Privacy Policy

Last updated: 19 September 2026. This is a translation of the German original, which prevails in case of discrepancy.

1. Controller

The controller responsible for processing your personal data within the meaning of the General Data Protection Regulation (GDPR) is:

Drift United GmbH
Hohentichelnstr. 20
04328 Leipzig
Germany

Phone: +49 341 2525330
Email: info@driftunited.com

We have not appointed a data protection officer, as the legal conditions for doing so are not met. Please direct any data protection enquiries to the address above.

2. Scope of this policy

This policy describes which personal data we process when you book a spot for one of our events through this website, use the customer portal, or contact us.

3. What data we process

3.1 Booking data

Form of address, first and last name, email address, phone number, postal address (street and house number, postal code, town, country) and date of birth.

3.2 Event-related details

Vehicle (make and model), registration plate, team name, preferred neighbours, the spot size you selected, the spot assigned to you, and any remarks you choose to add.

If you take part as a driver, we additionally process the details that follow from the Regulations: your start number, the result of the technical inspection, your signature on the driver briefing attendance list and on liability waivers, team wristbands issued, and scores, warnings and penalties.

3.3 Payment data

Booking and invoice number, payment reference, outstanding and paid amount, and the details of the incoming payment on our business account (name of the payer, amount, payment reference, value date). We do not actively collect your bank details; they reach us only in so far as they form part of the incoming payment.

3.4 Communication data

The content and time of the emails we send you about your booking, and of your enquiries to us.

3.5 Technical data

When you access the website, our server processes your IP address, the date and time of access, the page requested, the HTTP status code and information about the browser you use.

4. Purposes and legal bases

4.1 Performing the booking

We process your booking and event-related data in order to handle your booking, assign you a spot, produce and send your ticket and booking confirmation, and keep you informed about your booking. The legal basis is Article 6(1)(b) GDPR (performance of a contract).

We process your date of birth to verify the minimum age for participation and to match your booking to an existing customer record. We process your team name and preferred neighbours solely in order to place you on the site as you have asked; these details are optional.

4.2 Payment, invoicing and accounting

We process your payment data in order to match incoming payments to your booking, issue invoices and pursue outstanding amounts. The legal bases are Article 6(1)(b) GDPR and Article 6(1)(c) GDPR in conjunction with commercial and tax record-keeping obligations (section 147 of the German Fiscal Code, section 257 of the German Commercial Code).

4.3 Operation and security of the website

We process technical data in order to provide the website, ensure its stability and detect and prevent misuse - in particular automated bulk bookings and attacks on the booking system. The legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in the secure and functional operation of our service and in the fair distribution of a limited number of spots.

4.4 Communication

We answer your enquiries on the basis of Article 6(1)(b) GDPR where they concern your booking, and otherwise on the basis of Article 6(1)(f) GDPR.

5. Recipients of your data

Within our organisation, only those people who need it for the purposes described above have access to your data. Beyond that, we share data with our hosting provider, who operates the website and the database; our email provider, through which booking confirmations, tickets and payment reminders are sent; our bank, for processing payments; and our tax adviser and - to the extent required by law - the tax authorities.

We have concluded data processing agreements under Article 28 GDPR with every service provider that processes personal data on our behalf.

We use the DeepL service to translate the fixed interface texts of this website. Only our own, static interface texts are transmitted - never your personal data.

Your data is not transferred to any country outside the European Union or the European Economic Area.

6. Retention periods

We delete your personal data as soon as the purpose of processing no longer applies and no statutory retention obligation stands in the way. Specifically: invoices, payment records and the associated booking data are retained for ten years (section 147 of the German Fiscal Code, section 257 of the German Commercial Code). Contract documents are retained for six years after the end of the contract (section 257 of the German Commercial Code). Customer master data not subject to a retention obligation is deleted three years after your last activity. Our email log is retained for six years, and access logs of our administrative area for ten years. Records of cookie consent are retained for three years.

7. Cookies and similar technologies

This website uses strictly necessary cookies only. We do not use cookies for analytics, tracking or advertising, we do not embed advertising networks, and we do not run web analytics. Consent under section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) is therefore not required; the storage is strictly necessary under section 25(2)(2) TDDDG in order to provide the service you have requested.

Specifically, we use: a session cookie for the booking process, which stores your selections between the booking steps and expires after two hours; a cookie that stores your chosen display language for 30 days; and a security cookie protecting against cross-site request forgery (CSRF), which expires when you close your browser. If you use the customer portal, a login cookie is added for the duration of your session.

8. Your rights

You have the right to obtain information about the data we hold about you (Article 15 GDPR), to have inaccurate data corrected (Article 16 GDPR), to erasure (Article 17 GDPR), to restriction of processing (Article 18 GDPR) and to data portability (Article 20 GDPR).

Where we process data on the basis of a legitimate interest, you have the right under Article 21 GDPR to object to that processing on grounds relating to your particular situation.

You can exercise these rights at any time through our data subject request form at /dsar or informally using the contact details given above.

Independently of this, you have the right under Article 77 GDPR to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement.

9. Whether you have to provide data

We need the details marked as mandatory in order to conclude and perform a contract for a spot with you. Without them we cannot accept your booking. All other details are optional and withholding them has no disadvantage for you.

10. No automated decision-making

We do not carry out automated decision-making, including profiling, within the meaning of Article 22 GDPR. The assignment of your specific spot is done manually.

11. Changes to this policy

We update this privacy policy when our services or the legal situation change. The version published on this page applies.