Privacy notice
W12 Sprint Series · Last updated: 16 October 2026
This notice explains which personal data the W12 Sprint Series web app (the "app") processes, why, and what rights you have. The app is only used to run the league: invitations, registration, entry list, draws, results, standings and stewarding.
1. Who is responsible
The controller under the EU General Data Protection Regulation (GDPR) is:
Christian Ablasser
Hitzendorf, Austria
Email: contact@w12series.com
The league is organised by a small team of volunteers. Organisers and race stewards see personal data only as far as their role requires.
2. Data we process
2.1 Your account
- Email address – to sign in and to send you league emails (invitation, password reset, security notices).
- Password – stored only as a secure hash (Argon2id). We never see or store your password in plain text.
- Role (driver, steward, broadcast, organiser).
- Timestamps such as account creation, last sign-in and last password change.
2.2 Sign-in and security
- Session data: when you sign in we store your IP address, your browser's user-agent string and the session's expiry. A session ends when you sign out, after 30 days without activity (7 days for organiser and steward accounts) and in any case after 90 days.
- Known devices: a one-way hash of your browser's user-agent. For organiser and steward accounts we use it to send an email when the account is used on a new device.
- Sign-in attempts: email address entered, IP address, time and whether the attempt succeeded. We use this to block password-guessing attacks. These records are deleted after 30 days.
2.3 Invitation and application
When you register through your invitation link we collect:
- first and last name (also used as your display name in the app),
- iRacing customer ID and, optionally, your iRacing display name,
- country,
- team name (optional),
- your own Silver Cup assessment (yes / no / not sure),
- up to three preferred car numbers.
We also record when and from which IP address the invitation was used.
The organisers then decide on your entry and assign class, car number and status (for example confirmed, reserve or waitlist).
2.4 Racing data
If you race in the league, we process your results (positions, lap times, laps, incidents, car, number, class), penalties and licence points, and your involvement in steward cases (including the reasons for decisions).
2.5 Logs
- An audit log records which organiser changed what and when. If an account is deleted, the log keeps only a one-way hash of the email address, not the name or iRacing ID.
- Our hosting provider keeps technical server logs. They contain, among other things, the email address and IP address of failed sign-in attempts, and the email address of password reset requests for unknown addresses.
2.6 Cookies and tracking
The app sets one cookie, w12_session, which keeps you signed in. It is strictly
necessary and is not used for anything else. We use no analytics, no tracking and no advertising. Fonts are served from our own server. The YouTube
preview image on the start page is loaded through our own server, so your browser does not contact YouTube until
you click the link.
3. Why we process your data (purposes and legal bases)
| Purpose | Legal basis |
|---|---|
| Running the league: registration, entry list, draws, results, standings, licence points, stewarding | Art. 6(1)(b) GDPR – necessary to let you take part in the league |
| Account, sign-in, password reset, emails about your account | Art. 6(1)(b) GDPR |
| Protecting accounts and the app (sessions, sign-in attempts, new-device notices, audit log) | Art. 6(1)(f) GDPR – our legitimate interest in a secure service |
| Keeping the championship history (past results and standings) | Art. 6(1)(f) GDPR – legitimate interest in a complete and fair sporting record |
| Race broadcasts: showing names, numbers, nations and results in the live stream | Art. 6(1)(f) GDPR – our legitimate interest in broadcasting the league's races |
| Blocking rejected applicants from re-applying (hash of the email address only) | Art. 6(1)(f) GDPR |
You do not have to give us your data, but without it you cannot take part in the league.
4. Who receives your data
- Other league members see what the league needs to function, for example the entry list, results, standings and published steward decisions. League content is only accessible after signing in. Without signing in, only the start page, the sign-in and password pages, the invitation page and this notice can be opened.
- Broadcast team: for the live streams, our broadcast team receives an export with name, car number, nation, iRacing ID, team, class, results, licence points and suspension status.
- Race broadcasts: names, car numbers, nations and results are shown in our live streams, which are publicly available on our YouTube channel (https://www.youtube.com/@w12racingleague40). Recordings stay available there; YouTube's own privacy policy applies to the platform.
- Hosting – Render: the app and its database run on Render (Render Services, Inc.) in the Frankfurt, Germany region. Render processes the data on our behalf under its Data Processing Addendum, which is part of Render's terms of service. Render is a US company; where personal data may be accessed from the USA, the transfer is based on the EU–US Data Privacy Framework or, where that does not apply, on the EU Standard Contractual Clauses (Art. 45/46 GDPR).
- Network – Cloudflare: all requests to the app and to w12series.com pass through Cloudflare (Cloudflare, Inc.), which Render uses as its network provider (a subprocessor under Render's Data Processing Addendum). Cloudflare processes technical connection data such as your IP address to deliver and protect the website.
- Email – Brevo: league emails are sent through Brevo (Paris, France) on our behalf under the data processing agreement included in Brevo's terms of service. Brevo receives your email address and the content of the email.
We do not sell your data or pass it to anyone else.
5. How long we keep your data
| Data | Retention |
|---|---|
| Account | until the account is deleted |
| Sessions | until sign-out or expiry (max. 90 days) |
| Sign-in attempts | 30 days |
| Email address in a personal invitation | deleted 30 days after the invitation can no longer be used (used, revoked or expired) |
| Expired sessions and one-time links (password reset, email change) | deleted after they expire |
| Access log of broadcast overlays (IP address) | 30 days |
| Application data (preferences, status, class, car number) | kept with the season's records; deleted immediately if the application is rejected. On request, your application for the current season is deleted together with your account, unless you have already raced in that season (see below) |
| Rejected applications | deleted immediately; only a one-way hash of the email address remains to prevent re-applying |
| Results, penalties, licence points, steward decisions | kept as part of the league's history (see below) |
| Our own database backups | 30 days |
| Automatic backups of our hosting provider | according to Render's retention period |
| Server logs (Render) / email logs (Brevo) | according to the providers' own retention periods |
Deletion runs automatically during normal use of the app (for example when someone signs in), so data can be deleted a little later than the periods above.
If you ask us to delete your account, we delete your account and your application for the current season, unless you have already raced in it. Applications for past seasons, and the current one once you have raced, are part of that season's records. Your name, iRacing ID and country remain attached to results you have already driven, so that the championship history and standings stay correct.
6. Your rights
You have the right to:
- access the data we hold about you (Art. 15 GDPR),
- have incorrect data corrected (Art. 16),
- have your data deleted (Art. 17), within the limits described in section 5,
- restrict processing (Art. 18),
- receive your data in a common format (portability, Art. 20),
- object to processing based on legitimate interests (Art. 21),
- lodge a complaint with a data protection supervisory authority, for example the one responsible for us: the Austrian Data Protection Authority (Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at), or the authority in the EU country where you live.
To exercise these rights, email contact@w12series.com. You cannot delete your account yourself in the app at the moment; we will do it for you.
7. Automated decisions
We do not make decisions about you based solely on automated processing. The car and track draw is random, but it does not decide anything about you as a person; entries, classes and steward decisions are made by people.
8. Imprint
Disclosure under § 25 of the Austrian Media Act (MedienG): Christian Ablasser, Hitzendorf, Austria. Contact: contact@w12series.com. This is a private, non-commercial website of the W12 Sprint Series, a sim racing league.
9. Changes
We update this notice when the app or the way we use data changes. The date at the top shows the current version.