- Controller
- Hjelte Racing
- Address
- Molenstraat 101, 4902 NM Oosterhout, Netherlands
- Contact
- team@hotlaps.nl
1. Introduction
Hjelte Racing (hereinafter: “Hotlaps”, “we” or “us”) places great importance on protecting your personal data. In this Privacy Statement we explain which personal data we process, for which purpose, on which legal basis, how long we retain it, with whom we share it, and which rights you have as a data subject under the General Data Protection Regulation (GDPR — known in the Netherlands as the AVG, the Dutch implementation of the GDPR).
This Privacy Statement applies to all personal data Hotlaps processes via the platform at hotlaps.nl, including the registration page, the participant portal, and all related communications. By using the platform you consent to the processing of personal data as described in this document.
2. Controller
The controller for the processing of personal data described in this Privacy Statement is:
- Name
- Hjelte Racing
- Address
- Molenstraat 101, 4902 NM Oosterhout, Netherlands
- team@hotlaps.nl
For questions about this Privacy Statement, to exercise your rights as a data subject, or for other privacy-related requests, you can contact us using the details above.
3. Which Personal Data We Process
Hotlaps processes the following categories of personal data. For each category we indicate at which point in the process it is collected.
3.1 Identification data
- First and last name — provided by the organizer of the track day event you registered for, before the event starts.
- Vehicle data (make, model) — when provided to us by the organizer and to the extent relevant for identification during the event.
- Time slot or session grouping — where applicable for the event in question.
3.2 Contact data
- Email address — provided by you when you request access to the participant portal using the unique access code on your hang tag.
3.3 Authentication and session data
- Access code (six characters) — generated by Hotlaps and assigned to you before the event, printed on your physical hang tag.
- Magic-link verification token — a single-use token, valid for 1 hour, sent to you by email to verify your email address.
- Session cookies — small files stored in your browser to maintain your session for up to 30 days, so you do not have to verify again on every visit.
3.4 Usage data
- Number of portal visits — counted per participant, for internal statistics and to inform the organizer about participant engagement.
- Time of first and most recent visit to the portal.
- IP address — only temporarily processed by our technical service providers (see section 6) for the operation and security of the platform.
- Browser type and device type — only temporarily processed for correct rendering of content on your device.
3.5 Imagery
Hotlaps processes photo and video imagery from the track day event you took part in. You may be identifiable in this imagery, together with your vehicle. The imagery is produced by or on behalf of the organizer of the event and made available to Hotlaps for distribution to you and other participants via the participant portal.
4. Purposes of Processing
We process your personal data for the following purposes:
- To provide access to your personal participant portal at hotlaps.nl, including verifying that you are the rightful owner of the email address you register with.
- To make available the imagery from the track day event you took part in, exclusively to you personally via your secured portal page.
- To maintain a functional and secure session during your visit to the platform.
- To keep anonymized usage statistics for the event organizer, to provide insight into participant engagement.
- To send transactional communications necessary for the operation of the platform, such as the verification email containing the magic link.
- To send any further communications from the organizer about future events, only where you have given explicit consent at the appropriate place.
- To comply with legal obligations, such as retaining certain data for tax or evidentiary purposes.
- To secure and optimize the platform, detect and prevent abuse, and resolve technical issues.
5. Legal Bases for Processing
For each processing operation Hotlaps relies on a specific legal basis as set out in Article 6 GDPR. Below we explain, per processing operation, which legal basis applies.
| Processing | Legal basis | Explanation |
|---|---|---|
| Access to the portal | Performance of a contract (GDPR Art. 6(1)(b)) | Making content available is the core of the service you receive. |
| Email verification | Performance of a contract | Verification is technically necessary to grant access. |
| Making imagery available | Performance of a contract | Part of the event you registered for. |
| Marketing communications | Consent (GDPR Art. 6(1)(a)) | Only where you have given explicit consent via an opt-in. |
| Statistics for the organizer | Legitimate interest (GDPR Art. 6(1)(f)) | The organizer's interest in improving the quality of its events. |
| Security and abuse detection | Legitimate interest | The interest of Hotlaps and participants in a secure platform. |
| Retention for tax purposes | Legal obligation (GDPR Art. 6(1)(c)) | Mandatory retention periods under Dutch law. |
You have the right to withdraw your consent at any time for processing that is based on consent. Withdrawing your consent does not affect the lawfulness of processing carried out before the withdrawal.
6. With Whom We Share Your Data
Hotlaps does not sell your personal data to third parties and shares it only with parties where this is necessary for the operation of the platform or where we are legally required to do so. Below is a complete overview of the parties with which your data is shared.
6.1 Processors
The following third parties process personal data on behalf of Hotlaps under a data processing agreement in accordance with Article 28 GDPR.
| Processor | Purpose | Processing location |
|---|---|---|
| Supabase | Database hosting, content storage, user authentication | Frankfurt, Germany (EU) |
| Vercel | Hosting of the Hotlaps application and content delivery | Worldwide, with EU edge nodes |
| Brevo | Sending transactional emails (verification) and managing mailing lists and CRM functionality | France (EU) |
6.2 Event organizer
The organizer of the track day event you took part in receives anonymized usage statistics (number of participants who visited the portal, number of downloads). If you have given explicit consent for marketing communications, the organizer may receive your email address and name in order to send information about future events.
6.3 Sponsors
Hotlaps does not share personal data with sponsors. Sponsor branding on the platform is static and is not personalized based on your data.
6.4 Legal obligations
In exceptional cases we may be required to provide personal data to competent authorities, for example pursuant to a court order. We do this only where there is a legal obligation to do so.
7. Retention Periods
Hotlaps does not retain personal data for longer than necessary for the purposes for which it was collected, or as legally required. The table below sets out the specific retention periods.
| Data category | Retention period | Reason |
|---|---|---|
| Name, vehicle, access code | Up to 6 months after the event | Standard period for portal access |
| Email address and magic-link data | Up to 6 months after the event | For access to your own content |
| Session data | Up to 30 days | Portal session duration |
| Imagery | Up to 6 months after the event | Access for participants; deleted thereafter |
| Usage statistics (anonymized) | Indefinite | Contains no identifiable data |
| Mailing-list data (on opt-in) | Until consent is withdrawn | Consent is the legal basis |
| Audit logs of access attempts | Up to 90 days | Security and abuse detection |
| Tax data | 7 years | Statutory retention period (Dutch General State Taxes Act) |
After the retention period ends, your personal data is permanently deleted or anonymized, except where a longer retention period is legally required or permitted.
8. Security of Your Data
Hotlaps takes appropriate technical and organizational measures to protect your personal data against loss, misuse, unauthorized access, and unlawful processing. Our measures include, among others:
- Encrypted connections (HTTPS) for all communication between your device and the platform.
- Encrypted storage of personal data in our databases.
- Access control to the admin system based on email and password authentication.
- Securing of content via time-limited, signed URLs that cannot be retrieved without a valid session.
- Regular security updates of all software and infrastructure used.
- Logging of access attempts and monitoring for suspicious activity.
- Separated environments for development and production.
- Data processing agreements with all external service providers that process personal data.
Despite these measures, no system can guarantee complete security. If you suspect a personal data breach or security incident, we ask you to report it to us as soon as possible via team@hotlaps.nl.
9. Your Rights
Under the GDPR you have, as a data subject, a number of rights regarding the processing of your personal data. Hotlaps respects these rights and will respond to your request as soon as possible, and in any case within 1 month of receiving it.
9.1 Right of access
You have the right to know which personal data we process about you and to receive a copy of it.
9.2 Right to rectification
You have the right to have inaccurate personal data corrected and incomplete data completed.
9.3 Right to erasure
You have the right to have your personal data erased, to the extent that we have no legal obligation or legitimate interest in retaining it. Erasure of your email address and access code means you no longer have access to the participant portal.
9.4 Right to restriction
In certain situations you have the right to have the processing of your personal data restricted.
9.5 Right to data portability
For processing based on consent or on a contract, and where the processing is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller.
9.6 Right to object
For processing based on a legitimate interest you have the right to object to the processing. We will honour your objection unless we have compelling legitimate grounds that override your interests.
9.7 Right to withdraw consent
For processing based on consent you can withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
9.8 How to exercise your rights
To exercise the rights above, contact us via team@hotlaps.nl. We may ask you to prove your identity, to prevent us from disclosing personal data to unauthorized persons. Exercising your rights is free of charge in principle.
10. Complaints
If you believe Hotlaps is not processing your personal data in accordance with the GDPR, we ask you to contact us first via team@hotlaps.nl so we can address your concerns. If this does not lead to a satisfactory resolution, you have the right to lodge a complaint with the Autoriteit Persoonsgegevens, the Dutch Data Protection Authority (Dutch DPA) and the supervisory authority for privacy in the Netherlands. The Autoriteit Persoonsgegevens can be reached via autoriteitpersoonsgegevens.nl.
11. Cookies
Hotlaps uses a limited number of cookies that are strictly necessary for the operation of the platform. No prior consent is required for these strictly necessary cookies under the Dutch Telecommunications Act.
| Cookie | Purpose | Duration |
|---|---|---|
| supabase-auth-token | Maintains your sign-in session | Up to 30 days |
| supabase-refresh-token | Refreshes your sign-in session | Up to 30 days |
Hotlaps does not use marketing cookies, tracking cookies, or third-party analytics cookies. If we want to place other cookies in the future, we will ask for your explicit consent via a cookie banner.
12. Automated Decision-Making
Hotlaps does not use automated decision-making, including profiling, that produces legal effects concerning you or significantly affects you.
13. Changes to This Privacy Statement
Hotlaps reserves the right to amend this Privacy Statement from time to time, for example in case of changes in legislation, business operations, or platform functionality. The most current version is available at hotlaps.nl/privacy. We recommend reviewing this Privacy Statement regularly. For material changes, we will inform you proactively via the email address you provided at registration.
The version date at the top of this document indicates the date of the most recent change.
For questions about this Privacy Statement or about the processing of your personal data, you can contact us at any time via team@hotlaps.nl.