Privacy

Who we are

FOJI Raceworks Limited is a specialist vehicle workshop based at Unit 2, The Chicken Shed, Little Trethew, Horningtops, Liskeard, PL14 3GF, which is also our registered office. We are registered in England and Wales, company number 13326481, and we are the controller of the personal data described in this notice. If you have any question about this notice or about the personal data we hold, contact us at james@fojiraceworks.co.uk.

What we collect

We only collect the information you choose to give us. When you send an enquiry through our contact form we receive your name, email address and the message you write. When you join the shop launch list we receive your email address. When you send a special request from the rocker cover page we receive your name, your email address, which MX-5 and engine you are running if you tell us, and what you are asking for. When you ask a question under one of our build stories or field notes we receive the first name you give, your email address and the question itself. When you buy something from our shop we receive rather more than that, and the shop has its own section below. We do not ask for, and you should not send, sensitive personal information through this website.

How we use it

We use your enquiry to reply to you and to discuss the work you are asking about. We use your launch-list email only to tell you when something new goes up in the shop, and for nothing else. We use a special request to price the job and come back to you about it. We use a question you leave on a blog post to answer it, in public underneath it if we publish it, or privately by email. What we do with an order is set out in its own section below. We do not sell your information, and we do not use it for unrelated marketing.

Form processing

Our enquiry form, our launch-list form and the special-request form on the rocker cover page are delivered to us by Web3Forms, a third-party service that receives the submission and forwards it to our inbox. Your form data passes through Web3Forms purely so the message reaches us. Those three forms are not stored in a database on this website.

The question box on our blog posts works differently, and the next section says exactly how. Buying something works differently again, and the section after that says exactly how.

Questions on our blog posts

Our build stories and field notes have a box where you can ask a question. What you write there is kept in a database of ours rather than only forwarded to us, so it is set out here in full.

We store the first name you give, your email address, your question, the page you asked it on, the country your request came from, and whether you asked on the live site or on a test copy of it. We also count how many questions have come from your internet connection recently, to stop automated spam. That count is kept against a scrambled code, not against your address: your connection is turned into a code mixed with a secret that changes daily, in the same way as the measurement described below, and it is not stored with your question or your name.

Nothing you write appears on the website unless we put it there. If we publish it, the page shows your first name, the month, and your question, and it may show our answer underneath. Your email address is never published and is never shown on the website. We may edit a question for length. We may decline to publish it, and we may take it down later.

We ask for your email address for two reasons: so we can answer you directly rather than only in public, and so that if somebody complains about something you wrote, we can talk to you about it instead of simply deleting it.

Our lawful basis for this is our legitimate interests, being to answer questions about our work in public where the answer is useful to other people, to keep our own website free of spam and abuse, and to deal properly with any complaint about something published on it. You can object to this at any time, and you can ask us to take down anything of yours that we have published, by emailing james@fojiraceworks.co.uk. If somebody complains about a question, we take it off the page first and work out what to do afterwards.

Please do not name other people or businesses in a question, and please do not include a vehicle registration. We remove questions that do, because publishing them would mean publishing somebody else’s information.

The question box is for adults. It is not intended for use by anyone under 18.

Buying from our shop

Buying something collects more about you than anything else on this website, because an order has to reach your door and has to appear in our accounts. This section covers all of it. What the sale itself commits each of us to is a different matter, and it is set out in our sale terms.

When you go to pay, the payment page asks for your name, your email address, your phone number, your billing address and the address you want the order sent to. That page is Stripe’s, on Stripe’s own website, not ours. Stripe passes us your name, your email address, your phone number and the delivery address, and we keep those. We do not keep your billing address, with one exception: if Stripe sends us no delivery address at all, we use the billing address so the parcel can still be posted, and we record which of the two we used. Your card number never reaches this website and we never see it.

Against your order we also keep what you bought, what you paid, the VAT in it, our order reference, Stripe’s reference for the payment, the date, any refund, the tracking number once it is posted, and any note we write on the order while we are dealing with it. On a rocker cover we keep the date your old cover is due back and the date it arrives.

We use all of that to take your order, to build it, to post it, to talk to you about it, and to deal with a return, a refund or the rocker cover exchange. Our lawful basis for that is that it is necessary to perform the contract between us. Keeping the record afterwards is a separate thing with a separate basis: the law requires us to keep records of what we sold and to whom for VAT and for our accounts, so our basis for holding it that long is our legal obligation to do so.

Your order goes to Stripe, who take the payment, and to the carrier who takes the parcel. Stripe also uses payment details for its own fraud checking and its own legal duties, and for that it decides what it does rather than acting on our instructions; its privacy notice is at stripe.com/gb/privacy. For an order going outside the UK, your name, your address and a description of the goods go on a customs declaration, which the destination country requires. Nobody else is given your details. We do not sell them and we do not use them to market anything to you.

The order itself is held in a database attached to this website which is kept separate from the one holding our measurements and the one holding blog questions, so that nothing able to read those can read a customer’s address. We read it from the workshop over an encrypted connection, using a key only we hold, to pack and post your order and to keep our books.

We also count how many attempts to start a checkout have come from your internet connection recently, to stop automated abuse. That count is kept against a scrambled code in the same way as the one described above, and your address is not stored with it.

How long we keep an order is set out further down, under How long we keep it. That is the one period on this page we did not choose.

Outside the UK

Stripe is a payment company with its head office in the United States. Cloudflare, who host this website, the databases attached to it and the email that confirms your order, is a United States company as well, and so is Web3Forms, who deliver our three contact forms to our inbox. So some of what you give us is handled outside the UK. All three hold it for us under contract terms carrying the safeguards UK data protection law requires before personal data is sent abroad. If you want to know which safeguards, ask us.

Embeds and fonts

Some pages embed content from other services. Build stories use YouTube in its privacy-enhanced mode, and the contact page shows a map from OpenStreetMap. When these load, your browser contacts those providers directly and they may see your IP address as part of serving the content. We do not control what those providers do with that technical information; please see their own privacy policies. Our fonts are served from this website itself, so no font provider sees your visit.

Cookies and analytics

This website does not set advertising or tracking cookies, and nothing we measure is stored on your device. Your basket is the one thing that is. When you add something to it, the list of what you picked and the country you are sending it to are kept in your own browser, so the basket is still there when you move between pages. Nothing in it identifies you, none of it is sent anywhere until you press the button to pay, it is cleared the moment your order goes through, and you can empty it yourself on the basket page at any time. A basket is part of the shop you asked to use, so it does not need your permission in the way a tracking cookie would. That is why you do not see a cookie banner here.

We measure the site ourselves, using our own software running on our own hosting, so no advertising company or analytics company receives your visit. Nothing we record about your reading of the site identifies you. Your IP address and browser are turned into a scrambled code the moment a page loads, mixed with a secret that changes every day, and the IP address itself is discarded and never written down. Because the secret changes daily, the same visitor is a different code tomorrow, so we cannot follow anyone from one day to the next and we cannot follow anyone to another website.

Against that daily code we record which pages were opened and in what order, how long a page was actually on screen, how far down it was read, clicks on our phone number, our email address and links out to other sites, whether a form was started and whether it was sent, plays of the videos on our build pages, anything typed into the search box on this site, and the address of any page that could not be found, so we can fix broken links. We also record the country and county your request came from, which our host works out from your connection, whether you are on a phone, a tablet or a computer, and how wide your browser window is. We do not record the rest of the web address you were on, or what you searched for elsewhere to find us.

We use this to work out which pages are worth writing and where the site is confusing. It is never sold, never shared, and never used to advertise to you.

When you send us an enquiry or join the shop launch list, the message carries three extra pieces of information so we know which parts of the site are useful. They are: the page you sent it from, such as /brakes/; the name of the website or search engine you arrived from, if you came from one; and any campaign tags in the link you followed, if you clicked one of our own adverts or posts.

That is the whole of it. We do not include the rest of the web address you were on, so anything a link carried in it, and anything you searched for, stays out of our inbox. It is worked out at the moment you press send, and nothing is stored on your device to do it.

Hosting

This website is a static site hosted on Cloudflare Pages. Cloudflare may process standard technical request data (such as IP address) for security and to deliver the site. The measurement described above, the questions left on our blog posts, and the orders placed in our shop are stored in Cloudflare databases attached to this website, so Cloudflare holds that information on our behalf and under our instructions. Those are three separate databases and orders are kept apart from the other two deliberately, because an order carries a home address and the other two carry nothing of the kind.

How long we keep it

We keep enquiry emails for as long as we need them to deal with your request and our records, then we delete them.

For questions on our blog posts: a published question and our answer stay up while the page is up, because they are part of what the page says. The email address that came with it is deleted after twelve months, and the question stays without it. A question we decide not to publish is deleted thirty days after that decision, and one nobody has dealt with is deleted after ninety days. The spam counts described above are deleted after thirty days. If a complaint about a question is still open, we keep that question and its email address until it is settled. This is run automatically, every day, rather than when somebody remembers.

For shop orders: we keep the order record, which includes your name, your delivery address, your phone number, your email address and what you bought, for six years. That period is not one we picked. VAT and company records have to be kept for six years, and a sale is one of those records, so an order stays for six years whatever anyone would prefer. After that we delete it. If you ask us to delete an order sooner, we will tell you plainly which parts we are required to keep and until when, and delete the rest.

You can ask us to delete your information at any time, and we will, unless the law requires us to keep it for longer.

Your rights

Under UK data protection law you have the right to ask for a copy of the personal data we hold about you, to have it corrected, or to have it deleted. Because we hold your order details in order to perform a contract with you, you can also ask us for a copy of them in a form you can take elsewhere. To make any of these requests, email james@fojiraceworks.co.uk. If you are unhappy with how we handle your data you can also complain to the Information Commissioner’s Office at ico.org.uk.

Changes

We may update this notice from time to time. The date at the top shows when it was last changed.