Privacy policy

Yves Hug
Elgagass 12
9496 Balzers
Liechtenstein
Email: info [at] tracklap [dot] eu

As the controller is based in Liechtenstein (EEA), the General Data Protection Regulation (GDPR) applies in conjunction with the Liechtenstein Data Protection Act.

Tracklap is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When the website is accessed, Vercel automatically processes technical access data such as IP address, date and time, page requested and browser type in server logs. This is necessary to deliver the website and protect it against misuse. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation).

Data may be transferred to the USA in the process. The transfer is based on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. Details: Vercel privacy policy.

For anonymous audience measurement (e.g. number of page views and how often booking links to an organiser are clicked) we use Vercel Web Analytics. No cookies are set and no usage profiles are created; visits are only grouped via a short-lived, non-traceable hash that is discarded after 24 hours. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in improving the service). Details: Vercel Web Analytics and privacy.

We do not use any other analytics or tracking tools.

When you enter a place or postcode in the distance search, we forward this search term via our server to OpenStreetMap's Nominatim geocoding service to convert it into coordinates. Your IP address is not passed on to OpenStreetMap. If you choose «Use my location», your browser asks for permission first; the coordinates are only used to calculate distances and are not stored.

Your saved dates («My Season»), your best time in the reaction game and whether you have chosen a language or dismissed the language hint are stored locally in your browser (local storage) and are not transmitted to us unless you choose to sign in (see section 6). When you are signed in, the browser also stores the e-mail address of the account the list is synced with. To display the saved dates, your browser requests their details from us; only the identifiers of the dates are transmitted, nothing that identifies you personally. A share link likewise only contains these identifiers. You can delete the data at any time in your browser settings.

Under «My Season» you can choose to sign in with your e-mail address to use your list on several devices. There is no password. For this we store your e-mail address, the language for our e-mails, the time of registration and of your last sign-in, and your saved dates. The data is kept in our database at Neon (Neon, Inc., USA) on servers in Frankfurt am Main. The legal basis is Art. 6(1)(b) GDPR (providing the feature you requested).

To sign in, we send you an e-mail with a link and a code. Both are valid for 15 minutes, are stored by us only as an irreversible hash and are deleted after use or expiry. To prevent misuse, we additionally store an irreversible hash of your IP address for this period.

After signing in we set two cookies: a strictly necessary session cookie that keeps you signed in (valid for 12 months or until you sign out), and a hint cookie without personal data so the page knows to load your list. Without signing in we set no cookies.

We use Resend (Resend, Inc., USA) as a processor to send the e-mails. Your e-mail address and the content of the sign-in and notification e-mails are transmitted to Resend. The transfer to the USA is based on the European Commission's standard contractual clauses. Details: Resend privacy policy.

Optionally, you can turn on notifications under «My Season» (legal basis: your consent, Art. 6(1)(a) GDPR). We then send you an e-mail when one of your saved dates is down to its last few places or has places available again. For this we store whether you turned notifications on, the availability state we last saw for your saved dates and when we last notified you. Every such e-mail contains a link to turn the notifications off with one click; you can also do so at any time under «My Season». This is not a newsletter and not advertising. Notifications are only sent while the setting is on.

Also optionally, when signed in you can follow organizers or tracks (legal basis: your consent, Art. 6(1)(a) GDPR). We then send you an e-mail when new dates appear there. For this we store which organizers and tracks you follow and when we last notified you. Every such e-mail contains a link to unfollow all of them with one click; you can unfollow individually at any time under «My Season» or on the organizer's or track's page.

When signed in, you can report that something about a date is missing or wrong («Something missing or wrong?»; legal basis: our legitimate interest in accurate information, Art. 6(1)(f) GDPR). For this we store which date you reported, the kind of report you chose, your optional comment, the time and your account. The report is also sent to us by e-mail (via Resend, see above) so we can check it and reply if we have questions. Reports are deleted together with your account.

For events we show how many signed-in users have saved an event («Popular»). Only a total is shown, and only from a minimum number – never who saved an event.

You can delete your account yourself at any time under «My Season». Your e-mail address, saved dates, followed organizers and tracks, your reports about dates, your short profile with posts and replies (section 7), a photographer profile (section 8) and all sign-ins are removed immediately.

When signed in, you can choose to create a short profile, show yourself to other signed-in users at individual trackdays and write posts and replies in the exchange for a trackday (legal basis: Art. 6(1)(b) GDPR, providing the feature you requested). For this we store your short profile (nickname and, optionally, vehicle type, vehicle, region, experience and «About me»), the trackdays at which you show yourself, and your posts and replies with their time.

Before you take part, you accept the rules for «Who's going?». As proof, we store which version of the rules you accepted and when (legal basis: Art. 6(1)(f) GDPR, legitimate interest in verifiable consent). This information is deleted together with your account.

Your short profile and whether you are «going» or «interested» (derived from your booking status) are only visible to signed-in users, and only at the trackdays where you switched on «Show me here». Posts and replies are visible to signed-in users together with your nickname. Visitors who are not signed in only see how many people show themselves. Your e-mail address is never shown to others, and merely saving a date does not make you visible. Profiles, posts and replies are not intended for search engines.

When someone replies to your post or in a conversation you wrote in, we send you an e-mail (via Resend, see section 6). For this we store whether reply e-mails are switched on. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in informing you about replies in your conversations). You can switch these e-mails off at any time with one click in every e-mail or in the cockpit under «My Season».

Signed-in users can report posts and replies. We store the report (reason, optional comment, time and reporting account) and receive it by e-mail together with the reported content and the author's nickname and e-mail address, so that we can check it and get in touch if needed. The author is not told who reported. We can hide reported content; if three different people report the same content, it is hidden automatically until we have checked it. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a safe and respectful exchange).

You can remove your short profile at any time in the cockpit under «My Season»; you are then no longer visible at any trackday. You can delete your own posts and replies at any time. Posts you do not delete remain without a nickname («Former profile») after the profile is removed. If you delete your account, your short profile, posts, replies and reports are removed completely – including other people's replies to your posts.

If you take photos at trackdays, you can voluntarily list yourself in our directory with a photographer profile when signed in; we can also create a profile ourselves and offer it to the photographer to take over (legal basis: Art. 6(1)(b) GDPR, providing the function you asked for, or Art. 6(1)(f) GDPR for profiles we create from publicly available information). We store the name (person or studio), location, short description, an optional “About me” text, the languages you communicate in, website, Instagram name, a public contact address, vehicle types, how and on what terms drivers get their photos, the circuits and organisers you add, and the status and times (created, submitted, published, changed).

Published profiles are public and meant for search engines. Your account's sign-in address is never shown, only the contact address you enter yourself. We don't store or show photos; we only link to your website or Instagram profile.

We review a profile before its first publication. When you submit a profile or change the name, description or links of a published profile, we receive an e-mail (via Resend, see section 6) and log it. As proof we store which version of the rules for photographer profiles you accepted and when (Art. 6(1)(f) GDPR).

You can pause your profile at any time or delete it under «Photographer profile»; it is also deleted with your account.

When you write to us through the contact form, we process your name, your e-mail address, the topic you chose and your message in order to answer your enquiry. The message is delivered to us by e-mail via Resend (see section 6); we do not store it in our database. We only count how many messages were sent, without content or address. The legal basis is Art. 6(1)(b) GDPR where your enquiry aims at a contract (for example a partnership), otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).

To prevent abuse, we derive a non-reversible hash from your IP address and keep it in the server's memory for at most 15 minutes to limit too many messages in a short time; it is not stored. We keep your e-mail to us as long as needed to handle your enquiry and delete it afterwards, unless a legal retention obligation applies.

Paid partner spots are always labelled «Sponsored» or «Main partner». Partners have no influence on the order, prices or free spots of the dates. Partner links are marked as paid links for search engines (rel="sponsored").

Partners cannot embed their own code on Tracklap: no tracking pixels, cookies or ad-network scripts. Partner logos and images are served from our own server. For the report to partners we only count how often a partner was seen (at least half of it visible for one second) and how often its link was clicked. We only store totals per partner, spot and day, without IP address, without cookies and without any link to you. These events also appear anonymously in our audience measurement (see section 3). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in billing and evaluating partner spots).

If you follow a partner link, you reach the partner's website via a short step on our side (for counting). The partner's privacy policy applies there.

The dates, prices and organiser details shown come from publicly accessible organiser websites. If you follow a booking link, the organiser's privacy policy applies on their website.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). To exercise them, please contact the email address given above.

You can also lodge a complaint with the competent supervisory authority: Datenschutzstelle Liechtenstein, Postfach 684, 9490 Vaduz, www.datenschutzstelle.li.