Privacy and your data.

Who we are

Marbl Racing is run by MEM Digital Ltd, trading as Marbl Racing, a company registered in England and Wales (company number 13753194). Registered office: 25 Osier Way, Olney, Buckinghamshire, MK46 5FP.

We're the data controller for the personal data described here, registered with the Information Commissioner's Office (ICO) under number ZB306782. For anything about your data, email hello@marbl.racing.

What we hold, and why

You don't have to give us any personal data. But we can't publish a listing or pass on an enquiry without your name and email, or send you news without your email.

If you list an item

• Your name and email address (a first name is fine), to review your listing and send your reference, updates and manage links. We also email ourselves these and the listing's main details for review. They're never published.
• Your listing details, which are published: what the form asks about the item, your town or district if you give one (as you type it, our server sends the letters, never your IP address, to postcodes.io, a free UK place-name lookup, to suggest towns; if you type a postcode, only its first half, like NN8, is sent, never the whole postcode), and whether you're selling as a business (shown as "Trade seller", with the business name and address you give).
• Your photos, published with the listing. We re-save each one when you upload it, which strips location and other hidden data, and we don't keep the originals.
• Whether you ticked the box to let us share your listing in the Marbl Racing Facebook group.

If you manage a listing

We check your reference against the email you listed with, and keep a short scrambled code made from your email for about a day, so we send one link every 15 minutes at most. Pressing the button on a link sets one cookie for 30 minutes.

If you send an enquiry

• Your name, email address and message, which we pass to the seller.
• The country and network provider your connection comes from, which we use with your message to spot likely scams. We don't store your IP address with your enquiry. A flagged enquiry waits for a person, and lapses unsent if it isn't reviewed within 14 days.
• A scrambled (hashed) copy of your email once you've confirmed it, so you needn't confirm again for 30 days, and on a block list if we block an address for abuse.

If you join our news list

• On the website: your first name, email address and any topics you pick. The form also asks you to tick that you're 18 or over; we check the tick but don't keep it. We email you a link to confirm your address, and send nothing more until you click it. If you ask to beta test Marbl Pit Crew, we keep that request with your email so we can choose testers; unsubscribing deletes it.
• At a race-day event: our kiosk takes your name, email address and topics, notes which event you're at, and asks you to tick that you're 18 or over and that you want to join our list (its privacy notice is one tap away). You're added straight away and we send you a welcome email.
• One list: both routes add you to the same list, kept in our database and with Resend, our email provider, with a note of where you signed up. We send ourselves a note of each sign-up. If you joined on our pre-launch page, we also hold the name and topics you gave then.
• What it's for: news about Marbl Racing, such as new parts of the site opening (like the store and starter packages), new features and events, as the sign-up box says. If you joined before launch, you signed up for launch news only. Our launch email will ask whether you'd like more, and if you don't say yes, you won't get it.
• Leaving: every email has a one-click unsubscribe link. We then delete your name and topics, keeping only your email address, when you joined and left, and where you signed up, marked as unsubscribed so we never email you again.
• The kiosk's Pit Crew assistant sends your questions (never your name or email) to Claude, Anthropic's AI assistant, sometimes with a web search. We strip out email addresses, phone numbers and postcodes, but please don't type personal details. We don't store transcripts, and the kiosk forgets the chat after 10 minutes of quiet or when the next person starts.

If you contact us

If you email us, or use our contact form or club websites form, we get your name, email address, what it's about and your message, plus a listing reference, business name or club details if you add them. If you use our Mini-Z event hire form, we also get your company, the type of event, roughly how many guests, where it is, and the date and phone number if you add them, so we can quote for the event. Our forms email your message to our mailbox through Resend; it isn't stored in our database.

Reports about a listing or a user reach us the same way. We use a report only to deal with it, and it's deleted in our regular mailbox clear-out, within 12 months at most.

Everyone who uses the site

• Your IP address, sent with every request. We use it to limit repeated submissions (IPv4 in full, IPv6 cut to its first half) and to stop bots through Cloudflare Turnstile, and it appears in our request logs.
• Cookies and device storage: one cookie if you manage a listing, a possible Turnstile security cookie on our forms, a note in your browser if you pause the home page video, a copy of what you type into our contact forms, kept in that browser tab while you send it, Fathom's check for its opt-out note, and YouTube's own storage if you press play on our channel video. Full list: cookies.
• Visit counts: Fathom Analytics counts page views without cookies and never tells us who you are. It doesn't run on the private pages you reach from our emails.
• Listing views: when you open a live listing we add one to its view count, at most once a day per listing. To tell a repeat visit from a new one, we make a code from your IP address, the listing and the date. The code is scrambled with a secret key, so it does not show your IP address, and we delete it the following night. It uses no cookies. We filter out search engines and link previews, and a seller signed in to manage their listing is not counted.
• Distance from you: if you type a postcode on a club page to see how far away the club is, the sum is done in your browser. Your postcode is not sent to us and we do not keep it. To do the sum your browser fetches a small file for your postcode area (the letters at the start, such as NN). That request tells us the area letters and, like any request, your IP address. It does not say which club page you were on. If you tap Directions, Google Maps opens with the club as the destination and nothing from us about where you are.
• Searching: When you search, your words come to our server to be answered and aren't kept. They travel in the body of the request, never in a web address, and we don't store them, write them to a log or pass them on. We count that searches happen (Fathom, with no words in the count), never what was typed. Like any request, a search carries your IP address, which Cloudflare uses to limit how many searches can be sent from one place.

Club directory

Club entries hold the contact details clubs publish themselves. If one of those is yours and you'd like it changed or removed, tell us.

Data credits

The postcode areas behind the distance sum come from Ordnance Survey's Code-Point Open, used under the Open Government Licence v3.0. Contains Ordnance Survey data © Crown copyright and database right 2026. Contains Royal Mail data © Royal Mail copyright and database right 2026. Contains National Statistics data © Crown copyright and database right 2026.

Our lawful bases

• Contract (the service you asked for): publishing and managing your listing, its emails, and delivering your enquiry.
• Legitimate interests: keeping the site safe and honest (reviewing listings, screening enquiries, block lists, rate limits, bot checks, logs, reports and our moderation log), helping the police or Report Fraud prevent or detect crime (sharing only what's needed), counting visits without cookies, answering messages and kiosk questions, and showing the club details clubs publish. We've weighed each against your privacy and kept it small.
• Consent: our news list, and sharing your listing in our Facebook group if you tick the box. Withdraw it any time with the unsubscribe link or by emailing us, and we'll remove a shared post within 7 days.
• Legal obligation: where the law requires us to keep or share something, for example under a court order.

Who handles your data, and who else sees it

Our providers

• Cloudflare runs the site, our databases, photo storage and image processing, Turnstile, the login that protects our admin tools, and our request logs. Our databases and photo storage are in Western Europe, though Cloudflare's global network may handle requests elsewhere.
• Resend sends our emails, including relayed enquiries and contact form messages, and holds our news list. It stores email content and logs in the United States.
• Google Workspace hosts our mailboxes, where your messages, reports, and our listing review and sign-up notes arrive.
• Fathom Analytics (Canada) counts page views without cookies. Fathom says it uses your IP address only to tell a new visit from a repeat one, and doesn't store it.
• Anthropic (United States) answers kiosk questions, receiving the question but not your name or email. We also use Claude to help run and fix the site, so it may see listing, enquiry or sign-up details while we sort out a problem.

Each provider works under a contract limiting what it can do with the data. Where data leaves the UK, it's protected by the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), the UK International Data Transfer Agreement or Addendum, or a UK adequacy decision (Canada has one). Ask us if you'd like a copy.

Everyone else

• Meta receives your listing (never your name or email) if you tick the box to share it. We delete our post within 7 days of the listing coming down; Meta's own copies follow Meta's policies.
• YouTube (Google) receives your IP address and browser details if you press play on our channel video, which then plays from youtube-nocookie.com. From then on Google may store data in your browser and note what you watched, under its own privacy policy. If you don't press play, nothing reaches Google.
• Other users: your listing is public. When you enquire, the seller receives your name, email address and message, and a seller's email reaches a buyer only if the seller replies. We can't erase your details from someone else's inbox, but you can ask them to.
• The police and other authorities, where the law requires it, or where it's needed to prevent or detect crime, or to protect someone's safety, especially a child's. We share only what's needed.

How long we keep it

• Listings: held for review until a person decides, then live for 30 days unless you end them sooner or we extend them at your request.
• When a listing ends: a sold listing stays visible for 30 days. An expired listing leaves the marketplace straight away and can be relisted for 30 days. After that, the page comes down and your details and photos are permanently erased from the site within two days. A listing you delete is erased straight away, and always within a day. A listing we decline or take down has its photos erased at once and everything else within a day.
• Enquiries: your name, email and message are erased as soon as the enquiry is delivered or declined, within two days if you never confirm it, or within 15 days of confirming if it's held and never reviewed. A record without them (which listing, when, the outcome, why it was held, and the country and network) is kept for 90 days.
• Hashed email addresses: confirmed buyers, 30 days. Block list entries, as long as the block is needed (tell us if you think it's a mistake).
• Manage links: a link expires after 30 minutes, and the buttons it opens within three days. We store them hashed and delete them within eight days of use or expiry. The cooldown code lasts no more than 25 hours.
• View-count codes: deleted the following night.
• Rate limit records: three days at most. Cloudflare request logs: 7 days. Resend's copies of our emails, including relayed enquiries: 30 days. Kiosk questions held by Anthropic: deleted within 30 days, unless Anthropic needs them longer to enforce its usage policy.
• Database backups: roll off within 30 days, taking anything erased with them.
• News list: until you unsubscribe, then only the record described above. Unconfirmed website sign-ups are deleted within eight days, and the kiosk's own copy within seven days of reaching our list.
• Our mailboxes, including listing review notices, sign-up notes, reports and messages you send us: 12 months at most.
• Our moderation log (the decision, the date and our reason, with no name or email of yours, only which of us decided): 2 years. The note that a listing's web address once existed (the listing's reference and a date): kept indefinitely, so the address answers "gone".
• If the police or a court need us to keep something for an investigation or a legal claim, we keep only what's needed, and only until it's dealt with.

Your rights, and complaints

You can ask for a copy of your data, and ask us to correct it, erase it, restrict or object to how we use it, or give it to you in a portable form. Where we rely on consent, you can withdraw it at any time.

You can delete a listing yourself with a manage link, and leave our news list with the link in any of our emails. For anything else, email hello@marbl.racing, ideally from the address concerned. We may ask you to prove it's you, and we'll reply within one month.

Unhappy with how we've handled your data? Please tell us first so we can put it right, and we'll acknowledge your complaint within 30 days. You can also complain to the ICO at ico.org.uk/make-a-complaint, or on 0303 123 1113.

Children

Marbl Racing is for people aged 18 and over. If you're under 18, you can browse, but listing, enquiring, our news list and our contact forms are for over-18s, so please ask a parent or guardian to get in touch for you. Our sign-up, sell and enquiry forms ask you to confirm you're 18 or over. Anyone can report a problem to us, whatever their age.

If you think someone under 18 has listed, enquired or joined our news list, tell us. We'll remove it and delete their details, unless a child could be at risk, when we'll report it to the police straight away and share what we hold.

Keeping it secure

The site only runs over encrypted connections. Manage links work once, expire after 30 minutes and are stored hashed, and opening one changes nothing until you press its button. Our admin tools sit behind a login only we can use, which the site checks again itself.

Changes to this notice

If we change how we use your data, we'll update this page and the date at the top, and tell you on the site before a material change takes effect.

Questions? hello@marbl.racing. See also our terms and cookies.