Last updated: 26 September 2026
Who we are
Gravel Burn South Africa (Pty) Ltd (registration number 2024/397351/07), trading as Nedbank Gravel Burn (“we”, “us”, “our”), organises the Nedbank Gravel Burn gravel stage race and its associated events. We are the responsible party for the personal information described in this policy, as defined in South Africa’s Protection of Personal Information Act 4 of 2013 (POPIA).
- Address: Nedbank Gravel Burn HQ, WeWork, 80 Strand Street, Cape Town 8001, South Africa
- Email: info@gravel-burn.com
- Phone: +27 21 200 0447
Our Information Officer
Our Information Officer is Brett Walker. You can contact him at brett@gravel-burn.com about anything in this policy.
What this policy covers
This policy explains how we collect, use, share and protect personal information when you:
- visit our website, www.gravel-burn.com
- contact us by email, WhatsApp, live chat or our contact form
- sign up for our newsletter
- enter the race, book Optional Extras, or take part in race week and associated events
- volunteer or apply to work with us
The personal information we collect
When you visit our website: the pages you visit, how you found us, your browser and device type, and your IP address. Some of this is collected by our live chat service and, only if you agree, by analytics cookies. Our Cookie Policy explains this in detail.
When you contact us: your name, email address, country and message; your phone number and messages if you contact us on WhatsApp; and the content of live chat conversations.
When you enter the race (entries are handled through Quicket): your name, contact details, date of birth and gender (to place you in the right category), nationality, ID or passport number, emergency contact details, medical aid or travel insurance details, cycling licence details, and the other details requested on the entry form. Payments are processed by Quicket and its payment providers; we do not store your card details.
When you book Optional Extras, travel or accommodation: your booking details, and arrival, departure and flight details where we need them for shuttles and transfers.
During the race: your race number and timing results, and photographs and video of riders taken by us and our media partners.
Newsletter: your name and email address.
Volunteers and job applicants: your CV and the details you send us.
We do not collect health information.
Why we use your personal information
We process personal information only for specific, lawful purposes, and only as much as we need:
- To process your entry and run the event, including registration, Burn Camp accommodation, luggage, meals and Optional Extras. This is necessary to perform our agreement with you.
- To keep you safe: race-week safety, emergency response and contacting your emergency contact.
- To time the race and publish results: your name, race number, category, nationality and times appear publicly on our website and results platforms. Published results are part of taking part in a timed race.
- To tell the story of the race: photographs and video taken during the event may be used in our media and promotion, as set out in clause 11 of our standard terms and conditions of participation.
- To communicate with registered riders: rider information emails (Karoo Posts), race-week updates and changes.
- To send newsletters and news about future events, with your consent. You can unsubscribe at any time.
- To answer your questions and provide customer service.
- To meet our legal obligations: for example tax and accounting, and anti-doping requirements under the race rules.
- To improve our website, using analytics only if you agree to analytics cookies.
Who we share it with
We do not sell your personal information, and no rider information is shared with our sponsors or partners. We share personal information only with:
- Service providers who process it on our behalf (operators under POPIA), under written agreements that require them to keep it confidential and secure:
- Quicket: entries, ticketing and payments
- Zoho: contact forms, live chat, WhatsApp messaging and customer records
- RaceBase Pro and RACE RESULT: timing and results
- Mediclinic and our race medical team, if you need medical care during race week
- accommodation, transport and logistics providers for services you book through us
- photographers and media partners
- website hosting and IT providers
- Cycling South Africa and anti-doping authorities, where the race rules require it (for example licence checks and anti-doping procedures).
- Authorities, when the law requires us to.
Sending information outside South Africa
Some of our service providers store or process information outside South Africa (for example Zoho and Cloudflare). We transfer personal information across borders only as section 72 of POPIA allows: where the recipient is bound by laws, binding corporate rules or an agreement that give it adequate protection, where it is necessary to perform our agreement with you, or with your consent.
How long we keep it
We keep personal information for five years, unless the law requires us to keep it longer. Race results are event records, which we keep for 99 years as the permanent history of the race. Newsletter details are kept until you unsubscribe.
How we protect it
We take appropriate, reasonable technical and organisational measures to protect personal information against loss, damage and unauthorised access, as section 19 of POPIA requires. These include access controls, trusted service providers and confidentiality commitments from our team. If a security compromise affects your personal information, we will notify you and the Information Regulator as section 22 of POPIA requires.
Your rights
Under POPIA you have the right to:
- ask whether we hold personal information about you, and request a copy of it
- ask us to correct or delete information that is inaccurate, out of date, excessive or unlawfully obtained
- object to our processing of your personal information, including for direct marketing at any time
- withdraw your consent where we rely on it (this does not affect processing that already happened)
- lodge a complaint with the Information Regulator
To use these rights, contact our Information Officer. We may need to confirm your identity first, and we will respond within a reasonable time.
If you are in the European Union or the United Kingdom, you have similar rights under the GDPR, and can contact us in the same way.
Direct marketing
We send marketing emails, such as newsletters and news about future events, only to people who have agreed to receive them, or to riders and customers about similar events of ours, as section 69 of POPIA allows. Every marketing message includes an easy way to unsubscribe.
Cookies
Our Cookie Policy explains the cookies on our website and your choices.
Children
Riders must be at least 19 years old on 31 December of the year of the race. We do not knowingly collect personal information about children, except with the consent of a parent or guardian where the law allows.
Other websites
Our website links to other websites, such as Quicket for entries and VIP Bicycle Logistics for bike transport. Their own privacy policies apply when you use them.
Changes to this policy
We may update this policy from time to time. The date at the top shows when it last changed. If we make significant changes, we will tell registered riders by email.
Complaints
If you are unhappy with how we have handled your personal information, please contact our Information Officer first. You also have the right to complain to the Information Regulator (South Africa): https://inforeg.org.za
Contact us
- Information Officer: Brett Walker
- Email: brett@gravel-burn.com
- Address: Nedbank Gravel Burn HQ, WeWork, 80 Strand Street, Cape Town 8001, South Africa
- Phone: +27 21 200 0447