Privacy Policy

KEB Racing mobile app — Karting Events Bulgaria LTD

Last updated: 5 August 2026

This policy explains what personal data we collect through the KEB Racing mobile app for iOS and Android, why we collect it, who we share it with, how long we keep it, and the rights you have over it.

It applies to the app and the back-end services behind it. Your use of our events is also governed by our General Terms & Conditions.

1. Who we are

The data controller is:

Karting Events Bulgaria LTD
Sofia, Bulgaria
Email: info@karting-events.com
Phone: +359 877 919 914

We process personal data under the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Bulgarian Personal Data Protection Act.

2. What we collect

We only collect data that the app actually needs. Here is the complete list.

Category	Data	Why	Legal basis
Account & identity	Email address, username, password (stored only as a salted hash), first and last name, phone number, nationality, profile photo	To create and secure your account, identify you at events, and contact you about your registrations	Performance of a contract
Team data	Team name, your role in the team, team membership, invitations you send or receive (including the invited person's email address)	To let you form and manage a racing team	Performance of a contract
Event & booking data	Event registrations, racing category (Pro / Gold / Silver), which drivers are entered, training session bookings, and payment status flags (whether an advance or the full fee has been recorded as paid)	To register you for races and practice sessions and to run the event	Performance of a contract
Device & push data	Push notification token, mobile platform (iOS or Android), device name and type, operating system name and version, last-seen timestamp, and your per-device notification setting	To deliver push notifications and let you see and manage the devices signed in to your account	Performance of a contract; consent for notifications
Technical logs	IP address, request timestamps and error information recorded by our servers	Security, abuse prevention and diagnosing faults	Legitimate interests
Event photos & video	Photographs and video recorded by us or our partners at our events, which may include your image	Event coverage and promotion of future events	Legitimate interests — see section 9, you can object

Camera and photo library access

The app asks for camera or photo library access for one purpose only: choosing a profile photo. The image you pick is uploaded to your account. We do not access, scan or upload anything else from your device.

Notification permission

Push notifications are optional. If you decline the permission, or turn notifications off for a device in the app, the rest of the app keeps working normally.

3. What we do not do

To be explicit, the KEB Racing app contains:

No advertising and no ad identifiers. We do not use IDFA, the Android Advertising ID, or any advertising SDK.
No third-party analytics or tracking SDKs. We do not use analytics, attribution, or profiling services, and we do not track you across other companies' apps or websites.
No location tracking. The app never requests your device location. Circuit addresses open in your own maps app if you tap them — that is a normal link, and what you do in that app is governed by its own privacy policy.
No card or bank details in the app. The app records only whether a fee has been marked as paid. Payments themselves are handled outside the app.
No sale of personal data, and no sharing of it for anyone else's marketing.

4. Who your data is shared with

Other users

Some data is visible to other people by design:

Members of a team you belong to can see your name and email address in the team roster.
If you are entered in an event registration, your name appears in that registration and is visible to your team and to the organiser.
Results, timing and start lists published for an event may show your name and team.

Service providers

Provider	What they receive	Purpose
Google Ireland Ltd / Google LLC — Firebase Cloud Messaging	Push notification token and the content of the notification message	Delivering push notifications to your device
Our hosting provider	All data stored by the service, as part of hosting our servers and database	Running the back end
Circuits and event partners	Names and entry details of participants at a given event; emergency contact information where relevant	Running the event and meeting on-site safety obligations

Providers act as our processors under written agreements and may use the data only on our instructions.

Legal disclosure

We may disclose data where the law requires it, or where it is necessary to establish, exercise or defend legal claims — for example after an incident at an event.

5. Transfers outside the EU/EEA

Firebase Cloud Messaging is operated by Google, which may process notification data on servers outside the European Economic Area, including in the United States. Those transfers rely on the European Commission's Standard Contractual Clauses and Google's certification under the EU–US Data Privacy Framework. All other data stays with providers in the EU/EEA.

6. How long we keep it

Data	Retention
Account and profile data	For as long as your account exists. Deleted within 30 days of a deletion request.
Team membership and invitations	Deleted with your account. Invitations you did not accept are deleted after 12 months.
Event registrations and payment records	Kept for the period required by Bulgarian accounting and tax legislation (generally 5 years), even after your account is deleted.
Push tokens and device records	Removed when you sign out of that device, uninstall the app, or after 12 months without use.
Server logs	12 months.
Published results and standings	Retained as part of the historical record of the championship.
Event photos and video	Retained in our archive unless you object under section 9.

7. Deleting your account

You can ask us to delete your account and the personal data attached to it at any time. Email info@karting-events.com from the address registered to your account, or write to us using the contact details in section 1. Full instructions, and the complete list of what is deleted and what is kept, are on our account deletion page.

We will confirm and complete the deletion within 30 days. Two things survive deletion, and only these:

Registration and payment records we are legally required to keep for accounting and tax purposes.
Published race results and standings, which remain part of the championship record.

8. Your rights

Under the GDPR you have the right to:

Access — get a copy of the personal data we hold about you.
Rectification — have inaccurate data corrected. Most of it you can edit yourself in the app's profile screen.
Erasure — have your data deleted, subject to the exceptions in section 7.
Restriction — ask us to pause processing while a dispute is resolved.
Portability — receive the data you gave us in a structured, machine-readable format.
Object — object to processing based on our legitimate interests, including the use of event photos and video.
Withdraw consent — where processing is based on consent, withdraw it at any time. This does not affect processing already carried out.

Write to info@karting-events.com to exercise any of these. We respond within one month.

If you think we have handled your data incorrectly, you can complain to the Bulgarian supervisory authority:

Commission for Personal Data Protection (Комисия за защита на личните данни)
2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, Bulgaria
www.cpdp.bg

9. Photos and video at events

We photograph and film our events, and we use that material to report on the event and promote future ones — on our website, in the app and on social media. Given that racing is a public activity and coverage is part of it, we rely on our legitimate interests for this.

You can object. Tell a member of staff at the event, or email info@karting-events.com, and we will stop using material that identifies you and remove it from channels we control. Your objection has no effect on your entry, your results, or your ability to take part.

10. Children

KEB Racing is intended for people aged 18 and over. Younger drivers may take part in our events with the consent of a parent or guardian, and in that case the account must be created and managed by that parent or guardian, who is responsible for the data provided through it.

We do not knowingly collect data directly from a child without that involvement. If you believe a child has provided us with personal data on their own, contact us and we will delete it.

11. Security

All traffic between the app and our servers is encrypted with HTTPS. Your login token is stored in the platform's secure storage — the iOS Keychain or the Android Keystore — not in ordinary app storage. Passwords are stored only as salted hashes and are never readable by us. Access to production data is restricted to staff who need it.

No system is perfectly secure, but if a breach occurs that is likely to put your rights at risk, we will notify you and the supervisory authority as the GDPR requires.

12. Changes to this policy

If we change how we handle personal data, we will update this page and change the date at the top. For significant changes we will notify you in the app or by email before they take effect.

13. Contact

Questions about this policy, or about your data:

Karting Events Bulgaria LTD
Email: info@karting-events.com
Phone: +359 877 919 914
Address: Sofia, Bulgaria