Race Car Registry — Privacy Policy

Version: 1.0

Effective date: 12 August 2026

This Privacy Policy explains how Race Car Registry (“RCR”, “we”, “us” or “the Registry”) processes personal data in connection with racecarregistry.org.

Data controller: [OPERATOR NAME / LEGAL ENTITY — complete before public launch]

Postal address: [POSTAL ADDRESS — complete before public launch]

Privacy contact: info@racecarregistry.org

1. Scope

This policy applies to personal data processed when you:

• browse Race Car Registry;
• create or use an account;
• contribute vehicle or component information;
• submit claims, evidence, photographs, descriptions, explanations or sightings;
• communicate with Race Car Registry; or
• submit a legal, copyright or moderation request.

Public Registry records may also contain information about identifiable people where that information is relevant to racing-car history, provenance, ownership, custody, authorship or source attribution.

2. Personal data we may process

Depending on how you use the Registry, we may process:

• username;
• email address;
• password hash;
• optional first name and last name;
• account role and account status;
• owner or custodian verification status;
• account creation and update timestamps;
• records of acceptance of Terms, Privacy Policy acknowledgements or upload-rights declarations;
• content you submit to the Registry;
• attribution information you choose to make public, such as photographer name;
• source and copyright information attached to uploaded material;
• moderation and administrative records;
• messages you send to us;
• technical security and server-log information reasonably necessary to operate and protect the service.

We do not need your real name merely to browse the public Registry.

3. Optional first and last name

First name and last name are optional.

They are stored privately by default and are not automatically shown on your public contributions.

If a feature allows you to use your name publicly — for example, “credit me as the photographer” — your name becomes public only for that attribution or other choice you make.

Do not enter another person's name as your own.

4. Why we process personal data

We process personal data where necessary for purposes including:

• creating and managing user accounts;
• authenticating users and protecting accounts;
• operating the public historical Registry;
• attributing contributions and photographs where appropriate;
• preserving provenance and contribution history;
• recording which legal-document version a user accepted or acknowledged;
• moderating content and investigating abuse;
• responding to copyright, legal or privacy requests;
• maintaining security, backups and technical reliability;
• establishing, exercising or defending legal claims; and
• complying with applicable legal obligations.

Depending on the processing activity, the legal basis may include performance of a contract, compliance with a legal obligation, legitimate interests, consent where specifically requested, or another basis available under applicable data-protection law.

5. Public contributions

Race Car Registry is designed as a public historical registry.

Content you deliberately submit as public — such as claims, vehicle information, explanations, sightings or public photographs — may be visible to anyone on the internet and may be indexed by search engines.

Your username may be displayed alongside contributions where attribution of the contributor is part of the Registry record.

Your optional first and last name are not automatically substituted for your username.

6. Photograph attribution

Photograph metadata may include:

• photographer;
• copyright holder;
• source;
• licence;
• uploader account; and
• rights-confirmation information.

If you explicitly choose to be credited by your optional real name, that credit will be public with the relevant photograph.

The uploader account may also be retained separately for audit, provenance and moderation purposes.

7. Legal-document acceptance records

When you accept Terms of Use, acknowledge a Privacy Policy, or confirm a photo-upload rights declaration, Race Car Registry may store:

• your user ID;
• the document type;
• the document version;
• a SHA-256 hash of the exact document;
• the acceptance or acknowledgement time; and
• the context in which it was accepted.

This allows the Registry to retain an auditable record of which version applied at the relevant time.

8. Security and server logs

The hosting environment may record technical information such as request time, requested URL, IP address, browser or user-agent information, response status and security events.

Such information may be processed for security, abuse prevention, diagnostics, service reliability and legal compliance.

We do not use technical logs as a substitute for collecting unnecessary profile information.

9. Cookies and sessions

Race Car Registry may use cookies or similar browser storage that are technically necessary for functions such as authentication, session management and security.

If non-essential analytics, advertising or other optional tracking technologies are introduced, this policy and any required consent mechanism should be updated before they are used.

10. Service providers and recipients

Personal data may be processed by service providers that support operation of the Registry, such as:

• web-hosting and infrastructure providers;
• email service providers;
• backup or security providers; and
• professional advisers where reasonably necessary.

Access is limited to what is reasonably necessary for the relevant service or purpose.

Personal data may also be disclosed where required by law or where reasonably necessary to establish, exercise or defend legal claims.

Race Car Registry does not sell personal data to advertisers.

11. International transfers

Where a service provider processes personal data outside the European Economic Area, Race Car Registry should use an applicable lawful transfer mechanism where required.

The specific providers and transfer mechanisms may change as infrastructure evolves.

12. Retention

Personal data is retained only for as long as reasonably necessary for the purpose for which it is processed, subject to legal, security, archival and dispute-resolution needs.

Account data is generally retained while an account remains active.

Historical Registry contributions may remain after account closure where retention is reasonably necessary to preserve the integrity and provenance of the historical record. Where appropriate, contributor attribution may be anonymised or otherwise adjusted in accordance with applicable law.

Legal acceptance records, moderation records and records relevant to disputes may be retained for the period reasonably necessary to demonstrate compliance or establish, exercise or defend legal claims.

Server logs and technical records may be retained for shorter operational or security periods unless an incident requires longer preservation.

13. Your data-protection rights

Subject to applicable law and any relevant exceptions, you may have rights including:

• access to your personal data;
• correction of inaccurate personal data;
• deletion of personal data;
• restriction of processing;
• objection to certain processing;
• data portability where applicable;
• withdrawal of consent where processing is based on consent; and
• the right to lodge a complaint with a competent supervisory authority.

A request to erase personal data does not necessarily require deletion of every historical fact or public Registry record where another lawful basis for retention applies.

Requests may be sent to info@racecarregistry.org.

14. Supervisory authority

If you are in Slovenia, the competent data-protection supervisory authority is the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec).

You may also have the right to contact another competent supervisory authority under applicable law.

15. Data concerning other people

Do not submit unnecessary private personal information about other people.

Historical ownership, custody, team membership, authorship and provenance information should be limited to what is reasonably relevant to the Registry's documentation purpose.

If you believe personal data concerning you is displayed inaccurately or unlawfully, contact info@racecarregistry.org and identify the relevant Registry page.

16. Security

Race Car Registry uses reasonable technical and organisational measures intended to protect account and Registry data.

No internet service can guarantee absolute security.

Users are responsible for keeping their credentials confidential and should report suspected account compromise.

17. Children

Race Car Registry is a specialist historical documentation service and is not designed specifically for children.

If age-specific consent or other requirements apply to a particular feature, the service should implement them before relying on that feature for children.

18. Changes to this Privacy Policy

Materially changed versions are stored as new versioned documents.

The website identifies the currently applicable version and effective date.

Historical versions should remain retained so that Race Car Registry can determine which notice applied at a particular time.

19. Contact

Privacy questions and data-rights requests may be sent to:

info@racecarregistry.org