Privacy/Legal - Boston Athletic Association

Boston Athletic Association Privacy Policy

Effective: 2026-02-10

The Boston Athletic Association respects the privacy of our athletes, volunteers, website visitors, and other individuals. This Privacy Policy (“Policy”) describes how the Boston Athletic Association (“B.A.A.,” “we,” “our,” “us”) collects, uses, and discloses certain personal information obtained through our website (“Site”) located at www.baa.org, our mobile application (“App”), your “Athletes’ Village Account” (“Account”) as well as information that we process as part of offering you our services (collectively the “Services”). It also explains your rights and choices with respect to such information and the steps you can take to protect your privacy.

Please read this policy carefully and let us know if you have any questions. By using our Services, you are agreeing to the terms of this Policy.

The information that we collect in connection with our Services is controlled by the Boston Athletic Association, which is headquartered in the United States at 699 Boylston Street, 8th floor, Boston, Massachusetts 02116. As a result, such information may be transferred to and processed in the United States, as described in the section below titled “International Users.”

What Information We Collect and Maintain About You

We collect personal and other information from you directly when you provide it to us through the Services. We may also collect information from third parties in relation to providing you our Services. We collect a variety of information through the Services, including:

Account and profile information. If you make an account with us in relation to our Services, we will collect information from you related to maintaining your account. This may include your name, username, password, email address, self-reported demographic information, race history, volunteer experience, and reason for engaging our Services. We may also collect information about you from third parties in relation to our Services.

Event registration or volunteer information. We collect information when you register or volunteer for a race or other event, such as your name, address, email address, phone number, country of residence, citizenship, age or date of birth, gender, race history and experience, club affiliation, occupation, and other demographic categories you choose to provide, emergency contacts, and self-reported disability status, proof of disability, or other health-related information that you provide directly to us as necessary for participation in a race or other event. Our third-party service providers may also collect your payment card information when you submit your registration.

Race activities and results. We collect information when you participate in a race or other event that we organize. For example, we may collect information about your real-time location during a race (such as your progress along the course), your race times and splits, and your finishing results. We may share this information with the general public through our Services, as described in the section below titled “With Whom and Why We Share Your Information.”

Sensitive data. We generally ask that you not send us, and you not disclose, any sensitive information (g., social security numbers, financial account information, information related to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, or sexual orientation) on or through the Services or otherwise to us, except for self-reported disability status, proof of disability, or other health-related information that you provide directly to us as necessary for participation in a race or other event. In some circumstances related to your account, you may have the option to provide us with information, such as your ethnicity, which we will only collect and process with your consent. None of this sensitive information will be shared with third parties, except in the aggregate and never in a form that is attributable to an individual, and you will always have the option to decline to share such sensitive information with us.

Information you provide to us directly or through the Services. We collect information that you provide to us directly or through the Services, such as when you post questions or comments, respond to surveys, rate the Apps, or communicate with us.

We may use the following technologies to collect this information automatically, including:

Server logs. Server logs automatically record information and details about your online interactions with us. For example, server logs may record information about your visit to the Site on a specific day and time.

Cookies are small files that are stored on your computer by your web browser. A cookie allows the Site to recognize whether you have visited before and may store user preferences and other information. For example, cookies can be used to collect or store information about your use of the Site during your current session and over time (including the pages you view and the files you download), your computer’s operating system and browser type, your Internet service provider, your domain name and IP address, your general geographic location, the website that you visited before visiting the Site, and the link you used to leave the Site. If you are concerned about having cookies on your computer, you can set your browser to refuse all cookies or to indicate when a cookie is being set, allowing you to decide whether to accept it. You can also delete cookies from your computer. However, if you choose to block or delete cookies, certain features of the Site may not operate correctly.

Web beacons. The Site or the emails that you receive from the Boston Athletic Association may use an application known as a “web beacon” (also known as a “clear gif” or “web bug”). A web beacon is an electronic file that usually consists of a single-pixel image. It can be embedded in a web page or in an email to transmit information, which could include personal information. For example, it can allow an email sender to determine whether a user has opened a particular email.

Third-party online tracking and behavioral advertising. We may partner with certain third parties to collect, analyze, and use the personal and other information described in this section. For example, we may allow third parties to set cookies or use web beacons on the Site or in email communications from us. This information may be used for a variety of purposes, including online interest-based advertising, as discussed below (see “With Whom and Why We Share Your Information”).

SDKs and mobile advertising IDs. Our Services may include third-party software development kits (“SDKs”) that allow us and our service providers to collect information about your activity. In addition, some mobile devices come with a resettable advertising ID (such as Apple’s IDFA and Google’s Advertising ID) that, like cookies and pixel tags, allow us and our service providers to identify your mobile device over time for advertising purposes.

Third-party plugins. The Services may include plugins from other companies (such as a Facebook “like” button and Twitter “follow” button). Even if you do not click on these plugins, they may collect information about you, such as your IP address and the pages that you view. They also may set and/or access a cookie or use similar tracking technologies. These third-party plugins are governed by the privacy policies and terms of the companies that created them.

We may combine information collected through the Services with information that we collect in other contexts, such as information from our email communications or phone calls with you, or data that we collect at races and events. We also may collect information about your race eligibility, race qualifying information (such as information related to your past participation in other races), and factors that may disqualify you from participating in a race. We will treat such combined information in accordance with this Privacy Policy.

How We Use Your Information

We use the information that we collect (described in “What Information We Collect and Maintain About You,” above) for a variety of purposes. Our legal bases for processing your personal information are: 1) our legitimate interest in running and maintaining our business; 2) performance and fulfillment of our contracts; 3) your consent; and 4) compliance with our legal obligations. In many instances, more than one of these legal bases apply to the processing of your personal information.

We use the information that we collect for a variety of purposes, including:

Providing you with our Services, such as organizing races and events, fulfilling the terms of any agreement you have with us, responding to your requests, providing customer service or support, and for other purposes related to managing our organization;
Communicating with you, including sending promotional messages, updates, information about your account, information about events you have registered or volunteered for, and other important information.
Enabling community features, so that you can ask questions, post comments, and communicate with other users on the Services;
Advertising and marketing, such as sending you offers for special services via mail, email, or text message, displaying online advertising, and targeting our offers or promotions, and evaluating or improving the effectiveness of our marketing efforts.
Conducting analytics and research, such as examining which parts of the website users visit or which aspects of our mobile app you find most useful, evaluating user interface and experiences, testing features or functionality, performing debugging and error repair, and analyzing how visitors use the Services.
Improving our products and services, such as personalizing and optimizing your website and mobile experiences, recognizing you across different browsers and devices you use, improving existing products and services, and developing new products and services.
Compiling aggregated and de-identified information, such as using or modifying the information described in this Privacy Policy in a manner that does not allow us to reasonably identify you to create reports and generate statistics.
Carrying out legal and business purposes, such as complying with applicable laws, responding to civil, criminal, or regulatory lawsuits, subpoenas, or investigations, exercising our rights or defending against legal claims, resolving complaints and disputes, performing compliance activities, conducting human resources activities, and otherwise operating, managing, and maintaining our business.

We do not use your personal information for purposes of profiling in furtherance of decisions that produce a legal or similarly significant effect concerning a consumer. With Whom and Why We Share Your Information We may share any of the information described in “What Information We Collect and Maintain About You,” above, with other parties for a variety of purposes, as described below.

Third-party service providers. The Boston Athletic Association uses third-party service providers that perform services on our behalf, including web-hosting companies, mailing vendors, and analytics providers. For example, we may use third parties to assist with race events, mail printed materials to runners or volunteers, or communicate with runners and volunteers., These service providers may collect and/or use your information, including information that identifies you personally, to assist us in achieving the purposes discussed above.

We may share your information with other third parties when necessary to fulfill your requests for services; to complete a transaction that you initiate; to meet the terms of any agreement that you have with us or our partners; or to manage our business.

Other users of the Services. We may allow you to share information directly with other users of the Services. For example, if you post questions or comments to other users through the Services, add information to your profile, respond to surveys or requests to rate the Apps, or use other features of the Services, then your questions, comments, profile, or other information may be seen by other users of the Services. Please ensure when using these features that you do not submit any information that you do not want to be shared with other users or the public.

Our partners. We may share information about final race results with our partners, including other non-profit organizations, sports organizations, or researchers who may use the final race results to confirm race eligibility/disqualification, generate reports, or conduct academic research.

Live updates and final race results. If you participate in a race that we organize, we may share certain information about you with the general public. For example, we may share your name, age group, gender, state and country of residence, and final race results through our Websites and Apps. We also may share your real-time location during a race (such as your progress along the course), race times and splits, and final results so that others can track your progress.

Analytics. We partner with certain third parties to obtain the automatically collected information discussed above and to engage in analysis, auditing, research, and reporting. These third parties may use server logs, web beacons, tags, pixels, mobile advertising IDs (such as Apple’s IDFA or Google’s Advertising ID), and similar technologies, and they may set and access cookies on your computer or other device. In particular, the Site uses Google Analytics to help collect and analyze certain information for the purposes discussed above. You may opt out of the use of cookies by Google Analytics here.

Interest-based advertising. The Site also enables third-party tracking mechanisms to collect information about you and your computing devices for use in online interest-based advertising. For example, third parties may use the fact that you visited our Site to target online ads to you. In addition, our third-party advertising networks might use information about your use of our Site to help target advertisements based on your online activity in general. For information about interest-based advertising practices, including privacy and confidentiality, visit the Network Advertising Initiative website or the Digital Advertising Alliance website.

The use of online tracking mechanisms by third parties is subject to those third parties’ privacy policies, and not this Policy. If you prefer to prevent third parties from setting and accessing cookies on your computer or other device, you may set your browser to block cookies.

Additionally, you may remove yourself from the targeted advertising of companies within the Network Advertising Initiative by opting out here, or of companies participating in the Digital Advertising Alliance by opting out here. Our Site does not currently respond to “do not track” browser headers.

Legal purposes. We may use or share your information with third parties when we believe, in our sole discretion, that doing so is necessary:

To comply with applicable law or a court order, subpoena, or other legal process;
To investigate, prevent, or take action regarding illegal activities, suspected fraud, violations of our terms and conditions, or situations involving threats to our property or the property or physical safety of any person or third party;
To establish, protect, or exercise our legal rights or defend against legal claims; or
To facilitate the financing, securitization, insuring, sale, assignment, bankruptcy, or other disposal of all or part of our business or assets.

Aggregated and de-identified information. Sometimes we aggregate or de-identify information so that it can no longer identify you, as defined under applicable laws. We may share aggregated and de-identified information with third parties, such as by publishing or sharing reports with third parties about trends in the usage of the B.A.A. Services. We can use and disclose this aggregated or de-identified information for any purpose, unless an applicable law says otherwise. We will maintain and use such information in deidentified form and not attempt to reidentify the information, except where reidentification is allowed by law for particular purposes. In those situations, we will use the re-identified data in a manner consistent with this policy and applicable law.

To Whom and Why We Sell Your Information

We do not sell your personal information.

Your Rights and Choices

The Boston Athletic Association provides you with choices to review, access, and update your information or to exercise your data protection rights, as follows:

If you no longer want to receive our newsletters or other promotional communications from B.A.A., please follow the “unsubscribe” instructions that are included at the bottom of each message or email us at info@baa.org. Please note that if you unsubscribe from our promotional communications, you will still receive administrative messages from us.

If you want to learn more about the personal information that B.A.A. has about you, or you would like to update, change, or delete that information, please contact us by email at info@baa.org.

If you are a California resident under 18 years of age and a registered user of our Services, you may request that we remove content and information that you post on our Services. To obtain removal of such content and information, please send us an email to info@baa.org with a short description of the content or information you would like to have removed. Please note that such a request does not necessarily ensure complete or comprehensive removal of content posted by you, since the content and information may remain in our or our service provider’s databases, may remain visible in a manner that does not identify you, or may have been re-posted by another user.

If you are a resident of a jurisdiction with an applicable data privacy law, you may have certain rights available to you in relation to your personal information. These rights may include:

The right to access your personal information (including a data portability request);
The right to correct or amend any personal information we have on file about you;
The right to delete your personal information;
The right to limit the use of your “sensitive” personal information;
The right to opt-out of the sale or “sharing” of your personal information;
The right to opt-out of the use of your personal information for targeted advertising purposes;
The right to restrict or object to the processing of your personal information (such as for direct marketing purposes);
The right to restrict or opt-out of the use of your personal information for certain automated decision-making (including profiling in furtherance of decisions that produce legal or similarly significant effects);
The right to revoke your consent (to the extent applicable);
The right to confirm whether personal information about you is being processed;
The right to obtain a list of specific third parties (or categories of third parties) to which we have disclosed your personal information or any personal information.

To exercise any of the rights listed above, please contact us via email at info@baa.org.

We will respond to your request as soon as reasonably possible and within the timeframe required under applicable law. We will allow you to appeal any decision we make in response to such request in accordance with applicable law. Appeals may be submitted to info@baa.org. with the subject line “Appeal of Decision Related to Privacy Rights Request.”

Prior to complying with your request, we will first verify your identity by comparing the information you provide with the information we have on file for you.

You may authorize an agent to make a request on your behalf. To designate an agent, please provide a written and signed document by both you and the agent that authorizes the agent to act on your behalf. You may also use a power of attorney. We will still require you to provide information to allow us to reasonably verify that you are the person about whom we collected personal information.

If you have implemented an opt-out preference signal (sometimes known as a global privacy control) through your browser or device, we will treat that opt-out preference signal as a valid request to exercise the opt-out rights available to you under your jurisdiction’s privacy law(s). Once we recognize the opt-out preference signal on our Services, we will automatically apply your right to opt-out to the browser or device through which we recognize the signal. The Services respond to opt-out preference signals in a frictionless manner (i.e., you do not need to take any additional steps for your opt-out preference signal to be recognized). To learn more about opt-out preference signals, please visit https://globalprivacycontrol.org/.

External Links

The Services may contain links to websites or mobile apps of other third parties, including social media sharing features that link to third-party websites. If you follow a link to any of these websites or apps, please note that these websites and apps (and any services that may be accessible through them) have their own privacy policies. We have not reviewed these third-party sites and do not control and are not responsible for any of these sites, their contents, or their privacy policies. Thus, we do not endorse or make any representations about them, or any information, software, or other products or materials found there, or any results that may be obtained from using them. We encourage our users to be aware when they leave the Services and to read the privacy policies applicable to such third-party websites and apps. If you decide to access any of the third-party sites listed on our website, you do so at your own risk.

Data Security

B.A.A. uses reasonable physical, technical, and administrative procedures to safeguard the personal information we collect online. However, no security program is 100% secure, and thus we cannot guarantee the absolute security of your information, and we cannot ensure or warrant the security of any information you transmit to the Site or to us, and you transmit such information at your own risk.

Data Retention

We retain personal information about you necessary to fulfill the purpose for which that information was collected or as required or permitted by law. We do not retain personal information longer than is necessary for us to achieve the purposes for which we collected it. When we destroy your personal information, we do so in a way that prevents that information from being restored or reconstructed.

The B.A.A. retains information regarding your participation in events, including for athletes under the age of 13, to support strategic planning. This helps us set participation goals, gain a better understanding of the participants we serve, and track individuals who participate in multiple events in order to offer potential incentives for increased engagement. Where permitted under applicable law, the B.A.A. may also use this information to share relevant opportunities with you.

International Users

The information that we collect through or in connection with the Services is transferred to and processed in the United States for the purposes described above. The Boston Athletic Association may subcontract the processing of your data to, or otherwise share your data with, affiliates or third parties in the United States or countries other than your country of residence. The data protection laws in these countries may be different from, and less stringent than, those in your country of residence. By visiting or using the Services, installing our Apps, clicking “I agree” or any other button indicating your acceptance of this Privacy Policy, or otherwise providing information to B.A.A., you expressly consent to such transfer and processing.

We may implement standard contractual clauses, contractual arrangements, or other mechanisms, as appropriate, to safeguard your information during such cross-border transfers. We also may transfer information to the United States or another country as necessary for the performance of our agreements with you or to establish, exercise, or defend legal claims.

If you are an EU resident, our legal basis for processing information will depend on the type of information at issue and the purpose for which it is collected and used. In many cases, we rely on your consent to process information, or we process information as necessary for the performance of our agreements with you. When processing special categories of data, such as ethnicity, we rely on your consent. We also may rely on our legitimate interests to process your information, for the purposes described in this Privacy Policy, except where such interests are overridden by your data protection interests or fundamental rights and freedoms.

Children’s Privacy

The Services are not intended for nor directed to individuals that are deemed to be children under applicable data protection or privacy laws. We request that such individuals do not provide information to us through any of the Services. We do not knowingly collect personally identifiable information from individuals that are deemed to be children under applicable law without parental consent.

Changes to this Policy

We may revise this Privacy Policy periodically in the future. If we make any material changes, we will post the revised Privacy Policy on our Websites and in our Apps under “Settings,” with an effective date indicating when the revised Privacy Policy will take effect. We encourage you to review this Privacy Policy periodically.

How to Contact Us

If you have any questions or comments regarding our Privacy Policy, please email us at info@baa.org with “Attn: Privacy/Legal” in the subject line or contact us by mail at:

Boston Athletic Association Attn: Privacy/Legal

699 Boylston Street

Ste 800

Boston MA 02116