Privacy policy

1. Who we are

Green Turtle Timing (also shown as GT Motorsport) is a timing and club management service for Motorsport UK karting clubs, run by Green Turtle Media Ltd, trading as Green Turtle Timing, a company registered in England and Wales with company number 14017193, whose registered address is 27 Durnells, Didcot, OX11 6JP.

We are registered with the Information Commissioner’s Office (ICO) under registration number ZB574378.

You can contact us about privacy at privacy@greenturtletiming.com or by post at the address above.

2. Who is responsible for your data

Who is responsible depends on what the data is for.

Club data: the club is responsible, we process it for them

When you join a club, enter one of its events, sign on, are scrutineered, race, or appear in its results, the club (or series) running that activity decides what it collects and why. For that data the club is the controller and Green Turtle Timing is its processor: we store and handle it on the club’s instructions and do not use it for our own purposes.

This covers members, entrants and drivers, licences and licence photos, medical information, signatures and declarations, race-day records, results and lap times. Each club publishes its own terms and privacy information on its club pages (for example yourclub.greenturtletiming.com/terms). For questions or requests about this data, contact the club first; we will help the club answer.

Platform data: we are responsible

For your Green Turtle Timing account itself (sign-in details and security settings), billing clubs for the service, and the running and security of this website, Green Turtle Timing is the controller.

3. What we collect

Your account

• Name, email address and a password (stored only as a one-way hash, never in readable form).
• Two-step sign-in settings: an authenticator app secret or email codes, and a record of devices you have trusted for the day.
• For a parent or guardian, the junior drivers whose accounts you manage, and your household.

Club membership and entries (held for the club)

• Contact details, date of birth, address, emergency contacts and membership records.
• Event entries: class, kart number, transponder, kit and kart details, and the fees and discounts that apply.
• Motorsport UK licence details and photos of licences you or the club upload.
• Signatures and declarations, such as signing on, scrutineering and parental consent.

Medical information (held for the club, special category data)

Medical details you give a club, and records of medical attendances at an event, are special category data. Only the people a club gives the medical permission to (its medical team, club administrators) can see them, and we keep a log of who looked at them.

Race-day records (held for the club)

• Scrutineering checks, sound tests, incidents, penalties, decisions and appeals, and other officials’ records.
• Live timing data: passings from your transponder, lap times, positions and gaps.

Results published publicly

Results, lap times, championship standings and live timing show driver names, kart numbers and classes on the club’s public pages. That is how motorsport results are normally published; ask the club if you have a concern about your name appearing.

Payments

Entry fees and orders are paid to the club through its own payment provider account (Square or Stripe). Card details are entered with the payment provider and we never see or store card numbers. We keep the order, amount and payment status so the club can see who has paid. When a club pays us for the service, Revolut Business handles the payment in the same way.

Messages and notifications

• Emails we send for the club or about your account (for example confirmations, sign-in codes and race-day notices), sent through Resend.
• Text messages a club sends through its own Twilio account, which needs your mobile number.
• Browser push notifications you choose to turn on, which need a subscription address from your browser.

Accounting

If a club connects its own Xero or QuickBooks account, paid orders and refunds (customer name, items and amounts) are posted to that account.

Using the website

Our servers keep short technical logs (address, browser and the pages requested) to keep the service secure and working. We use a few cookies that the site needs to work and no advertising or tracking cookies: see the cookie notice.

4. Why we use it, and our lawful basis

• Club data: we process it only to provide the service to the club, under our contract with the club. The club decides its own lawful basis (usually contract with you, its legitimate interests in running safe events, and legal obligations under Motorsport UK rules). For medical information the club relies on your explicit consent or on the vital interests of the person, and on the substantial public interest conditions for sport safety.
• Your account: to provide the service you sign up for (contract), and to keep accounts secure (legitimate interests).
• Billing clubs: to perform our contract with the club and keep financial records the law requires (legal obligation).
• Security and logs: to protect the service and its users (legitimate interests).

We do not sell personal data, use it for advertising, or make decisions about you by automated means alone.

5. Who we share it with

We use the following services to run Green Turtle Timing. Each one only gets what it needs for its job. Services marked “the club’s own” are accounts the club holds directly with that provider.

We may also share data when the law requires it, and the clubs you race with may share results and race-day records with Motorsport UK as its rules require.

6. International transfers

Our main hosting and backups are in the UK or the European Economic Area, which the UK treats as giving adequate protection. Where a service processes data outside the UK and EEA (for example in the United States), we or the club rely on the UK International Data Transfer Addendum or Agreement, the UK–US data bridge for certified companies, or another safeguard UK GDPR allows.

7. How long we keep it

The same rules apply on every club and a club cannot shorten them:

• Records about a person (membership, entries, licences, signatures, race-day records and results) are kept for 7 years after that person’s last activity on the service.
• Under-18 competitors: kept until they turn 18, then 7 more years, if that is later.
• Medical attendance records: personal details are removed 3 years after the event, keeping only anonymous statistics.
• Open cases: while a club has an open case (for example an incident, appeal or investigation) records involving the people in it are kept until the club releases the hold.

When a record is due, it is anonymised automatically after the club’s administrators have had a report: the person’s name is replaced and their contact details removed, while results stay correct for everyone else. A club that stops paying for the service does not lose its data; it stays under these rules. Encrypted backups are kept for up to 30 days (daily) and 12 months (monthly), then deleted.

8. Your rights

Under UK GDPR you have the right to:

• access the personal data held about you and get a copy;
• rectification: have inaccurate data corrected (you can change much of it yourself under Your account);
• erasure: ask for data to be deleted, where it is not needed for the reasons above (records Motorsport UK rules or the law require may have to be kept, without your name). You can delete your account yourself at Delete your account;
• restriction: ask for its use to be limited while a concern is looked at;
• portability: receive data you gave in a common machine-readable format;
• objection: object to use based on legitimate interests;
• withdraw consent at any time, where something relies on your consent (for example push notifications).

For club data, ask the club; for your account or anything else, email privacy@greenturtletiming.com. We reply within one month. There is normally no charge.

9. Children

Many karting drivers are under 18. A junior driver’s account is run by their parent or guardian, who enters events, gives consents and signs declarations for them. When the driver turns 18 the account can move to their own email address, with their racing history. If you are under 18 and have a question about your data, ask your parent or guardian, your club, or us.

10. How we protect it

• All connections to the site are encrypted (HTTPS).
• Passwords are stored as one-way hashes; clubs’ payment and accounting credentials are encrypted at rest (AES-256).
• Two-step sign-in, required for club administrators and for officials who sign decisions, and available to everyone.
• Access by role: each club sees only its own data, and medical records only the people the club allows.
• Nightly backups, encrypted before they leave the server, with a weekly check that the backups can be read.
• Audit logs of sensitive changes and of who looked at medical records.

11. Complaints

If you are unhappy with how your data is handled, please tell the club or us first so we can put it right. You can also complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint or 0303 123 1113.

12. Changes to this notice

We will update this page when what we do changes, and change the date at the top. For significant changes we will tell clubs and account holders by email.