Nofa Running Race
Privacy Policy
Effective date [September 24, 2026]
1. Introduction
This Privacy Policy explains how Zawiya 180 Company ("we", "us", "our"), the operator of the Nofa Running Race website at https://nofarace.com/ (the "Website"), collects, uses, discloses, stores, and protects personal data. It is issued in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia, promulgated by Royal Decree No. (M/19) dated 9/2/1443H and its amendments, together with its Implementing Regulations (collectively, the "PDPL").
By using the Website, registering an account, or submitting an order, you acknowledge that you have read and understood this Privacy Policy.
2. Data Controller and Contact Details
- Controller:
- Zawiya 180 Company, Kingdom of Saudi Arabia
- Privacy contact:
- social@z180.com
All privacy inquiries and data subject requests should be sent to the email address above.
3. Personal Data We Collect
3.1 Information you provide to us
- Identity and contact data: name, email address, telephone number, and address.
- Account data: login credentials and account details, collected only if you choose to register an account.
- Order and registration data: information relating to your registration for races, events, or purchases made through the Website.
3.2 Payment data
Payments are processed by a third-party payment gateway. We do not collect or store your full payment card details. Payment information you enter is handled directly by the payment gateway under its own terms and privacy policy.
3.3 Information collected automatically
When you use the Website, we and our service providers may automatically collect technical and usage data through cookies and similar technologies, including IP address, device and browser type, pages viewed, referring pages, and interactions with the Website.
3.4 Data we do not collect
We do not knowingly collect sensitive personal data (such as health data, government ID numbers, or biometric data), precise location data, or user-generated content through the Website.
4. Purposes and Legal Basis for Processing
We process personal data for the following purposes:
| Purpose | Basis |
|---|---|
| Fulfilling orders and registrations, and managing your account | Performance of a contract / your request |
| Providing customer support and responding to your requests | Legitimate interest and performance of a contract |
| Sending marketing emails about our events and services | Your consent (you may withdraw it at any time) |
| Analyzing and improving the Website and our services | Your consent and our legitimate interest |
| Complying with legal and regulatory obligations | Legal obligation |
Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of prior processing.
6. Disclosure of Personal Data
We do not sell your personal data. We share personal data only as follows:
- Payment gateway provider: to process payments for your orders.
- Analytics and measurement providers: Google (Google Analytics) and Meta (Meta Pixel), to provide analytics and measurement services.
- Infrastructure providers: Amazon Web Services (AWS), which hosts the Website and our data.
- Authorities: where required by law, regulation, court order, or a competent governmental authority.
We require our service providers to process personal data only for the purposes for which it is disclosed and to protect it appropriately.
7. Cross-Border Transfers
Our servers are hosted by Amazon Web Services in Frankfurt, Germany, and some of our service providers (such as Google and Meta) may process data outside the Kingdom of Saudi Arabia. Accordingly, your personal data may be transferred to and stored outside the Kingdom.
Where we transfer personal data outside the Kingdom, we do so in accordance with the PDPL and its regulations governing transfers of personal data, and we take reasonable steps to ensure that appropriate safeguards are in place to protect your data.
8. Data Retention
We retain your personal data until you delete your account, after which we will delete or anonymize it within a reasonable period. We may retain certain data for longer where necessary to comply with legal, accounting, or regulatory obligations, or to establish, exercise, or defend legal claims. Data collected without an account (for example, records of a completed order) is retained only for as long as necessary for the purposes described in this Policy or as required by law.
9. Data Security
We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or disclosure, including:
- HTTPS encryption for data in transit;
- encrypted storage of data;
- access controls limiting access to personal data to authorized personnel.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. In the event of a personal data breach that is required to be notified under the PDPL, we will notify the competent authority and affected individuals as required.
10. Your Rights
Under the PDPL, and subject to its conditions and exceptions, you have the right to:
- be informed of the legal basis and purposes for collecting your personal data;
- access your personal data and obtain a copy of it;
- request correction or completion of inaccurate or incomplete data;
- request destruction of your personal data where it is no longer needed for the purposes for which it was collected;
- withdraw your consent to processing at any time.
To exercise any of these rights, email us at social@z180.com. We may need to verify your identity before responding, and we will respond within the period required by applicable law.
If you believe your rights have been infringed, you may also contact the Saudi Data and Artificial Intelligence Authority (SDAIA), the competent supervisory authority.
11. Children
The Website is available to users of all ages. The processing of personal data of children and persons lacking full legal capacity is carried out with the consent of their parent or legal guardian. Registration, account creation, and purchases on behalf of a minor must be made by, or with the consent of, a parent or legal guardian. If you believe we have collected a minor's personal data without appropriate consent, please contact us at social@z180.com and we will take appropriate steps to delete it.
12. Automated Decision-Making
We do not use automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.
13. Third-Party Websites
The Website may contain links to third-party websites, including our payment gateway. We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy policies.
14. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify registered users by email, and the "Effective Date" above will be updated. Your continued use of the Website after changes take effect constitutes acceptance of the updated Policy, where permitted by law.
15. Contact Us
For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact:
Zawiya 180 Company
Email: social@z180.com
Website: https://nofarace.com/