POPIA Compliant - Protection of Personal Information Act 4 of 2013
This Privacy Policy has been prepared in compliance with the Protection of Personal Information Act 4 of 2013 (POPIA), South Africa's primary data protection legislation.
As a registered South African company, Couch Potato Run Club (Pty) Ltd is subject to POPIA in all its data processing activities. Our designated Information Officers are Calvin Hammond and Danielle Lubbe, reachable at hello@couchpotatorunclub.co.za.
"I highly recommend joining. It certainly helped me to achieve my goal of being able to run 5km with no walking- and this at 64 years old!"
5000+
Runners Supported Since May 2024
20+
Active Locations in South Africa
8 WEEKS
from the Couch to your first 5km
AS HEARD ON
Cape Talk 567am, KFM, Voice of the Cape, and Women's Health Mag
Sonja Briggs | Stellenbosch | Programme Grad 2025
COUCH POTATO RUN CLUB (PTY) LTD · REG. 2022/825572/07
privacy policy
Version: 3.0 | Effective Date: 15 April 2026 | Last Updated: 15 April 2026 | Applies To: All Couch Potato Run Club Programmes, South Africa
We take your privacy seriously. This policy explains exactly what personal information we collect, why we collect it, how we use it, who we share it with, and what rights you have over it. We will never sell your data. Ever.
SECTION 01
WHO WE ARE
Couch Potato Run Club (Pty) Ltd (Registration Number 2022/825572/07), trading as "Couch Potato Run Club" or "CPRC", is a South African company that operates beginner running programmes, events, and a running community across South Africa.
For the purposes of POPIA, CPRC is the Responsible Party - meaning we determine the purpose and means of processing your personal information. Our designated Information Officers are Calvin Hammond and Danielle Lubbe.
Our principal contact details are set out in Section 20 of this policy.
SECTION 02
Scope of This Policy
This Privacy Policy applies to all personal information that CPRC collects, receives, stores, uses, or shares in connection with:
2.1 Our website at couchpotatorunclub.co.za and any related subdomains or pages;
2.2 Registration for and participation in any CPRC programme, event, or session;
2.3 Communications with CPRC via email, WhatsApp, telephone, contact forms, or any other channel;
2.4 Our social media pages and accounts, including Instagram and Facebook;
2.5 Our booking and ticketing platform (currently operated via Wix Events);
2.6 Any WhatsApp groups operated by CPRC or its coaches.
This policy does not apply to third-party websites or platforms that we may link to. When you leave our website or use a third-party platform such as Wix, Yoco or WhatsApp, you are subject to that platform's own privacy policy.
SECTION 03
What Information We Collect
We only collect personal information that is necessary, relevant, and adequate for the purposes described in this policy. The categories of information we may collect include:
Identity information (such as your name) collected at programme registration
Contact information (such as email address & mobile number) collected at registration or when contacting us
Location information (such as city, area, suburb) collected at registration, where relevant to programme placement
Health & medical information (such as pre-existing conditions, injuries, pregnancy, medication disclosed voluntarily) collected when voluntarily disclosed before or during a programme
Payment information ( such as transaction confirmation, ticket reference) collected via the Booking Platform - card details are not stored by CPRC
Communications (Emails, WhatsApp messages, contact form submissions, feedback) collected when you contact us or communicate in a CPRC group
Images & recordings (such as photographs and video footage from sessions and events) collected at CPRC sessions and events where photography takes place
Usage & technical data (such as IP address, browser type, pages visited, time on page) collected automatically via our website (see Section 11 — Cookies)
Marketing preferences (such as Opt-in/opt-out status for marketing communications) collected at registration or when you update your preferences
SPECIAL (SENSITIVE) PERSONAL INFORMATION
Health and medical information is classified as special personal information under POPIA and is subject to a higher level of protection. CPRC collects this information only where you voluntarily disclose it for your own safety and the safety of others during a programme. We will never request this information unnecessarily and will store it with appropriate security measures.
SECTION 04
How We Collect Your Information
We collect your personal information through the following means
4.1 Directly from you - when you register for a programme, complete a contact form, send us an email or WhatsApp message, respond to a survey, or communicate with a CPRC coach or team member.
4.2 Through our Booking Platform - when you purchase a ticket for a programme via Wix Events. The Booking Platform collects payment and registration details on our behalf and is subject to its own privacy policy
4.3 Automatically via our website - our website uses cookies and similar tracking technologies to collect certain technical and usage data. See Section 11 for details.
4.4 Through social media - if you interact with our social media pages (Instagram, Facebook) or send us a message via those platforms, we may receive information you have made publicly available or that you send to us directly.
4.5 From third parties - in limited circumstances we may receive information about you from other sources, such as where a friend registers on your behalf or refers you to a programme. We will treat such information in accordance with this policy.
SECTION 05
Why We Use Your Information
We use your personal information only for the purposes for which it was collected, or for compatible purposes that you would reasonably expect. These purposes are:
Programme administration (Processing your registration, verifying attendance, managing your participation in a CPRC programme) | Legal Basis: Performance of contract
Session communications (Sending session reminders, programme plans, missed session plans, and WhatsApp group communications) | Legal Basis: Performance of contract
Coach support (Sharing relevant information with your assigned CPRC coach to facilitate your programme) | Legal Basis: Performance of contract
Payment processing (Processing and recording your payment via the Booking Platform) | Legal Basis: Performance of contract
Health & safety (Using health information you disclose to ensure your safety and the safety of others during sessions) | Legal Basis: Legitimate interest / consent
Emergency contact (Contacting you or your emergency contact in the event of injury or health emergency during a session) | Legal Basis: Vital interest / legitimate interest
Marketing (Sending you information about future CPRC programmes, events, and news) | Legal Basis: Consent (opt-out available)
Improvement & analysis (Understanding how our website and programmes are used in order to improve them) | Legal Basis: Legitimate interest
Legal compliance (Complying with applicable South African law, including record-keeping obligations) | Legal Basis: Legal obligation
Photography & marketing media (Using photographs and video recordings of sessions for marketing and promotional purposes) Legal Basis: Consent (opt-out available)
SECTION 06
Legal Basis for Processing
Under POPIA, we are required to have a lawful basis (called a "ground for processing") for each use of your personal information. We rely on the following grounds:
6.1 Performance of a contract. where processing is necessary to register you for a programme, fulfil our obligations to you as a participant, or administer your participation. This is the primary ground we rely on for core programme operations.
6.2 Consent. where you have actively agreed to a specific use, such as receiving marketing communications or being photographed at sessions. Where we rely on consent, you have the right to withdraw it at any time without affecting the lawfulness of prior processing.
6.3 Legitimate interest. where processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights and interests. We rely on this ground for analytics, website improvement, and certain safety-related communications. We have assessed that our legitimate interests do not unduly interfere with your rights.
6.4 Legal obligation. where processing is required to comply with a law applicable to CPRC, such as tax or company law record-keeping requirements.
6.5 Vital interest. in emergency situations where processing is necessary to protect your life or health, or the life or health of another person.
SECTION 07
Who We Share Your Information With
Our commitment
We will never sell, rent, or trade your personal information to any third party for their own commercial or marketing purposes. Full stop. Your data is used to run your programme and nothing else.
We may share your information with the following categories of recipients, strictly for the purposes described in this policy:
7.1 CPRC Coaches - your name, contact number, and any relevant health information you have disclosed will be shared with your assigned CPRC coach for the purposes of programme delivery and participant safety. Coaches are contractually required to keep this information confidential and use it only for programme purposes.
7.2 Booking Platform - your registration and payment data is processed through Wix Events and is subject to Wix's Privacy Policy, available at wix.com/about/privacy. CPRC does not store your payment card details.
7.3 Communication Platforms - Where you join a CPRC WhatsApp group, your name and phone number will be visible to other members of that group. WhatsApp's privacy policy governs the processing of data within the WhatsApp platform itself. Please be aware that WhatsApp groups are not entirely private - be mindful of what personal information you share in group chats
7.4 Social Media Platforms - where photographs or videos featuring you are shared on CPRC's social media accounts (Instagram, Facebook), those platforms will process your image data in accordance with their own privacy policies. You may request removal of any photograph or video in which you appear by contacting us at the details in Section 20.
7.5 Professional advisers - our legal, accounting, and tax advisers may have access to your information on a strictly confidential basis where necessary for their professional services.
7.6 Regulatory authorities and law enforcement - we may disclose your information where required to do so by law, court order, or lawful request by a regulatory authority or law enforcement body.
7.7. Emergency services - in the event of a medical emergency at a CPRC session, we may disclose relevant information (including health information you have provided) to emergency medical services or healthcare providers for the purpose of protecting your life or health.
SECTION 08
Cross-Border Data Transfers
8.1 Some of the third-party platforms we use - including Wix (website and booking), WhatsApp (Meta Platforms), and social media platforms - may process or store your personal information on servers located outside the Republic of South Africa.
8.2 Under POPIA section 72, personal information may only be transferred across borders if the recipient country or organisation provides an adequate level of protection, or if you have consented to the transfer, or if the transfer is necessary for the performance of a contract with you.
8.3 Where we transfer your data outside South Africa, we take reasonable steps to ensure that such transfers are lawful and that your information is adequately protected. By registering for a CPRC programme and using our services, you acknowledge and consent to such transfers where they are necessary to provide our services to you.
8.4 CPRC itself stores operational records (programme registers, coach notes, contact details) within South Africa.
SECTION 09
How Long We Keep Your Information
We retain personal information only for as long as is necessary for the purpose for which it was collected, or as required by South African law. The following retention periods apply:
Programme registration records (name, contact, attendance) | Retention Period: 3 years after programme end | Reason: Legal and liability record-keeping; potential dispute resolution
Payment and transaction records | Retention Period: 5 years | Reason: South African tax and accounting obligations (Income Tax Act)
Health and medical disclosures | Retention Period: 3 years after programme end, then securely deleted | Reason: Safety records; potential liability claims
Email and contact form communications | Retention Period: 2 years after programme end | Reason: Correspondence records; potential dispute resolution
Marketing contact lists | Retention Period: Until you opt out, or 3 years of inactivity | Reason: Ongoing consent-based communications
Photographs and video | Retention Period: Indefinitely (unless removal is requested) | Reason: Marketing and community archive
Website usage data (cookies, analytics) | Retention Period: Up to 26 months (Google Analytics standard) | Reason: Website performance and improvement
When personal information is no longer required, we will securely delete or anonymise it. In some cases, anonymised data (where you can no longer be identified) may be retained indefinitely for statistical and research purposes.
SECTION 10
How We Protect Your Information
CPRC takes the security of your personal information seriously. We implement reasonable technical and organisational measures to protect your information against unauthorised access, loss, misuse, alteration, or destruction, including:
10.1 Access controls - personal information held by CPRC is accessible only to those coaches, staff, and representatives who need it to perform their role.
10.2 Confidentiality obligations - all CPRC coaches and team members are required to treat participant information as confidential and to handle it in accordance with this policy.
10.3 Secure platforms - we use reputable third-party platforms (Wix, WhatsApp, Google, Yoco) that apply their own security standards to data stored on their systems.
10.4 Device security - team members handling participant data are required to secure their devices with passwords or PINs and to not share access with unauthorised persons.
Important Limitation:
No method of electronic transmission or storage is 100% secure. While we take reasonable steps to protect your information, we cannot guarantee absolute security. If you have reason to believe that your interaction with us is no longer secure, please notify us immediately at hello@couchpotatorunclub.co.za.
SECTION 11
Cookies and Website Tracking
Our website at couchpotatorunclub.co.za uses cookies and similar tracking technologies. A cookie is a small file placed on your device when you visit a website. Cookies help websites remember your preferences and understand how visitors use the site.
Cookie Type: Essential | Duration: Session | Purpose: Required for the website to function. Cannot be disabled. Includes session management and security cookies set by Wix.
Cookie Type: Analytics | Duration: Up to 26 months | Purpose: Collect anonymous data about how visitors use our site (pages viewed, time on site, referral source). Used to improve the website experience. May be set by Google Analytics or Wix Analytics.
Cookie Type: Functional | Duration: Persistent | Purpose: Remember your preferences, such as language settings or previously viewed content. Improve your user experience.
Cookie Type: Marketing | Duration: Up to 90 days | Purpose: May be set by Meta (Facebook/Instagram) Pixel if installed, to measure the effectiveness of our advertising and to enable retargeting. Only active if you have given consent via our cookie banner.
11.1 Managing cookies - most browsers allow you to control and delete cookies through your browser settings. You can also use our cookie consent tool (if present on the site) to manage your preferences. Please note that disabling certain cookies may affect the functionality of our website.
11.2 Third-party cookies - our website is built on the Wix platform. Wix may set additional cookies in connection with its services. CPRC has no control over third-party cookies and you should refer to the relevant third party's privacy policy for more information.
11.3 By continuing to use our website after being notified of our use of cookies, you consent to our use of cookies as described in this section.
SECTION 12
Photography and Video
PHOTO & VIDEO CONSENT
CPRC coaches and authorised representatives may photograph and video-record sessions and events for use in marketing, social media, press, and other promotional materials. Your image is personal information under POPIA.
12.1 Consent to Photography and Recording. By participating in a CPRC programme or session, you provide your consent to being photographed or recorded in this context. This consent is given at the time of Registration and by attending sessions.
12.2 Opt-Out. If you do not wish to be photographed or recorded, you must notify your Coach in writing (including via WhatsApp) before your first Session. CPRC will make reasonable efforts to exclude you from photographs and recordings, but cannot guarantee your complete exclusion from all media captured in a group setting.
12.3 Removal requests. if you wish to have a specific photograph or video removed from CPRC's platforms and channels, please contact us at hello@couchpotatorunclub.co.za with a description or link to the relevant content. We will process your request within a reasonable time, subject to any overriding legitimate interests (such as record-keeping or existing published articles).
12.4 CPRC will not knowingly use photographs or videos of participants in a manner that is unflattering, defamatory, or harmful to their reputation.
12.5 Photographs and videos shared on third-party social media platforms (Instagram, Facebook) are subject to those platforms' terms and privacy policies once published. CPRC cannot control how those platforms process or display the content once it has been shared.
SECTION 13
Children's Privacy
CPRC is committed to protecting your Personal Information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and all other applicable data protection legislation.
13.1 POPIA provides enhanced protection for the personal information of children (persons under 18 years of age). CPRC does not knowingly collect personal information directly from children without the prior written consent of a parent or legal guardian.
13.2 Where a child participates in a CPRC programme, the parent or guardian's consent is required before the first session. By providing such consent, the parent or guardian agrees that the child's personal information (including name, attendance records, and any health information disclosed) may be processed in accordance with this policy.
13.3 Special care is taken with photographs and video recordings of minor participants. We will not knowingly publish identifiable photographs of children without explicit parental or guardian consent. If you believe we have inadvertently published an image of a child without appropriate consent, please contact us immediately at hello@couchpotatorunclub.co.za and we will remove it without delay.
13.4 Parents and guardians may exercise the rights set out in Section 15 on behalf of their child at any time.
SECTION 14
WhatsApp and Messaging
14.1 CPRC uses WhatsApp as its primary communications tool for programme administration. By registering for a programme you consent to being added to the relevant CPRC WhatsApp group and to receiving programme-related communications via WhatsApp.
14.2 Visibility in groups - when you are added to a CPRC WhatsApp group, your name and profile picture (as set in your WhatsApp account) will be visible to all other members of that group. Your phone number may also be visible. CPRC has no control over this - it is a feature of WhatsApp's platform.
14.3 WhatsApp's own privacy policy the processing of data within the WhatsApp platform itself (including message encryption, metadata, and backup) is governed by WhatsApp's Privacy Policy (Meta Platforms Ireland Ltd). CPRC is not responsible for WhatsApp's data processing practices.
14.4 Leaving a group - you may leave a CPRC WhatsApp group at any time. Note that messages you have already sent within the group will remain visible to other group members and cannot be fully recalled by CPRC.
14.5 Direct messages - messages you send directly to a CPRC coach or team member via WhatsApp are treated as confidential and will not be shared outside CPRC without your consent, except where required by law or in an emergency.
SECTION 15
Your Rights
Under POPIA, you have the following rights in respect of your personal information held by CPRC. You may exercise any of these rights by contacting us at the details in Section 20. We will respond to all requests within 30 days.
RIGHT OF ACCESS
You have the right to request a copy of the personal information CPRC holds about you. We will provide this free of charge in most circumstances. We may ask you to verify your identity before processing your request.
RIGHT TO CORRECTION
If any personal information we hold about you is inaccurate, incomplete, or out of date, you have the right to request that we correct it. Please notify us as soon as possible if your contact details or health information changes.
RIGHT TO DELETION
You may request that we delete your personal information where it is no longer necessary for the purpose for which it was collected, or where you withdraw consent and there is no other legal basis for processing. Note that some information must be retained to comply with legal obligations.
RIGHT TO OBJECT
You have the right to object to the processing of your personal information where we rely on our legitimate interests as the legal basis. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests.
RIGHT TO WITHDRAW CONSENT
Where we process your information on the basis of your consent (e.g. marketing emails, photography), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
RIGHT TO COMPLAIN
If you believe CPRC has handled your personal information unlawfully or in breach of POPIA, you have the right to lodge a complaint with the Information Regulator of South Africa. See Section 19 for details.
To exercise any of these rights, please email hello@couchpotatorunclub.com with the subject line "Privacy Request - [your name]" and a description of your request. We may ask you to verify your identity before we can process the request.
SECTION 16
MARKETING COMMUNICATIONS
16.1 Where you have registered for a CPRC programme or otherwise engaged with us, we may send you information about upcoming programmes, events, news, and community activities that may be of interest to you. We rely on your implied consent as a registered participant as our legal basis for this, unless you have explicitly opted out.
16.2 Opting out - you may unsubscribe from marketing communications at any time by: clicking the "unsubscribe" link in any marketing email; replying "STOP" or "UNSUBSCRIBE" to any marketing message; or contacting us directly at hello@couchpotatorunclub.com. We will process opt-out requests within 10 business days.
16.3 Please note that opting out of marketing communications will not stop you from receiving operational and administrative communications related to a programme you are currently enrolled in. Those communications are necessary for the performance of our contract with you and will continue for the duration of your programme.
16.4 We do not share your contact information with third parties for the purpose of sending you marketing communications on their behalf.
SECTION 17
Data Breaches
17.1 In the event that we become aware of a security breach that may affect the personal information we hold, we will investigate promptly and take reasonable steps to contain and remedy the breach.
17.2 Where a breach is likely to result in a real risk of harm to affected individuals, CPRC will notify the Information Regulator of South Africa as required under POPIA section 22, as soon as reasonably possible after becoming aware of the breach.
17.3 Where the breach may cause harm to you specifically, we will also notify you directly as soon as reasonably possible, providing details of the nature of the breach, the information affected, the steps we are taking, and any recommended steps you should take to protect yourself.
17.4 If you believe your personal information has been compromised or that you have been the victim of a security breach involving CPRC data, please contact us immediately at hello@couchpotatorunclub.com
SECTION 18
Changes to This Policy
18.1 We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or the services we provide. The most current version will always be available on our website at couchpotatorunclub.co.za, and will display the date it was last updated at the top of the document.
18.2 Where changes are material - meaning they significantly affect how we use your personal information or your rights - we will notify currently enrolled programme participants via email or WhatsApp, and will give you a reasonable opportunity to review the changes before they take effect
18.3 Your continued participation in CPRC programmes or use of our website after the effective date of any changes constitutes your acceptance of the updated policy. If you do not agree with any changes, you should stop using our services and contact us to request deletion of your information.
SECTION 19
Complaints
If you have a complaint about how CPRC has handled your personal information, we ask that you first contact us directly at the details in Section 20 so that we have the opportunity to resolve the matter. We take all privacy complaints seriously and will investigate and respond within 30 days.
If you are not satisfied with our response, or if you wish to escalate your complaint, you have the right to lodge a complaint with the Information Regulator of South Africa, which is the body responsible for enforcing POPIA:
Information Regulator of South Africa
WEBSITE: inforegulator.org.za
EMAIL: PAIAComplaints@inforegulator.org.za / POPIAComplaints@inforegulator.org.za
ADDRESS: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
TEL: 010 023 5207
SECTION 20
CONTACT US
For all privacy-related queries, requests, or complaints - including requests to access, correct, or delete your personal information - please contact our Information Officers using the details below:
TRADING NAME: Couch Potato Run Club
LEGAL ENTITY: Couch Potato Run Club (Pty) Ltd, Reg. 2022/825572/07
POPIA RESPONSIBLE PARTY: Calvin Hammond / Danielle Lubbe, Couch Potato Run Club
WEBSITE: couchpotatorunclub.co.za
EMAIL: hello@couchpotatorunclub.com
Please include "Privacy Request" or "Privacy Complaint" in the subject line of your email, along with your full name, so we can handle your request efficiently. We will acknowledge receipt within 3 business days and aim to resolve all requests within 30 days.