Privacy Policy

This privacy notice tells you what to expect us to do with your personal information.

‘BB Racers’ a brand owned by Brandbase Ltd (“we”, “our”, “us”) values your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, and share information when you interact with us online at bbracers.com, and as part of the BB Racers Owners Club.

Contact details

Post: Brandbase, X+Why, Unity Place, 200 Grafton Gate, MILTON KEYNES, MK9 1UP, United Kingdom

Email: hello@bbracers.com

What information we collect, use, and why

We collect or use the following information for the operation of customer accounts and guarantees:

Names or Pseudonyms and contact details
Addresses
Payment details (including card information)
Purchase history
Account information, including registration details
Information used for security purposes
Marketing preferences

We collect or use the following information for service updates or marketing purposes:

Names and contact details
Addresses
Marketing preferences
Location data
Purchase or viewing history
IP addresses
Website and app user journey information
Records of consent, where appropriate

Lawful bases and data protection rights

We must have a “lawful basis” for collecting and using your personal information. Which lawful basis we rely on may affect your data protection rights which are set out in brief below.

Your right of access - You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for.
Your right to rectification - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete
Your right to erasure - You have the right to ask us to delete your personal information.
Your right to restriction of processing - You have the right to ask us to limit how we can use your personal information.
Your right to object to processing - You have the right to object to the processing of your personal data.
Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time.

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

Our lawful bases for the collection and use of your data

Our lawful bases for collecting or using personal information for the operation of customer accounts and guarantees are:

Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

Our lawful bases for collecting or using personal information for service updates or marketing purposes are:

Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:

Keeping customers informed about important service updates such as new product registrations, changes to their account, or security alerts.
Notifying Owners Club members of new car releases, accessories, or competitions, which are integral to the experience of collecting and racing BB Racers.
Sending exclusive content and offers that enhance ownership, such as behind-the-scenes insights, limited-edition announcements, or rewards programs.
Maintaining an engaged community where users can get the most value from their membership, collections, and participation in the BB Racers ecosystem.
Ensuring brand trust and product authenticity by communicating only relevant and beneficial updates to our registered customers.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Where we get personal information from

Directly from you

How long we keep information

We will store your personal information for as long as you remain a member of BB Racers Owners Club

Who we share information with

Because BB Racers operates globally, personal information may be transferred across international borders. We ensure that any transfers comply with the GDPR, and other relevant laws by using contractual safeguards (such as Standard Contractual Clauses under GDPR).

Data processors

Firebolt Games

This data processor does the following activities for us: hosting, database management and customer support

Shell

We will share information with this data processor only where relevant and disclosed and for the purposes of their campaign related to the BB Racers Owners Club.

How to complain

If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice.

GLOBAL PRIVACY POLICY ADDENDUM: REGIONAL DISCLOSURES

If you reside in one of the jurisdictions listed below, the following country-specific provisions apply to you and supplement our core Global Privacy Policy.

International Data Hosting

Regardless of where you live in the world, your data is securely transferred to and hosted on our core infrastructure located in the United Kingdom. By interacting with our products, you acknowledge and agree to this cross-border transfer.

How to Contact Us / Privacy Management

For any privacy inquiries, right-of-access requests, data deletion, or regional complaints, you may reach our dedicated Privacy Team directly by visiting the Contact Page on our website or emailing our support queue at hello@bbracers.com (Attn: Privacy Desk).

1. UNITED STATES REGIONAL NOTICE

This section applies to residents of U.S. states with active comprehensive privacy laws (including California, Texas, Virginia, Colorado, Indiana, and others).

Notice at Collection: In the preceding 12 months, we have collected identifiers (name, username, IP address, email), commercial information (history of toy car purchases, digital ownership certificates, token balances), and internet/electronic network activity (app metrics, browsing history).

"Sale," "Sharing," or Targeted Advertising: We do not sell your personal data for money. However, using analytics and marketing cookies to measure app engagement may be defined as "selling" or "sharing" under certain U.S. state laws. You can opt-out at any time via our cookie preference center or by broadcasting a Global Privacy Control (GPC) signal via your web browser, which our platforms honor automatically.

Children's Privacy (COPPA): Our services are designed for general audiences. We do not knowingly collect or track the personal information of children under the age of 13 without verifiable parental consent in compliance with the Children's Online Privacy Protection Act (COPPA). For users aged 13 to 16, we do not share your data for targeted advertising unless you explicitly opt-in.

Your Rights: You have the right to request access to, correction of, and deletion of your data without facing discrimination (denied services or altered pricing).

2. CANADA REGIONAL NOTICE

This section applies to residents of Canada under PIPEDA and Quebec's Law 25.

Privacy Officer: Our corporate Privacy Team handles privacy oversight for Canadian compliance and can be contacted via the Contact Page on our website.

Cross-Border Transfers: Your personal data will be transferred and stored outside of Canada on our secure servers in the United Kingdom. Local law enforcement agencies in the UK may access this data under lawful local court orders. You may withdraw your consent to cross-border transfers at any time, though doing so may limit your ability to access the BB Racers digital platforms.

3. BRAZIL REGIONAL NOTICE

This section applies to residents of Brazil under the Lei Geral de Proteção de Dados (LGPD).

Data Controller & DPO (Encarregado): The legal data controller is Brandbase Ltd (UK). Our Privacy Team acts as our data protection representative. To submit requests, please use the Contact Page on our website.

Your Rights: In addition to standard access and deletion, Brazilian users have the explicit right to request the anonymization, blocking, or elimination of any data that is deemed unnecessary, excessive, or processed in non-compliance with the LGPD.

4. INDIA REGIONAL NOTICE

This section applies to residents of India under the Digital Personal Data Protection (DPDP) Act.

Data Fiduciary: Brandbase Ltd acts as the "Data Fiduciary" for your data.

Characteristics of Consent: Where we rely on your consent to process data, it must be free, specific, informed, unconditional, and unambiguous. You may withdraw this consent at any time via our Contact Page.

The Right to Nominate: In accordance with the DPDP Act, you have the unique right to nominate another individual to exercise your data protection rights on your behalf in the event of your death or health incapacity.

Children's Protections: If you are an Indian resident under the age of 18, we require verifiable parental or legal guardian consent to process your data. We strictly prohibit tracking, behavioral monitoring, or targeted advertising directed at minors in India.

5. MAINLAND CHINA REGIONAL NOTICE

This section applies to residents of the People's Republic of China under the Personal Information Protection Law (PIPL).

Separate Consent for Cross-Border Transfers: Because BB Racers operates globally, your personal information will be transferred outside mainland China to our servers in the United Kingdom. By clicking "Agree" to this policy or our dedicated pop-up, you provide your explicit, separate consent for this international transfer. We utilize strict legal safeguards to ensure your data is treated with the same level of security required by PIPL.

Children Under 14: We treat the data of children under the age of 14 as sensitive personal information. We do not process this data without obtaining distinct, specialized consent from a parent or legal guardian.

6. SOUTH AFRICA REGIONAL NOTICE

This section applies to residents of South Africa under the Protection of Personal Information Act (POPIA).

Information Officer: Our Privacy Team acts as our designated Information Officer under POPIA and can be reached via our Contact Page.

Strict Opt-In Direct Marketing: We will never use your personal data to send automated direct marketing communications (via email or SMS) unless you have explicitly opted-in to receive them, or unless you are an existing customer who purchased goods from us previously and were given a clear opportunity to opt-out.

Last updated: 18^th June 2026