Privacy Policy

Draft for review. This policy is not yet in force.

1. Who we are

Stagewerk is a platform for running motorsport events. It is operated by Shakewell Agency Pty Ltd ("we", "us", "Stagewerk") in Australia. [TO CONFIRM: ABN and registered address of Shakewell Agency Pty Ltd.]

This policy explains how we handle your personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. It covers the Stagewerk website and app. Contact us at privacy@stagewerk.com.

The clubs, series and other organisers who run events on Stagewerk also collect information about entrants. They are responsible for how they use it. This policy covers what we do on the platform.

2. What we collect

Your account and profile. Your name, email address, password (stored only as a hash), sign-in settings such as two-factor codes and passkeys, and your notification choices. If you give a mobile number for texts, we keep it (encrypted) and when you agreed to texts. As a competitor you may add a phone number, date of birth, address and an emergency contact. If you are under 18, we also hold your guardian's name, phone and email and the times consent was given. As an official you may add a Working With Children Check number, first aid and radio licence details.

Health and medical information. An organiser may ask for health or medical details for an event, and you may choose to add an emergency contact and medical notes to your profile. This is sensitive information under the Privacy Act. We collect it only with your consent, use it only for your safety at the events you enter, show it only to the officials of those events when they need it, and record every time it is viewed. You can withdraw consent and delete it at any time. [TO CONFIRM: final wording after the privacy review for the medical notes feature.]

Licences and documents. Licence numbers and images, apparel evidence such as homologation label photos, safety documents, and identity or verification documents you upload. Uploaded files are scanned for malware before they are used.

Vehicles and teams. Your vehicles and their photos, entrants you manage (name, ABN, billing contact, address), and crew links.

Entries and payments. Your entries, the declarations you sign (with your typed name, the exact wording, your IP address and browser details), and any tickets or memberships you buy. Payments are taken by Stripe. Your card details go to Stripe and never reach us. We keep the record of the payment: amounts, GST, Stripe reference numbers and tax invoices.

Photos and community content. Event and vehicle photos you upload, and forum posts and reports you make.

Messages. Messages you send us through the contact page, and bulletins, newsletters, emails, texts and app notifications we or an organiser send you, with whether they were delivered, opened or confirmed.

Location. The app asks to use your location only for "Near me", and only if you allow it. [TO CONFIRM: whether the location is used on your device only or is sent to our servers, and whether it is stored.] Photos of vehicles are resized by us, and the original file (including any location hidden in the photo) is deleted.

Push tokens and devices. If you sign in to the app, we keep your device's push token, platform, app version, language, time zone and when it was last used, so we can send notifications.

App and website error reports. When something breaks we record the error, the page address (without anything after a "?"), and your user id. We send error reports to Sentry. [TO CONFIRM: where our Sentry account stores data, and what personal data Sentry receives.]

Logs. Our servers keep a short record of requests: time, your user id, the page, the result, and your IP address with its last part removed. For sign-in events we keep the full IP address, and for failed sign-ins a keyed hash of the address that was typed, never the address itself. We also keep warning and error log lines.

Cookies. See section 9.

3. Why we collect it

To create and secure your account.
To let you enter events, pay, sign declarations and show organisers you are eligible to compete or officiate.
To run events: entry lists, results, points, bulletins and notices.
To send what you asked for and what an event needs: confirmations, reminders, notifications, expiry reminders.
To keep tax, payment and safety records the law or an organiser requires.
To keep Stagewerk safe and working: security monitoring, fixing errors, audit trails, preventing fraud and abuse.
To answer you and improve the service.

We do not use advertising or tracking cookies.

Organisers and officials. When you enter an event, the organiser and the event's officials can see your entry, and the details they need to run it, such as licences, vehicle details and declarations. Organisers set what is public: an event's entry list can be published, and you can opt out of being listed in your public profile settings. Published results show your name and results. A public competitor profile is shown only if you switch it on, and cannot be switched on for anyone under 18.

Sanctioning bodies. The body that sanctions an event may see the event's entries and records for audit and inspection.

Service providers. These process data for us:

Stripe (payments and organiser payout accounts).
Amazon Web Services: hosting and file storage in Sydney, email through Amazon SES, text messages, and malware scanning of uploads.
Apple and Google, to deliver push notifications to your phone.
Sentry, for error reports.
Xero, only if the organiser connects its own Xero account. Then the payer's name (and a company's ABN) on tax invoices goes to the organiser's Xero file.

Others. We disclose information if the law requires it, or to protect people from serious harm. If Stagewerk is sold, your information may go to the new owner under this policy. [TO CONFIRM: whether any other processor (for example a support, analytics or timing-data provider) receives personal data.]

5. Overseas disclosure

We host the platform on Amazon Web Services in Sydney. Some providers may store or process information outside Australia:

Stripe processes payments internationally, including in the United States.
Apple and Google run push notifications from their global systems.
Sentry may store error reports outside Australia. [TO CONFIRM: Sentry data region.]
Amazon SES and SMS [TO CONFIRM: AWS region used for email and text sending].
Xero, if an organiser connects it.

We take reasonable steps to make sure these providers handle your information in line with the Australian Privacy Principles, for example by using providers with strong security programs and contractual privacy terms. [TO CONFIRM: that data processing terms are in place with each provider.]

6. How long we keep it

Account and profile data: until your account is erased (see section 8).
Sign-in links: 1 day. Data export files: 1 day.
Contact messages: 2 years.
In-app notifications: 180 days.
Request logs, warning and error logs and error reports: 90 days.
Security events (sign-ins, failed sign-ins, two-factor and export events): 12 months.
Delivery records of outgoing webhooks and Stripe events: 30 and 90 days.
Volunteer, roster and ticket-buyer details: 12 months after the event.
Audit log of changes to data, signed declarations and incident records: 7 years.
Tax invoices, credit notes and the payment ledger: for the period the law requires for tax records. [TO CONFIRM: the period.]
Server log files: 12 months.

Organisers can lengthen some of these periods. They cannot shorten the seven-year periods. Some of these periods are the defaults set in our system and may change.

7. How we protect it

Data is held in a private AWS environment in Sydney, and travels over encrypted connections.
Sensitive fields (licence numbers, phone numbers, addresses, emergency contacts, guardian details, WWCC numbers) are encrypted in the database.
Uploaded files are held in a private encrypted store and reached only through short-lived links, after a malware scan.
Staff access is limited to what each role needs, and reads of sensitive fields by anyone other than you are recorded.
A tamper-evident audit log records changes to data.
We support two-factor authentication and passkeys.

No system is perfectly secure. If a data breach is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner (OAIC) as the Privacy Act requires.

8. Your rights: access, correction and deleting your account

Access and correction. You can see and update most of your details in your profile. You can download a copy of your data from your profile page. To ask for anything else, or to correct information you cannot change yourself, email privacy@stagewerk.com. We will respond within 30 days. [TO CONFIRM: any fee or identity check we apply for access requests.]

Deleting your account. You can ask for deletion from your profile on the website, or in the app. We wait 30 days in case you change your mind, and you can cancel during that time. After that we delete your profile, licences, vehicles, photos, documents, devices and sign-in data.

Some records must stay: we keep records that show what an organiser or official did, signed declarations and incident records (7 years), and tax records. Where such a record points to your account, we keep the account in anonymised form (your name and email are replaced). Audit log rows are not changed on erasure. Forum posts stay with the author shown as "Former member". Data already given to an organiser or to Stripe is kept by them under their own policies. [TO CONFIRM: wording about logs kept after erasure, pending legal check.]

9. Cookies

We use only the cookies Stagewerk needs to work:

A session cookie that keeps you signed in. Sessions end after a period of inactivity and after a fixed maximum time.
A security cookie (XSRF-TOKEN) that protects forms from forgery.
A "remember me" cookie, only if you ask to stay signed in. [TO CONFIRM: that "remember me" is enabled.]
A cookie that remembers whether the side menu is open, and a setting that remembers your light or dark appearance choice.

We do not use advertising, cross-site tracking or analytics cookies. Stripe's payment form may set its own cookies for fraud prevention when you pay. Stripe's policies apply to those.

10. Children

Stagewerk accounts are for adults. A junior (under 18) competes through a parent or guardian, who creates the account or gives consent and whose details are held with the junior's profile. A junior's public profile cannot be switched on. [TO CONFIRM: the minimum age and the exact process for junior accounts.]

11. Complaints

If you think we have breached the Australian Privacy Principles, email privacy@stagewerk.com with details. We will acknowledge your complaint and reply within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

12. Changes to this policy

We may update this policy. We will post the new version here with a new date, and give notice of important changes. [TO CONFIRM: how notice is given, for example email or in the app.]