Privacy policy

This privacy policy applies to the processing of personal data of the customers and/or users of https://kartdatapro.com (the WEBSITE), owned by the company POP TECH SYS, S.L. (the DATA CONTROLLER). It is a translation of the Spanish version; if they differ, the Spanish version prevails.

Applicable law

This Privacy Policy follows REGULATION (EU) 2016/679 of the EUROPEAN PARLIAMENT and of the COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation, GDPR), and, where it does not contradict that Regulation, Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).

By providing us with their data, the customer and/or user declares that they have read and understood this Privacy Policy and gives their unambiguous and express consent to the processing of their personal data for the purposes and on the terms set out here. This does not apply to the B2B prospecting described in section c), which is based on legitimate interest, not consent.

Basic data protection information

BASIC DATA PROTECTION INFORMATION
Controller: POP TECH SYS, S.L.
Purpose: To answer requests for information and queries, manage user registration, provide the services requested, and send commercial communications about our services by letter, phone, email, SMS/MMS, WhatsApp, Telegram or other equivalent electronic means, provided the data subject has consented to the processing of their personal data for this purpose. For B2B prospecting, to present our services to companies in the karting sector (see section c).
Legal basis: Performance of a contract to which the data subject is party, or steps taken at their request before entering into a contract. Legitimate interest of the controller. Consent of the data subject.
Source: Business contact data of B2B prospects comes from publicly available sources (the company's website and legal notice, business registers).
Recipients: Data will not be disclosed to third parties unless required by law. Our technology providers access it as data processors.
Rights: You have the right to access, correct and delete your data, as well as other rights listed in the additional information, which you can exercise by writing to the controller at info@kartdatapro.com
Additional information: Additional and detailed data protection information is available in the clauses below, at https://kartdatapro.com/privacy-policy

Additional data protection information

The data controller is:

Name: POP TECH SYS, S.L.
Tax ID (NIF): B56306038
Address: C/ Debla 9 – 29631 Benalmádena, Málaga (Spain)
Phone: (+34) 644 167 616
Email: info@kartdatapro.com

Purposes and legal basis of processing

a) In general

The DATA CONTROLLER processes the personal data provided by its customers and/or users for the following purposes:

Purpose: To answer requests for information and queries, manage user registration, provide the services requested, carry out administrative, commercial, accounting and tax management, and send commercial communications about our services by letter, phone, email, SMS/MMS, WhatsApp, Telegram or other equivalent electronic means, provided the data subject has consented to the processing of their personal data for this purpose.
Legal basis: Performance of a contract to which the data subject is party, or steps taken at their request before entering into a contract. Legitimate interest. Consent of the data subject, which may be withdrawn at any time.

b) Electronic forms on the WEBSITE

The DATA CONTROLLER processes the personal data provided by customers and/or users through the electronic data-collection forms on the WEBSITE for the following purposes:

For the “Contact form” and other enquiries (those sent to the email addresses shown on the WEBSITE):

Purpose: To contact the data subject, answer requests for information and queries, and send commercial communications about our services by letter, phone, email, SMS/MMS, WhatsApp, Telegram or other equivalent electronic means, provided the data subject has consented to the processing of their personal data for this purpose.
Legal basis: Consent of the data subject, which may be withdrawn at any time.

For the “Registration form”:

Purpose: To let the data subject register and create a user account on the website.
Legal basis: Consent of the data subject, which may be withdrawn at any time.

Where data requested in the electronic forms is required, the DATA CONTROLLER will say so when collecting it; if it is not provided, the request cannot be handled.

c) B2B prospecting

Controller: POP TECH SYS, S.L. (contact details above). We process business contact details (name, job title, work email and phone) of karting venue managers, taken from publicly available sources: the venue's own website, its legal notice and business registers.

Purpose: to present our services to your company.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR and Art. 19 of Spanish Organic Law 3/2018) in offering services relevant to your business. You can request our legitimate interest assessment at info@kartdatapro.com.
Recipients: our technology providers (email and data storage), acting as processors. We do not sell this data or disclose it to third parties for their own purposes.
Retention: if you don't reply, 12 months from our last contact; if you reply, for as long as our business relationship lasts. If you object, we keep only your email address or phone number on a suppression list so that we never contact you again.
Your rights: you can object at any time by replying "stop" to any of our messages, saying so on a call or writing to info@kartdatapro.com, with no proof of identity needed. You can also access, correct or delete your data and complain to the Spanish Data Protection Agency (www.aepd.es) or the authority in your country.

What data do we process?

For the purposes above we process customer data from the following sources and categories:

a) Data provided directly by the customer and/or user: data the customer and/or user gives us directly, whether when requesting the service through electronic or paper data-collection forms, or during the contractual relationship through other means such as requests for information or complaints. The customer and/or user is responsible for its accuracy and for keeping it up to date.

b) Data obtained from sources other than the customer and/or user: data obtained from other sources, either with their consent or under another legal basis (legitimate interest, compliance with a legal obligation, etc.).

c) Data arising from the commercial relationship: data the customer and/or user provides indirectly through the provision and continued operation of the contracted service. This includes traffic data, browsing data on the public website or in the private area, and similar data.

Our articles count visits and reading time without cookies and without storing personal data: we keep only daily totals per article. Like every website, our web server keeps standard access logs (including IP address) for about 14 days for security.

Record of processing activities

The personal data obtained from customers and/or users through the electronic forms on the WEBSITE form part of the DATA CONTROLLER's Record of Processing Activities, which is updated periodically in accordance with the GDPR and the LOPDGDD.

Recipients

The personal data of data subjects will be disclosed to the following recipients:

a) In general:

The DATA CONTROLLER's providers, acting as data processors, as part of the services they provide (partner karting venues and information technology providers: website hosting on Amazon Web Services, Ireland; email on Aruba, Italy; reCAPTCHA form verification by Google; and generation of the automatic comments in driving reports by OpenAI, which receives technical lap data, without name or email address) and, for B2B prospecting, the same technology providers.
The competent authorities and bodies, to the extent necessary to comply with legal obligations.

b) For the “Contact form”, other enquiries (those sent to the email addresses shown on the WEBSITE) and the “Registration form”:

Data will not be disclosed to third parties unless required by law.

Transfers to third countries

Some providers (Google, for reCAPTCHA form verification, and OpenAI, for analysis features of the application) may process data in the United States. These transfers rely on the EU-U.S. Data Privacy Framework (for certified providers) or on standard contractual clauses approved by the European Commission.

Retention periods

Personal data will be kept:

a) In general:

Data will be kept until you ask for it to be deleted and, in any case, for the years required to meet legal obligations.

b) For the “Contact form”, other enquiries (those sent to the email addresses shown on the WEBSITE) and the “Registration form”:

Personal data will be kept until the relationship between the DATA CONTROLLER and the customer and/or user ends, unless they ask for it to be deleted earlier, or until the data subject withdraws their consent, which they may do at any time without affecting the lawfulness of processing based on consent before its withdrawal.

c) B2B prospecting:

As set out in section c) of «Purposes and legal basis of processing».

For this purpose, the data subject must inform the DATA CONTROLLER, as the recipient to which they disclose personal data, of any correction or deletion of the data of their representatives, authorised persons and other contacts.

Once the relationship has ended, to the extent that the personal data is relevant to the DATA CONTROLLER's liability towards customers and/or users, it will be kept, duly blocked, at the disposal of the courts or the competent public authorities, for the purpose of any liability arising from the processing, for the applicable limitation period.

Rights of data subjects

Customers and/or users of the WEBSITE may exercise the following rights before the DATA CONTROLLER, where applicable: access to personal data, rectification, erasure (right to be forgotten), restriction of processing, data portability, objection to processing and not to be subject to automated individual decisions, and, where processing is based on consent, the right to withdraw it at any time.

Customers and/or users may exercise these rights by a written and signed request sent to the DATA CONTROLLER's postal address at C/ Debla 9 – 29631 Benalmádena, Málaga (Spain) or by email to info@kartdatapro.com, stating clearly the right they wish to exercise. We will only ask you to prove your identity if we have reasonable doubts about it. No proof of identity is needed to object to commercial communications.

Customers and/or users also have the right to lodge a complaint with the competent supervisory authority (Spanish Data Protection Agency) if they believe the processing does not comply with the law or that their data protection rights have been infringed, especially when they have not obtained satisfaction in exercising their rights, through the website https://www.aepd.es

The DATA CONTROLLER will answer these requests within 1 month, which may be extended to 2 months if the complexity or number of requests requires it. This is without prejudice to the obligation to keep certain data as required by law and until any liability arising from the processing or from a contractual relationship has expired.

In addition, users who so request may give instructions on what happens to their data after their death.

Commercial communications

In accordance with the second final provision of Spanish Law 9/2014 of 9 May on Telecommunications, which amends Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (LSSI), commercial communications sent by electronic means must be clearly identifiable as such, and the person or company on whose behalf they are sent must also be clearly identifiable, without prejudice to the rules of the Autonomous Communities with exclusive competence over consumer affairs.

A customer and/or user who gives their contact details to the DATA CONTROLLER by clicking the “SEND” button of the website's electronic forms and ticking the two consent boxes, “I accept the processing of my data for the purposes stated in the basic data protection information” and “I consent to receiving commercial communications about your services”, expressly authorises and gives their express, free and unambiguous consent to the DATA CONTROLLER to process their personal data in order to send them commercial communications about its services by letter, phone, email, SMS/MMS, WhatsApp, Telegram or other equivalent electronic means.

The legal basis for this processing is the consent of the data subject, which may be withdrawn at any time.

Under Articles 21 and 22 of Law 34/2002 of 11 July on Information Society Services and Electronic Commerce, users may object to the processing of their data for promotional purposes and withdraw their consent to receiving commercial communications by email at any time, simply and free of charge, by sending an email to info@kartdatapro.com with “UNSUBSCRIBE” or “DO NOT SEND” in the subject line.

The data provided will be kept for as long as the commercial relationship lasts or for the years required to meet legal obligations.

Commercial communications addressed to company managers as part of B2B prospecting are governed by section c) of «Purposes and legal basis of processing». They are sent by electronic means only to those who have requested or authorised them.

Social media policy

The DATA CONTROLLER has profiles on the following social networks:

Instagram

In this case it is considered the controller of the data of its users, including followers, subscribers, fans, and anyone who posts comments or queries through these channels.

The DATA CONTROLLER may use this profile to inform its users of news it considers relevant to the services offered, and may also share information or current articles published by other social network users.

It will never use users' personal information without their consent for relationships other than those expected on the social network concerned, and will ask for the user's agreement where needed.

Accuracy of the data provided by data subjects

The customer and/or user is responsible for ensuring that the information they provide through the electronic forms on the WEBSITE, or by email to the addresses under the kartdatapro.com domain, is true. They answer for the accuracy of all the data they provide, will keep it up to date so that it reflects their real situation, and are responsible for any false or inaccurate information and for any damage, inconvenience or problems it may cause to the DATA CONTROLLER or to third parties.

Security measures

The DATA CONTROLLER guarantees that it has implemented on the WEBSITE the appropriate technical and organisational policies to apply the security measures required by the GDPR and the LOPDGDD, in order to protect the rights and freedoms of customers and/or users, and has given them the information they need to exercise those rights.

To protect individual rights, especially with regard to automated processing, and to be transparent with customers and/or users, the DATA CONTROLLER has established a policy that sets out all such processing, its purposes, its legal basis and the means available to customers and/or users to exercise their rights.

The WEBSITE's frontend is built with Angular, an open-source JavaScript framework written in TypeScript, and its backend with the open-source .NET platform. It has an SSL certificate active for the whole domain and uses Google reCAPTCHA to detect traffic from automated programs or bots, so users can send their personal data securely through the website's data-collection forms.

The WEBSITE is hosted on servers provided to the DATA CONTROLLER by Amazon Web Services EMEA SARL in its Dublin (Ireland) data centre, with a European IP address.

All information will be stored and handled with due confidentiality, applying the security measures needed to prevent unauthorised access to or use of your data, and its manipulation, deterioration or loss.

However, customers and/or users should bear in mind that the security of computer systems is never absolute. When personal data is provided over the Internet, it could be collected without consent and processed by unauthorised third parties. The DATA CONTROLLER accepts no liability for the consequences such acts may have for the User if the User published the information voluntarily.

Acceptance and consent

The customer and/or user declares that they have been informed of the conditions on personal data protection, and accepts and consents to the automated processing of their data by the DATA CONTROLLER in the manner and for the purposes set out in this Privacy Policy. Certain services provided on the WEBSITE may have specific conditions with particular provisions on personal data protection. This does not apply to the B2B prospecting described in section c), which is based on legitimate interest, not consent.

Changes to this privacy policy

THE DATA CONTROLLER reserves the right to change this Privacy Policy to adapt it to new legislation, case law, interpretations of the Spanish Data Protection Agency and industry practice.

In such cases, the DATA CONTROLLER will announce the changes on its websites reasonably in advance of their application.

This privacy policy may be supplemented by the Legal Notice, the Cookie Policy and the General Terms and Conditions that apply to certain products or services, where access to them involves specific personal data protection provisions.

Last updated: 20 October 2026.