Legal
Privacy policy
Summary
This privacy policy sets out how we collect, store and use information about you when you use or interact with our websites and where we otherwise obtain or collect information about you. This summary is a general overview only and must be read with the full sections below.
Data controller. Brentwood Karting is operated by Brentwood Park Karting Centre Ltd (company number 03145349) and Lakeside Karting by Lakeside Karting Ltd (company number 03584761). Both are private limited companies registered in England and Wales and part of Letsgoactive Ltd (company number 04331946). Registered office: 46-54 High Street, Ingatestone, Essex, CM4 9DW. You can contact the data controller by email at info@letsgoactive.co.uk. If you have any questions about this policy, please contact the data controller.
- How we collect information: when you provide it to us (by contacting us, placing an order, subscribing to our newsletter or creating an account), from your use of our website using cookies and similar technologies, and occasionally from third parties.
- Information we collect: name, email address, telephone number, contact address, gender, country, payment details, IP address, information from cookies, information about your device and browser, and information about how you use our website (pages viewed, time viewed, what you clicked, and your approximate location based on IP address).
- How we use it: for administrative and business purposes (particularly to contact you and process your orders), to improve our business and website, to fulfil our contractual obligations, to advertise our services, to analyse your use of our website, and in connection with our legal rights and obligations.
- Disclosure to third parties: only to the extent necessary to run our business, to our service providers, to fulfil contracts with you, and where required by law or to enforce our legal rights.
- We do not sell your information to third parties, other than in the course of a business sale, purchase or similar event.
- Automated decision making and profiling: we use these through remarketing advertisements and web analytics. See the section below.
- Retention: no longer than necessary, taking into account our legal obligations (for example tax records), any other legal basis for using your information, and the factors set out below.
- Security: appropriate technical and organisational measures, including secure servers, SSL encryption of data transfers, and granting access only where necessary.
- Cookies: we use essential, functional, analytical and targeting cookies. See our cookie policy.
- Transfers outside the EEA: in certain circumstances we transfer your information outside the European Economic Area, including to the United States, with appropriate safeguards in place.
- Sensitive personal information: we do not knowingly collect it. Please do not send it to us.
Your rights in relation to your information
Subject to certain limitations, you have the following rights, which you can exercise by emailing info@letsgoactive.co.uk.
You also have the right to lodge a complaint with a supervisory authority under Article 77 of the General Data Protection Regulation. In the UK this is the Information Commissioner's Office (ICO), ico.org.uk. The rights above are a summary only and limitations apply to many of them. Further information is available on the ICO website and in Articles 12 to 22 and 34 of the GDPR.
Where you request access to your information we are required by law to take reasonable measures to verify your identity. Where we hold appropriate information about you we will use that. Otherwise we may require original or certified copies of documents before providing access, and we will confirm what is needed when you make the request.
- To access your information and receive information about its use
- To have your information corrected and completed
- To have your information deleted
- To restrict the use of your information
- To receive your information in a structured, commonly used and machine readable format (for example a CSV file) and to have it transferred to another data controller
- To object to the use of your information for certain purposes, including profiling and direct marketing
- To withdraw your consent at any time where we rely on consent, without affecting the lawfulness of processing before withdrawal
- Not to have significant decisions made about you based solely on automated processing, including profiling
- To complain to a supervisory authority
Your right to object
You may object to us using your information where we do so to carry out a task in the public interest or for our legitimate interests, including profiling, and to us using your information for direct marketing, including any related profiling.
You can object to direct marketing by clicking the unsubscribe link at the bottom of any marketing email we send you, or by emailing info@letsgoactive.co.uk asking us to stop, or including the words OPT OUT. To object to our use of information from cookies, see the section on accepting or rejecting cookies in our cookie policy.
Information we collect when you visit our website
Web server logs. Our website server automatically logs the IP address you use to access our website, the pages accessed, information requested, approximate location, date and time, the source of your visit (for example the referring website), and your browser version and operating system. Our third party hosting provider stores server logs to ensure network and IT security, analysing them to identify and prevent unauthorised access, malicious code, denial of service and other cyber attacks. Unless we are investigating suspicious or potential criminal activity we do not attempt, or allow our hosting provider to attempt, to identify you from server logs. Legal basis: compliance with a legal obligation to keep our processing secure (Article 6(1)(c) GDPR) and our legitimate interest in network and information security (Article 6(1)(f) GDPR). Our server is located in the United Kingdom.
Cookies and similar technologies. Cookies are data files sent from a website to a browser to record information about users. We use essential, functional, analytical and targeting cookies. You can reject some or all cookies by changing your browser settings, but doing so may impair your ability to use our website. See our cookie policy and www.allaboutcookies.org.
Information we collect when you contact us
Email. When you email us we collect your email address and any other information in the email, such as your name, telephone number and signature block. Emails are stored by our third party email provider, Google (Gmail), on servers outside the European Economic Area.
Contact form. We collect your name, email address and anything you include in the message field. If you do not provide the mandatory fields you will not be able to submit the form. Contact form submissions are stored by a third party service, Ontraport, on servers in the United States.
Phone. We collect your phone number and any information you provide during the conversation. Call details such as your number and the date and time are processed by our telephone provider and stored in the United Kingdom.
Post. We collect any information you send us by post, which is stored in the United Kingdom.
Legal basis for all of the above: our legitimate interest in responding to enquiries and keeping records of correspondence (Article 6(1)(f) GDPR), and where your message relates to us providing services to you, the necessity of performing a contract or taking steps at your request before entering one (Article 6(1)(b) GDPR).
Information we collect when you interact with our website
E-newsletter. When you sign up for our e-newsletter we collect your email address. We rely on your consent (Article 6(1)(a) GDPR), which you give by signing up, and on our legitimate interests. Our mailing list is administered by Ontraport on servers in the United States.
Registering and booking online. When you register and create an account by booking with us online we collect your name, contact address, gender, email address, phone number, password and any other information you provide. Without the mandatory fields you cannot register. Legal basis: our legitimate interest in administering accounts and running our business (Article 6(1)(f)), necessity of performing a contract, including sending receipts and confirmations (Article 6(1)(b)), and our legal obligation to issue invoices and keep accounting records (Article 6(1)(c)). Account information is stored by our booking software provider, which may transfer or store it outside the European Economic Area with appropriate safeguards.
Information we collect when you place an order
When you order goods or services we collect your name, email address, telephone number, contact address, gender, account details (if applicable) and payment details. Without this information you cannot purchase from us. Legal basis: necessity of performing a contract (Article 6(1)(b) GDPR) and our legal obligation to issue invoices and keep accounting records (Article 6(1)(c) GDPR).
Payments are processed by a third party payment processor, which collects and processes your payment information under its own privacy policy and may transfer transaction information outside the European Economic Area with appropriate safeguards.
Information from third parties
Generally we do not receive information about you from third parties. Where we do, it will usually be from businesses and clients we work with who recommend our services to you, and it will usually be your name and contact details. Legal basis: necessity of performing or entering a contract at your request (Article 6(1)(b)), your consent where you asked the third party to share it (Article 6(1)(a)), or our legitimate interests, for example performing a sub contract or investigating an infringement of our rights (Article 6(1)(f)). If we receive information about you in error, or without a legal basis, we delete it.
In certain circumstances, for example to verify information we hold or obtain missing information we need to provide a service, we obtain information from publicly accessible sources such as Companies House, business directories, social media and websites. Legal basis: necessity of performing a contract and our legitimate interests.
Automated decision making and profiling
We use automated decision making and profiling. You have the right to object, which you can do by opting out of cookies and similar technologies using our cookie tool. If you do not want us to process your actual IP address you can use a VPN or a service such as Tor.
Display advertising. We automatically display advertisements for our services on other websites you visit based on the fact you have visited our website, using cookies. This is more efficient than displaying advertisements manually. Cookies will recognise that you have visited our website and collect information about your online behaviour. You can block these cookies using our cookie tool or by opting out of personalised ads with Google. Legal basis: your consent, given by turning on remarketing cookies (Article 6(1)(a) GDPR).
Web analytics. Google Analytics collects your approximate location (from your IP address) and your behaviour (from cookies) when you use our website, such as pages visited and what you click on. We only process cookie information if you have consented. Information is anonymised and stored on an aggregate basis. This helps us understand what visitors want, how to improve the website and how to market our services. Legal basis: our legitimate interest in understanding visitor preferences and improving our website (Article 6(1)(f) GDPR).
Heat mapping. Crazy Egg heatmaps show which elements of our website get the most interaction, based on mouse clicks, keystrokes, pages visited and visit duration. We only process this if you have consented to cookies. Legal basis: our legitimate interest in improving our website (Article 6(1)(f) GDPR).
Facebook advertising. We use profiling to advertise on Facebook and to track conversions using the Facebook Pixel. Facebook targets advertisements based on criteria such as what you have liked, and if you click one your actions on our website are tracked and shared with Facebook (if you consented). You can turn the Pixel off with our cookie tool, change your Facebook ad settings, or opt out via youronlinechoices.com. Legal basis: our legitimate interest in marketing effectively (Article 6(1)(f) GDPR).
Disclosure and additional uses of your information
Service providers. We use third parties to provide services necessary to run our business, who process your information on our behalf: a telephone provider (UK), an email provider (USA), a mailing list provider (USA), an IT service provider (UK), a web developer (UK) and a hosting provider (UK). Information is shared with them where necessary to provide the service you have requested. We do not name all our providers publicly for security and competitive reasons, but will do so on request where you have a legitimate reason. Legal basis: our legitimate interest in running our business efficiently (Article 6(1)(f)) and necessity of performing a contract (Article 6(1)(b)).
Google, Facebook and Crazy Egg. Google collects information through Google Analytics, including IP addresses and cookie information, shared on an aggregated and anonymised basis. Crazy Egg collects mouse behaviour through code and cookies. Facebook collects information about your interaction with our website through its Pixel and cookies so we can run advertising campaigns. Information collected by all three is stored in the United States. You can opt out of Google Analytics with its browser plugin and out of Crazy Egg on its website. Legal basis: our legitimate interest in meeting our contractual obligations to Google (Article 6(1)(f)).
Business related third parties. Where necessary we share information with our accountants (for tax returns and year end accounts), advisors (accountants, financial advisors, lawyers and PR professionals), affiliates (who promote our business), business partners (who provide complementary services, including our booking software provider and the LetsGoActive group), independent contractors and insurers (for claims and disclosure obligations). Apart from our booking software provider, which also operates in the United States, these are all located in the United Kingdom. Legal basis: our legitimate interest in running our business efficiently.
Business sale. We may share your information with a prospective or actual purchaser or seller in the context of a business or asset sale, merger or similar event. Legal basis: our legitimate interest in allowing such a transaction to take place.
Legal reasons. We may use or disclose your information to report possible criminal acts or threats to public security to a competent authority such as the police, to enforce our legal rights (including sharing information with debt collection agencies if you do not pay amounts owed), in connection with a legal dispute or proceedings, and to comply with laws, regulations, court orders and other legal requirements. Legal basis: our legitimate interests in preventing crime, enforcing our rights and resolving disputes (Article 6(1)(f)), and compliance with legal obligations (Article 6(1)(c)).
How long we retain your information
In any other circumstances we retain your information no longer than necessary, taking into account the purpose and use of the information, any legal obligation or legal basis to continue processing it, how valuable it is, industry practice, the risk, cost and liability of holding it, how hard it is to keep accurate, and the nature of our relationship with you.
- Server log information: 3 months
- Order information: seven years from the date of the order, for tax purposes and to defend legal claims
- Correspondence and enquiries: as long as it takes to respond and resolve the enquiry, and one further year
- E-newsletter: for as long as you remain subscribed, or until we cancel the newsletter
- Account information: for as long as your account is active, deleted after 24 months of inactivity
How we secure your information
We take appropriate technical and organisational measures to protect your information against unauthorised or unlawful use and accidental loss or destruction, including sharing it only to the minimum extent necessary and on an anonymised basis where possible, storing it on secure servers, verifying the identity of anyone who requests access, and using SSL encryption for any forms on our website.
Transmission of information over the internet is not entirely secure. If you send information to us over the internet, whether by email, our website or any other means, you do so at your own risk, and we cannot be responsible for any loss or damage you suffer as a result.
Transfers of your information outside the European Economic Area
Your information will be transferred and stored outside the EEA in the circumstances below. We will also transfer information outside the EEA where required to comply with a legal obligation, such as a court order, with appropriate safeguards in place.
- Email: stored by Google (Gmail) in the United States, Taiwan, Singapore or Chile, using approved transfer mechanisms or EU approved model contract clauses
- E-newsletter and contact forms: stored by Ontraport in the United States
- Online registration and booking: may be stored outside the EEA by our booking software provider, with appropriate safeguards
- Crazy Egg: mouse behaviour information stored in the United States
- Facebook: advertising and Pixel information stored in the United States and other countries under EU approved model contract clauses or your explicit consent
- Payment processing: transaction information may be transferred outside the EEA by our payment processor with appropriate safeguards
- LiveChat: conversation information stored in the United States
Sensitive personal information
Sensitive personal information reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric information, health, sex life or sexual orientation. We do not knowingly collect it and you must not submit it to us. If you do, you will be treated as having explicitly consented to our processing of it under Article 9(2)(a) GDPR, and we will process it only for the purpose of deleting it.
Children's privacy
We do not knowingly contact or collect information from anyone under 18, and our website is not intended to solicit information from them. If we are notified that we have received information about someone under 18 through the fraud or deception of a third party, we will, where required by law, obtain parental consent to use it or delete it from our servers. To notify us, email info@letsgoactive.co.uk.
Do Not Track
Do Not Track is a browser privacy preference that asks websites not to track you. At this time we do not respond to Do Not Track signals. We also use standard technologies such as pixel tags to track visitors, which may collect information even if Do Not Track is on. To opt out of the tracking technologies we use, see our cookie policy.
Changes to this policy
We update this policy from time to time. For minor changes we update the effective date at the top, and the new version governs our processing from that date. For major changes, or where we intend to use your information for a new purpose, we will notify you by email where possible or by a notice on our website, and where required will obtain your prior consent.
The copyright in this policy is owned by or licensed to us. All intellectual property rights in it are reserved.
