Privacy policy

This policy explains which personal data BDR processes, why, and what your rights are. BDR is a sim racing platform: drivers sign up for races, results come in from the race servers, and ratings, standings and stewarding are built from them.

Who is responsible

The controller under the GDPR is:

Lars Heinrichs
Dr.-Brueck-Weg 4
33014 Bad Driburg
Germany
Email: bdr@lars-hei.eu

Visiting the website

Cookies. BDR sets one cookie: a session cookie that keeps you signed in and protects forms against forgery. It is technically necessary, so we do not ask for consent (§ 25 (2) TDDDG). There are no analytics, no advertising and no tracking cookies, and no third-party scripts or fonts are loaded.

Steam avatars. Drivers' avatars are shown straight from Steam's image servers. To show them, your browser asks Valve's servers for the images, and Valve sees your IP address. We do this because copying every avatar onto our own servers would mean keeping more data about drivers, not less (Art. 6 (1) (f) GDPR).

Your time zone and language. Your browser tells the page its time zone and language, so we can show race times in your local time. We do not store them.

Technical logs. The web server keeps no access log, but it logs errors, such as a request it could not pass on. An error entry can contain your IP address. The application logs which pages are requested and any errors, without your IP address. Both logs are deleted after 14 days. To stop abuse, your IP address is also held in memory for up to a minute to count requests, and not written to disk. The legal basis is our legitimate interest in running a secure, working service (Art. 6 (1) (f) GDPR).

Your account

You sign in with Steam. Steam tells us your SteamID, and we ask the Steam Web API for your public Steam name, avatar and country. You can set a display name. We store when you last signed in, and your role on the platform (driver, steward or admin).

We need these to give you an account and to match race results to you: the race servers identify drivers by their SteamID. The legal basis is the performance of our agreement with you, the Terms of use (Art. 6 (1) (b) GDPR).

Signing in through Steam also means Valve processes data as its own controller, under Steam's privacy policy.

Low Fuel Motorsport. If you link your Low Fuel Motorsport profile, we fetch it once from LFM's public API: your LFM id, SteamID, ELO, safety rating and number of ranked races. We use them to give you a fairer starting rating. We only do this when you ask for it (Art. 6 (1) (b) GDPR).

Racing on BDR

Who sees your racing. Every driver signed in to BDR can see your display name, avatar and country, which races you entered, your results, lap times and incidents, your ratings and licence, your teams, and your place in standings and leaderboards. Shared results are the service itself: drivers compare themselves, and communities build standings from them (Art. 6 (1) (b) GDPR). Visitors who are not signed in, and search engines, see races, tracks, lap times and figures such as how many drivers took part, but no driver's name, avatar or profile.

Race servers. When a race or open server runs on a machine connected to BDR, it sends us the session results: each driver's SteamID, name, car, laps, times, penalties and incidents. It also sends live events during the session, such as contacts and track limits. We delete live events after 30 days, and we do not keep the result file itself: once its results are stored, it is gone.

Drivers without an account. Some drivers race on a connected server without having signed up. We keep their results under a hidden placeholder account, so their results count and can be claimed once they sign up. This is our legitimate interest in complete and fair results (Art. 6 (1) (f) GDPR). To signed-in drivers, such a driver is shown only by the initials of their in-game name, marked as not registered; the full name is visible only to the community that ran the race, to stewards and to platform admins. A placeholder with no race for 12 months is deleted. Its results then keep only the in-game name, without the SteamID.

Communities. A community that runs a race you enter sees your signup and your results. Its owners, admins and stewards also see its members and the reports from its races. Community admins can connect their own Discord channel. BDR then posts race announcements there, such as race names and times, and, if the community sets up a results channel, each race's result: drivers with an account by their display name, drivers without one by their initials, with their gaps and lap times.

Reports and stewarding

If you file a report or are named in one, we store:

• the report: race, lap, description and an optional video link
• statements from both drivers, and any appeal
• the stewards' decision, and any penalty or ban that follows

Only the drivers involved, the stewards who decide the report and platform admins can see a report. Penalties change results and ratings, which are public. The legal basis is our agreement with you and our legitimate interest in fair racing (Art. 6 (1) (b) and (f) GDPR).

Emails to us

If you write to us, we use your email and your message to answer you. We delete them when the matter is settled, unless we have to keep them by law (Art. 6 (1) (b) and (f) GDPR).

Who else receives data

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, hosts BDR on servers in Germany. Hetzner processes data on our behalf, under a data processing agreement (Art. 28 GDPR).
• Valve (Steam) is involved when you sign in; see above.
• Low Fuel Motorsport receives only your LFM id, and only when you link your profile.
• Discord receives the messages sent to a community's channel, or to the platform team's own channel. Discord is based in the USA. Messages to the platform team are about machines and requests from communities, not about drivers.

We do not sell data, and we do not share it with advertisers.

How long we keep data

• Your account: we keep it until you delete it. You can do that yourself on your Account page.
• What deleting does: your SteamID, email, avatar, country, Discord ID and LFM link are removed. The SteamID is also removed from your results and incidents. Your memberships of communities and teams, your signups for races that have not started, and your signed-in sessions end.
• Your results after deletion: results you took part in are also other drivers' results and part of standings, so they stay. They show a made-up name such as "Former driver 7F3K" instead of yours, and are no longer linked to a profile.
• Reports: reports you were part of stay for the other driver and the stewards. They show the made-up name.
• Bans: a ban that is still running when you delete your account stays in force. We keep a keyed hash of your SteamID for it (a one-way code from which the SteamID cannot be read back), so the ban still applies if the same Steam account signs up again. When the ban ends, we delete the hash. The legal basis is our legitimate interest in fair racing (Art. 6 (1) (f) GDPR).

Automated decisions

Ratings, licences and the incident points on results are calculated automatically from race results. They decide which races you may enter and which split you race in. They have no legal effect on you and do not significantly affect you in a similar way (Art. 22 GDPR). Penalties and bans from reports are always decided by a person.

Your rights

You have the right to:

• access your data (Art. 15)
• rectification (Art. 16)
• erasure (Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20)
• object to processing based on our legitimate interests (Art. 21)

You can delete your account yourself on your Account page. For everything else, write to bdr@lars-hei.eu.

You can also complain to a data protection authority. The one responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestr. 2–4, 40213 Düsseldorf, Germany.

Changes

We update this policy when BDR changes what it does with data. The date at the top shows when it last changed.