Last updated: 13 October 2026
This policy explains what personal information M4 Karting Ltd ("we", "our" or "us") collects when you book, visit us, sign a waiver, race or create an online account, what we do with it, how long we keep it, and the choices you have. We have tried to write it in plain English. If anything is unclear, please contact us using the details at the end.
1. Who we are
M4 Karting Ltd is a company registered in England and Wales (company number 10380341), of Hangar 88, Hullavington Airfield, Chippenham, Wiltshire, SN14 6GU. We are the "controller" of your personal information, which means we decide how and why it is used.
You can contact us about anything in this policy at info@m4karting.com, on 01666 838234, or by post at the address above.
2. What information we collect
Information you give us
When you book, register or create an online account:
- your name, email address and telephone number;
- your date of birth (we need it to check that you meet the age rules for the experience you are booking);
- your address and postcode, if you give them;
- a "race name" if you choose one, and a profile picture if you upload one;
- a password for your online account (we store only a scrambled version of it, never the password itself);
- anything you write to us in a message or request.
Information about your visit
- your bookings, who was in the group, and whether you checked in;
- your race results: kart number, lap times, positions and fastest laps, recorded by our timing system when you race;
- what you bought from us (the items, the amount and how you paid) and any account credit you hold;
- the emails we have sent you, such as booking confirmations, receipts, waiver and account emails and, if you have agreed to marketing emails, whether you opened them and which links in them you clicked (see section 5).
Waivers, photographs and video
Before you race you must sign a waiver. We record the wording you signed, the date and time, your typed name, your drawn signature and how it was signed. Whether you sign on one of our tablets at the venue, or online on your own phone or computer, we also take two photographs of the person signing, using the device's camera, to help show who signed. Your device will ask for permission to use its camera, and the screen tells you when the photographs are taken. If you sign online you need to allow the camera, or you can sign on our tablet at the venue instead. When an adult signs on behalf of a child, the photographs are of the adult signing, not the child. The photographs are kept with the waiver record. Separately, our staff take photographs and videos at the venue, for example of races, groups and parties, and we use them on our website, on social media and in our advertising and promotion, where they can be seen by the public. The waiver tells you this before you sign. Pictures of children are taken and used on the same basis, with the permission of the parent or guardian who signs their waiver. If you would like a photo or video of you or your child taken down, contact us (see section 14) and we will remove it where we reasonably can. We also use CCTV (see section 4).
Payments
When you pay by card online or through a payment link, you enter your card details on our payment provider's own secure page. We never see or store your full card number. We receive confirmation that the payment was made and a reference for it.
Technical information
When you sign a waiver online we record the IP address of the device you used. We also keep security records such as sign-in attempts to our booking system. See "Cookies" below for information about cookies.
3. Children
Many of our customers are children. A parent or guardian must book for, and sign the waiver for, anyone under 16 (older children may sign their own). If you add your child to your account or register them for a booking, you are giving us their information and you confirm that you are their parent or legal guardian. For a child we collect their name, date of birth, race name (if chosen), their waiver and their race results. When you sign a child's waiver, the photographs and signature we keep are yours, as the adult signing, and not the child's. We do not send marketing emails to children, and children are only ever shown on public screens by race name or first name (see section 7).
Because a child's date of birth is used to apply safety and age rules, it cannot be changed from your online account once it has been set. If it is wrong, please ask us and a member of staff will correct it.
4. CCTV
We use CCTV cameras at our venue for the safety and security of customers, staff and property, and to help deal with accidents, incidents and insurance claims. Signs at the venue tell you where cameras are in use. Footage is kept for 31 days and then recorded over or deleted, unless we need to keep it longer to deal with a specific incident, claim or request from the police or another authority.
5. Why we use your information
The law says we must have a reason, called a lawful basis, for using your information. Ours are:
- Contract: to take your booking, take payment, run your session and provide your account.
- Legitimate interests: to keep our venue safe, keep records of who took part and signed a waiver, deal with insurance claims, run race results and leaderboards, promote our business with photos and video taken at the venue, keep our systems secure and backed up, and prevent fraud.
- Legal obligation: to keep accounting and tax records, and to meet health and safety duties.
- Consent: to send you marketing emails, to see whether you open them and which links you click so we can tell which offers are useful, and to show a profile picture you upload. Opens and clicks are only recorded for marketing emails, never for booking confirmations, receipts or other emails about your booking. You can withdraw consent at any time.
We do not sell your information. We do not make decisions about you that have a legal or similarly significant effect by automated means.
6. Who we share your information with
We only share information where we need to, with companies that act on our instructions:
- Stripe and Worldpay, who process card payments. We do not see or store your full card number.
- Google, who provide our email service and the encrypted cloud storage we use for backups.
- Webflow, who host our website.
- Fly.io, who host the online part of our booking system (online booking, customer accounts, online waivers and live timing) on servers in London. The rest of our booking and timing system runs on our own computers at the venue. Apex Timing, who provided our previous booking and timing system, still hold older booking, waiver and race records until our account with them is closed.
- Our insurers and professional advisers, where needed for a claim or to get advice.
- The police or other authorities, where we are legally required to or where it is needed to prevent or detect crime.
Some of these companies may handle information outside the UK. Where they do, we rely on UK-approved safeguards, such as the UK International Data Transfer Agreement or addendum, or an adequacy decision, so that your information stays protected.
7. Race results, leaderboards and screens
Lap times and results can be shown on screens at the venue and on our live timing and results pages. We show the race name you chose or, if you have not chosen one, your first name and the initial of your surname. For children we show the race name or first name only. We never show surnames, contact details or payment details. A profile picture is only shown if you uploaded one and our staff have approved it. If you would rather not appear on screens or leaderboards, ask us and we will use a different name or remove you.
8. How long we keep your information
- Adult customer records, bookings, waivers and results: 6 years after your last activity with us.
- Records for children: until they turn 22.
- Waiver photographs, whether taken on our tablets or online: the same time as the rest of the customer record they belong to.
- Online sign-ups that are never confirmed: 30 days.
- Stored copies of emails we have sent you: about 13 months. Records of whether you opened or clicked a marketing email: up to 2 years.
- Encrypted backups: about 30 days, so someone we have deleted may remain in a backup until it expires. If we ever restore a backup, we delete those people again straight away.
- CCTV: 31 days, unless we need to keep footage longer for an incident, claim or request from the authorities (see section 4).
Photos and videos our staff take at the venue to promote our business are kept while we are still using them, and removed if you ask us to (see section 2). When the time is up we delete or anonymise the record. We may keep anonymous figures, such as sales and lap statistics, that no longer identify anyone. Signed waivers and race records can be needed as evidence in injury or legal claims, which can be brought many years later. For that reason we may keep signed waivers, and the race and session records that go with them, for longer than the periods above, including records brought over from our previous booking and timing system. We keep these securely and use them only to deal with claims, incidents and legal requirements.
9. Keeping your information safe
Staff only see what they need for their job, and staff sign in with their own accounts. Customer passwords are stored in scrambled form, our systems are protected by access controls, and our backups are encrypted. Our online booking pages use an encrypted (https) connection, and the online part of our booking system and the computers at our venue only exchange information over an encrypted connection that each side checks is genuine. If there is a data breach that puts your rights at risk, we will tell you and the Information Commissioner's Office as the law requires.
10. Your rights
You have the right to:
- see the information we hold about you, and get a copy. If you have an account you can download your data yourself from the Profile page, under Your data.
- have wrong information corrected.
- ask us to delete your information. If you have an account you can request this from the Profile page, or you can email us.
- object to, or ask us to restrict, how we use your information.
- withdraw consent to marketing at any time, by changing the tickbox on your account or using the unsubscribe link in an email.
- receive your information in a portable format.
To use any of these rights, email info@m4karting.com. We will reply within one month. We may need to check who you are first. Some rights have exceptions, for example we may need to keep a signed waiver or accounting records for the periods in section 8. We cannot change a date of birth once it has been set, but our staff can correct it if it was entered wrongly.
11. Cookies
Our website and booking pages use cookies. If you sign in to a customer account we use an essential cookie to keep you signed in. See our Cookies Policy for details.
12. Complaints
If you are unhappy with how we have used your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.
13. Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last changed.
14. Contact us
M4 Karting Ltd, Hangar 88, Hullavington Airfield, Chippenham, Wiltshire, SN14 6GU
Email: info@m4karting.com
Phone: 01666 838234
