemnity directly to us at that step. The booker does not complete it for you, and your medical information is given by you, not by them.
• Emergency contact details — so we can reach someone on your behalf in an emergency.
• Medical information (medical aid details, allergies, conditions, medication, optional blood type) — special personal information collected so ride leaders and medics can respond appropriately if you are injured or unwell.
• Motorcycle details (make, model, registration) — for rider identification and safety.
• Meal selections and consents (brunch and lunch choices, terms acceptance, optional future-events opt-in) — to cater your included meals and record your agreements.
• Future-events marketing (optional) — if, and only if, you tick the optional box, we keep your name and email to let you know about future XPLR rides and events. This is separate from your rally entry; leaving it unticked has no effect on your registration, and you can unsubscribe at any time.
• Payment information — card payments are handled by our payment processor, Yoco. We do not receive or store your full card details; we keep only a payment reference and status.

3. Lawful basis for processing

We process your information on the basis of (a) performance of the event contract you enter into when you buy a ticket, and (b) your explicit consent — in particular for special personal information (your medical details), for media use, and for optional future-events marketing, all of which you provide during registration. You may withdraw any consent at any time (see section 7); withdrawing marketing consent simply stops those emails, while withdrawing consent to process your medical details may affect our ability to let you participate safely.

4. Who we share it with

We do not sell your information. We share it only as needed to run the event:

• Ride leaders — your emergency contact and medical information, used only for your safety during the event. In a medical emergency it may also be given to attending emergency or medical personnel.
• Rooiberg Lodge and associated accommodation providers — the details needed to allocate your room.
• Service providers (operators) who process data on our behalf: Yoco (payments), Resend (transactional email), Railway (application and database hosting) and Google Analytics (anonymous website-usage statistics).

Some of these operators store or process data outside South Africa. Our application and database are hosted by Railway in the European Union (Amsterdam, Netherlands), and Google Analytics processes website-usage data on Google’s infrastructure, which includes the United States. These trans-border transfers are permitted under POPIA because the receiving countries and providers are subject to data-protection laws or binding contractual terms that offer protection comparable to POPIA. Google Analytics measures only how the site is used (such as pages visited and device type); it does not receive the details you enter into the registration form, such as your ID number or medical information.

5. How long we keep it

We keep your information only as long as we actually need it. Your medical information and ID or passport number are deleted within 30 days after the event ends, once they are no longer needed for your safety on the ride. This deletion also covers your emergency contact, cell number and other event-only details. Afterwards we keep only a basic record — your name, email, the amount paid, the payment reference, and confirmation that you accepted the terms and signed your indemnity — for as long as tax, accounting and the handling of any legal claim require. That record does not include your medical details or ID number.

If you opted in to hear about future events, we keep only your name and email for that purpose, and only until you unsubscribe or ask us to stop. This marketing opt-in is not affected by the deletion of your event and medical records above.

6. How we protect it

Your information is transmitted over encrypted connections (TLS) and stored in a database with access restricted to the organising team. Card payments are processed by Yoco; we never see your full card number. Medical and ID information is treated as confidential, is not displayed publicly, and is shared only with the people described above.

7. Your rights

Under POPIA you have the right to:

• access the personal information we hold about you;
• request correction of inaccurate information;
• request deletion of your information, subject to our legal obligations;
• object to processing or withdraw your consent;
• lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za.

To exercise any of these rights, contact us at [email protected].