Data Protection
UK Road Races · Last updated 20 June 2026
This page summarises how UK Road Races meets its obligations under UK GDPR and the Data Protection Act 2018. It works alongside our full Privacy Policy, which covers what we collect and why in more detail.
Data Controller
UK Road Races (ukroadraces.co.uk) acts as the data controller for personal data collected through this website. For data protection queries, contact shoestring360@gmail.com.
Lawful Basis for Processing
Certificate purchases
Lawful basis: Contract — we need your email to deliver the certificate you've purchased.
Newsletter subscription
Lawful basis: Consent — you actively opt in and confirm via a double opt-in email, and can withdraw consent (unsubscribe) at any time.
Bulk/organiser-paid certificates
Lawful basis: Legitimate interest — the race organiser has commissioned us to deliver a service (certificates) to their event's finishers, who have a reasonable expectation of receiving this as part of taking part in the race.
Where Your Data Is Stored
Personal data collected through this site is stored on secure servers provided by IONOS (our hosting provider) and, for payment processing only, by Stripe. We do not store any data on personal devices or unsecured systems.
International Data Transfers
Stripe, our payment processor, may process data outside the UK as part of its global payment infrastructure. Stripe maintains appropriate safeguards for international transfers in line with UK GDPR requirements — see Stripe's Privacy Policy for full details.
Data Minimisation
We only collect the minimum personal data needed to provide each specific service. For example, we do not require your name, address, or phone number to purchase a certificate — only an email address for delivery and receipt purposes; your name is taken from the results data, not entered separately by you.
How to Make a Data Request
You can ask us to:
- Access — receive a copy of the personal data we hold about you
- Rectify — correct any inaccurate data
- Erase — delete your data, where we have no overriding legal reason to retain it
- Restrict — limit how we use your data while a query is resolved
To make any of these requests, email shoestring360@gmail.com with "Data Request" in the subject line. We aim to respond within one calendar month, as required under UK GDPR.
Complaints
If you have concerns about how your data has been handled, you can contact us directly first, or raise a complaint with the UK's data protection regulator, the Information Commissioner's Office (ICO).