Privacy Policy

The Paddock Hub is a trading name of, and is wholly owned and operated by, HC Motorsports Ltd, a private limited company registered in England and Wales (company number [to be added], registered office 66 Paul Street, London, EC2A 4NA, United Kingdom) ("HC Motorsports", "we", "us", "our").

HC Motorsports Ltd is the data controller responsible for your personal data for the purposes of the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and, where it applies, Regulation (EU) 2016/679 ("EU GDPR"). ICO registration number: [to be added].

Contact us about your data at privacy@paddockhub.co.uk.

• Account details: name, email address, password (stored encrypted), account type.
• Profile details: display name, photo, date of birth, phone number, nationality, racing class, team and biography.
• Racing data: race weekends, sessions, results, lap times, uploaded lap sheets and screenshots, race photos and kart setups.
• Connections: parents, sponsors, team managers and teams linked to a driver.
• Payment details: handled by Stripe. We receive your plan, payment status and renewal date, never your full card number.
• Security records: sign-in times, verification codes, device and browser information and IP address.
• Cookies: see our cookie policy.

• Providing your account and the service — performance of a contract (Article 6(1)(b)).
• Taking payments and keeping financial records — contract and legal obligation (Article 6(1)(b) and (c)).
• Keeping accounts secure and preventing fraud or misuse — our legitimate interests (Article 6(1)(f)).
• Service emails such as verification codes and receipts — contract.
• Optional cookies and any marketing — your consent (Article 6(1)(a)), which you may withdraw at any time.

Many karting drivers are under 18. Where a driver is under 13 in the UK (or under the age set by local law in the EU, up to 16), an account must be created or approved by a parent or legal guardian, who gives consent on their behalf. Parents and guardians may view the child's data and ask us to correct or delete it at any time.

We do not sell your personal data. We share it only with service providers acting on our instructions under contract:

• Hosting, database and file storage providers.
• Stripe Payments Europe Ltd / Stripe Payments UK Ltd, for payments.
• Our email delivery provider, for account and security emails.
• An AI provider, used only to review general kart reference settings — never your personal or racing data.
• Google, if you choose to sign in with it.

We may also disclose information where required by law, to protect our rights, or as part of a sale or restructuring of HC Motorsports Ltd, in which case your data would remain protected by this policy.

Some providers process data outside the UK or European Economic Area. Where they do, we rely on adequacy regulations or decisions, the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses, together with appropriate additional safeguards.

• Account and racing data: while your account is active, and deleted within 30 days of account closure.
• Payment and invoice records: 6 years, as required by HMRC.
• Security and audit logs: up to 12 months.

If you share a public driver profile, the name, photo, results and CV details you choose to show are visible to anyone with the link. Private details such as your phone number and date of birth are never shown publicly. You can hide sections or switch off your public profile at any time.

You have the right to access, correct, delete, restrict or object to the use of your data, to receive it in a portable format, and to withdraw consent at any time without affecting earlier processing. Email privacy@paddockhub.co.uk. We will reply within one month, and may ask you to confirm your identity.

Please contact us first so we can help. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk, 0303 123 1113) or, in the EU, to the data protection authority in the country where you live or work.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

We use encryption in transit, access controls, verified sign-in and regular reviews to protect your data. No system is completely secure, and we will notify you and the regulator of any serious breach as the law requires.

We may update this policy. The date at the top shows the latest version; we will tell you about significant changes by email or in the app.