Karting Benelux Privacy Policy
Last updated: 16 September 2026
This privacy policy gives a complete overview of personal data processed by Karting Benelux for the public karting directory, accounts, organiser tools, planning features, memberships, communications, payments, security and the restricted BMR area. It applies alongside our Cookie Policy and Terms and Conditions.
This policy also covers website pages opened inside the Karting Benelux app. The App Privacy Policy explains the native tools, local app storage, sharing and deletion controls.
1. Who is responsible
The controller is Crauwels Arne, trading as Lespa Software Solutions, Kerkhofstraat 27, 2845 Niel, Belgium, enterprise number 0684.706.469, VAT number BE 0684.706.469. Contact: info@kartingbenelux.com, info@lespasoftware.com or +32 (0)456 06 57 38.
We have not designated a data protection officer. Send privacy questions and requests directly to the contact above.
2. Scope and sources
We obtain data (a) directly from you when you register, complete a profile, submit content, plan, pay or contact us; (b) automatically from your browser and our security/service logs; (c) from Mollie about payment status; (d) from authorised team or organisation administrators; and (e) from publicly accessible circuit, organiser and event pages.
For public-source discovery we retain the source URL, source evidence, relevant public text, technical fingerprints and proposed event data. Proposals are reviewed before publication. If public source information identifies you and you want correction or removal, contact info@kartingbenelux.com.
The same controller and website data practices apply when you use these features in the Karting Benelux app. The app also stores language, stopwatch/lap data, reaction records and any older race notes locally without uploading them. Website account features remain online and are separate from these local records. See the App Privacy Policy for the current app-specific details.
3. Data we process
| Component | Data |
|---|---|
| Account and authentication | Username, email, protected password evidence, account type and role, verification/recovery codes, session version, language, creation and status data, login/security events. For breached-password checking, only the first five characters of a SHA-1 hash go to Have I Been Pwned—never the password or full hash. |
| Profile and location | Optional first and last name, street, postal code, city, country, email, phone, profile photo and coordinates derived from city and country. Uploaded profile photos are re-encoded to strip embedded metadata. |
| Organisers and public listings | Organiser application and explanation; event, training, race, lesson and circuit data including name, category, date, price, classes, participants, description, website, public contact email/phone, location, coordinates, images, source and creator. |
| Search, favourites and planning | Filters, favourite events, saved-search alerts, frequency and delivery history; My Season calendars, statuses, budgets, notes, estimated/actual/shared costs; saved races, drivers, stints and Stint Splitter calculations. |
| Team HQ and Drivers & teams | Team name, description, invitations, usernames, membership, event plans, availability, tasks, expenses, cost shares and recorded repayments. Active members can see team records according to permissions set by the team owner. The public teams overview shows non-archived team names, team logos or pictures, active member counts and creation dates, even without a listing. Usernames and profile pictures appear on public team rosters only when the user enables this preference in their profile; it is off by default and can be turned off at any time. Team descriptions and team records remain private. Finder listings and linked team names are public; replies and messages are visible only to the two accounts involved. An accepted match may activate team membership. Closing removes a listing from search; archiving keeps team data. Historical financial entries remain when a member leaves. These features do not transfer money. |
| Membership, billing and payment | Plan, period, start/end, renewal/cancellation and applicable feature limits; billing name, Belgian billing address, email and optional phone; price, VAT, currency, invoice and seller snapshot; Mollie customer, mandate, subscription and payment references, status and necessary provider response. We do not retain a full card or bank-account payment instrument. |
| Communications | Newsletter/communication preference, consent and source; campaign, recipient, sending, delivery and error status; transactional account, alert, payment and invoice mail; support messages. |
| Restricted BMR area | Team roster, display name and visibility; races, teams and member assignments; entry/other costs, results and notes; sponsor income, expenses, reimbursements and member-attributed statistics. Access is limited to authorised BMR and administrator roles. |
| Usage, advertising and security | Requested page, time, language, referring path/origin, device/browser details, server-log IP and errors. For first-party ad measurement: ad ID, slot, language, destination, user agent, HMAC-hashed IP and a 15-minute deduplication bucket. Plausible supplies cookieless aggregated usage statistics. |
| Administration and audit | Review status, internal summary, responsible administrator, entity and time of an administrative action. The security audit log does not by default copy decrypted personal-data contents. |
The directory also includes minimum and maximum ages, age groups, team size, kart type, unknown prices and source evidence. These are participation conditions for an activity; we do not request individual data about participating children for these fields. Distance filters, sorting and the map use an approximate position derived from your profile city and country, without continuous GPS tracking.
Cookie choice: version, date and statistics selection retained in your browser for 180 days. Plausible and our ad measurements run only with your consent.
First-party traffic statistics: with your statistics consent, we count public page views and clicks and detail opens for races, lessons, circuits and public pages by day, source page, category, public record ID, language and broad referrer group. These analytics tables contain no IP addresses, browser details, account IDs, full URLs, search terms or persistent visitor IDs. A random proof per page load prevents duplicate counting; it expires after about two hours and is removed by periodic cleanup. Daily totals are kept for 25 months. DNT/GPC requests and recognised bots are excluded. Only aggregate figures and public listing names may be shared with potential advertisers, without individual visitor profiles. Separate security logs still apply.
Authorised moderation: assigned role, reviewed proposals, decision, reason, time, audit trail and, where enabled, reward balances, adjustments and claim/settlement status. These records are restricted to the relevant moderator and authorised administrators.
4. What is public and what remains restricted
An organiser profile may publicly show username, account type, profile photo, city, country and published-event counts. An event or circuit listing shows the information submitted for publication, potentially including a public contact email or phone number. Do not submit a private contact if it should not be public.
Your private first/last name, street, postal code, account email and phone are not shown on the public profile unless you deliberately place them in a public text or contact field. Membership, payment, personal planning and BMR data are restricted to you and, where needed, authorised team administrators or Karting Benelux administrators.
5. Why we use data and our legal bases
| Purpose | Legal basis |
|---|---|
| Create accounts, authenticate, provide requested profiles and free/paid functions, favourites, planning, alerts, team access and support. | Performance of the contract or steps you request before entering it. |
| Handle payments, subscriptions, invoices, VAT and accounting. | Contract performance and legal obligations. |
| Send newsletters or non-essential promotional communications. | Your consent, which you may withdraw at any time without affecting earlier processing. |
| Send transactional account, security, payment, invoice and saved-search messages. | Contract performance and our legitimate interest in administering the service and alerts you configured. |
| Find, review, update and publish public event and circuit information as a directory. | Our legitimate interest and that of visitors and the karting community in a current, verifiable directory; we limit it to relevant professional/public information and offer correction and objection. |
| Prevent abuse, fraud, spam and unauthorised access; logging, backups, audit, disputes and legal claims. | Our legitimate interest in safe, reliable services and, where relevant, legal obligations or legal claims. |
| Measure site usage and views/clicks on our own ads through Plausible and our measurement functions. | Your prior consent through cookie settings, freely refused or withdrawn. Technically necessary server and security logs remain separate, based on the legitimate interest described above. |
| Publish public content you choose and attribute it to an organiser profile. | Performance of your publication request and our legitimate interest in attribution and directory integrity. |
Where we rely on legitimate interests, you may object for reasons relating to your situation. We will stop unless compelling legitimate grounds or a legal claim justify continued processing.
For assigned moderation and any rewards, we use data to carry out the relevant arrangements, audit decisions and prevent abuse. The bases are performance of that arrangement and our legitimate interest in reliable moderation; statutory recordkeeping duties apply where relevant.
6. Service providers and other recipients
- Hosting, database, backup and email providers to keep the service available and send messages.
- Mollie for checkout, payments, mandates, recurring subscriptions, fraud prevention and status callbacks.
- Google for reCAPTCHA according to your cookie choice or activation beside a protected form, and for Fonts; OpenStreetMap/OSMF and Nominatim for maps and geocoding; Cloudflare CDNJS for the Leaflet map library. Cookie settings are served locally.
- Plausible for cookieless aggregate web statistics, only with your consent.
- OpenAI for AI-assisted extraction/classification of limited text from public event sources. The API request is set to
store: false, and an authorised reviewer reviews the result before publication. - Have I Been Pwned for the k-anonymous breached-password check using only a hash prefix.
- Authorised organisers, team administrators and other users for public or shared features you select.
- Professional advisers, authorities or courts when legally required or needed for our rights and security.
We do not sell personal data. External websites, advertisers and social media receive data under their own policies only when you open their link or content.
7. Processing outside the EEA
Some international suppliers, particularly Google, OpenAI or Cloudflare, may process data outside Belgium or the European Economic Area. Where we are responsible for that transfer, we use an adequacy decision, appropriate contractual safeguards such as standard contractual clauses, or another lawful derogation. Provider statements linked from our Cookie Policy contain more about their locations and safeguards. Ask info@kartingbenelux.com for information or, where available, a copy of the relevant safeguard.
8. How long we keep data
| Data | Period or criterion |
|---|---|
| Account, profile, private planning, saved races and preferences | While the account is active, then only as needed for closure, fraud prevention, a dispute or legal duty. Following a valid erasure request we delete or anonymise, subject to the exceptions below. |
| Public listings and contributions | While current and useful to the directory. After account deletion a listing may remain with removed or generic creator attribution where needed for continuity, source integrity or its public nature; we correct or remove personal contact details where appropriate. |
| Invoices, payments and accounting | For the statutory retention period applicable to the document and tax year; longer only where an investigation, dispute or another legal obligation justifies it. |
| Password recovery | A reset link is usable for one hour; expired, replaced or used tokens are removed by technical cleanup. Verification codes remain only as long as needed for verification and abuse prevention. |
| Newsletter consent and communication history | Until withdrawal/unsubscribe, then as long as needed to prove the choice, prevent renewed sending and handle legal claims. Transactional delivery logs remain as long as operationally or legally needed. |
| Security and rate limiting | Ordinary hashed rate buckets are normally cleaned after about one day; login-protection buckets may remain for up to about seven days. Server and audit logs follow a limited operational security cycle and remain longer for an incident. |
| Advertising, analytics and discovery records | For the shortest period reasonably needed to deduplicate, report, review sources, investigate errors and improve campaigns or the directory, then deleted or aggregated. Public-source evidence may remain while a listing, correction or dispute needs it. |
| Backups | Until overwritten under the secure backup rotation; used only for recovery and brought back under the applicable deletion rules. |
Cookie choices remain in your browser for 180 days. Moderation and reward records remain as needed for review, settlement, audit and applicable statutory recordkeeping or disputes, then are deleted or anonymised.
Local app data: language, stopwatch/lap data, reaction records and older race notes remain on the device until cleared or the app storage is removed. The current Android build disables automatic app backup. The app’s local-data reset preserves the language and does not erase website accounts, website records or session cookies. See the App Privacy Policy.
9. Security
Measures include encrypted connections, session and role controls, CSRF protection, hashed or encrypted account/profile fields, password hashing, key and secret handling outside public code, rate limits, image re-encoding, restricted administration, audit logging and backups. Payment instruments are handled by Mollie.
No method is absolutely secure. Report a suspected security incident to info@kartingbenelux.com. We investigate incidents and notify people and authorities where the law requires it.
10. Your choices and privacy rights
Subject to applicable conditions, you may request access and a copy, correction, erasure, restriction, portability, objection to legitimate interests or direct marketing, and withdrawal of consent. Manage communication preferences in your account and use the unsubscribe facility.
Email info@kartingbenelux.com and identify the account, listing or processing concerned. We may request only the information needed to verify identity. We normally answer within one month; the statutory extension may apply to a complex or numerous request. Rights are not absolute: legal retention, others' rights, freedom of expression, public-source integrity or legal claims may justify a limit.
You may complain to the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be, +32 (0)2 274 48 00, through its contact page, or to the authority where you habitually live or work.
Cookie settings lets you manage web statistics, our ad measurements and automatic reCAPTCHA loading. Newsletters and search alerts are disabled separately in your account or through their unsubscribe function.
Community safety records include reports, reported pages/accounts, explanations, block relationships, moderation decisions and acceptance of community rules. Reports are restricted to authorised administrators. We process these records to prevent abuse, protect users and handle complaints under legitimate interests and applicable legal obligations. We retain only what is necessary to address the report, enforce a block or resolve a dispute, review continued need, and erase identifying data when no longer needed. You can remove your blocks through Report and block, and request deletion through the page below.
Account and data deletion: you can request deletion of your Karting Benelux account and associated personal data or specified server-held data using the Account and data deletion instructions or by emailing info@kartingbenelux.com. Identify the account and the scope of your request; do not send your password. The Account and data deletion instructions gives the steps, verification process and retention exceptions, and works without the app or a sign-in. Cancelling membership, signing out or clearing local app data does not itself delete the account.
11. Children and automated processing
The service is not specifically directed at young children. Anyone who cannot independently enter a valid contract must have a parent or legal guardian's permission and supervision. Contact us if a child supplied personal data without appropriate permission.
We make no decision based solely on automated processing that produces legal or similarly significant effects for you. AI may propose or classify public-source data, but an authorised reviewer decides on publication. reCAPTCHA and security rules may block a suspicious request; contact us for human review. Membership entitlements and limits are applied automatically according to the selected plan, not through profiling.
12. Changes and contact
We update this policy when services, data flows or legal duties change. The date at the top identifies the latest substantive version. Where appropriate, we will notify you of a material change on the site or through an account message.
Questions, requests or objections: info@kartingbenelux.com, info@lespasoftware.com, +32 (0)456 06 57 38 or by post to Crauwels Arne / Lespa Software Solutions, Kerkhofstraat 27, 2845 Niel, Belgium.