Privacy notice · updated 24 October 2026
Your data, and your child's.
VLTA Motorsport helps drivers and their families build a sponsor-ready profile. This notice explains what we collect, why, who sees it and how to control it.
Who we are
VLTA LTD, 19 Wildern Court, Hedge End, SO30 4DT, company number 16561041, is the controller of your personal data. Registered with the Information Commissioner's Office: ZC024978. Contact us at info@vlta.co.uk.
Children
- Nobody under 18 can have an account. A driver under 18 is added and managed by a parent or guardian, who controls everything about their profile.
- A junior profile is private until the guardian ticks a consent statement and publishes it. We record when that consent was given and the exact wording.
- We ask only for a racing name, number, series, class, car, team and an optional bio. We never ask for a child's address, school, date of birth or phone number.
- Sponsor messages about a junior go to the guardian, never to the child.
- Photos are hidden from the public profile unless the guardian chooses to show them, and location data is removed from every photo on upload.
- We do not profile children, show them advertising, track them across other sites or sell anyone's data.
What we collect and why
| Data | Why | Lawful basis |
|---|---|---|
| Account: name, email, a scrambled (hashed) copy of your password | To run your account and sign you in | Contract |
| Driver profile, results, partners, social figures you enter | To build the profile, posts and sponsor reports you ask for | Contract |
| Publishing a junior profile or showing a junior's photos | So a child's details are public only with a guardian's agreement | Consent, given by the guardian, withdrawn at any time by unpublishing or hiding photos |
| Images you upload (location and other hidden data removed) | For your Builder graphics and, if you choose, your profile. Photos are also cut out (the driver or car separated from the background) by software running on our own server, so styles can place type behind the subject. No image is sent to anyone else for this. | Contract |
| Connected Instagram or TikTok accounts, if you connect one: the account name, follower count, and monthly totals of posts, reach and views; an access key, stored encrypted | To put real social figures in your sponsor reports. We only read these totals: we never post, comment, or see messages, and you can disconnect at any time | Contract |
| Official results imported from series timing | To keep results accurate and draft result posts | Legitimate interests: accurate, sourced results for the driver |
| Sponsor enquiries: sender's name, company, email, message | To pass the message to the profile's owner | Legitimate interests of the sender and the owner |
| Daily totals of profile visits and partner-link clicks | For sponsor reports | Legitimate interests. Only a number per day is stored, nothing about the visitor |
| Subscription status, styles you have bought, and Stripe reference numbers | To take payment and keep what you bought on your account. Card details go to Stripe and never reach us | Contract, and legal obligation for accounting |
| Security records: sign-in sessions, abuse reports | To keep accounts and children safe | Legitimate interests and legal obligation |
Who can see it
- Anyone can see a profile once its owner publishes it, and a photo only if the owner chooses to show it.
- A partner or prospective sponsor can see a report or proposal only through a link the owner sends, which the owner can withdraw. These never show the guardian's name or email.
- Our service providers process data for us under contract: hosting (Render), payments (Stripe) and, once enabled, email (Resend). Some are based outside the UK. Where data leaves the UK, we rely on UK adequacy regulations or the UK's approved international data transfer agreement.
- Authorities, where the law requires it or a child is at risk.
How long we keep it
Everything stays until you delete it. Deleting your account removes your profiles, results, images, posts, partners, reports and share links straight away. Copies in our backups are deleted within 30 days. Stripe keeps payment records for as long as the law requires.
Cookies
We use two cookies, both essential: one keeps you signed in, and one protects forms from forgery. There are no analytics or advertising cookies, so there is no cookie banner.
Your rights
You can see, correct, download, restrict or delete your data, and object to how we use it. Most of this is built in: Download my data and Delete account are on your dashboard, and you can edit or unpublish a profile at any time. For anything else, email info@vlta.co.uk. We reply within one month.
Complaints
If you are unhappy with how we have handled personal data, email info@vlta.co.uk with "Data protection complaint" in the subject. We acknowledge every complaint within 30 days, look into it without undue delay, keep you updated and tell you the outcome. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes
If we change this notice in a way that matters, we will tell account holders before the change takes effect.