Racing Club Privacy Notice

We use your personal information to set up and manage your Racing Club membership, take and match your payments, and keep our membership records up to date. We will only send club news, updates or offers by email or WhatsApp if you choose to receive them.

This notice is published on the main Brian Ellison Racing & Rental website, and the Racing Club join page is on the main site.

The controller is Brian Ellison Racing Ltd, a company registered in England and Wales (company number 05329647), which runs the Brian Ellison Racing Club.

Business address: Langton Road, Norton, Malton, North Yorkshire

Email: club@brianellisonracing.co.uk

We are registered with the Information Commissioner's Office and pay the annual data protection fee (micro organisation, Tier 1). Our registered office address is published on the website.

We are responsible for deciding how your personal information is used. If you have a question about your information, please contact us at:

Email: club@brianellisonracing.co.uk

Postal address: Langton Road, Norton, Malton, North Yorkshire

When you join, we collect:

• your name;
• your email address;
• your phone number;
• the date you last paid;
• your membership status; and
• your membership expiry date.

We may also keep information about your communications with us and your marketing preferences.

We use your information to:

• set up and administer your Racing Club membership;
• confirm your membership and expiry date;
• process and match your payment;
• contact you about essential membership matters;
• maintain accurate membership records;
• manage security and prevent misuse;
• meet our accounting and legal obligations; and
• send club news, updates and offers where you have given us permission to do so.

Our lawful bases

For setting up and running your membership and taking or matching your payment, we rely on performance of a contract under Article 6(1)(b) of the UK GDPR.

For day-to-day administration, maintaining records, managing security and protecting the Club from misuse, we rely on our legitimate interests under Article 6(1)(f) of the UK GDPR.

For email and WhatsApp messages about club news, updates and offers, we rely on your consent under Article 6(1)(a) of the UK GDPR and applicable electronic marketing rules. You can withdraw this consent at any time.

For keeping payment and accounting records, we rely on our legal obligation under Article 6(1)(c) of the UK GDPR.

Your membership administration does not depend on giving marketing consent. The marketing checkbox is optional.

At launch, members will pay by bank transfer. After you submit the joining form, we will give you our bank details and a unique payment reference.

We use that reference to match your payment to your membership. The reference will be kept in our payment and membership records and may also be recorded in HubSpot.

We may later accept card payments through a payment provider, such as Global Payments or Stripe. The payment provider will handle your card details. We do not store your full card details ourselves.

We keep membership information in:

• HubSpot, which we use as our customer relationship management system;
• a secure internal membership spreadsheet; and
• our email and WhatsApp communications, where relevant.

HubSpot is a US-based service provider acting on our instructions as a data processor. We have appropriate contractual arrangements and transfer safeguards in place, or will put them in place before using HubSpot for this information, as required by UK data protection law. These safeguards may include an applicable adequacy arrangement, the UK International Data Transfer Agreement, the UK Addendum to standard contractual clauses, or another lawful transfer mechanism.

We take reasonable steps to keep your information secure and limit access to people who need it for Club administration.

We may share relevant information with:

• HubSpot;
• our email and communications providers;
• WhatsApp and its operator, Meta, where we communicate with you through WhatsApp;
• our payment provider, such as Global Payments or Stripe;
• our accountant; and
• professional advisers or authorities where this is required by law.

The Club and the Brian Ellison Racing office are part of the same business, Brian Ellison Racing Ltd, so information is not shared with a separate organisation. Access to the membership records is restricted to the Club, and member records are held by the Club.

The club inbox is monitored by the Club. Emails sent to club@brianellisonracing.co.uk are also received by the office team, so the office may see what a member writes to the Club. This is so queries, cancellations and requests are dealt with promptly.

Individual member details are passed to the office where that is needed to deal with a member's request or to run the membership.

We do not sell your personal information.

Sometimes two members may use the same email address. For example, a member may use an email address shared with a spouse or another member.

If you give us an email address, we will use it to contact you about your membership and any communications you have agreed to receive. If the person who owns or controls the email address asks us to stop using it, we may remove it from the relevant membership record and ask for another contact method.

Please only provide an email address that you are authorised to use.

We use WhatsApp as a matter of course for day-to-day club communications with members, and we also contact members by email.

WhatsApp is operated by Meta and its own privacy policy applies to the app and its processing of messages.

If you prefer not to use WhatsApp, you can ask to be contacted by email only at any time by emailing club@brianellisonracing.co.uk.

We keep your membership information while you are a member.

After your membership ends, we keep contact details for 2 years and then delete them, unless we need to keep them for longer to deal with a complaint, dispute, legal claim, fraud prevention or another legal requirement.

We keep payment and accounting records for 6 years to meet tax and accounting requirements.

We will keep a record of withdrawn marketing consent or an objection where necessary to make sure we do not contact you again.

When information is no longer needed, we will securely delete it or anonymise it.

You may have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct inaccurate or incomplete information;
• ask us to delete your information in certain circumstances;
• ask us to restrict how we use your information;
• object to certain uses of your information, including direct marketing;
• withdraw consent at any time where we rely on consent; and
• receive certain information in a portable format.

To exercise your rights, contact us at club@brianellisonracing.co.uk. There is normally no charge. We will respond without undue delay and normally within one month.

You can withdraw marketing consent by contacting us or by using the unsubscribe or opt-out instructions in a message. You can also ask us to stop WhatsApp contact and use email only.

Please contact us first if you have a concern about how we use your information.

You also have the right to complain to the Information Commissioner's Office:

Website: https://ico.org.uk/make-a-complaint/

Telephone: 0303 123 1113

Use an unticked, optional checkbox with the following wording:

"I agree to receive Brian Ellison Racing Club news, updates and offers by email and WhatsApp. I understand that I can withdraw my consent at any time."

Membership administration and payment processing are based on the membership contract, not this consent. The checkbox must therefore be optional and must not be a condition of joining. Marketing consent should not be bundled with acceptance of the membership terms.