Data Protection

Last updated: [DATE]

This page sets out how UK Virtual Races ("UKVR") meets its obligations under UK GDPR and the Data Protection Act 2018. It's a companion to our Privacy Policy, which explains what we collect and why - this page focuses on how we look after it.

Data controller

[TRADING NAME / COMPANY NAME] is the data controller for personal data collected through ukvirtualraces.co.uk. [ICO registration reference, if/when registered.]

Where your data is stored

Account, entry, and submission data is stored in a dedicated database hosted with IONOS, on servers within the UK/EU. We don't transfer personal data outside the UK or EEA. Where a third-party processor we use (such as Stripe) operates internationally, they do so under their own GDPR-compliant safeguards - see their respective privacy policies for detail.

Security measures

We take reasonable technical and organisational steps to protect your data, including:

• Passwordless login (magic links) rather than stored passwords, removing the risk of password reuse or leaked credentials
• Single-use, time-limited login tokens (15-minute expiry) rather than long-lived session tokens sent by email
• Rate-limiting on login requests to prevent abuse
• HTTPS encryption across the site
• Restricted access to the underlying database and hosting account, limited to those who need it to operate the site
• No storage of full payment card details - all card processing is handled directly by Stripe, a PCI-DSS compliant payment provider

Data minimisation

We deliberately collect as little as possible, and only when it's actually needed. For example, we don't ask for a postal address at signup - only once a challenge submission has been approved and a medal actually needs posting.

Data retention

Personal data is retained for as long as your account remains active, so your challenge history stays available to you. On request, we'll delete your account and associated personal data within [30] days, other than basic transaction records we're legally required to retain for accounting/tax purposes (typically 6 years).

Data breaches

In the unlikely event of a data breach affecting your personal data, we'll notify the ICO within 72 hours where required, and notify affected individuals directly where the breach is likely to result in a risk to their rights and freedoms, in line with our obligations under UK GDPR.

Your rights and how to exercise them

See the "Your rights" section of our Privacy Policy for the full list of rights available to you (access, correction, erasure, restriction, objection, and withdrawal of consent). To exercise any of them, contact [privacy@ukvirtualraces.co.uk]. We aim to respond within one month, as required by law.

Complaints

If you're unhappy with how we've handled your data, we'd like the chance to put it right first - contact us directly. You also have the right to lodge a complaint with the UK's supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
ico.org.uk · 0303 123 1113