Privacy Notice
1. About this notice
KartHub is an independent, unofficial mobile application that presents publicly available karting race results in a mobile-friendly format.
This privacy notice explains who is responsible for personal data processed through KartHub, what information is processed, where it comes from, why it is used, who it may be shared with, how long it is kept and the rights available to individuals.
KartHub is currently distributed only in the Republic of Ireland and the United Kingdom.
2. Who is responsible for personal data?
Alfred Tepa, trading as Tepa Digital, is the controller responsible for personal data processed through KartHub.
Privacy and data-protection enquiries can be sent to TepaDigital@gmail.com.
3. Personal data processed through KartHub
3.1 Race-result information
Information: Competitor names, kart numbers, class names, event participation, race classifications, race and lap times, positions, gaps, penalty codes and reasons, championship points and sporting statistics derived from those results.
Who it relates to: Karting competitors, including competitors in youth classes.
Source: Publicly available race-classification and lap-analysis documents published by Timing.ie and, where applicable, other official event sources such as INEO Events. KartHub does not obtain this information directly from competitors.
Purpose: To display race results, standings, driver profiles and related sporting statistics in an accessible format, and to support result notifications selected by users.
Lawful basis: Legitimate interests under Article 6(1)(f) GDPR and UK GDPR. The interests pursued are making officially published sporting results easier to access, supporting the karting community and maintaining an accurate sporting record for a limited period.
Retention: Identifiable race-result information is normally kept for no longer than three years from the event date. It is then deleted or anonymised unless continued retention is required by law or is justified and documented for a specific reason.
3.2 Notifications and follow selections
Information: Push-notification tokens, the drivers or classes selected for following, device platform, and notification delivery status.
Who it relates to: Users who enable notifications and choose drivers or classes to follow.
Source: Generated through the device and provided through the user's notification settings and in-app selections.
Purpose: To deliver notifications requested by the user, such as result updates and race-related reminders.
Lawful basis: Legitimate interests under Article 6(1)(f) GDPR and UK GDPR. Notifications are sent only after the user enables them and selects the relevant follow options.
Retention: Tokens and follow selections are kept while the relevant notification or follow feature remains active. Invalid tokens are removed when identified. Delivery records may be kept for up to 90 days for troubleshooting, security and abuse prevention.
3.3 Account information
Information: Email address, password hash managed by the authentication provider, authentication tokens, account preferences and account-linked follow selections.
Who it relates to: Users who create an account where account features are available.
Source: Provided directly by the user and generated through the authentication process.
Purpose: To create, secure and manage an account and provide requested account-based features.
Lawful basis: Article 6(1)(b) GDPR and UK GDPR, because the processing is necessary to provide the requested account service.
Requirement: An email address and authentication credentials are required to create an account. Without them, account-based features cannot be provided.
Retention: Account information is kept while the account remains active. Associated information is scheduled for deletion within 30 days after account deletion, subject to any legal retention requirement.
3.4 Technical and security logs
Information: Source IP address, request time, requested route, device or browser user-agent, response status and related technical information.
Purpose: To operate the service, maintain security, prevent abuse, investigate incidents and diagnose technical faults.
Lawful basis: Legitimate interests under Article 6(1)(f) GDPR and UK GDPR.
Retention: Logs are normally kept for up to 30 days, depending on the log type and hosting-provider settings. They are not routinely combined with account information.
3.5 Enquiries and data-rights requests
Information: Name, contact details, the content of the enquiry or request, related correspondence and proportionate identity-verification information where necessary.
Purpose: To respond to enquiries, verify and process data-rights requests, and demonstrate compliance with data-protection obligations.
Lawful basis: Compliance with a legal obligation under Article 6(1)(c) GDPR and UK GDPR for formal rights requests, and legitimate interests under Article 6(1)(f) for general enquiries and service administration.
Retention: Formal rights-request records may be kept for up to two years after the request is resolved. General correspondence is kept only for as long as reasonably necessary for the purpose of the enquiry.
4. Information not used for competitor profiles
KartHub does not intentionally obtain or display the following information as part of its race-result processing:
- Home addresses, telephone numbers or competitor email addresses
- Dates of birth
- Precise location or GPS information
- Government identification or motorsport licence numbers
- Health information
- Photographs, video or biometric data
- Advertising identifiers or behavioural advertising profiles
- Parent or guardian contact details
Class names may indicate that a competitor is likely to be a child. KartHub applies additional safeguards to records relating to youth classes. Information provided when a person creates an account or contacts KartHub is handled as described in Section 3.
5. Service providers and international transfers
KartHub uses service providers to host and operate the application, manage accounts and deliver notifications. They receive only the information needed to provide their services and act under applicable contractual and data-protection terms.
| Provider | Service | Processing location |
|---|---|---|
| Supabase Pte Ltd | Database hosting and authentication | EEA project region, with supporting infrastructure in other locations |
| Railway | Backend hosting, logs and file storage | Multi-region infrastructure |
| Expo | Push-notification transport | United States and other service locations |
| Firebase Cloud Messaging for Android notifications | United States and other service locations | |
| Apple | Apple Push Notification service for iOS | United States, EEA and other service locations |
Where personal data is transferred outside the EEA or the United Kingdom, KartHub uses an applicable transfer safeguard where required, such as an adequacy decision, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or the UK Addendum. Further information about relevant safeguards may be requested using the contact details in this notice.
6. Advertising, sale and automated decisions
KartHub does not:
- Use competitor information for advertising
- Sell personal data
- Share personal data for cross-context behavioural advertising
- Use advertising identifiers or behavioural advertising profiles
- Enrich competitor profiles with unrelated personal information
- Make automated decisions that produce legal or similarly significant effects
7. Individual rights
Depending on the circumstances and the lawful basis used, individuals may have rights to access, correct, erase, restrict or object to the processing of their personal data, and to receive certain information in a portable format where the right to data portability applies.
These rights are not absolute. Each request is assessed under the GDPR or UK GDPR. KartHub will respond without undue delay and normally within one month. This period may be extended by up to two further months where permitted because of the complexity or number of requests.
7.1 Requests relating to race-result information
After assessing a request, KartHub may correct, restrict, suppress or anonymise race-result information within the application where appropriate. Changes made by KartHub do not alter the official source record held by the original publisher. A correction to the official result may also need to be raised with the relevant source publisher.
7.2 Children
A parent or guardian may contact KartHub about information relating to a child. KartHub may request proportionate information to confirm identity and authority before acting on a request. The child's rights, circumstances and level of understanding will be considered when the request is assessed.
7.3 Complaints
Individuals may complain to a data-protection supervisory authority:
- Ireland: Data Protection Commission — www.dataprotection.ie
- United Kingdom: Information Commissioner's Office — www.ico.org.uk
8. Unofficial status and source accuracy
KartHub is an independent, unofficial results viewer. It is not operated by or affiliated with Timing.ie, Motorsport Ireland or any championship organiser.
KartHub presents information obtained from publicly available source documents. Official results and later amendments should always be verified with the relevant official publisher.
9. Security
KartHub uses technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss and misuse. These measures include access controls, secure data transmission, encryption where supported, service monitoring, backups and controls applied to service providers.
No internet-connected service can guarantee absolute security. Security measures are reviewed and updated where appropriate.
10. Changes to this notice
This privacy notice may be updated to reflect changes to KartHub, its service providers or applicable data-protection requirements. The current version and effective date are shown at the top of the notice. Material changes will be communicated through the application where reasonably possible.