Privacy Policy

Last updated: [DATE]

UK Virtual Races ("UKVR", "we", "us") is operated by [TRADING NAME / COMPANY NAME], [registered address, or "a sole trader based in Lancashire, UK" if not a limited company]. This policy explains what personal data we collect, why, and what rights you have over it, in line with UK GDPR and the Data Protection Act 2018.

What we collect

We only ask for what we actually need, and only when we need it:

• At account creation: your name and email address. That's it - we use a passwordless "magic link" login, so we never ask you to create or store a password.
• At challenge entry: which challenge and distance you've entered, and payment confirmation from our payment processor (see "Payment" below) - we don't see or store your card details ourselves.
• At challenge completion: the evidence you submit to confirm your run (for example, a screenshot from a fitness app or GPS watch, or a photo), and - only once your submission is approved - your postal address, so we can send your medal and certificate. We don't ask for your address before it's actually needed.
• Technical information: a session cookie so you can stay logged in (see "Cookies" below).

We do not collect payment card numbers, and we do not ask for information about your health beyond what you choose to include in your own evidence submission (for example, a screenshot that happens to show your heart rate - we don't require this and don't use it for anything beyond confirming the run took place).

Why we collect it, and our legal basis

Data	Purpose	Legal basis
Name, email	Creating and running your account, sending login links	Contract (you asked us to provide this service)
Entry & payment confirmation	Processing your challenge entry	Contract
Evidence submission	Confirming your completion, awarding your medal/certificate	Contract
Postal address	Posting your medal and certificate	Contract

Where we send you optional emails about new challenges (rather than transactional emails about your own entries), we rely on your consent, and you can unsubscribe at any time.

Who we share it with

We use a small number of trusted providers to run UKVR, and only share what each one needs to do its job:

• Payment processing: Stripe handles all card payments. We never see or store your full card details - Stripe's own privacy policy covers how they process that data.
• Hosting and email delivery: our website and database are hosted with IONOS (UK/EU data centres), and outgoing emails (magic links, confirmations) are sent via IONOS's mail service.
• Medal & certificate fulfilment: your postal address is used internally to address your parcel and is not sold or passed to any third party for marketing purposes.

We do not sell your data, and we do not share it with advertisers.

How long we keep it

We keep account and entry data for as long as your account is active, so your run history stays available to you. If you ask us to delete your account (see "Your rights" below), we'll remove your personal data within [30] days, except where we're required to keep basic transaction records for tax/accounting purposes (typically 6 years, as required by HMRC), in which case only the minimum needed for that purpose is retained.

Cookies

UKVR uses a single essential session cookie to keep you logged in between pages. We don't use tracking or advertising cookies, and we don't run third-party analytics that profile individual visitors. [Update this section if analytics/marketing cookies are added later - they would require a cookie consent banner.]

Your rights

Under UK GDPR, you have the right to:

• Ask what personal data we hold about you, and get a copy of it
• Ask us to correct anything that's inaccurate
• Ask us to delete your data ("right to be forgotten"), subject to the retention exceptions above
• Ask us to restrict or object to certain processing
• Withdraw consent at any time for anything we do on a consent basis (e.g. marketing emails)

To exercise any of these, contact us at [privacy@ukvirtualraces.co.uk]. If you're not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO).

UKRR linking

UKVR is a separate site and brand from ukroadraces.co.uk (UKRR). We never automatically link your UKVR account to any UKRR account or results history. If we introduce an optional linking feature in future, it will always require your explicit, opt-in consent, and can be switched off at any time.

Contact

Questions about this policy or your data can be sent to [privacy@ukvirtualraces.co.uk].