PaddockFlow
Privacy Policy
How we collect, use, and protect your personal data when you use PaddockFlow. We process your data lawfully and transparently under the EU General Data Protection Regulation (GDPR).
Last updated:11 May 2026PaddockFlow is operated by DSS Synergy AB, the data controller for personal data processed through paddockflow.se.
This policy explains what data we collect, why we collect it, how we use and protect it, and the rights you have under the EU GDPR. If you have questions or want to exercise a right, contact us at the address in section 12.
Controller details
Data we collect
We collect only the data needed to provide PaddockFlow. Specifically:
- Account data — name and email address you provide at sign-up. If you sign in with Google, we also receive your Google account identifier. Authentication is handled by Amazon Cognito and we never see your password.
- Profile and team data — team name, club affiliation, vehicle or kart details, and any other information you choose to enter.
- Booking and event data — slot requests, day-by-day assignments, inspection results, and notes you submit during events.
- Communications — emails we send you (booking confirmations, reminders) via our delivery providers.
- Technical data — IP address, browser and device information, and request logs collected automatically by AWS Amplify and CloudFront.
- Analytics data — page views and basic interaction events via Google Analytics 4. Only collected if you consent.
- Marketing data — advertising identifiers used by Google Ads for measurement and remarketing. Only collected if you consent.
Why we process your data
Under GDPR every processing activity needs a legal basis. Ours are:
- Performance of a contract (Art. 6(1)(b)) — to operate the service, manage your account, and process bookings.
- Legitimate interest (Art. 6(1)(f)) — to let clubs run their events, secure the platform, prevent abuse, and improve the service.
- Consent (Art. 6(1)(a)) — for analytics and marketing cookies. You can withdraw consent at any time.
- Legal obligation (Art. 6(1)(c)) — where retention or disclosure is required by law.
Who we share data with
We do not sell your personal data. We share it only with service providers (sub-processors) that help us operate PaddockFlow:
- Amazon Web Services (AWS) — hosting, authentication (Cognito), storage (DynamoDB, S3), and email delivery (SES). Primary region: eu-north-1 (Stockholm, EU).
- Resend — transactional email delivery. Based in the United States; transfers covered by Standard Contractual Clauses.
- Google LLC — Google Analytics 4 and Google Ads, only if you have consented. Based in the United States; transfers covered by the EU-US Data Privacy Framework.
- The club running your event — club admins and event staff can see your booking, team information, and inspection status for events you participate in.
International transfers
Your data is primarily stored within the European Union on AWS infrastructure in Stockholm.
Where data is transferred outside the EU — for example to Google or Resend in the United States — we rely on appropriate safeguards such as Standard Contractual Clauses or the EU-US Data Privacy Framework.
How long we keep your data
- Account data — while your account is active, and up to 12 months after deletion for backup and security purposes.
- Booking and event data — for the duration of the event and up to 2 years afterwards, to support post-event queries, disputes, and federation compliance.
- Server and security logs — typically 30 to 90 days.
- Analytics data — Google Analytics retention is set to 14 months.
We may keep some data longer if required by law or to defend legal claims.
Your rights
Under GDPR you have the right to:
- access the personal data we hold about you
- request correction of inaccurate data
- request deletion of your data ("right to be forgotten")
- restrict or object to certain processing
- receive your data in a portable format
- withdraw your consent at any time, where processing is based on consent
- lodge a complaint with the Swedish data protection authority, Integritetsskyddsmyndigheten (IMY)
To exercise any of these rights, email privacy@paddockflow.se. We respond within 30 days.
Cookies and similar technologies
PaddockFlow uses a small number of cookies. Cookies that are not strictly necessary are only set after you give consent.
Necessary (always on)
Authentication, session management, and remembering your cookie choices. Required for the service to function. Examples: access_token, id_token, pf-cookie-consent.
Analytics (consent required)
Used by Google Analytics 4 to measure how PaddockFlow is used so we can improve it. Examples: _ga, _ga_*.
Marketing (consent required)
Used by Google Ads for conversion measurement and remarketing. Examples: _gcl_auand IDs set by Google's ad servers.
Security
We use industry-standard security measures including encrypted connections (HTTPS), encrypted storage at rest, role-based access control, and audit logging.
No system is perfectly secure, and we cannot guarantee absolute protection, but we work continuously to reduce risk.
Children
PaddockFlow is intended for adults managing motorsport events. Karting often involves minors, and information about young drivers may be entered by their parents, guardians, or team managers.
By entering such data, you confirm that you have the legal authority to do so.
Changes to this policy
We may update this policy from time to time. When we make material changes, we will update the "last updated" date above and, where appropriate, notify you in the app or by email.
Contact
If you have questions about this policy or want to exercise your rights, please contact:
DSS Synergy AB
Email: privacy@paddockflow.se
Address: Normalmsgatan 3, 64147, Katrineholm, Sweden
Organisation number: 5595601179