Privacy Notice

This notice explains what personal data we collect when you register for POWER UP RUN 2026, where it comes from, why we use it, who can see it, how we protect it and how long we keep it. By registering you agree to it, together with our Terms & Conditions.

Last updated: 12 November 2026

Who we are

NUR Power Sdn. Bhd. organises POWER UP RUN 2026 and is responsible for your personal data under the Personal Data Protection Act 2010 (PDPA). In this notice, "we" means NUR Power Sdn. Bhd.

Personal data we collect

For each participant: full name (as on the MyKad or MyKid) and MyKad or MyKid number. We work out the date of birth, and whether the person is under 18 on race day, from that number.
For each registration: the lead participant's mobile number and email address. They are the contact for everyone in the registration.
Created by us: a registration reference, bib numbers, and records of check-in, race kit collection and lucky draw results.
Technical data from your visit to this website (see "Cookies and technical data").
Photographs and video taken at the event (see "Event photographs and video").

Where your data comes from

We collect it from the person who fills in the registration form. If someone registered you as part of a group or family, your details came from them.

If you register other people, you confirm that they agree to be registered and that you will show them this notice. For anyone under 18, you confirm that you are their parent or guardian, or that you have the parent's or guardian's permission.

If our email delivery provider tells us that a confirmation email could not be delivered or was reported as spam, we record that against the registrations made with that email address, so the organisers can see the confirmation was not delivered and contact the person who registered another way, or send it again.

Why we use it

To process your registration and send your confirmation and check-in QR codes.
To make sure each person registers only once, and to check eligibility and age (under-18s run with an adult).
To assign bib numbers.
To check you in and record race kit collection on race day.
To run the lucky draw and publish the winners.
To contact the lead participant, who is the registration's contact, about the event or in an emergency on race day.
To keep this website secure and prevent abuse.
To plan and run the event, including attendance counts.

What you must provide

All the details on the registration form are required. Without them we cannot register you: we use the MyKad or MyKid number to confirm identity and age and to make sure each person registers only once, and the email address to send your confirmation and check-in QR codes.

Lucky draw winners

Lucky draw winners' names and bib numbers are published, with the prize won, on the Lucky Draw page from the start of the race, as each prize is drawn.

Adults are shown by full name. Under-18s are shown only by their first name and an initial (for example, "Adam K."). The list stays on this website until we delete the event data. Taking part in the lucky draw means agreeing to this; see the lucky draw clause in the Terms & Conditions.

Event photographs and video

We and our photographers take photographs and video at the event and may use them on our social media, website and publicity. See Photography and media in the Terms & Conditions. People in them, children included, can be identified, so they are personal data.

If you prefer not to be featured, tell a crew member at the event. Afterwards, contact us and we will remove a photograph of you from our own channels where we can. We cannot recall copies that others have already shared. Photographs you post yourself with #PowerUpRun2026 are public under that platform's terms.

Children

Under-18s can take part only when registered by, or with the permission of, a parent or guardian, and must run with an adult. A parent or guardian can make any request in this notice on the child's behalf. If an under-18 wins a lucky draw prize, we publish only a first name and an initial (see "Lucky draw winners").

Transfers outside Malaysia

Some of our service providers may process data outside Malaysia. In particular, our email delivery provider may handle your confirmation email, which carries the lead participant's email address, the names in the group, the QR codes and a link to your registration, outside Malaysia. Photographs we post on social media are stored by those platforms around the world. We send abroad only what the service needs.

How we protect your data

The website uses HTTPS only.
MyKad or MyKid numbers, email addresses and mobile numbers are stored encrypted and are filtered out of our application logs. Our web server's own request logs record the addresses of the pages visited, which can include search terms that organisers type, and are overwritten automatically.
Organiser accounts are personal and password protected. Organiser screens show MyKad and MyKid numbers only partly.
Only site administrators can see full contact details or download the participant list, and every such view or download is logged.
Your confirmation email contains a private link to your registration and your check-in QR codes. Anyone with the link or a code can see the names, bib numbers, adult or child labels, registration reference and partly hidden email address on it, so share them only with people in your group.

If a data breach affects your personal data, we will notify the Personal Data Protection Commissioner and, where it is likely to cause you significant harm, tell you directly, as the law requires.

How long we keep it

We delete your personal data within 90 days after the event, unless the law requires us to keep it longer.
Automatic backup copies of our database expire on a rolling schedule and are deleted no later than nine months after the event.
Any other copies we make, for example before updating the website, are deleted by the same date.
Emails we have sent stay in your inbox, and our email provider keeps delivery records for a limited time under its own policy.
Website server logs are overwritten automatically as they fill up.
The lucky draw winners list stays on this website until we delete the event data.
Photographs and video already published may stay online (see "Event photographs and video").

Your rights

You can ask us to:

give you a copy of the personal data we hold about you;
correct anything that is inaccurate or incomplete;
stop using your data (withdraw your consent); or
send your data to you or to another organisation in a common electronic format, where technically feasible.

To make a request, use the details under "Contact", give your registration reference and tell us what you need. We may ask you to confirm your identity. We will reply within 21 days. A parent or guardian can make these requests for a child under 18.

If you withdraw consent before race day, we cancel your registration and you will not be able to take part. After race day, we keep the check-in, race kit and lucky draw records until we delete the event data, so we can account for prizes and race kits.

If you are unhappy with our reply, you can complain to the Personal Data Protection Commissioner.

Cookies and technical data

This website uses one essential session cookie that protects forms against misuse and, if you arrived through a campaign link, remembers which one until you register. It is deleted when you close your browser. Organisers who sign in get an extra cookie that keeps them signed in, and may get one that remembers their light or dark theme. We do not use analytics, advertising or third-party tracking cookies.

If you arrive through a campaign link (for example one shared on WhatsApp), we save the campaign tags in that link, and the name of the website you came from, with your registration, so we know which announcements reach people.

Like most websites, our server records technical details of each visit (IP address, browser type and pages requested) to keep the site secure and to limit repeated registrations from one network address. These logs are overwritten automatically.

Changes to this notice

If we change this notice, we will update the date at the top. If a change affects how we use the data you have already given us, we will email the lead participant.

Contact

Contact for privacy enquiries, requests and complaints: hello@tujucreative.com .