Privacy & your data

Versus Run Rewards is operated by Versus Socks, South Africa. Versus Socks is the responsible party (data controller) for the personal information described here. It rewards you with a Versus store discount for the kilometres you run. It is not developed by, affiliated with, endorsed by or sponsored by Strava.

Privacy questions, access requests and complaints go to our Information Officer at team@versussocks.com.

We process your personal information in line with South Africa's Protection of Personal Information Act, 2013 (POPIA). Where the General Data Protection Regulation (GDPR) applies to you, we give you the equivalent rights set out below. Our lawful basis is your consent: you tick a consent box before connecting, and you approve Strava access on Strava's own screen. You may withdraw that consent at any time.

• From you: your name, surname and email address, given when you join, plus your email preference and the date you consented.
• From Strava, with your permission: your Strava athlete ID, your first name, last name and profile photo, and for each activity in the current calendar month its name, distance, moving time, start date and sport type.
• Created by us: the discount amounts you have claimed and the discount codes issued to you.

• What we ask permission for: permission to see your activities — nothing more. We can never post to Strava for you, change anything on your account, or see activities you have marked as private beyond the runs we count.
• How we use that access: when you connect, we confirm who you are and collect your name and profile photo (read fresh from Strava each time you visit, not kept by us). We then look at only your runs from the current month to work out your total, and when Strava tells us you have uploaded a new run, we take that single run's details so we can email you a short summary. If you disconnect, we use the same link to Strava to end our access. We also rely on Strava's notifications to know when you upload a run or take our access away.
• Where your Strava data shows up: your monthly kilometre total and the rand value it earns; the list of counted runs on your dashboard; the amount your discount code is worth; the run-summary email we send after an upload; the month-end balance reminder; and your Strava name and photo in the header. That is the complete list — your Strava data is used for nothing else.

To work out your monthly kilometres and the discount you have earned, to show that back to you, to issue your discount code, and to email you about new runs and your month-end balance. Your Strava data is used for nothing else — no advertising, no profiling, no analytics, no sharing with third parties, and it is never used to train or operate AI systems.

• Your runs and activity details: not stored. They are read live from Strava each time your rewards are calculated and discarded immediately, so a change or deletion on Strava is reflected straight away.
• Your Strava name and profile photo: not stored. Read live from Strava each time you open your dashboard.
• Run-email log: the only activity-related record we keep. It holds a one-way scrambled fingerprint of the activity, the send status and a timestamp — no activity ID, name, distance or route — so that the same run is never emailed twice. It is automatically deleted after 7 days.
• Your Strava athlete ID and access tokens: kept only while you are connected, so the connection keeps working. Deleted when you disconnect.
• Your contact details, consent date and email preference: kept while you are in the programme. Deleted when you disconnect.
• Your claim history: kept while you are in the programme so you can view codes you have already claimed. Deleted when you disconnect.

Your email address and name are shared with our email provider (Resend) and our marketing list (Klaviyo) so we can send you programme emails, and a discount code is created for you in our store (Shopify). No Strava activity data is sent to any of them. We never sell, license, rent or otherwise make your data available to anyone else.

Cross-border transfers: these providers, and the hosting and database services that run this site, store data on servers outside South Africa, including in the European Union and the United States. We only use providers that are bound by contractual terms giving your information a level of protection comparable to POPIA.

All traffic runs over encrypted HTTPS connections and data is encrypted at rest. Strava access tokens and other credentials are held in a restricted store and are never exposed to your browser. Access to the database is limited to the application and to authorised Versus personnel. Your dashboard is opened with a signed session token rather than an athlete number, so it cannot be altered to view another athlete's rewards. If a security compromise affects your personal information we will notify you and the Information Regulator as POPIA requires.

• Ask what personal information we hold about you, and get a copy.
• Ask us to correct or complete anything that is wrong.
• Ask us to delete your information (see below).
• Withdraw your consent at any time, without affecting what came before.
• Object to processing, and opt out of programme emails.
• Ask for your information in a portable format.
• Complain to the Information Regulator of South Africa if you are not satisfied with how we have handled your information.

Email team@versussocks.com to exercise any of these. We do not charge for reasonable requests.

You can turn programme emails off at any time from your dashboard, and you can leave the programme entirely using Disconnect on your dashboard. That revokes our access on Strava and permanently deletes your contact details, your Strava connection and your claim history. We confirm the deletion on screen and by email. You can also revoke access directly in your Strava settings, which removes you from the programme in the same way. Deletion is immediate; any remaining run-email fingerprints age out within 7 days.

Strava may monitor and collect usage data relating to our access to the Strava API and may use that data for any business purpose, including improving the Strava platform, supporting developers and users, and checking compliance with its API agreement.

The programme is not intended for anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has joined, email us and we will delete the account.