Privacy and AI notice
Final draft, version 1.1
B1 Who controls your information
This notice covers My Paddock users, visitors and enterprise owners, administrators, staff and customer contacts across Storage, Events, Dealership and Suppliers. Racingedge Technology ltd controls its account, billing, platform and security processing. For privacy requests, use Contact us on racingedge.com. An enterprise may independently control its customer records; RacingEdge processes specified records on its instructions under Part C. Payment providers have their own responsibilities for regulated services, identified before activation. Roles depend on the processing activity, not the module or account label.
B2 Information and sources
We receive information from you, authorised business staff, counterparties, connected providers, public vehicle sources where used, and your interaction with the service. This may include account and contact information, business/staff details, vehicle identifiers, photos and documents, messages, bookings, expenses, payment references, verification outcomes, device/security records and journey data you choose to record. VINs, number plates and vehicle records can be personal data when linked to a person. We identify non-user sources and provide the required notice when collecting personal information indirectly.
| Purpose and information | Lawful basis and limits |
|---|---|
| Accounts, subscriptions, selected vehicle services and requested AI extraction | Contract where objectively necessary for our contract with you. Business staff/contact administration may use legitimate interests instead. |
| Storage, supplier, dealer and event records processed solely for an enterprise | The enterprise identifies its lawful basis as controller. RacingEdge follows its documented instructions as processor. |
| Payments, invoices, fraud and disputes | Contract for requested payment functionality; legal obligation where a specific duty applies to us; proportionate legitimate interests for security and claims. Provider duties are separately explained. |
| Optional analytics and advertising tracking | Consent under the chosen cookie model. No optional tags before a valid choice. |
| Marketing and preferences | Consent where required; any legally permitted existing-customer exception is assessed separately with an opt-out. No purchased consent assumed. |
| Precise route and telemetry features | Request-based collection and device permission, with a documented lawful basis for the feature. Separate consent for optional sharing or secondary use where required. |
B3 Your choices: information necessary for a requested feature is identified when collected. Withholding it may prevent that feature; refusing marketing or optional cookies does not prevent normal account, subscription or wallet access. We do not use a blanket acceptance of this notice as consent to every processing activity.
HOW INFORMATION IS USED
AI sharing and protection of data
B4 Processing through AI
Selected photo or document content is sent only to the configured AI/OCR providers needed for your requested feature. A multi-page document is treated as one document while its pages may be processed individually. Outputs and confidence/review information may be stored with the vehicle record. Avoid uploading unrelated personal information. AI processing is not enabled by accepting marketing cookies; it follows the feature request, the documented lawful basis and the disclosed service-provider arrangements.
We do not use private documents, messages, identity/payment records or precise routes for general-purpose model training by us or our processing providers. We require matching contractual and configuration restrictions for providers processing this information. If a separate improvement programme is offered, its data, purpose, recipients, retention and withdrawal limits will be explained separately. Manual correction is available. AI does not itself authorise a payout, determine vehicle ownership or certify safety. Where any automated decision has a legal or similarly significant effect, we explain the process and applicable rights to representations, human intervention and challenge; do not infer that a score is a final human decision.
B5 People and organisations who receive data
Recipients may include the enterprise or transaction counterparty you select, authorised staff, payment and identity providers, hosting and backup providers, AI/OCR processors, messaging providers, support vendors and authorities where lawfully required. Public listings are accessible to the public and may be indexed or copied. Private vault content is not automatically public. We disclose the minimum appropriate information for each purpose. A prospective business buyer may receive protected due-diligence information where lawful; any completed transfer remains subject to data-protection duties.
B6 Provider details and international transfers
Information is shared with the recipient categories and for the purposes described in B5. The privacy information for the relevant feature identifies applicable overseas processing and safeguards before collection. For a restricted transfer outside the UK, we use an applicable adequacy regulation or appropriate safeguards, such as the UK International Data Transfer Agreement or approved Addendum, together with the required assessment. Contact us on racingedge.com for information about the provider, processing location and a copy or explanation of the safeguards. Cookie consent is not a blanket authorisation for overseas disclosure. A materially new recipient or purpose is explained before that processing begins.
B7 Security and access
We apply appropriate safeguards to protect confidentiality, integrity and availability, including proportionate access restrictions, security monitoring, recovery controls and provider oversight. No online service can promise zero risk. Staff access must be limited to authorised support and operational needs. We assess incidents and notify affected people or the regulator where required. Do not share passwords, payment authentication codes or unnecessary sensitive documents in ordinary chat.
CONTROL OF YOUR INFORMATION
Retention rights and privacy complaints
B8 How long information is kept
We retain information only for the stated service, legal, security and dispute purposes. Closing an account stops ordinary account use but does not automatically remove records another controller must lawfully retain. We apply the criteria below and documented deletion schedules. When the purpose ends, we delete or irreversibly anonymise the record unless a specific legal duty or live dispute requires restricted retention.
| Record group | Retention criteria |
|---|---|
| Account, cars, media and vault | While the account or record is maintained. After deletion or closure, remove when export, requested service and specific legal/dispute needs end. |
| AI uploads and outputs | Outputs follow the vehicle record. Temporary inputs remain only for task completion, troubleshooting or a specific security/legal need, never unrelated model training. |
| Journeys, GPS and telemetry | Until journey deletion or account closure, subject to specific security, legal or dispute needs. Recipients control their own lawfully shared copies. |
| Invoices, transactions and disputes | For applicable accounting, tax, payment and claim requirements, measured from the transaction, accounting period or dispute closure. Restrict later access. |
| Messages, bookings and custody evidence | During the service or custody relationship and any specific complaint, damage claim or legal duty after closure. Delete when those purposes end. |
| Backups, security logs and consent evidence | For documented security/accountability needs. Deleted backups stay outside ordinary use until scheduled overwrite. Browser cookie choices expire after 180 days. |
B9 Your rights
Depending on the legal basis and circumstances, you may request access, correction, erasure, restriction, portability or objection to processing, and withdraw consent prospectively. You can object to direct marketing at any time. Withdrawal does not make earlier lawful processing unlawful. Some rights have legal exceptions; we explain any refusal and your review options. We verify identity proportionately and respond within the applicable legal period, normally one month for a rights request, subject to lawful clarification or extension. These rights are not conditional on a paid subscription.
B10 Contact and complaints
Use Contact us on racingedge.com and state whether you are making a privacy complaint or exercising a data right. We acknowledge a data-protection complaint within 30 days, investigate and communicate the outcome without undue delay, keeping you informed. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint. Contacting us does not waive that right. A privacy complaint and a subject-access request may require different response processes. We update this notice when purposes or arrangements change and provide advance information or seek a new choice where required.
The service is intended for adults. If we discover children's information has been collected inappropriately, we assess and address it. Where children are likely to access a feature, we assess and apply the protections required by law.