Privacy Notice
Version 1 · Effective [DATE]
[COMPANY LEGAL NAME] trading as Karat Racing ([ADDRESS]; [EMAIL]) is the data controller for the personal data described here. [ICO registration number: ZA______]
1. What we collect
| Category | Examples |
|---|---|
| Identity and contact | Name, date of birth, nationality, address, email, phone, emergency contact |
| Verification | ID document and selfie check, carried out by our verification provider (Stripe Identity); the result and a reference |
| Licences and documents | Race licence, driving licence, insurance documents |
| Physical details | Height, weight, kit sizes (for seat fit and equipment) |
| Health (special category) | Medical declaration, conditions or medication relevant to safe driving, incident and first-aid records |
| Bookings and payments | Bookings, extras, invoices, payment status. Card details are handled by Stripe; we do not store full card numbers. |
| Driving data | Lap times, telemetry, run notes, engineer and coach feedback, benchmarks |
| Images and video | On-board and trackside video, photographs |
| Communications | Messages with us by email, WhatsApp and in-app requests |
| Technical | Login records, device and browser information, IP address |
| Children | For drivers under 18: the data above, plus the parent or guardian's details and consent |
2. Why we use it, and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Creating your account, taking and managing bookings, running test days | Contract (Art. 6(1)(b)) |
| Identity and licence checks, safety management, incident records | Legitimate interests in operating safely (Art. 6(1)(f)); legal obligation where it applies |
| Health information for safe participation and emergency care | Explicit consent (Art. 9(2)(a)), and vital interests in an emergency (Art. 9(2)(c)) |
| Invoicing, accounting and tax records | Legal obligation (Art. 6(1)(c)) |
| Coaching, data and video delivered to you | Contract |
| Using images or video in our marketing | Consent, which you can withdraw at any time |
| Marketing messages | Consent, or the soft opt-in for existing customers; you can unsubscribe at any time |
| Service messages by WhatsApp, email or SMS | Contract and legitimate interests |
3. Who we share it with
- Venues and organisers: driver and licence details and, for safety, relevant medical information.
- Partner teams, and staff assigned to your day: only what they need to run it.
- Service providers acting for us:
- Stripe (payments and identity verification);
- our hosting provider ([PROVIDER], [UK/EU]);
- Xero (accounting);
- Meta / WhatsApp Business and our email provider (messages);
- our automation platform (n8n, self-hosted).
- Insurers, brokers and legal advisers: in the event of an incident or claim.
- Authorities: where the law requires it.
We never sell your data.
4. International transfers
Some providers (for example Stripe and Meta) may process data outside the UK. Where they do, we rely on UK adequacy regulations or the International Data Transfer Agreement / Addendum.
5. How long we keep it
| Data | Kept for |
|---|---|
| Account and booking records | While your account is active, then 6 years (tax and limitation periods) |
| Verification results | 6 years from the last booking |
| Health declarations | Until replaced, and no longer than 3 years after your last booking. Records linked to an incident are kept for up to 7 years, or longer for a minor (until they reach 21). |
| Video and telemetry | Available to you for [90] days after the test day, then deleted [or archived for up to 2 years for coaching continuity, if you consent] |
| Marketing consent records | Until withdrawn, plus 2 years |
6. Your rights
You have the right to access, correct, delete, restrict or object to our use of your data, and the right to data portability. You can also withdraw consent at any time. You can download your data and request deletion from your account settings, or email [EMAIL]. Some records (for example invoices and incident records) must be kept by law even after a deletion request.
If you are unhappy, please contact us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
7. Children
A parent or guardian with parental responsibility must consent for drivers under 18. Young drivers can still contact us about their own data.
8. Security
- Data is encrypted in transit.
- Access is limited by role.
- Files are stored privately, with download links that expire.
- Staff see only the drivers they are assigned to.
9. Changes
We will tell you about material changes. This notice was last updated on [DATE].