1. Preamble

The purpose of this privacy policy is to inform you how Speed2Max collects, uses and protects your personal data, and about the use of cookies when you browse our website.

It applies to the speed2max.com site and the services offered on it: contact and quote requests, online shop and gift cards, online booking with payment, and the customer area.

1.1 Data controller

The data controller is SARL SYCOMAX, which operates the Speed2Max brand, a limited liability company with share capital of 65,250 euros, whose registered office is at 160, avenue Jean-Mermoz, 63100 Clermont-Ferrand, registered with the Clermont-Ferrand RCS under number 411 857 378.

Telephone: +33 4 73 14 14 28. E-mail address: accueil@speed2max.com.

Data protection contact person: Robin Perez, Sales Director, r.perez@speed2max.com.

1.2 Centres in the network

The Clermont-Ferrand centre is operated by SARL SYCOMAX. The other centres are operated by independent, franchised companies. When you book at a franchised centre, the company that operates it is the data controller for your booking data; Speed2Max provides it with the site and the technical tools. Your contact record is shared between the centres of the network.

2. Data collected

We only collect the data needed to ensure:

• the management of your bookings,
• the management of your orders on the online shop and of your gift cards,
• online payment,
• the personalisation of your user experience,
• responding to your contact and quote requests,
• the sending of marketing information if you have consented to it.

The types of data collected may include: surname, first name, e-mail address, telephone number, booking history, IP address, etc. The details for each service are set out below.

2.1 Contact and quote requests

Depending on the form: name, position, company or organisation, e-mail address, telephone number, centre concerned, desired date or period, number of participants, type of event, indicative budget, location, and the message you write. We also record the page from which the request originated and the language of the site at the time of submission.

2.2 Online shop and gift cards

• Your details as buyer: name, e-mail address, telephone number.
• For a shipped item: name of the recipient, postal address, country, telephone.
• The content of the order, the amounts, the order reference, the language of the order.
• The record of your acceptances: terms and conditions of sale (with their version) and, for a digital gift card, your request for immediate delivery.
• For a gift card: its code, its amount, its balance and its expiry date. The digital gift card is sent as a PDF to the buyer’s e-mail address.

2.3 Online booking

• Your account: e-mail address (and its verification status), account identifier.
• Your contact details: name, telephone number.
• The booking: centre, package, date and time slot, number of participants per category (adult, teenager, child), options chosen, voucher code used where applicable, reference, status and amounts (total, paid, balance due).
• The record of your acceptances: the centre’s terms and conditions of sale (with their version) and, where applicable, authorisation to debit your card (see 2.4).
• Where payment is split between the participants: each person’s share and its payment status.

2.4 Online payment

Payment is made on the secure Sogecommerce (Société Générale) page. Your bank card details are entered on that page only; neither Speed2Max nor the centres receive them.

We send the provider: the amount, the currency, the order or booking reference, your e-mail address, an internal customer identifier and the display language. We receive in return the result of the payment and its references.

Where the centre allows a booking to be paid in several shares and an amount remains to be paid after your payment, the provider, with your authorisation given by ticking the box provided, stores your card and gives us an identifier (“alias”) and the last four digits of the card. This identifier allows the centre to debit the amounts still due after the session, under the conditions of the terms and conditions of sale. It is deleted at the provider 30 days after the session.

2.5 Customer account

Online booking and the customer area require an account (e-mail address and password, managed by Google Firebase Authentication). The customer area brings together your bookings, your invoices, your gift cards and your driver profile. The profile includes: first name, last name, date of birth, height, weight, nickname, as well as your choices regarding session photos and videos and public leaderboards. Both choices are switched off by default.

Date of birth, height and weight are used to check the track safety conditions: minimum age 7, minimum height 1.30 m and maximum weight 130 kg.

A parent or guardian may link to their account the profile of a minor in their care; they then provide that minor's data.

You can delete your account from the customer area. Deletion erases your login account, the copies of your data shown in the customer area and your PDF documents. It does not delete the data that each centre and Speed2Max must keep under their legal obligations (invoices: 10 years) or the proof of your acceptances.

2.6 Technical data

While you browse: IP address, browser and device type, pages viewed, and the data needed to protect the site against automated submissions (section 7).

To offer you the nearest centre and your browser's language, our host infers your country from your IP address at the moment it serves you the page. Neither the IP address nor the country is stored by the site. This processing is based on our legitimate interest in presenting relevant content to you from the outset; your own choice of centre or language always takes precedence. The site never asks for access to your location. The language you choose in the menu is kept for one year in a cookie, firebase-language-override (section 7.1).

2.7 Data concerning other persons

You may have occasion to provide us with data concerning other persons: the recipient of a shipped item, or the participants in a booking that you organise. You undertake to have informed them thereof and to bring this policy to their attention. These persons have the same rights as you (section 6).

2.8 Minors

The account, ordering and booking are reserved for persons of legal age. Minors may take part in a session under the responsibility of an adult; their data are then provided by that adult. Minors are accepted from the age of 7, accompanied by an adult; the minimum age may be higher in certain centres (8 years in Courchevel).

2.9 Public leaderboards

If you agree in your profile, your nickname, your lap times and the kart type appear in the monthly leaderboards published by the centre. Your name is never published, and without a nickname you do not appear. You can withdraw this agreement at any time from your profile; the leaderboards are then republished without you.

3. Purpose of collection

Your personal data is used to:

• ensure our booking service runs smoothly,
• process your orders, issue your gift cards and collect your payments,
• communicate with you in connection with your dealings with Speed2Max,
• improve our services,
• protect the site against fraud and abuse,
• comply with our legal obligations.

3.1 Legal bases

Purpose	Legal basis
Booking, order, gift card, payment, customer account, e-mails relating to these operations (confirmation, invoice, balance reminder, refund)	Performance of the contract or of pre-contractual measures taken at your request
Debiting of the saved card for the shares that remain unpaid	Performance of the contract, on the basis of the authorisation you gave at the time of payment
Driver profile (height, weight, date of birth)	Performance of the contract: checking the track safety conditions
Responding to your contact and quote requests	Pre-contractual measures taken at your request; failing that, our legitimate interest in responding to the requests received
Retention of invoices and accounting documents	Legal obligation
Sharing your contact record between the centres of the network	Legitimate interest
Pre-selection of the centre and language based on country	Legitimate interest
Audience measurement, improvement of our services	Legitimate interest
Security of the site, prevention of fraud and abuse, handling of incidents	Legitimate interest
Sending of commercial information	Your consent, which you may withdraw at any time
Public leaderboards, photos and videos	Your consent, which can be withdrawn at any time

4. Retention and recipients of the data

Data is kept only for as long as necessary to achieve the purposes described above, in compliance with the regulations in force.

4.1 Retention periods

Data	Duration
Contact and quote requests that were not followed up	3 years from the last contact
Customer data (orders, bookings, gift cards)	Duration of the business relationship, then 3 years from the last purchase or the last booking
Invoices and accounting documents	10 years
Gift card	Valid for one year from the date of purchase; retained thereafter as an accounting document
Request transmitted by the site (form, order, booking), in its transmission queue	Up to 30 days after it has been processed, then automatic erasure
Payment notification in transit	Its content is erased as soon as it has been processed; if it is not processed, it is deleted within 24 to 48 hours
Public tracking of a booking (reference, status, amounts, without name)	30 days after the session, or after the expiry of an unconfirmed booking
Unpaid order	Automatically cancelled after 24 hours
Card identifier (“alias”)	30 days after the session
Audience measurement	25 months at most
Technical and security logs	12 months
Customer account	Until you delete it

Deleting your account erases the copies of your data shown in the customer area. It does not erase the data that the law requires us to retain, in particular invoices.

4.2 Recipients of the data

Your data are intended for the teams of Speed2Max and, for a booking or a request concerning a centre, for the centre concerned.

They may be transmitted to our technical processors, solely within the limits of their task:

Service provider	Task	Location of the data
Google (Firebase Hosting, Cloud Firestore, Cloud Storage, Cloud Functions, Compute Engine)	Hosting of the site, transmission of requests between the site and our servers, hosting of our central server	Paris region (europe-west9) for the databases, storage and the central server; the site itself is delivered through Google’s global network
Google (reCAPTCHA Enterprise, Firebase App Check)	Protection of the forms, ordering and booking against automated submissions	Global service
Google (Firebase Authentication)	Account creation and sign-in, verification and password reset e-mails	United States
Sogecommerce — Société Générale, platform operated by Lyra	Card payment, refunds, saving of the card	France
Umami (Umami Cloud)	Audience measurement, on speed2max.com only	European Union
Google (Google Workspace e-mail)	Sending of service e-mails (acknowledgements of receipt, confirmations, invoices, reminders)	European Union and United States (EU–US Data Privacy Framework)
Mailgun (Sinch)	Sending our marketing information, if you have consented	European Union (Mailgun’s European region)
Postal carrier	Delivery of items	Metropolitan France

The centres’ servers are installed in the centres. They are operated by each centre and administered remotely by us; their backups are kept in the European Union, except for a centre located outside the Union.

The YouTube video player (Google) embedded in certain pages receives data directly from your browser: see section 7.

We do not sell your data.

4.3 Transfers outside the European Union

Logging in to your account (Firebase Authentication) and certain Google services (protection against automated submissions, YouTube player, site delivery) may involve data processing in the United States. These transfers are governed by the European Commission's adequacy decision on the EU–US Data Privacy Framework, under which Google LLC is certified, and, failing that, by the Commission's standard contractual clauses.

5. Security

Speed2Max implements all appropriate technical and organisational measures to protect your personal data against any loss, unauthorised access or disclosure.

In particular: exchanges with the site are encrypted; your browser never communicates directly with our management servers; prices and availability are always recalculated by our servers; bank card data are entered only with the payment service provider; each centre has access only to the requests intended for it; automated submissions are filtered and limited; our databases are backed up.

6. Your rights

Under the GDPR, you have the following rights:

• right of access to your data,
• right to rectification,
• right to erasure,
• right to restriction of processing,
• right to object,
• right to data portability,
• right to withdraw your consent at any time, where the processing is based on it,
• right to define directives concerning the fate of your data after your death.

To exercise your rights, you can write to us at contact@speed2max.com, or by post to SARL SYCOMAX, 160, avenue Jean-Mermoz, 63100 Clermont-Ferrand.

We will reply to you within one month. In the event of reasonable doubt as to your identity, we may ask you for proof of identity.

You may at any time object to receiving our commercial information, by means of the unsubscribe link contained in each message or at the address above.

If you consider that your rights are not being respected, you may lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), 3, place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.

7. Use of cookies and storage on your device

When you visit, the site and some third-party services store or read information on your device: cookies, browser local storage or an IndexedDB database. This section gives the complete list. The site sets no advertising cookies.

7.1 What the site needs in order to work

These items do not require your consent, because they are strictly necessary for the service you request:

• your display theme choice (s2m-theme) and centre choice (s2m-centre);
• the language you choose in the menu, kept for one year in the firebase-language-override cookie, set by the language selector;
• the contents of your basket (s2m-shop-cart) and the reference of an order or booking in progress (s2m-shop-pending, s2m-booking-pending);
• your login session for the customer area, kept until you log out;
• the Firebase App Check verification token (firebase-app-check-database) and the Firebase SDK technical database (firebase-heartbeat-database).

This information stays on your device; the basket is only sent to us when you confirm your order.

7.2 Audience measurement

On speed2max.com, the site measures its audience with Umami, which sets no cookies and writes nothing to your device. Umami receives the address of the page viewed, without its parameters, its title, the referring site and certain actions (click on “Book”, sending of a quote request, order, confirmed booking), without any personal data entered. Statistics are kept for 25 months at most; they are hosted in the European Union. The site does not use Google Analytics.

7.4 YouTube videos

The background video on the home page is hosted by the site itself: it calls on no third-party service and stores nothing on your device.

The other videos are played by Google's YouTube player in enhanced privacy mode (youtube-nocookie.com). The player only loads when you start a video. It then stores data in your browser's storage, for the domain youtube-nocookie.com, and sends Google technical information, including your IP address and playback statistics, in accordance with Google's privacy rules (https://policies.google.com/privacy).

7.5 Payment

The payment page is operated by Sogecommerce (Société Générale). It may use its own cookies, which are necessary for payment security.

7.6 Your choices

You can delete cookies and stored data from your browser settings.

8. Changes to the policy

Speed2Max reserves the right to amend this policy at any time in order to comply with legal or technical developments. The latest update is dated 2 November 2026.