Privacy Policy

1. Who we are#

motorev.club is operated by MotoRev Group / Karl Chelton trading as MotoRev Group ("MotoRev", "we", "us", "our").

You can contact us about anything in this policy at hello@motorev.club, or by writing to us at 167-169 Great Portland Street, 5th Floor, London, W1W 5PF.

We are registered with the Information Commissioner's Office under registration number C1994136.

We are the data controller for the personal data described in this policy. We have not appointed a Data Protection Officer, as we are not required to under Article 37 UK GDPR.

2. What this policy covers and what it doesn't#

This policy explains how we handle personal data where we decide the purposes and means of processing. That covers people who create or hold a motorev.club account, billing and subscription contacts, people who contact us for support or to complain, people who subscribe to our updates, and visitors to motorev.club and to club sites hosted on our platform.

It does not cover the data a club puts into the platform. When a car club uses motorev.club to store its members' details, its events, its photographs, its venue contacts or its communications, the club decides why and how that data is used. The club is the data controller and we act as its data processor, only on its instructions. Our handling of that data is governed by our Data Processing Agreement rather than by this policy.

If you are a member of a club that uses motorev.club - or a venue the club has contacted through it - and you want to know what the club holds about you, or you want it corrected or deleted, please contact the club directly. If you contact us instead, we will forward your request to the club so that they can respond, and we will assist them in doing so. This means we will tell the club that you contacted us.

3. What we collect, why, and on what legal basis#

3.1 Account and administrator data#

We collect your name, email address, password, club affiliation, your role and permissions within a club, your contact telephone number if you give us one, your email and marketing preferences, your confirmation that you are 18 or over, and your account preferences. Your password is stored hashed and is never held in readable form.

Most of this comes from you when you register. If you were invited to a club rather than signing up yourself, we received your name and email address from the club administrator who invited you.

We use it to create and secure your account, to authenticate you, to apply the correct permissions, and to provide the service.

Our lawful basis is Article 6(1)(b) of the UK GDPR, performance of a contract with you or steps taken at your request before entering one, once you hold an account. For the invitation itself, before you have accepted, our basis is Article 6(1)(f), legitimate interests. Our interest is in allowing clubs to add their own committee members. The data involved is limited to a name and an email address; an unaccepted invitation stops working after 7 days, and we delete the record 30 days after that.

When you ask us to delete your account we schedule it rather than doing it immediately: the account and everything attached to it is destroyed 30 days later, and you can call the deletion off at any point during those 30 days. See section 7.

3.2 Subscription and billing data#

We collect the club name, the billing contact's name and email address, the billing address, your subscription plan and history, invoices, and VAT details where they apply. Card details are entered directly into Stripe and never reach our systems.

This comes from you and from Stripe.

We use it to take payment, manage renewals and cancellations, issue invoices, prevent payment fraud, and meet our tax and accounting obligations.

Our lawful basis is Article 6(1)(b), contract, for taking payment and managing your subscription, and Article 6(1)(c), legal obligation, for tax and accounting records.

We keep financial records for six years from the end of the accounting period they relate to, as required by HMRC. This means invoice and payment records survive the deletion of your account.

Stripe acts as a separate controller for the payment data it processes for fraud prevention and regulatory compliance. Its handling of your data is governed by its own privacy policy at https://stripe.com/gb/privacy.

3.3 Support and correspondence#

We collect your name, your email address, the content of your message, and anything else you choose to include. It comes from you.

We use it to answer your question, resolve your issue, and keep a record in case the matter comes up again.

Our lawful basis is Article 6(1)(b), contract, where you are a customer, and Article 6(1)(f), legitimate interests, where you are not. In that case our interest is in responding to enquiries and running a functioning support service.

We keep support correspondence for 24 months from the date the matter is closed.

3.4 Technical, security and abuse prevention data#

We collect your IP address, browser and device type, the pages you request, timestamps, error and diagnostic logs, authentication events such as sign-ins, sign-outs, failed attempts and password resets, and the result of Cloudflare Turnstile bot checks.

This is collected automatically when you use the service. Loading maps also sends your IP address and the area of the map you are viewing to our map tile providers.

We use it to keep the service running, diagnose faults, detect and block automated abuse and credential stuffing, and investigate security incidents.

Our lawful basis is Article 6(1)(f), legitimate interests. Our interest, and yours, is in a secure and available service. We have assessed that this does not override your rights, because the data is limited, retained briefly, and never used to build a profile of you or to advertise to you. You can request a summary of that assessment at hello@motorev.club.

We keep request and error logs for 30 days, and authentication and security events for 12 months.

3.5 Analytics#

If you accept analytics cookies, Microsoft Clarity records the pages you view, your clicks, scrolling and mouse movement, and produces session recordings and heatmaps.

We use this to understand how the platform is actually used, so that we can fix confusing interfaces and improve it.

Our lawful basis is Article 6(1)(a), consent. You can withdraw your consent at any time through Cookie settings, in the footer of this site and in the admin app's sidebar, and doing so has no effect on the service.

Microsoft deletes session recordings after 30 days, and keeps sampled or favourited sessions for up to 9 months.

Clarity is off by default. If you decline or ignore the cookie banner, no analytics data is collected at all. Clarity masks what you type into forms, and values it recognises as sensitive such as email addresses, before anything is uploaded, so that content is not captured in recordings.

3.6 Updates and marketing#

When you register you choose whether you want product updates and whether you want marketing email. We record that choice against your account, along with the date you made it, and you can change it at any time.

We use it to decide whether to send you product updates, new features and occasional news about motorev.club.

Our lawful basis is Article 6(1)(a), consent, together with regulation 22 of the Privacy and Electronic Communications Regulations.

We keep your choice for as long as you hold an account. If you unsubscribe we keep your email address on a suppression list indefinitely, so that we do not contact you again by mistake.

Every marketing email carries an unsubscribe link. We do not track whether you open or click our emails. Service and transactional emails, such as email confirmations, password resets, billing notices, security alerts and changes to these terms, are not marketing and will continue regardless, because we cannot operate your account without them.

3.7 Visitors to club sites hosted on our platform#

Club websites published through motorev.club sit on our infrastructure. For the content of those sites, including event listings, member areas, photographs and anything else the club publishes, the club is the data controller. For the underlying hosting, security logging and cookie handling described in sections 3.4 and 4, we are the data controller.

A club can embed a YouTube or Vimeo video on its site. If it does, your browser contacts that provider directly when the page loads, and the provider may set its own cookies. That is the provider's processing, under its own privacy policy.

3.8 Complaints#

If you complain to us, we collect your name, your email address, what kind of complaint it is, what it concerns, the club it relates to where that applies, and our record of what we did about it.

We use it to acknowledge, investigate and answer your complaint, and to keep a record of it.

Where your complaint is about how personal data has been handled, our lawful basis is Article 6(1)(c), legal obligation - section 164A of the Data Protection Act 2018 requires us to accept and handle complaints of that kind, and to keep records of them. For any other complaint, our basis is Article 6(1)(b), contract, where you are a customer, and Article 6(1)(f), legitimate interests, where you are not. In that case our interest is in running a platform where problems can be reported and dealt with.

We keep complaint records for six years from the date the complaint is closed, so that we can evidence how it was handled if the ICO or a court asks. See section 10 for how to complain.

3.9 Do you have to give us this data?#

You are not obliged by law to give us any of it, but some of it we cannot do without.

Your name, email address and password are required. We cannot create or secure an account without them, so we cannot provide the service.

Billing details are required for paid plans. Without them we cannot take payment and the subscription cannot start.

Confirming that you are 18 or over is required, because accounts are for adults only and registration cannot complete without it.

The content of a support message or a complaint is optional, though we can only help with what you tell us. If you are complaining about a club, we do need to know which club, because we cannot look into it otherwise.

Marketing consent is entirely optional. Declining has no effect on your account or on the service.

4. Cookies and similar technologies#

We use the minimum needed to run the service, plus one optional analytics tool.

4.1 Strictly necessary#

These are required for the service to function. They do not need your consent and cannot be switched off.

4.2 Analytics#

Only set if you accept analytics cookies.

Microsoft Clarity records how the platform is used, including clicks, scrolling and session replays, so that we can improve it.

4.3 Signup progress#

Also only set if you accept analytics cookies.

4.4 Managing your choice#

You can change your analytics choice at any time through Cookie settings, which is in the footer of motorev.club and of every club site, and in the sidebar of the admin app. Declining stops Clarity being loaded from that point on, stops anything in 4.2 and 4.3 being set, and neither is started again on your next visit.

Until you have made a choice, nothing in 4.2 or 4.3 is set at all.

We do not use advertising or marketing cookies, we do not run advertising pixels, and we do not sell or share your data with advertising networks.

5. Who we share your data with#

We do not sell your personal data. We share it only with the service providers listed below, all of whom process it on our instructions under a written contract.

5.1 Loaded by your browser#

These receive your IP address because your browser contacts them directly.

5.2 Used by our servers#

Your browser never contacts these directly, so they do not receive your IP address.

We will also disclose personal data where we are legally required to, for example in response to a court order or a lawful request from a regulator or law enforcement body. If we are ever involved in a merger, acquisition or sale of assets, your data may transfer to the buyer. We will tell you before that happens, and before your data becomes subject to a different privacy policy.

6. International transfers#

Some of our providers process data outside the UK. Where they do, we rely on one of the following safeguards, as required by Article 46 UK GDPR.

We rely on UK adequacy regulations where the country has been recognised as providing an equivalent level of protection. This covers our transfers to the European Economic Area and Switzerland.

We rely on the UK Extension to the EU-US Data Privacy Framework where the recipient in the United States is certified under it.

Where neither applies, we rely on the International Data Transfer Agreement, or on the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum.

You can request a copy of the safeguards we rely on for any specific transfer by emailing hello@motorev.club.

7. How long we keep your data#

Where we are required to keep data for longer for legal reasons, for example under a litigation hold or to establish or defend a legal claim, we will keep only what is necessary for that purpose and nothing more.

8. How we protect your data#

We take appropriate technical and organisational measures under Article 32 UK GDPR. These include encryption in transit and at rest, passwords stored hashed and never in readable form, row level security policies in our database so that a club's data is only reachable by that club, role based access control so that administrators see only what their role requires, two factor authentication on administrative and infrastructure accounts, bot and abuse protection on authentication endpoints, regular automated backups with restores tested quarterly, and a documented incident response procedure that includes notifying the ICO within 72 hours where a breach is reportable.

No system is completely secure. If a breach occurs that is likely to result in a high risk to your rights and freedoms, we will tell you without undue delay.

9. Your rights#

Under the UK GDPR you have the right to access a copy of the personal data we hold about you; to have inaccurate data corrected or incomplete data completed; to have your data erased where there is no overriding reason for us to keep it; to ask us to restrict processing while a dispute about accuracy or lawfulness is resolved; to receive data you gave us in a structured, commonly used and machine readable format, or to have it sent to another provider; to object to processing based on legitimate interests, in which case we must stop unless we can show compelling legitimate grounds that override your interests, or we need the data for legal claims; to withdraw your consent at any time where consent is our basis, without affecting the lawfulness of what came before; and to complain, both to us directly and to the ICO, as set out in section 10.

Your right to object to direct marketing is absolute. If you tell us to stop sending you marketing, we must stop, and we will. There is no balancing test and no exception. You can use the unsubscribe link in any marketing email, or email us.

You can delete your account yourself from the Your Account page in the admin app. Deletion is scheduled 30 days ahead so that an accidental or coerced request can be called off; after that the account, and the club you own if you own one, are destroyed. Invoice and payment records are kept for the six years HMRC requires.

To exercise any of these rights, email hello@motorev.club. We will respond within one month. If your request is complex, or you have made several, we may extend that by up to two further months, and we will tell you within the first month if we do. There is no charge, unless a request is manifestly unfounded or excessive.

If we decide not to act on your request, we will tell you why, and we will tell you that you can complain to us under section 10 and to the ICO.

We may ask you to verify your identity before we act, but we will only ask for what is proportionate to the sensitivity of the data.

We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you, and we do not profile you for marketing.

10. Complaints#

You have the right to complain to us directly about how we have handled your personal data, and we are required to have a proper process for dealing with it.

You can use our online form at motorev.club/complaint, email us at hello@motorev.club, or write to us at 167-169 Great Portland Street, 5th Floor, London, W1W 5PF. We will accept your complaint however it reaches us, and you do not need a motorev.club account to make one.

The same form also takes complaints that are not about data protection - conduct or abuse in a club, content published on a club site, and billing. Choose the category that fits and it reaches us the same way. Everything below applies to all of them; only the last paragraph, about the ICO, is specific to data protection.

Tell us what happened, what it concerns, and what you would like us to do. We will acknowledge your complaint without undue delay and in any event within 30 days, investigate it without undue delay and make whatever enquiries are needed, and keep you updated on progress before telling you the outcome and our reasoning.

We keep a record of every complaint, of how and when we acknowledged it, of what we did to investigate it, and of how it was resolved.

If your complaint is about personal data and you are unhappy with our response, or we do not respond, you can complain to the Information Commissioner's Office at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, by telephone on 0303 123 1113, or online at https://ico.org.uk/make-a-complaint/. The ICO expects you to raise your complaint with us first.

11. Children#

motorev.club accounts are for adults aged 18 or over. We do not knowingly create accounts for anyone under 18, and you must confirm that you are 18 or over when you register or when you accept an invitation to join a club. If we learn that an account belongs to someone under 18, we will close it and delete the associated data, apart from anything we are required to keep by law.

Car clubs using our platform may hold details of members under 18 in their own records. Where that happens, the club is the data controller for that data, and is responsible for having a proper lawful basis, usually the consent of a parent or guardian obtained when the young person joins the club. Our Data Processing Agreement requires clubs to confirm that they have obtained it.

12. Changes to this policy#

We review this policy at least every 12 months, and whenever our processing changes materially. When we make a significant change we will email account holders and update the date at the top of this page at least 14 days before it takes effect. Minor corrections take effect immediately. Previous versions are available on request.

13. Contact us#

For privacy enquiries and rights requests, email hello@motorev.club. You can write to us at 167-169 Great Portland Street, 5th Floor, London, W1W 5PF.