Privacy Policy

Who we are

MTB east CIC (company number 17349989), 4 Pudsey Hall Lane, Canewdon, Essex SS4 3RY. MTB east CIC is not registered with the Information Commissioner's Office (ICO). We checked directly with the ICO and, as a not-for-profit, we're exempt from registration.

Hosting & data location

The website's database and hosting are located in the UK/EU (Supabase, London region; Vercel, UK/EU region) once those services are configured. Supabase Inc. and Vercel Inc. are US-headquartered companies, so hosting data in a UK/EU region reduces, but does not eliminate, exposure under the US CLOUD Act. This is a known limitation shared by most modern edge/serverless hosting stacks, not something specific to this site.

What we collect

We collect only what we need to run races, the rider portal and the volunteer rota. For each rider that is their name, date of birth, whether they race as Female or Open, category, club (optional), their own phone number and email address (a parent or guardian's for a child), and an emergency contact's name and phone number. For each entry we keep the rounds, price, extras and a payment reference. Card details are handled only by Stripe: we never see or store them. If you volunteer we also collect your name and phone number, and whether you are 16 or over. We don't collect data "just in case".

Race diary

The race diary is optional. It lets a rider keep private notes for each round they enter, such as their bike set-up, how they felt, sleep, weight, what they ate, heart rate, the conditions, and whether anything went wrong, including a crash, illness or injury. Some of this is information about health. We only record it if you choose to fill it in, which is your consent, and you can change or delete an entry or ask us to delete the whole diary at any time. The diary can be seen only by the account that owns the rider. It is not shown to other riders, published on the website or used for any other purpose. You can download your own diary as a spreadsheet from the diary page. When a rider or account is deleted, the diary is deleted with it. For a rider under 18, the parent or guardian who holds the account is the person who decides whether to use the diary.

Public start list

For each round we publish a start list showing who has entered: their category, their club if they gave one, and their name. Riders under 18 are shown by first name and the initial of their last name only. Adults are shown by full name. If you would prefer a rider not to be named on the start list, tick the option on their profile: they will still race, and we will show them only as part of the count for their category. Race results, including name, category and finishing position, are published on the website as they always have been.

Volunteers and the Marshal Club

If you sign up for a volunteer shift we use your name and phone number to organise the day and to reach you at the event, and we email you the details. We ask whether you are 16 or over. Volunteers under 16 must have an adult with them, and we record that adult's name. Marshals are on the course only and are not left alone with children. Your attendance is recorded so that we can give you a Marshal Club credit. Only you and MTB east staff can see your sign-ups.

Credits and passing on a place

A Marshal Club credit (a free entry for a full day, or half price for a half day) belongs to your account, and you can use it or pass it to another account. If you offer a credit, or a paid race place, to someone else, you enter their email address. If there is an account with that address we email its holder to say who the offer is from and what it is, and it appears in their account. If there is no account with that address we tell you so and nothing is sent. You should only enter the address of someone who expects to hear from you.

Programme sign-ups

If you sign up for the Women's Rookie Race Squad or Sofa to Singletrack, we collect your name, email address, an optional phone number and an optional message. We use them only to contact you about that programme and to count how many people take part, without naming anyone. We don't share them, and you can ask us to delete them at any time by emailing info@mtbeast.co.uk. If you sign up a child, use a parent or guardian's details.

Sofa to Singletrack progress

The Sofa to Singletrack app works on your own device without an account. If you sign in to your MTB east account while using it, we save your progress on your account, and that of anyone in your family you add in the app, so it follows you between devices: the name you gave, age group and experience level, your chosen days, the sessions you have logged and how each one felt, and your settings. It can be seen only by you, is not used for anything else, and is deleted with your account. If you sign in and then stop for a fortnight, we may send you one email to say the plan is still there, and never a second; switch it off under Settings in your account or with the link in that email. If you don't sign in, none of it leaves your device.

Emails we send

We send emails about your own entries and account: confirmations, refunds, cancellations, information for a round you are entered in (such as parking, timings and the forecast), offers of a place from another rider, and sign-in emails. We don't send marketing emails. After a race, the timing system may email each rider their results; a rider can opt out on their profile.

Who we share data with

We use a small number of services to run the website and races, and share only what each needs: Supabase (database and sign-in), Vercel (website hosting), Stripe (card payments), our email provider, and MET Norway (weather forecasts, which receive only the venue's location). Entries and rider details are also passed to the MTB east timing system, which runs on a computer we control and is used at race venues without internet. Traffic between the website and the timing system passes through Cloudflare. We don't sell personal data or use it for advertising.

How long we keep data

We keep rider and account details for as long as the account exists. When you delete an account, the riders on it, their diaries and their entries are deleted, other than records we must keep by law, such as financial records. Race results are kept permanently as a public record of the League.

Children's data

Many riders are minors. A parent or guardian holds the account and adds each rider, a minor does not hold their own login. If you add a rider under 18, you're confirming that:

• You are their parent or legal guardian, with the authority to consent to their data being processed as described on this page.
• You consent to us collecting and holding the rider's name, date of birth, race category, club, phone number and email address and emergency contact details to organise and run races, gridding, timing, and results.
• You understand race results (name, category, finishing position) are published publicly on this website, the same as for adult riders.
• You understand that, unless you ask us not to, a rider under 18 appears on the public start list for the rounds they enter by first name and the initial of their last name, with their club and category.
• You understand that the race diary is optional, may include information about how a rider felt or any illness or injury, and is visible only to your account.
• You understand photographs and video may be taken at events for MTB east's website, social media and promotional use. If you'd rather your rider wasn't photographed, tell an organiser on the day and we'll do our reasonable best to avoid or remove them from anything we publish.
• We don't use a rider's data to market to them directly, and don't share it beyond what's needed to run the event (the timing system, and Stripe for payment).
• You can withdraw consent, request a copy of your rider's data, or ask us to delete it, at any time via Account Settings or by contacting us. We'll action this unless we have a legal reason to keep it (for example, financial records).

Your rights

You can request a copy of your data, or delete your account yourself, from Account Settings, or by contacting us directly.

Cookies

See our separate Cookie Policy.