Data Protection

Effective from: 1 November 2026

This page sets out how UK Virtual Races ("UKVR") meets its obligations under UK GDPR and the Data Protection Act 2018. It's a companion to our Privacy Policy, which explains what we collect and why - this page focuses on how we look after it.

Data controller

Stuart Flynn, trading as UK Virtual Races, is the data controller for personal data collected through ukvirtualraces.co.uk. The controller's address and email are published in the Business & Legal Contact Details. UKVR's ICO registration position is under assessment; this page does not claim registration or exemption.

Where your data is stored

Account, entry, submission and operational data is stored using UKVR's IONOS-hosted website, database and mail services. Founding Run booking and payment information supplied directly to BookitZone is processed under BookitZone's own privacy information. Where a provider processes personal data outside the UK, UKVR will use the transfer mechanism and safeguards required by applicable data protection law. UKVR does not sell personal data.

Security measures

We take reasonable technical and organisational steps to protect your data, including:

Passwordless magic-link authentication for runners, and separate protected administrator access
Single-use, time-limited login tokens (15-minute expiry) rather than long-lived session tokens sent by email
Rate-limiting on login requests to prevent abuse
HTTPS encryption across the site
Restricted access to the underlying database and hosting account, limited to those who need it to operate the site
No storage by UKVR of full payment-card details; the external payment provider handles card processing
Private evidence storage and authenticated, role-controlled evidence review

Data minimisation

We deliberately collect as little as possible, and only when it's actually needed. For example, we don't ask for a postal address at signup - only once a challenge submission has been approved and a medal actually needs posting.

Data retention

Personal data is kept only for as long as reasonably required for the relevant account, participation, evidence-review, permanent-achievement, fulfilment, security, dispute and legal purpose. Financial and audit information may need to be retained after an account closes. The criteria, rather than an unconfirmed fixed period, are described more fully in our Privacy Policy.

Data breaches

In the unlikely event of a data breach affecting your personal data, we'll notify the ICO within 72 hours where required, and notify affected individuals directly where the breach is likely to result in a risk to their rights and freedoms, in line with our obligations under UK GDPR.

Your rights and how to exercise them

See the "Your rights" section of our Privacy Policy for the full list of rights available to you (access, correction, erasure, restriction, objection, data portability where applicable, and withdrawal of consent). To exercise any of them, contact admin@ukvirtualraces.co.uk. We aim to respond within one month, as required by law.

Complaints

If you're unhappy with how we've handled your data, we'd like the chance to put it right first - contact us directly. You also have the right to lodge a complaint with the UK's supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
ico.org.uk · 0303 123 1113