1. Who we are
This website, btrrun.mgsstudents.com, is run by the Run for the Mind organising committee, the organiser of Run for the Mind, a community run (3K, 5K and 10K) in Mak BTR on Saturday 17 October 2026. We are the “data fiduciary” for the details described here. Contact details are on the Contact Us page.
2. What we collect
When you register
- Full name, the name to print on your bib, date of birth, mobile number, email address, T-shirt size and your chosen distance.
- Optionally: gender, how you heard about the run, and a message to us.
- An emergency contact’s name and mobile number. Please make sure they know you have given them.
- Your confirmation of the participation waiver, and the date and time you registered.
When you register a group
The contact person’s name, email and mobile number, the group name, and for each member the details listed above.
When you donate
Your name, email address, the amount, and optionally a mobile number and a message. You can choose to donate anonymously, in which case your name is not shown publicly.
When you volunteer
Your name, email address, mobile number, the roles you are interested in, your availability and any message.
When you pay
Razorpay sends us the order ID, payment ID, amount and status of each payment. We do not receive, see or store your card number, CVV, bank login, UPI PIN or similar details. Those are handled entirely by Razorpay under its own privacy policy.
Automatically
- Cloudflare, which hosts the site, keeps standard server logs (IP address, browser, pages requested) for security and to keep the site running. Its Turnstile bot check on the registration form may set a short-lived cookie and looks at browser signals to tell people from bots.
- On race day, the time you check in and collect your kit.
We do not use advertising or analytics cookies.
3. Why we use it
- To register you, take payment, and send your confirmation, receipt, payment link and QR code.
- To prepare your bib and T-shirt, check you in on race day, and issue your finisher’s certificate.
- To send reminders and essential information about the event (kit collection, flag-off time, route, changes or cancellation).
- To contact your emergency contact if something happens to you at the event.
- To keep the site safe, prevent duplicate or fraudulent registrations, and answer your questions.
- To keep the financial records the law requires.
We use your details because you asked us to register you (or to donate or volunteer) and, for safety and legal record-keeping, because we have to. We will only send you marketing about future events if you agree to it.
4. Who else handles your details
We use a small number of service providers to run the site. Each only receives what it needs:
- Supabase stores the registration, group, donation and volunteer records in a database hosted in Mumbai, India.
- Cloudflare hosts the website, runs the code that processes your form and generates emails, and provides the Turnstile bot check.
- Razorpay processes payments and sends us the payment status.
- Resend delivers our emails to you.
- Meta (WhatsApp), if WhatsApp confirmations are switched on, delivers messages to the mobile number you gave.
- Google serves the typefaces on the site (your browser requests them from Google Fonts) and, only if you press “Show map” on the home page, an embedded Google Map, which is subject to Google’s own privacy policy.
We may share details with first-aid and medical responders in an emergency, and with the police or authorities where the law requires it. We never sell or rent your details, and we do not share them with sponsors or partners for their own marketing.
5. How long we keep it
- Registration, group and volunteer details: until six months after the event, so that certificates, lost-kit queries and thank-you messages can be handled. They are then deleted or anonymised.
- Payment and donation records (name, amount, payment ID, date): for as long as Indian tax and accounting law requires, currently up to eight years.
- Emergency-contact details: deleted within one month after the event.
- Server logs: retained by Cloudflare for a short period under its own policy.
6. How we protect it
The site is served over HTTPS. The public part of the website can only add records to the database, never read them. Records are viewed only by named organisers through a password-protected admin page. Payment links and QR codes carry a signed code so they cannot be guessed. No system is perfectly secure, but we take reasonable care and will tell you if we discover a breach that affects you.
7. Your rights
You can ask us at any time to:
- tell you what details we hold about you;
- correct anything that is wrong (for example a bib name or T-shirt size);
- delete your details, which will also cancel your registration if the event has not yet happened;
- stop sending you messages that are not essential to the event.
Email the organisers from the address you registered with, and we will reply within 7 days. We cannot delete payment records that the law requires us to keep, but we can restrict them to that purpose. If you are unhappy with how we have handled a request, you can complain to the Data Protection Board of India under the Digital Personal Data Protection Act 2023.
8. Children
Participants under 18 are registered by, or with the consent of, a parent or guardian, who is responsible for the details given. We do not knowingly collect details from children for any other purpose.
9. Photographs
Photographs and video from the event may include you and may be published in our gallery and on social media, as explained in the Terms and Conditions. Ask us to remove an image and we will do so where we reasonably can.
10. Changes
We may update this policy, for example if we change a service provider. The date at the top shows the current version. Material changes will be emailed to registered participants.