This Privacy Policy explains how The Startup Race Ltd (“we”, “us”, “our”) collects, uses, stores, and shares personal data when you visit our websites, complete our forms, purchase our programmes, apply to participate in The Startup Race, or invest through our investor route. It also explains your rights and how to exercise them.
This policy is written in plain English wherever the law allows. Where a particular section sets out something legally specific (such as the lawful basis for processing, or your statutory rights), the language follows the requirements of UK data protection law and is intended to be read in that more formal sense.
This policy is being published as an interim version while we complete a review with our solicitors. We will replace it with a finalised version once that review is complete. The substance below reflects how we currently collect and use personal data, and is intended to give you a clear, accurate, and legally meaningful picture of our practices today.
This policy replaces an earlier privacy notice that was a default WordPress template and did not address the specific data flows operated by The Startup Race Ltd. The version of the policy in force at any given time is the version published on this page; the version number and effective date are at the top of this document.
The Startup Race Ltd is the data controller for the personal data described in this policy.
If you have any questions about this policy, or you wish to exercise any of your rights under UK data protection law, please contact us at privacy@thestartuprace.com.
We do not currently have a statutory Data Protection Officer (DPO), because we are not required to appoint one under Article 37 of the UK GDPR. The contact above is the right route for any privacy or data protection question.
This policy applies to all of the following:
It also applies whenever you contact us by email, complete a paper or digital form on our behalf, or attend a coaching session, programme call, or investor meeting.
We collect personal data from you in the following situations. The lists below describe what we typically collect; we will only ask for what we actually need for the purpose involved.
If you complete the Contact form on www.thestartuprace.com or send us an email, we collect your name, your email address, and the content of your message. If you provide a phone number we will collect that too.
We collect your name, email address, and any business information you choose to share (such as your business name, sector, stage, and current revenue).
We collect your name, email address, and the answers you give to the assessment questions. Those answers may include details about your business model, your revenue position, your team, and other commercial information you decide to share.
We collect your name, email address, billing address, and the information needed to process your payment. Card details are handled directly by Stripe (see section 6 below); we do not see or store your full card number.
This applies to the Startup Race Preparation Programme, the Virtual Innovation Programme, the New Endorsement Letter Programme, the New Business Coaching Programme, the Endorsement Readiness Services, and any other programme we run.
We collect your name, email address, phone number, business and immigration-related information you share with us in the application and over the course of the programme (which may include information about your business plans, financial models, immigration status, visa history, and supporting documents). For some programmes we will ask you to share the content of your business plan and financial model in third-party platforms (LeanSpark and LivePlan); the personal data within those platforms is governed by their own terms in addition to this policy.
We are not a regulated immigration adviser and we do not provide immigration legal advice; we ask for the information described above so that we can deliver the coaching and preparation service you have purchased.
We collect your name, email address, and the answers you give to the assessment questions. The assessment is operated for us by ScoreApp; ScoreApp acts as our processor in respect of that data.
If you fill out the Race Investor form, we collect your name, email address, the information you provide about yourself in the form, and (where relevant) the self-certification statements you make under the Financial Promotion Order (Article 48 high net worth investor, Article 50A self-certified sophisticated investor, or Article 50 sophisticated investor).
We treat investor self-certification data with extra care and retain it for the periods required by the FCA financial promotions regime.
If you book a call through our scheduling links (currently provided through link.magicmrm.com booking widgets), we collect your name, email address, the calendar details for the booking, and any answers you give to the booking questions.
When you visit our websites we, and the third parties listed in section 6, may set cookies and equivalent tracking technologies on your device. These collect technical and behavioural information such as your IP address, your device and browser type, the pages you view, the links you click, the time you spend on each page, and the route by which you arrived at the site.
A cookie consent banner is being put in place across our websites. While that work is underway you may see existing trackers (notably the Facebook Pixel) firing on page load. You can opt out of advertising cookies in your browser, on Meta’s privacy settings, and through the consent banner once it is live. We will publish a separate Cookie Policy alongside this Privacy Policy that lists each cookie, its purpose, its provider, and its lifespan.
Some of the personal data we receive (in particular from visa programme applicants) may include information that UK GDPR treats as a special category of data, such as information about racial or ethnic origin, religious beliefs, or health. We only process such data where you have given explicit consent or where another lawful basis under Article 9 applies.
We do not knowingly collect data from anyone under 18. Our services are sold to and intended for adults.
We process personal data only where we have a lawful basis under UK GDPR. The bases we rely on, and the purposes they cover, are summarised below.
Where you have purchased a programme, course, race entry, or investor service from us, we process the personal data needed to deliver that service. This includes scheduling sessions, providing access to third-party platforms (LeanSpark, LivePlan), reviewing materials you submit, providing feedback, processing payments, and corresponding with you about the programme.
Where you have submitted an enquiry, joined a waitlist, completed an assessment, or otherwise contacted us, we will use your contact details to respond, to follow up on your enquiry, and to share information that is reasonably related to what you asked about. Our legitimate interest is in operating our business and responding to people who have approached us. You can opt out of these communications at any time.
Where we send you marketing emails that are not part of an existing business relationship (for example, a newsletter sign-up), we rely on your consent. You can withdraw consent at any time using the unsubscribe link on any marketing email.
Non-essential cookies (analytics, advertising) require your consent under the Privacy and Electronic Communications Regulations (PECR). Once our cookie consent banner is live, we will not set non-essential cookies until you accept them. You can withdraw consent at any time by changing your preferences in the banner, your browser, or the relevant third-party privacy settings.
We retain certain records, including financial records and FCA-relevant investor self-certification statements, because the law requires us to.
We may retain limited personal data where it is reasonably necessary to deal with a complaint, dispute, or legal claim. Our legitimate interest is in protecting our position; where the law specifies a retention period (for example, a six-year limitation period for contract claims) we will follow that.
For Article 13 transparency, the categories of personal data we process across the cases above are:
We do not sell your personal data. We share it only with the following categories of recipient, and only for the purposes described.
The following third-party providers act as our data processors. We have, or will put in place where one is not already in place, a written Data Processing Agreement with each of them under Article 28 of the UK GDPR.
We may add or change processors over time. When we do, we will update the list above and, where the change is material, tell you about it.
In limited circumstances we may share personal data with:
We do not share personal data with endorsing bodies, the Home Office, or UK Visas and Immigration as a routine matter. Any communication you have with those bodies is your communication, not ours.
Some of the processors listed in section 6 are based outside the United Kingdom or process your data on servers outside the United Kingdom. In particular, Stripe, Meta, and Google may transfer personal data to the United States.
Where personal data leaves the United Kingdom we rely on one of the lawful transfer mechanisms in Articles 44 to 49 of the UK GDPR. In practice, this means either:
If you would like a copy of the safeguards that apply to a particular transfer, please contact us at privacy@thestartuprace.com.
We do not keep personal data for longer than we reasonably need. The retention periods we apply are summarised below.
| Category of data | Typical retention period |
|---|---|
| Enquiry and waitlist data (no ongoing relationship) | Up to 24 months from last contact, then deleted or anonymised |
| Newsletter / marketing list (consent-based) | Until you unsubscribe, then a short final period to honour your unsubscribe |
| Programme participant records (active client) | For the duration of the programme, plus six years from the end of the contract (limitation period for contract claims under Scots law) |
| Race entrant records | For the duration of the cohort, plus six years |
| Investor self-certification statements | At least five years from the date the statement was made, or longer if the FCA’s rules in force at the time require it |
| Payment records and financial records | Six years from the end of the financial year to which they relate (HMRC requirement) |
| Cookie and analytics data | As specified in our Cookie Policy (typically up to 24 months for analytics; shorter for advertising) |
Where a longer or shorter period applies for a specific reason (for example, a live legal claim or a regulatory request), we will keep the data for as long as that situation requires and then delete or anonymise it.
Under UK GDPR you have the rights listed below. To exercise any of them, please email privacy@thestartuprace.com. We will respond within one calendar month; in some complex cases we may extend this by a further two months and will tell you if we need to.
We will not charge you a fee for handling a rights request unless your request is manifestly unfounded or excessive (in which case we may charge a reasonable fee or refuse the request, as the law allows).
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if you believe we have mishandled your personal data. The ICO can be contacted at ico.org.uk, by phone on 0303 123 1113, or by post at Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We would prefer to address any concern directly first, but you do not have to come to us before approaching the ICO.
Where you are entering into a contract with us (for example, purchasing a programme), you are not legally required to provide personal data, but if you do not provide the data we need to deliver the service we will not be able to deliver it. The same applies to the Investor self-certification process: without a completed self-certification we cannot communicate certain investment promotions to you.
For enquiries, waitlists, and assessments, providing data is voluntary. You can complete an assessment, ask a question, or join a waitlist with the minimum information requested on the form.
If you are participating in, or applying to, one of our Innovator Founder visa programmes, we would like you to know the following.
If you have completed, or are about to complete, a self-certification statement on the Race Investor form, the following applies.
A separate Cookie Policy will be published alongside this Privacy Policy and linked from the footer of every page on our websites. The Cookie Policy will list each cookie, its purpose, its provider, and its lifespan. A consent banner is being put in place across the estate; until that banner is live, you can manage cookies through your browser settings, and through the privacy settings of the third parties listed in section 6 (in particular Meta and Google).
We take reasonable technical and organisational measures to protect personal data against loss, misuse, unauthorised access, and unauthorised disclosure. These include access controls on our systems, encryption of data in transit, supplier reviews, and a written subcontractor information security policy.
No system is perfectly secure. If you become aware of a security incident affecting your data with us, please email privacy@thestartuprace.com so that we can investigate and respond.
Our websites contain links to third-party websites and platforms (for example, LeanSpark, LivePlan, Eventbrite event listings if used in the future, payment pages on Stripe, and the Magic MRM booking widget). When you follow such a link, the third party’s own privacy policy applies to your interaction with their service. We are not responsible for the content or privacy practices of websites we do not control.
We may update this Privacy Policy from time to time, including to reflect changes in our processors, our services, or the law. The version in force at any given time is the version published on this page. The version number and effective date are at the top of this document. Where the change is significant, we will let you know by email or by a prominent notice on our websites.
For any privacy or data protection question, including a request to exercise your rights:
Risk Warning: Investment in early-stage companies involves significant risks including illiquidity, lack of dividends, and potential total loss of investment. Past performance is not indicative of future results. Tax reliefs depend on individual circumstances and may change. Professional advice should be sought.