The following is about Race Space s use of your data. Any data entered into the event entry forms set-up by or on behalf of an organiser is shared with that organiser. For information on their GDPR processes, please contact the organiser.

1. Who is collecting the data?

   Race Space Limited is collecting your data.

2. What data is being collected?

   On top of data being entered on Race Space account registration and on event entry join forms, Race Space also collects anonymised performance data for our analytics software as well as device and action information to help us in troubleshooting any issues that you may have.

   Race Space collects card details on our site, however card details are not available to us or stored on our servers. Card details are held with our payment processing partner Braintree.

3. What is the legal basis for processing data?

   Race Space requires basic information to create a Race Space account. For event entry, the information specified is set by the organiser of the event and is therefore a requirement for them to operate their event. We don t pass on any other collected data on to the organisers.

4. Will the data be shared with any third parties?

   Apart from sharing data that you enter in to an organisers entry form, data is NOT shared with any third party outside of what is required to operate Race Space as a business. Further details on what software we use and who we share data for this purpose is available here.

5. How will the information be used?

   We use the information provided to:

   • Create / manage a Race Space account
   • Be able to proactively support any queries that you may have
   • To enter events, which are passed on to organisers
   • To allow pre-filling of fields if you opt-in with the ‘this is me  checkbox
6. How long will the data be stored for?

   Data entered and stored on Race Space will be held for either 5 years from last action or when you request account deletion, whichever is earlier.

7. What rights does the data subject have?

   You have the right to request all information that we hold on you or delete your account with all information we hold on you at any time.

8. How can the data subject raise a complaint?

   Please email [email protected] with ‘DATA COMPLAINT  in the subject line with details of your account and details of the complaint. We will aim to get back to you within 3 business days.

Race Space considers data security of the utmost importance. Here is an overview on how we handle security.

1. Your data is sent using HTTPS, and encrypted at rest.

   When your data is moving between you and us, everything is encrypted and sent securely using HTTPS. We also encrypt your data at rest using Transparent Data Encryption.

2. We host on Digital Ocean

   Race Space is hosted on Digital Ocean cloud platform, placing your data in their UK data centre.

   Using Digital Ocean means we take advantage of their rigorous security standards and reliance. Servers and firewalls are always up to date. You can read more about their specific standards and procedures here.

3. We don't store your debit/credit card information.

   All our payments are processed through Braintree (a PayPal company) They are a PCI Service Provider Level 1 organisation - the most stringent certification level available in the payment industry.

   Using Braintree means we don't need to store or have access to your payment card details, they are sent encrypted direct to Braintree.

   You can read more about Braintree security here.

4. Your passwords are hashed

   We hash your passwords using a PBKDF2-based function, but that's no reason not to create a strong password in the first instance.

   We encourage you to understand, and educate yourself on what makes a strong password, and use them accordingly.

5. Keeping your data secure

   Keeping customer data safe is a huge responsibility and our top priority. We work hard to protect our customers' data from the latest threats. This is not a one time effort, it's a continual process that we monitor and work on.

   Security issues come to light through different means and activities, from articles in technical press, discovery during routine work, and through our internal reviews and vulnerability scans.

6. How we deal with security issues

   When we discover a security threat we follow this process:

   1. Understand the nature of the threat.
   2. Assess the risk of the threat to our customers data - bearing in mind the likelihood of breech and the impact of a possible breach.
   3. Scope the work required to mitigate or eliminate the risk.
   4. Prioritise any work according to the results of this risk assessment.
7. Reporting security problems

   Please email [email protected] with ‘DATA COMPLAINT  in the subject line with details of your account and details of the complaint. We will aim to get back to you within 3 business days.