Privacy Policy

Depending on your use, we may collect account and contact details; profile information; enquiries and support messages; booking, order and payment-status records; job listings and applications; listing claims; comments, posts, images and videos; moderation and complaint records; marketing choices; cookie identifiers; approximate location where requested; and technical, device, security and usage logs.

Payment card details are handled by the payment provider and are not stored in full by KartDirectory.Racing.

Information may come from you, your organisation, another user acting with authority, venues and service providers, public websites and registers, imported legacy systems, social platforms, analytics/security providers and technical activity on our service.

When we obtain personal information indirectly, we will provide required information unless a lawful exception applies.

The following bases describe processing where UK/EU data-protection law applies. Other territories may require consent or a different legal basis; a legitimate-interest label does not override those requirements. We distinguish information necessary for a requested service from optional uses. If necessary information is not provided, we may be unable to supply that service.

• Contract: to run accounts, orders, paid job listings and booking services you request.
• Legitimate interests: to operate and improve the directory, moderate content, prevent fraud, secure the service, support users and manage business relationships where those interests are not overridden by your rights.
• Legal obligation: for tax, accounting, consumer, safety, regulatory and law-enforcement requirements.
• Consent: for optional cookies, some marketing, location access and other activities where consent is the appropriate basis.

We will identify an additional condition before processing special-category or criminal-offence information where required.

We may share relevant information with hosting, email, security, analytics, CAPTCHA, mapping, payment and support providers; venues and booking providers; employers receiving applications; organisations managing claimed listings; professional advisers; regulators and authorities; and a buyer or successor during a business reorganisation.

We do not sell contact-form, booking or job-application information.

Information you choose to publish in a profile, listing, comment, post, image or video may be visible worldwide and indexed by search engines. Do not publish another person’s personal information without a lawful reason and appropriate permission.

Information may be processed in the countries where we and our service providers operate. Publishing content makes it accessible internationally; this is different from giving a supplier access to private account or transaction records. Where required, restricted transfers need an applicable adequacy decision, approved contractual safeguards or another lawful mechanism, with the necessary assessments and supplementary protection. Contact us to request information about relevant safeguards.

[Before launch: identify actual hosting, email, payments, analytics and fulfilment recipients, processing countries and transfer safeguards. Do not enable a transfer until its lawful basis and safeguards are established.]

Retention depends on the record and its purpose. Account information is needed while the account is in use and while a closure request, security issue or dispute is being resolved. Enquiries and applications are needed while routing, responding and handling follow-up. Booking and order records may also be required for accounting, tax, chargebacks and legal claims.

Published content and attribution are retained while published; evidence of permissions, corrections and moderation may need to outlast publication. Consent evidence and a minimal suppression record help demonstrate and honour marketing choices. Security logs and backups have separate restricted retention cycles. We assess legal duties, unresolved disputes, sensitivity and the continuing need for identifiable information, then delete or anonymise information no longer needed. Deletion from active systems may precede expiry of restricted backups.

[Before launch: verify the actual retention/deletion schedule for each category, including suppliers and backups, and publish fixed periods where these can be specified. This draft does not confirm automated deletion is operating.]

We use proportionate technical and organisational measures to protect information. No internet service is completely secure, so please use a strong unique password and tell us promptly about suspected misuse.

Depending on the law that applies, you may have rights to access, correct, erase, restrict or receive your information, object to processing, withdraw consent and complain to a regulator. UK users may complain to the Information Commissioner’s Office. We may need to verify identity before acting on a request.

The consumer newsletter and Industry Brief are separate optional subscriptions. We use double opt-in confirmation before newsletter marketing. Each subscription can be withdrawn independently through its unsubscribe link or account preferences. Buying, booking, applying for work or creating an account does not itself subscribe you. Service messages about requests and transactions are not marketing.

We record the publication, source, wording/version, subscription and confirmation times, withdrawal and limited hashed technical evidence. A minimal suppression record helps prevent unwanted resubscription. Newsletters may include clearly identified sponsored content; sponsors do not receive your email address merely because their content appears. A separate, informed choice is needed for sharing your details with a sponsor for its marketing.

The service is not intended for children to create accounts or publish independently. An adult arranging karting for children may provide the ages or age ranges needed to check eligibility and group requirements. Provide only the requested details, explain this notice to participants or their parent/guardian as appropriate, and do not put children’s contact details, identity documents or medical histories in public content or free-text notes. Participation ages are set by each venue and differ from account eligibility.

If accessibility or health information is necessary, ask the venue or our support team for an appropriate private route before sending it. We need the applicable lawful basis and additional safeguards for sensitive information and children’s data. Contact us about information a child may have submitted without appropriate authority.

We may use automated tools to detect spam, classify directory or job content and support moderation. We will explain any solely automated decision that produces a legal or similarly significant effect and provide rights required by applicable law.

Use the contact page for privacy questions or rights requests. We will publish material policy changes and update the date shown on this page.

Accounts and social sign-in: we use contact details, login identifiers, security and verification records and, if you choose a connected provider, the profile details that provider shares with your permission. Linking a login does not make your account public or subscribe you to marketing.

Directory, editorial and community: we use submitted and publicly sourced business information, attribution, media, listing-claim evidence, corrections and moderation records to publish and maintain content. Public business contact details may still be personal information.

Jobs: we route applications and attachments to the identified employer or application provider, support adverts and investigate abuse. An external application site collects information under its own notice.

Marketplace: we process listings, seller-contact requests and membership billing. Information sent through a seller-contact form is disclosed to that seller. Do not include card details or identity documents in listings or messages.

Shop and bookings: we process order, address, delivery, participant, payment-reference and support information needed for the requested service. A printing, delivery or venue partner receives only the information needed for its role. Optional newsletters and sponsored communications require a separate choice.

The country edition or language you select does not decide which law protects you. Applicable rights depend on where you live, the service and the relevant law. Contact us to exercise rights; we may request proportionate verification or evidence that an agent is authorised. We explain refusals and available review or complaint routes, and apply the legal response deadline. You do not have to accept marketing to make a request.

United Kingdom and Ireland/EEA: where the UK GDPR or EU GDPR applies, rights include access, correction, erasure, restriction, portability and objection, subject to statutory conditions. You can withdraw consent without affecting earlier lawful processing and object to direct marketing. Complain to the UK ICO, Ireland’s Data Protection Commission or your competent EEA authority; contacting us first does not remove that right.

United States: state law may provide access, correction, deletion, portability, appeal and opt-out rights concerning sale, sharing, targeted advertising or specified profiling, where applicable. An authorised agent may act as permitted by law. Exercising a protected right must not result in unlawful discrimination. The applicable notice and opt-out mechanism, including recognised preference signals where required, must accompany any covered advertising practice.

Canada: applicable federal and provincial rules may provide access, correction, meaningful consent, withdrawal subject to lawful limits and a right to challenge our practices. Complaints may be made to the Office of the Privacy Commissioner of Canada or the relevant provincial authority, including Québec’s Commission d’accès à l’information. Processing outside Québec or Canada requires the disclosures and safeguards applicable to that transfer.

Brazil: where the LGPD applies, rights include confirmation, access, correction, information about sharing, applicable portability, anonymisation, blocking or deletion of unnecessary or unlawfully processed data, consent withdrawal and review of qualifying automated decisions. You can petition the ANPD under its procedure if the controller does not satisfactorily address your request.

Australia: where the Privacy Act and Australian Privacy Principles apply, you can request access or correction and complain about our handling of information. Contact us first to seek resolution; unresolved eligible complaints can be raised with the OAIC.

New Zealand: applicable rights include access and correction and complaints to the Office of the Privacy Commissioner. For information collected indirectly, the required notice includes source and purpose information unless a statutory exception applies.

United Arab Emirates: applicable federal or free-zone rules may provide information, correction, deletion, restriction, objection and other rights. The competent authority and transfer rules depend on the regime; DIFC and ADGM have distinct frameworks. Contact us to identify the processing concerned and the applicable complaint route.

Other countries: mandatory local privacy protections continue to apply where the relevant law covers our processing. These summaries do not restrict rights granted by law.