Privacy Policy

1. Controller

The controller of personal data processed through this website, online bookings, gift card sales and payment processing is SIA „Drift Arena“, registration No. 40203320451, Visbijas prospekts 30, Rīga, LV-1014. Data protection contact: payments@driftarena.com.

By making a booking, buying a gift card or submitting an enquiry, the customer agrees that the data required to fulfil the order is shared with the relevant Drift Arena franchise location, as listed in the Contacts (in Liepāja: SIA „DA LIEPAJA“, registration No. 40203522098, Ganību iela 197/205, Liepāja, LV-3407, liepaja@driftarena.lv). The franchise location uses this data solely to provide the service and communicate about it.

For services provided in person at the arena, including video surveillance, the relevant franchise location may be an independent controller within its own area of operation; information about this is available at the arena.

2. Personal data we process

• Booking and purchase data: first name, last name, phone number, email address, booking date and time, number of riders and purchase amount;
• Payment status from SEB bank (EveryPay). We do not receive or store payment card data — they are processed only by the bank in its secure environment;
• Your consent to receive news, if given.

3. Purposes and legal bases

• Fulfilling bookings and purchases and sending confirmations and receipts — performance of a contract (Article 6(1)(b) GDPR);
• Retention of accounting records — compliance with a legal obligation (Article 6(1)(c) GDPR; Accounting Law — retention for 5 years);
• Sending news and offers — your consent (Article 6(1)(a) GDPR), which you may withdraw at any time using the unsubscribe link in any email or by contacting us;
• Security and fraud prevention (including rate limiting and technical error logs containing no personal data) — our legitimate interests (Article 6(1)(f) GDPR).

4. Recipients

• Drift Arena franchise locations, as listed in the Contacts: receive the data required to fulfil the order (booking code, date and time, number of participants, and contact details for communication about the service).
• SEB bank and EveryPay: payment processing.
• Providers of cloud infrastructure, email and booking-system services, acting as processors.
• Providers of analytics and marketing tools, if you have given the relevant cookie consent (see Section 7).

Where processing takes place outside the EU/EEA, it is carried out only with GDPR-compliant safeguards (Standard Contractual Clauses).

5. Retention periods

• Booking and purchase data and receipts — 5 years (accounting requirements);
• News subscription data — until consent is withdrawn.

6. Your rights

You have the right to access, rectify or erase your data, restrict or object to processing, receive your data in a portable format and withdraw consent. Send requests to payments@driftarena.com. If you believe that the processing of your data infringes the law, you may lodge a complaint with the Data State Inspectorate (www.dvi.gov.lv).

7. Cookies

Cookies are small text files that a website places on your computer or mobile device when you visit it. They help the website operate more efficiently and provide information to the website owner.

Cookie categories:

• Strictly necessary cookies — are required for the website to function correctly (for example, to maintain a session or save your chosen language or consent). Without them, the website may be difficult to use; they do not collect personal data;
• Performance cookies — collect anonymous statistics about website use to help improve it; the statistics are not linked to specific individuals;
• Functional cookies — remember choices you have made (for example, your language);
• Third-party cookies — for example, allow you to watch embedded YouTube videos; depending on their type, they may collect your data;
• Targeting cookies — are used to show more relevant advertising.

By duration, cookies are classed as session cookies (deleted when the browser closes) and persistent cookies (remain on the device for a set period).

Consent. On your first visit, the website displays a cookie banner where you can accept all cookies, select individual categories or allow only those that are necessary. Analytics and marketing tools are loaded only after you give consent; until then, their code is not executed. You can change your consent at any time by clicking the „Cookies“ button at the bottom left of the page. Your consent choice is stored in your browser (local storage) under the key da-consent-v1 and remains valid for 12 months; after that, the website will ask for your consent again.

Tools we use with your consent:

• Google Analytics 4 (Google Ireland Limited): website traffic statistics that help us understand which sections are useful. Category: analytics.
• Google Tag Manager (Google Ireland Limited): management of measurement tools. Category: analytics.
• Google Ads and advertising conversion tracking (Google Ireland Limited): measuring advertising effectiveness and remarketing. Category: marketing.
• Meta (Facebook) Pixel (Meta Platforms Ireland Limited): measuring advertising effectiveness and building audiences on Facebook and Instagram. Category: marketing.
• YouTube Embedded videos (Google Ireland Limited): playing videos on the page; we use the enhanced-privacy domain youtube-nocookie.com.

We use Google Consent Mode v2 for these tools: analytics and advertising storage is denied by default and enabled only when you allow it. These service providers may also process data outside the EU/EEA; in such cases, GDPR safeguards (Standard Contractual Clauses) apply. Learn more about these companies' privacy practices: Google, Meta.

How to manage cookies: you can restrict or block cookies by changing your browser settings (Chrome, Safari, Firefox, etc.), and you can delete cookies and cached data already stored. Please note that blocking certain cookies may limit the website's functionality. Our Privacy Policy does not apply to other websites you may reach from this website.

8. Photography and filming at events

Purpose: coverage of „DRIFT ARENA“ events in the mass media and on social media to build brand awareness, and in advertising materials to promote future events.

When attending events organised by „DRIFT ARENA“, visitors may be photographed and recorded on video, and may be invited to give interviews in which their full name and other information they provide voluntarily are recorded. Information about prize winners may be published on „DRIFT ARENA“ social media and in the mass media. At certain events, identifying information may be requested to ensure they are conducted safely.

Legal basis: Article 6(1)(a) of the GDPR (consent — by attending an event, knowingly being photographed or filmed, or giving an interview) and point (f) of the same paragraph (the controller's legitimate interest in covering its events). Consent may be withdrawn at any time by contacting the controller; withdrawal does not affect the lawfulness of processing carried out before it was withdrawn.

Retention and availability: materials are retained permanently to preserve the brand's history and build brand awareness and may be publicly available unless there are grounds for erasure. Any data subject may object to the processing at any time by contacting the controller — high ethical standards are always applied to publications.

Recipients: the controller's authorised employees, processors (such as photographers), and law-enforcement and supervisory authorities. Online partners (such as Google and Facebook) may be used and may operate outside the EU/EEA — please review those companies' privacy policies.

9. Video surveillance

SIA „DA LIEPAJA“ (registration No. 40203522098) operates video surveillance at the „DRIFT ARENA“ sports and entertainment centre and on its grounds to protect property and people.

Legal basis: Article 6(1)(f) GDPR (the controller's legitimate interests). No automated decision-making takes place; data is not transferred to third countries or international organisations.

Recipients: the controller and its authorised employees or contracted partners, the data subject, and national and local authorities in cases provided for by law.

Rights of the data subject: to request access to images of themselves in video surveillance recordings (by identifying themselves and specifying the date, time and place); to receive the information or a reasoned refusal free of charge within one month (no more than twice a year); and to request rectification, erasure or restriction of processing where permitted by law. Contact details: olga@driftarena.lv.

10. Loyalty programme

Purpose: research into customer behaviour to identify the „DRIFT ARENA“ target audience for the controller's internal marketing purposes; keeping customers informed about activities and offers; and compiling sales and attendance statistics.

Data processed: first and last name (required for participation), address, year of birth, phone number and email address for communication, preferred language of communication, priority service categories, purchase history, points balance and benefits used. No special category personal data is processed.

An application to join the loyalty programme constitutes consent to this policy and the programme rules. The data is retained for as long as the loyalty programme operates and is confidential — it can be accessed only by employees whose duties include processing data for the programme and who have received personal data protection training.

11. Handling claims and complaints

A complaint, submission or claim may be submitted by sending it to olga@driftarena.lv. It will be reviewed at the „DRIFT ARENA“ office at Ganību iela 197/205, Liepāja, without undue delay — we will respond in Latvian at the email address provided within 30 days of receipt; if more time is needed to prepare the response, we will let you know. On written request, we can also respond in English. The consumer may additionally contact the Consumer Rights Protection Centre (www.ptac.gov.lv).

12. Final provisions

This Privacy Policy has been drawn up in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation) and the laws of the Republic of Latvia. The data subject is responsible for ensuring that the data submitted is accurate and up to date. The controller may amend this policy at any time — the current version is always available on this page, and amendments take effect upon publication.