What we collect, and what we don't

F1 RMAV is an independent fan channel run by one person, who is the data controller for everything described on this page.

Controller

Rares Mavromati

Country

Sweden

Contact

mavromatirares647@gmail.com

That address is the one to use for anything on this page — a question, a correction, or a request to be deleted. It reaches a person, not a ticketing system.

If you join the merch list

The signup form on the shop page stores exactly three things:

• Your email address. Nothing else from the form — there is no name field, no phone number, no address.
• Which page you signed up from — a short label like shop-page, so we know which part of the site actually works.
• The date and time you signed up.

The form also carries a hidden field that only automated bots fill in. If it has anything in it the submission is discarded and nothing is saved.

Your IP address

When you submit the form, your IP address is held in the server's memory just long enough to stop the same address submitting more than five times in ten minutes. It is never written to the database, never logged, and disappears when the server process recycles.

What we never collect

No account, no password, no payment details, no location, no contact list. Nothing you do on this site builds a profile of you.

The email address is used for one purpose: to tell you when merch goes on sale, ahead of the public announcement. That is the whole reason the list exists.

The legal basis is your consent (Article 6(1)(a) of the GDPR), given when you submit the form. You can withdraw it at any time, and withdrawing is as easy as giving it — one email to the address above. Withdrawing does not affect anything done before you withdrew.

We will not sell the list, rent it, share it with other channels, or use it to send you anything that isn't about an F1 RMAV merch drop.

You have an absolute right to object to your data being used for direct marketing. If you object, we stop — no reason needed, no questions asked.

This site sets no cookies for visitors. Not for analytics, not for preferences, not for advertising. There is no consent banner because there is nothing on your device for you to consent to.

We do measure which pages get read, using Vercel Web Analytics. It records the page address, the referring site when you arrive from somewhere else, a timestamp, and one of a handful of named events — a follow-button click, a feed filter, a contact-card download, a share, or a signup. Vercel tells apart one visit from another using a value it derives from the incoming request rather than anything stored on your device, and discards it after 24 hours.

The signup event records only which page the signup came from. Your email address is never sent to analytics.

The fonts, images and video on this site are served from this domain and its own storage — your browser is not asked to fetch anything from Google, a font service, an ad network or a social network while a page loads. The links to TikTok, Instagram, YouTube and Facebook are ordinary links: nothing is sent to those companies unless you click one.

Two companies process data on our behalf, both under contract and neither permitted to use it for their own purposes:

Vercel

Hosting, media storage and the analytics described above. Pages are served from, and functions run in, Vercel’s European infrastructure.

Neon

The database holding the merch list. The database itself is located in Frankfurt, Germany.

Both are US-incorporated companies operating EU infrastructure. Where that arrangement means personal data is transferred outside the EEA, it is covered by the European Commission's Standard Contractual Clauses. You can ask us for details of those safeguards using the contact address above.

Nobody else receives the list. There is no mailing platform, no CRM, and no advertising partner.

Honestly: until you ask us to delete it, or until the merch list is no longer needed. There is no automatic expiry, and we would rather say that plainly than quote a retention period nothing actually enforces.

If you want out, email the address above and the record is deleted. If you would prefer we keep a note that you don't want to be contacted again, say so and we will keep only what is needed for that.

Under the GDPR you can ask us to:

• Show you what we hold about you, and give you a copy.
• Correct anything that's wrong.
• Delete it.
• Restrict what we do with it, or object to it.
• Hand it over in a portable format.
• Withdraw your consent, at any time.

Email the contact address above and we'll act on it. There is no charge, and we aim to respond well inside the one month the law allows.

If you're not satisfied with how we handle it, you can complain to the Swedish privacy regulator, Integritetsskyddsmyndigheten (IMY) — Box 8114, 104 20 Stockholm, imy@imy.se, or via imy.se. You can also complain to the authority where you live or work.

In Sweden a child can consent to this kind of service from the age of 13. If you are younger than that, please don't submit your email address — and if you already have, ask a parent or guardian to email us and we'll remove it.

If what we collect changes, this page changes with it and the date below moves. We won't start using your email address for something new without asking you first.

See also the terms of use.