Privacy and personal data

2 Your data is safe

Here you will find information about the processing of your personal data. We follow applicable legislation, particularly personal data protection legislation, and process data only to the extent required by the particular service or purpose.

Internal procedures governing access to personal data are regulated by internal guidelines to prevent misuse. Our employees receive regular training on handling data and eliminating the possibility of misuse.

We process children’s personal data (persons under 15) only where a parent or other representative has first acted on the child’s behalf. The high personal data protection standards applied within our group apply equally to children and are fully sufficient for processing their data. As a parent or representative, you are responsible for ensuring that providing the child’s data is not contrary to the child’s interests and for explaining our processing and the child’s rights in an understandable way.

For clarification, contact provoz@cmkarting.cz or +420 774 026 513.

If you disagree with how we process your personal data, you may take the steps described below to protect your rights.

Privacy and personal data protection are supervised by the Office for Personal Data Protection: Pplk. Sochora 27, 170 00 Praha 7; telephone +420 234 665 111; website www.uoou.cz.

Visiting our website or following us on social media
Data: information supplied by Google Analytics, Facebook, Twitter, YouTube and Instagram.
Purpose: tailoring our offer to you.
Can you restrict it? Yes, on the relevant website, for example by disabling cookies or unfollowing social media accounts.

Creating a CMKarting profile
Data: information you provide, most often your name, date of birth, email, photograph and signature.
Purpose: we request consent to send results, display your photograph on the LED results board, send marketing messages and agreement to the operating rules. Existing registrations must be updated. If you have already purchased our products, newsletters are sent on the basis of the Controller’s legitimate interest.
Can you restrict it? Yes, you may unsubscribe in an email or at the venue at any time.

Online shop
Data: information necessary to perform the contract.
Purpose: identifying the purchaser and delivery destination. We do not otherwise process this data.
Can you restrict it? Partly, but we must retain basic accounting information.

CCTV
Data: camera footage only.
Purpose: our legitimate interest in safety on the track and in the restaurant.
Can you restrict it? Yes.

Transaction history
Data: the payment date and amount.
Purpose: statutory retention obligations.
Can you restrict it? No.

3 Your data controller

Your data controller is CM Karting s.r.o., Báštěcká 85, 250 69 Klíčany, company ID 22395474, VAT ID CZ22395474. CM Karting s.r.o. is a limited liability company established on 22 December 2024, registered by the Municipal Court in Prague under file C 416019/MSPH, to which you provided the data or which obtained it to fulfil one or more purposes.

The Controller collects and holds your data and is responsible for its proper and lawful processing. You may exercise your rights against the Controller as described below.

We process your data transparently, fairly and lawfully. You have a right of access, a right to an explanation and other rights if you believe processing is improper. You may also complain to the Office for Personal Data Protection. Exercise your rights with the relevant company in our group with which you hold a product.

For questions, contact provoz@cmkarting.cz or +420 774 026 513.

4 Data we process

We process only the data needed to provide professional services and convenient assistance, comply with our legal obligations and protect our legitimate interests. The data we process is described in the overview above.

5 Main categories of data we process

5.1 Basic data

Identification data
Basic identification data includes your name, gender, date of birth, photograph, email and telephone number. Unless strictly necessary to perform a contract, for example in the online shop, you do not have to provide it. By purchasing a ride, however, you automatically agree to CM Karting’s operating rules.

Contact data
Providing contact details, particularly your email, social media profile address and telephone number, allows us to provide more convenient service according to your preferences. Some services cannot be provided without your telephone number or email.

5.2 Product and service data

We also process information closely related to how you use our services, or information you disclose or otherwise create while using them. This particularly includes transaction history and results from all races. You may request deletion of your profile at any time.

We also collect information about the devices you use to access our services electronically. This helps us optimise and develop our platforms and improve security. It includes your IP address, browser information and device hardware information. Cookies are also stored on your device for this purpose. To serve you properly, we also need information about financial objectives and sales information.

6 Why do we process your data?

We process data to the extent necessary for the relevant purpose, for example to provide a service, typically to identify you. Various laws require us to process data. Much of it must be processed for archiving purposes. Some processing is necessary to protect our company’s rights and legally protected interests, particularly CCTV footage.

In other cases, we process your data only with your consent.

Processing purposes include the following categories.

6.1 Registration profile

Basic identification data is used to create an authentic profile and personalise your CMKarting results.

Reasons for processing:
• performing the commercial contract;
• storing ride results;
• transaction history;
• agreement to the venue’s operating rules;
• the loyalty scheme.

6.2 Email for sending results

Your email address is used to send personalised results.

• Based on your consent.

6.3 Photographs

Your photograph is needed to display you as a winner on the televisions. It is also needed to identify the loyalty card you may purchase.

Reason for processing:
• Based on your consent.

6.4 Customer relationship management

Where the necessary data is available, we assess your complaint, suggestion or request using the database of information you have provided.

Reason for processing:
• Protection of our rights and legitimate interests.

6.5 Marketing

Two models apply to commercial communications:

• Messages relating only to CM Karting s.r.o. products, using email addresses received in performing a contract.
Reason for processing: the legitimate interest of CM Karting.

• Messages that may include products of parties other than CM Karting s.r.o., based on your consent.
Reason for processing as stated in the source policy: the legitimate interest of CM Karting s.r.o.

6.6 Security

We protect both physical property, for example by installing cameras at our premises, and data. CCTV systems protect people and property against unlawful conduct, primarily to prevent and investigate robbery, burglary, theft, vandalism and fraud. We process camera recordings.

Reason for processing:
• Protection of our rights and legitimate interests.

7 How long do we retain your data?

We retain your data only as long as necessary. We archive it for 10 years, except CCTV recordings, which are retained for seven days.

We follow data minimisation rules. Strict internal archiving rules ensure that we do not keep data longer than we are entitled to.

8 Must you provide personal data?

Providing data based on your consent is voluntary. We require other data because processing is necessary to perform the contract, fulfil our legal obligations or protect our legitimate interests. If you do not provide it, we cannot supply the relevant product, service or other performance for which the data is required.

9 Sources of personal data

All data we process has been received directly from you or created through your activities.

10 Recipients of personal data

We generally keep your personal data within our company. We transfer data outside the group only with your permission or where legislation provides for it. Approved and verified processors are listed below, and you also give consent for their processing.

11 What are your rights?

We process your data transparently, fairly and lawfully. You have a right of access, a right to an explanation and other rights if you believe processing is improper. You may also complain to the Office for Personal Data Protection. Exercise your rights with the relevant company in our group with which you hold a product.

For questions, contact provoz@cmkarting.cz or +420 774 026 513.

12 Would you like to know what data we process about you?

You have the right to access your data and related information, without affecting third parties’ rights. We may request a reasonable fee not exceeding the costs necessary to provide the information.

13 Would you like your data corrected?

We will correct incorrect or inaccurate data. Taking account of the processing purposes, you also have the right to have incomplete data completed.

14 Would you like us to erase your data?

You have the right to erasure of personal data where our processing is unlawful.

15 Would you like to restrict processing?

You also have the right to have data blocked.

16 Are you unwilling or unable to provide your data?

You may refuse to provide the personal data we request. However, if providing it is mandatory, we cannot provide the associated service.

17 Would you like to withdraw your consent?

Where we require your consent to process data, you may withdraw it at any time. Withdrawal does not affect processing while your consent was valid, or processing on other applicable legal grounds, such as compliance with legal obligations or our legitimate interests.

18 Would you like to restrict marketing?

If you consented to marketing or receive commercial offers on another lawful basis, you may withdraw consent or unsubscribe at any time:
• in person at CM Karting;
• by contacting provoz@cmkarting.cz or +420 774 026 513;
• using the automatic unsubscribe link in an email;
• in writing to CM Karting, Ringhofferova 1, Praha 5 Zličín.

If you restrict marketing, we may still contact you for service purposes and use your contact details for service messages and purposes other than marketing.

Website visitors may withdraw cookie consent using the procedure on the relevant website.

19 Processing that requires your consent

19.1 Consent to processing personal data for sending results

You consent to CM Karting s.r.o., Báštěcká 85, 250 69 Klíčany, company ID 22395474, VAT ID CZ22395474, a limited liability company established on 22 December 2024 and registered by the Municipal Court in Prague under file C 416019/MSPH (the “Controller”), processing your email address under Act No. 101/2000 Coll., on Personal Data Protection.

• The email address will be processed for inclusion in a database for sending karting results.
• Consent is given for processing for 10 years for the purpose of sending commercial communications, unless you extend this period.
• Processing is performed by the Controller, but the following processors may also process data on its behalf:
a) Apex Timing, 11 Route de la Salle, Cran Gevrier, 74960 Annecy, France; Siret 53197601700032, Naf 6201Z, VAT FR61531976017, RCS Annecy 531976017.
b) Other providers of processing software, services and applications, which the Controller does not currently use.
• You may withdraw consent at any time, for example by letter, email or a link in a message. Withdrawal stops the sending of karting results.
• Under personal data protection legislation, you may request information about the personal data we process, an explanation of processing, access to data and its updating or correction, and erasure. Erasure stops the sending of commercial communications. If you have doubts about compliance with processing obligations, you may contact us or the Office for Personal Data Protection.

19.2 Consent to processing personal data for newsletters

You consent to CM Karting s.r.o., Báštěcká 85, 250 69 Klíčany, company ID 22395474, VAT ID CZ22395474, a limited liability company established on 22 December 2024 and registered by the Municipal Court in Prague under file C 416019/MSPH (the “Controller”), processing your email address under Act No. 101/2000 Coll., on Personal Data Protection.

• The email address will be processed for inclusion in a database for sending commercial communications.
• Consent is given for processing for 10 years for the purpose of sending commercial communications, unless you extend this period.
• Processing is performed by the Controller, but the following processors may also process data on its behalf:
a) ECOMAIL.CZ, s.r.o., Na Zderaze 1275/15, Praha 2, 120 00, company ID 02762943, VAT ID CZ02762943, account 2100563096/2010.
b) Know-how provider Green digital solutions s.r.o., company ID 09960805, VAT ID CZ09960805, Slavíkova 1611/5, Vinohrady (Praha 2), 120 00 Praha.
c) Other providers of processing software, services and applications, which the Controller does not currently use.
• You may withdraw consent at any time, for example by letter, email or a link in a commercial message. Withdrawal stops the sending of commercial communications.
• Under personal data protection legislation, you may request information about the personal data we process, an explanation of processing, access to data and its updating or correction, and erasure. Erasure stops the sending of commercial communications. If you have doubts about compliance with processing obligations, you may contact us or the Office for Personal Data Protection.

19.3 Consent to processing personal data for displaying a photograph

You consent to CM Karting s.r.o., Báštěcká 85, 250 69 Klíčany, company ID 22395474, VAT ID CZ22395474, a limited liability company established on 22 December 2024 and registered by the Municipal Court in Prague under file C 416019/MSPH (the “Controller”), processing your photograph under Act No. 101/2000 Coll., on Personal Data Protection.

The photograph will be processed for display on the results television and, where purchased, for the loyalty programme.

• Consent is given for processing for 10 years for the purpose of sending commercial communications, unless you extend this period.
• Processing is performed by the Controller, but the following processors may also process data on its behalf:
a) Apex Timing, 11 Route de la Salle, Cran Gevrier, 74960 Annecy, France; Siret 53197601700032, Naf 6201Z, VAT FR61531976017, RCS Annecy 531976017.
b) Other providers of processing software, services and applications, which the Controller does not currently use.
• You may withdraw consent at any time, for example by letter, email or in person at the venue. Withdrawal results in deletion of the photograph from the system.
• Under personal data protection legislation, you may request information about the personal data we process, an explanation of processing, access to data and its updating or correction, and erasure. Erasure stops the sending of commercial communications. If you have doubts about compliance with processing obligations, you may contact us or the Office for Personal Data Protection.

19.4 Online shop – terms and conditions

The conditions for purchases in the online shop and processing personal data for purchases are available on the separate Terms and Conditions page.