Legal information
Privacy policy
1. In short
- Crazy Racing Sensations (CRS) decides what happens with your data. JBit builds and runs the website and booking system for us; Amazon Web Services hosts it in Ireland.
- We ask for what we need to book you onto a track day, invoice you and keep you safe on the circuit. Nothing more.
- Your dietary needs and physical details are health information. We only store them if you tick a separate box on the rider form. You can book without it.
- We do not sell your data and we send no newsletters. Cookies for statistics and advertising are only used if you allow them.
- Apart from those, the website only stores what it needs to work: your cookie choice, your sign-in to "My bookings" while the tab is open, and during a booking one small entry so you do not lose your place if you close the tab.
- You can ask us at any time what we hold about you, have it corrected or deleted, or withdraw your consent: info@crs-racing.com.
2. Who is responsible for your data
The controller of your personal data is:
Crazy Racing Sensations (CRS Racing)
Coesens Renting Services BV
Diebeke 17, 9500 Geraardsbergen, Belgium
VAT BE0474.199.940
info@crs-racing.com · +32 475 45 21 96
CRS has not appointed a data protection officer and, as far as we can see, is not required to.
3. What we collect, and when
3.1 When you visit the website
Like every website, ours receives some technical data with each page you open: your IP address, the date and time, the page requested, the page you came from, and your browser and device type. Our hosting provider records this in access logs. We use them to keep the site running, to detect and block attacks, and to count visits in aggregate. We do not combine them with your booking.
A web application firewall run by our hosting provider looks at each request (including your IP address) to stop automated attacks, and can block an address that sends too many requests.
3.2 When you choose an event and a place is held for you
You pick an event, the formula (Experience Track Riding or Bring Your Own Bike), any options and your language. We then hold a place for you for 60 minutes.
To stop one person holding every place on an event, we keep a counter per network address. The address is stored as a cryptographic hash, but because the number of possible addresses is limited, we treat it as personal data. The counter disappears within a few hours; the copy on your booking is removed as soon as you confirm or the hold ends.
3.3 When you give your details
| What | Why |
|---|---|
| First name, last name | To know who is riding and to invoice you |
| E-mail address | To check it is yours (see 3.4), to send your confirmation and practical information |
| Phone number | To reach you before and during the event |
| Date of birth | To check you are at least 18 on the first day of the event; younger riders cannot book |
| Street, postcode, city, country | For the invoice |
| Company name and VAT number (optional) | Only if you want the invoice addressed to your company |
3.4 The e-mail code
Before your booking can be confirmed, we send a one-time code to your e-mail address and you type it in. This proves the address is yours, so nobody can book under your name.
To do this, your e-mail address, your language and whether the address has been verified are stored in a customer directory at our hosting provider (Amazon Cognito). The code is generated, sent and checked there and is valid for a few minutes. We keep only the result: that your address was verified, and when. To prevent misuse we count how many codes are sent per address and per network address; those counters disappear the next day.
Your account. After your first code you choose a password. With it you sign in next time, to book or to see your bookings under "My bookings", without us having to send you a code first. Your password is stored only as a hash (a derived value from which the password cannot be recovered) in the customer directory (Amazon Cognito, in the EU, Ireland). Nobody at CRS or at its IT provider can read it, and we will never ask you for it. You can always sign in with a code by e-mail instead, after which you choose a new password; that is also what to do if you have forgotten it. An account without bookings is deleted 90 days after it was created. An account with bookings is kept as long as the personal data of those bookings, and is deleted when you have your data erased.
3.5 When you confirm
We record your booking: the event, formula, options, price, booking reference, the date by which payment is due, and any note you write for us (optional, up to 2,000 characters — please do not put health information in it; the rider form has its own place for that).
We also record that you accepted the terms of sale: which version of the text, in which language, and at what time. That is our proof of the agreement.
3.6 The rider form
After confirming, you receive a link to the rider form. It is open for 72 hours after confirmation; after that you can send the information to CRS directly.
| Always asked (necessary to run the event) | Only with your separate consent |
|---|---|
| Riding level, height, weight | Dietary requirements |
| Helmet, suit, glove and boot size | Physical details (for example an old injury, a medical condition, medication) |
| Your own motorcycle (Bring Your Own Bike only) |
Height and weight help us choose the right bike setup and gear. They are not used for anything else.
Dietary and physical details are health information (special-category data under Article 9 GDPR). We only accept them if you tick the separate consent box, which says:
"I give CRS permission to store my dietary requirements and physical details and to use them for my safety and for the catering on the day of the event. CRS keeps them until 90 days after the event and shares them with no one else. I may withdraw this later, and they are then deleted."
If you do not tick it, your booking stands; we simply cannot take a diet or physical details into account on the day. We record when you gave consent and which version of the text you saw.
3.7 E-mails we send
- the code mail (3.4);
- the booking confirmation, with your reference, the amount, the payment date and the link to the rider form;
- a cancellation notice if CRS cancels your booking;
- a short notice to CRS about each new booking, with your name, e-mail, phone, reference and your note — never your date of birth, your address or the rider form.
We send no newsletters or marketing e-mail.
3.8 When you contact us
If you e-mail or phone us, we use what you tell us to answer you.
If you use an enquiry form on the website (for example to ask about hiring the CRS Sleepliner), what you fill in is sent to CRS by e-mail, at info@crs-racing.com, with your e-mail address as the reply address. The website does not store the enquiry itself. To stop the form being misused, it only keeps a counter per hashed network address and per hashed e-mail address, which disappears within two days. CRS keeps the e-mail as general correspondence (section 7).
3.9 Photos and video at the event
Photographers and videographers work on site during CRS events. On Experience Track Riding the images are used by the instructors to review your riding with you and you receive them afterwards.
As our general terms say, CRS may also use photos and video made at its events for commercial, informational and promotional purposes, such as on the website, on social media or in printed matter. Images in which you are clearly recognisable by your face are used only where this falls within what participants can normally expect at a public motorsport event. If you object to an image in which you are recognisable, write to info@crs-racing.com; CRS assesses your request and, if it is well founded, adjusts or removes the image.
3.10 Our back office
CRS staff manage bookings in a back office that requires a password and a second factor. Every change, and every time somebody opens a rider's health information, is recorded in an audit trail with who did it and when (not the data itself).
4. Why we use your data, and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Taking and managing your booking, running the event | details in 3.2–3.6 (except health data) | Performance of the contract you ask for (Art. 6.1.b) |
| Checking the minimum age of 18 | date of birth | Contract (Art. 6.1.b) |
| Taking a diet or physical details into account | dietary and physical details | Your explicit consent (Art. 9.2.a), which you can withdraw |
| Invoicing and bookkeeping | name, address, company, VAT number, booking and payment data | Legal obligation (Art. 6.1.c): Belgian accounting and VAT law |
| Proving that you accepted the terms | consent record | Legitimate interest in being able to prove the agreement (Art. 6.1.f) and legal obligation |
| Security, preventing fraud and misuse (place hoarding, code-mail abuse, attacks) | IP address (hashed counters, logs, firewall), e-mail hash in counters | Legitimate interest (Art. 6.1.f) |
| Keeping the site working and counting visits in aggregate | access logs | Legitimate interest (Art. 6.1.f) |
| Statistics and advertising cookies (section 9) | cookie identifiers, IP address, information about your visit | Your consent (Art. 6.1.a), which you can withdraw at any time |
| Answering your questions | what you send us, also through an enquiry form | Legitimate interest (Art. 6.1.f), or the contract if it is about your booking |
| Photos and video | images of you | Legitimate interest (Art. 6.1.f) in showing and promoting CRS events, with your right to object (3.9) |
You do not have to give us your data, but without the details marked as required we cannot accept a booking.
5. Who processes your data for us
We do not sell your data and do not pass it on for others' marketing. The following parties process it on our behalf and on our instructions:
| Who | What they do | Where |
|---|---|---|
| JBit (Belgium) | Builds, hosts and maintains the website and booking system; has technical access to the data to keep it running. Bound by a processing agreement with CRS. | Belgium |
| Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg) | Hosting of the website (Amazon CloudFront, S3), the booking system (API Gateway, Lambda, DynamoDB), the customer directory and e-mail code (Amazon Cognito), sending of e-mail (Amazon SES), logs (CloudWatch), backups (AWS Backup) and the web application firewall (AWS WAF) | Data stored in the EU (Ireland, eu-west-1); see section 6 for the content delivery network |
| Combell (Belgium) | Hosts the info@crs-racing.com mailbox, which receives the booking notices, the enquiry forms and your e-mails to CRS | Belgium |
Our accountant receives the invoice data needed for our bookkeeping and tax returns.
Only if you allow statistics or marketing cookies (section 9), Google and Meta (Facebook, Instagram) receive information about your visit through those cookies. For advertising they also use it for their own purposes, as described in their own privacy policies.
We may also disclose data where the law requires it, for example to the tax authorities or a court.
6. Transfers outside the European Union
Your booking data, the customer directory and our e-mail are stored and processed in the EU (Ireland).
The website is delivered through Amazon CloudFront, a worldwide network: when you open a page from outside Europe, or when the network routes your request that way, your IP address and the request can be processed at a server outside the EU. The firewall rules are managed from AWS's US region. Amazon Web Services is part of a US group. AWS commits to the European Commission's standard contractual clauses in its data processing addendum and is certified under the EU-US Data Privacy Framework.
If you allow statistics or marketing cookies, Google and Meta can process information about your visit in the United States. Google LLC and Meta Platforms, Inc. are certified under the EU-US Data Privacy Framework.
7. How long we keep your data
| Data | Period |
|---|---|
| Confirmed bookings and invoice data | 7 years after the end of the financial year |
| Bookings never confirmed (abandoned or expired holds) | 30 days after the hold ends |
| Rider form: level, height, weight, sizes, motorcycle | 90 days after the event ends, the same as the health data |
| Dietary and physical details | 90 days after the event ends, or immediately when you withdraw your consent (this is what the consent text promises) |
| Record of your consent (to the terms, and to health data) | as long as the booking it belongs to |
| Customer directory entry (e-mail, language, verified, password as a hash) | deleted together with the personal data of your last booking; without bookings, 90 days after creation |
| Anti-abuse counters (hashed network address, hashed e-mail) | a few hours to two days |
| Server and application logs | 90 days |
| Back-office audit trail | 24 months |
| Backups of the booking database | daily backups kept 35 days, monthly backups kept 12 months. Data deleted from the live system disappears from the backups when they expire; we do not restore deleted data except to recover from an incident. |
| General e-mail correspondence, including enquiry forms | 2 years after the last contact |
| Cookies and browser storage | as listed in the cookie statement |
8. How we protect your data
- All traffic to the site and the booking system is encrypted (HTTPS). The database is encrypted at rest.
- Each part of the booking system can only reach the data it needs. Health information is in a separate part of the database that the booking pages cannot read back; only authorised CRS staff can open it in the back office, and every such opening is recorded.
- The back office requires a password and a second factor.
- Our logs do not contain your name, address, phone number or rider information. Where an e-mail address has to be traceable in a log, it is replaced by a short hash.
- A firewall and per-address limits protect the booking system against automated abuse.
- Backups allow us to recover from an incident.
No system is perfectly secure. If a breach puts your rights at risk, CRS will inform the Data Protection Authority within 72 hours and you without undue delay, as the law requires.
9. Cookies and storage in your browser
With your consent, we use Google Analytics, loaded through Google Tag Manager, to measure how visitors use the site, and Meta (Facebook, Instagram) and Google to measure our ads and show you relevant ones. They set cookies for this and receive your IP address and information about your visit. Nothing of this is loaded until you choose "Accept all", or allow statistics or marketing under "Settings", in the panel that appears on your first visit; refusing is just as easy. You can change your choice at any time via "Cookie settings" at the bottom of every page. Legal basis: your consent (Art. 6.1.a GDPR).
The website also stores a few things that it needs to work and that need no consent: your cookie choice (crs_consent, 180 days) and, during a booking, one entry (crs.booking.hold) in your browser's local storage: the booking number, a key to that one booking, and when the hold ends. It lets you continue if you close the tab and come back. It is removed when you confirm, when you start a new booking, or when you come back after the hold has ended. When you sign in to "My bookings", your sign-in is kept in the browser's session storage (crs.account.session) until you sign out or close the tab. Nothing of this is sent to anyone else.
Every cookie and storage entry, with its purpose and lifetime, is listed in our cookie statement.
10. Your rights
You have the right to:
- access the data we hold about you and receive a copy;
- have incorrect data corrected;
- have your data deleted, unless we must keep it (for example invoices for the tax authorities);
- restrict our use of your data while a question about it is being settled;
- object to use based on our legitimate interest;
- receive the data you gave us in a machine-readable format (portability);
- withdraw your consent for the health information or for cookies at any time. We then delete the health information; cookies you refuse are deleted from your browser. Withdrawal does not affect what was done before.
How: send an e-mail to info@crs-racing.com from the address you booked with, or tell us your booking reference. If we cannot be sure the request comes from you, we may ask for one more piece of information, never more than we need. We answer within one month; if a request is complex we may extend that by two months and tell you why.
11. Complaints
If you are not satisfied with how we handle your data, please tell us first. You can also lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be, www.dataprotectionauthority.be, or with the supervisory authority in the EU country where you live or work.
12. Changes
We will update this policy when the website or the booking system changes the way it uses personal data. The date at the top shows the current version. If a change affects a booking you already made, we will tell you by e-mail.