PRIVACY POLICY AND LEGAL INFORMATION (THE BORING STUFF)

Stansted Raceway is a company registered in England and Wales, company registered address being Stansted Raceway Lovecotes Farm Chinkney Road Henham Village Bishops Stortford CM22 6BH (hereafter referred to as "we", "us", "our" and "ours"). We run and organise the Raceway events at the  Raceway. This notice describes how we collect and use personal data about you, in accordance with the General Data Protection Regulation (GDPR), the new Data Protection Act (DPA) 2018 and any other national implementing laws, regulations and secondary legislation, as amended or updated from time to time, in the UK ("Data Protection Legislation"). This policy affects your legal rights and obligations so please read it carefully to understand our practices regarding the collection and storage of your personal data and how we will treat it. If you have any questions please contact us at info@stanstedraceway.com or call us on 07851 204063For the purpose of the Data Protection Legislation and this notice, we are the "data controller". This means that we are responsible for deciding how we collect, hold and use personal data about you. We are required under the Data Protection Legislation to notify you of the information contained in this privacy policy.

          We obtain personal data about you, for example, when:           you request one of our services, for example:

• make a purchase of  event tickets,    
• make a driver booking or license application  
• sign up to receive our newsletters  
• or other services made available via our website or office  
• you contact us by email, telephone or post or you have a meeting with us (for example when you have a query about our services)  

We may also collect personal data that you give to us about other people if you register them to attend an event. You agree that you have notified any other person whose personal data that you provide to us of this privacy notice and, where necessary, obtained their consent so that we can lawfully process their personal data in accordance with this policy.

• Your personal details (such as your name, address, telephone number, email address and, where relevant, your driver race number and license information)  
• Payment information (such as credit card details used to secure a track hire booking). For note, payments made via our website (such as for advance event tickets or DVD purchases) are directed through PayPal, or our relevant supplier, therefore, we will not retain any card information. Please see PayPal's privacy statements for their data protection policies.  
• Details of contact we have had with you in relation to the provision, or the proposed provision, of our services  
• Details of any services you have received from us  
• Our correspondence and communications with you  

You do not need to provide us with any personal data to view our website or event ticket shop. However, we may still collect the information set out under the 'Data we automatically collect section of this policy, and marketing communications information in accordance with the 'Marketing Communications' section of this policy.

When you visit our website or event ticket shop, we, or third parties on our behalf, automatically collect and store information about your device and your activities. This information could include (a) your computer or other device's unique ID number; (b) technical information about your devices such as type of device, web browser or operating system; (c) your preferences and settings such as time zone and language; and (d) statistical data about your browsing actions and patterns. We collect this information using cookies in accordance with the 'Cookies' section of this policy and we use the information we collect on an anonymous basis to improve our website and/or event ticket shop, our events and the services we provide, and for analytical and research purposes. We also allow specific third parties, including social media network providers and advertisers to collect information about your computer or mobile device, activities, and geographic location to enable them to display targeted ads to you and provide us with anonymous information about our users' behaviour. Again, this takes place through the use of cookies in accordance with the 'Cookies' section of this policy.

A cookie is a small text file containing a unique identification number that is placed on your device when you visit a website or application. Your web browser (such as Google Chrome, Internet Explorer or Mozilla Firefox) then sends these cookies back to the website on each subsequent visit so that they can remember things like preferences. Our website uses several cookies in order to display social media content, e.g. from Facebook and Twitter, and to display localised weather information. Our event ticket shop also uses cookies so that we can recognise you when you return and personalise your settings and preferences. We also use Google Analytics to monitor how our website and event ticket shop are being used. Google Analytics collects information anonymously and generates reports detailing information such as the number of visits, where visitors generally came from, how long they stayed on each page, and which pages they visited. Google Analytics places several persistent cookies on your computer's hard drive. These do not collect any personal data. If you do not agree to this you can disable persistent cookies in your browser. This will prevent Google Analytics from logging your visits. Most browsers are initially set up to accept cookies. You can change your browser settings either to notify you when you have received a cookie or to refuse to accept cookies.  Please note that our website and event ticket shop may not operate efficiently if you refuse to accept cookies. There may also be parts of the website that will not display if you choose not to accept cookies, e.g. the Twitter feed if you choose not to accept cookies from Twitter.

We will use your personal data in order to:

• carry out our obligations arising from agreements entered into for the provision of our services  
• provide you with information related to our services and our events and activities that you request from us or which we feel may interest you  
• notify you about any changes to our services  

In some circumstances, we may anonymise or pseudonymise your personal data so that it can no longer be associated with you, in which case we may use it without further notice to you. If you refuse to provide us with certain information when requested, we may not be able to perform the contract we have entered into with you or we may be unable to comply with our legal or regulatory obligations. We may also process your personal data without your knowledge or consent, in accordance with this notice, where we are legally required or permitted to do so.

We will only use your personal data lawfully to provide our services and respond to enquiries/feedback; most commonly, we will use your personal data in the following circumstances:

• where we need to perform the contract we are about to enter into or have entered into with you e.g. to sell you and send to you advance event tickets, DVDs or to enter into a site/track hire agreement with you  
• to use/forward your details for driver bookings (for note where you have booked in to take part in an event you are also agreeing to your details being published, whether via race programmes, photos being used, points charts, race winners or race updates)  
• to respond to an enquiry or complaint you have made about our company or services  
• where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests  
• where we need to comply with a legal or regulatory obligation, including for audit purposes  

Generally, we do not rely on consent as a legal basis for processing your personal data other than in relation to sending direct marketing communications to you via email or text message (see the 'Marketing Communications' section of this policy).

If you opt-in to receive marketing communications from us you consent to the processing of your data to send you such communications, which may include newsletters, special offers and information about new events. We retain a record of your consent. You can choose to no longer receive marketing communications by contacting us at info@stanstedraceway or clicking unsubscribe from a marketing email. If you do unsubscribe to marketing communications, it may take up to five business days for your new preferences to take effect. We shall therefore retain your personal data in our records for marketing purposes until you notify us that you no longer wish to receive marketing communications from us.

We will only retain your personal data for as long as is necessary to fulfil the purposes for which it is collected. When assessing what retention period is appropriate for your personal data, we take into consideration:

• the requirements of our business and the services provided  
• any statutory or legal obligations  
• the purposes for which we originally collected the personal data  
• the lawful grounds on which we based our processing  
• the types of personal data we have collected  
• the amount and categories of your personal data  
• whether the purpose of the processing could reasonably be fulfilled by other means  
• 
  

We may share your personal data with any service providers, sub-contractors and agents that we may appoint to perform functions on our behalf and in accordance with our instructions, including payment providers, event ticketing providers, email communication providers, IT service providers, accountants, auditors and lawyers. Under certain circumstances, we may have to disclose your personal data under applicable laws and/or regulations, for example, as part of anti-money laundering processes or protect a third party's rights, property, or safety. We may also share your personal data in connection with, or during negotiations of, any merger, sale of assets, consolidation or restructuring, financing, or acquisition of all or a portion of our business by or into another company. Our website and event ticket shop may contain links to other sites of interest. Once you have used these links to leave our website or event ticket shop, you should note that we do not have any control over that other site. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this policy. You should exercise caution and look at the privacy policy applicable to the site in question.

Some or all of your personal data may be stored or transferred outside of the European Union (the EU) for any reason, including for example, if our email server is located in a country outside the EU or if any of our service providers or their servers are based outside of the EU. We shall only transfer your personal data to organisations that have provided adequate safeguards in respect of your personal data.

We shall process your personal data in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures. All information you provide to us is stored on our secure servers. Where we have given, or you have chosen a password, you are responsible for keeping this password confidential. We have put in place reasonable and appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to employees, suppliers and/or contractors who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality. We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so. However, you acknowledge that no system can be completely secure. Therefore, although we take these steps to secure your personal data, we do not promise that your personal data will always remain completely secure in situations outside of our control.

All personal data that you provide to us must be true, complete and accurate. If you provide us with inaccurate or false data, and we suspect or identify fraud, we will record this.It is important that the personal data we hold about you is accurate and current. Should your personal information change, please notify us of any changes of which we need to be made aware by contacting us at info@stanstedraceway.com

Under certain circumstances, by law, you have the right to:

• request access to your personal data; this enables you to receive details of the personal data we hold about you and to check that we are processing it lawfully  
• request correction of the personal data that we hold about you  
• request erasure of your personal data; you may ask us to delete or remove personal data where there is no good reason for us continuing to process it, plus you have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing (see below).  

Please note, we reserve the right to charge an administrative fee if your request is manifestly unfounded or excessive.

In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal data for a specific purpose (for example, in relation to direct marketing that you have indicated you would like to receive from us), you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please email our data protection point of contact info@stanstedraceway.comOnce we have received notification that you have withdrawn your consent, we will no longer process your personal information (personal data) for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

If any provision of this policy is held by a court of competent jurisdiction to be invalid or unenforceable, then such provision shall be construed, as nearly as possible, to reflect the intentions of the parties and all other provisions shall remain in full force and effect. This policy shall be governed by and construed in accordance with the law of England and Wales, and you agree to submit to the exclusive jurisdiction of the English Courts.

We may update or change the terms of this policy from time to time by posting a new version on our website. You are responsible for regularly reviewing this policy so that you are aware of any changes to it. If you continue to use our website or event ticket shop after the time we state the changes will take effect, you will have accepted the changes. This privacy notice was last updated on 1 November 2018.

Should you have any queries or concerns and wish to contact us in regard to data protection, please use either of the following contact details asking to be put in contact with our Data Protection Point of Contact:Email:info@stanstedraceway.comTelephone: 01708 867728Via our website www. stanstedraceway.com If you have any complaints in relation to this policy or otherwise, in relation to our processing of your personal data, you should contact the UK supervisory authority: the Information Commissioner.