Privacy notice

The Blissti Fun Run 2027 (Sat 20 March 2027, Taman Botani Negara Shah Alam) is organised by Blisstifood (blisstifood.org), the name used by Pertubuhan Makanan Kebahagiaan, a society registered in Malaysia (registration no. PPM-013-10-11102024) that provides free plant-based meals. Registered address: 10 Jalan Bayu Tinggi 8, Taman Bayu Tinggi, 41200 Klang, Selangor. Pertubuhan Makanan Kebahagiaan decides how your information is used and is responsible for it.

Early list. Your name, email, WhatsApp number and preferred language.

Registration. From the person paying: name, email and phone, plus an emergency contact. For each participant: name, date of birth, gender (optional), shirt size and the categories chosen. For participants under 18: the parent or guardian's details and their consent. We also keep your payment status and a record of each agreement you make (the waiver, this notice, photo/media consent and Blisstifood email updates), with the version and the time you agreed.

We never see or store your card or bank details. The payment provider handles them.

On event day. When your pass QR code is scanned at check-in or race-kit collection, we record that it happened.

Technical. Security logs that keep out personal details wherever possible, and a bot check from Cloudflare (Turnstile) that protects our forms.

If you give us someone else's details (an emergency contact or family members), please let them know.

• Early list: to tell you when registration opens, and about this run only.
• Registration: to confirm your place, issue passes, prepare shirts and race packs, keep children safe, and contact you or your emergency contact if needed.
• Event-service messages: confirmations, your pass, kit collection details and changes on the day. These are part of taking part, not marketing.
• Event day: to run check-in and kit collection smoothly.
• Safety and security: to stop spam, fraud and misuse.

Each choice is separate:

• Waiver and privacy notice — required to register.
• Photo/media consent — optional. Saying no does not affect your place.
• Blisstifood email updates — optional and off unless you tick it. You can unsubscribe at any time.

We never sell personal data.

Participants under 18 must be registered by a parent or guardian, who gives consent for them. We collect only what the event needs about a child, and we never publish a child's contact details or bib number.

We publish photos or videos in which you or your child can be clearly recognised only if you gave photo/media consent. Wide crowd shots may show people in the background.

To have a photo taken down, message us with a link or a description of it. We will remove it from our website and our own social media pages as soon as we can.

We use a few service providers to run the website, only for the purposes above:

• Cloudflare — website hosting, database and bot check.
• Amazon Web Services (SES) — sending emails.
• Xendit — payments.

We may also share information when the law requires it, or with emergency services if someone's safety is at risk. Volunteers see only what their task needs, such as the check-in list on event day.

Our providers may store or process your information outside Malaysia. We choose providers who protect it to a standard comparable to the PDPA.

• Early list: deleted by 30 June 2027 (about three months after the event). Ask us and we remove you sooner.
• Registration, consents and event-day records: up to 12 months after the event, for questions, refunds and safety follow-up. Longer only if there is an open claim or dispute.
• Payment records: as long as accounting and tax law requires.
• Email updates: until you unsubscribe.
• Security logs: about 30 days.

After that, we delete the information or make it anonymous.

Information is sent over encrypted connections. Access is limited to the people who need it, and staff accounts are protected. If a data breach happens that may harm you, we will tell the authorities and you, as the law requires.

We save one small setting in your browser, blissti-lang, to remember your language. Cloudflare's bot check may also use what it needs to tell people from bots. We use no advertising or tracking cookies.

You can:

• ask for a copy of the information we hold about you;
• ask us to correct it;
• withdraw a consent, such as photo/media or email updates;
• ask to be removed from the early list;
• ask us to stop using your information for a purpose, or to delete it.

We reply within 21 days. We may need to check who you are first. If you withdraw a required consent before the event, we may not be able to keep your place.

Email: pmkcharity@gmail.com

Phone: 016-214 4160

WhatsApp: +60 13-444 9504

If we change this notice, we will post the new version here with a new date. If a change affects something you agreed to, we will ask you again.