PARENTAL CONSENT POLICY

1. Introduction

• MyRacingPath welcomes drivers of all ages. We are committed to protecting the privacy, safety, and wellbeing of young drivers in accordance with UK GDPR, the EU GDPR, the ICO Age Appropriate Design Code, and the Online Safety Act 2023.
• This Policy explains how we handle accounts for users below the digital consent age in their country of residence.

2. Digital consent ages by country

Under GDPR Article 8, each country sets its digital consent age. Below this age, verifiable parental consent is required. We apply each country's specific age:

Where we are uncertain of a user's country, we apply the stricter age of 16 by default until country is verified.

3. How account creation works for users below the digital consent age

• On registration we ask for date of birth on a neutral screen with no age guidance.
• If the date of birth falls below the digital consent age for the user's country, the user cannot create an account directly.
• The user is prompted to provide a parent or legal guardian's email address.
• A consent request is sent to the parent email.
• The parent must complete our Verifiable Parental Consent process.
• Once verified, the parent creates a linked account through the Parent Portal.
• The child's account is activated only after verified parental consent.
• Until parental consent is verified, the child account is inactive. No features, content, or data is accessible to the child.

4. How we verify parental consent

We use a layered verification approach proportionate to the risk of processing. Our current verification methods include:

• Email confirmation with a time-delay verification step.
• Payment card micro-charge: a small amount is charged and refunded; this confirms the parent has adult financial responsibility.
• Photo ID verification via a trusted third-party provider (yes/no attribute check; we do not store full ID documents).
• UK Digital Verification Services Trust Framework providers where available.

The method used depends on the child's age, country, and features requested. For AI chat features, stronger verification is applied. Parents may be asked to re-verify consent periodically or when the child accesses new features.

5. What parents can do via the Parent Portal

Once consent is verified, parents have access to a Parent Portal with the following capabilities:

• View and edit the child's account details.
• View all data stored about the child.
• Access Race Engineer conversation logs.
• Receive safeguarding alerts.
• Receive screentime reports.
• Approve or decline paid transactions.
• Turn specific features on or off.
• Delete the child's account at any time.
• Export the child's data.
• Revoke consent.

Parents can manage multiple children under a single Parent Portal account.

6. What we tell the child

• Per Standard 11 of the ICO Age Appropriate Design Code, we tell the child clearly when parental monitoring is active.
• A visible indicator in the user interface shows “Parent can see your account” when applicable.
• We provide age-appropriate explanations of what data is collected, why, and who can see it.

7. What data can and cannot be processed for users below digital consent age

Prohibited by default

• Profiling for marketing.
• Geolocation.
• Contact from adults who are not verified coaches, parents, or official partners.
• Solely automated decisions with significant effect.
• Special-category data processing without explicit parental consent.
• Public profile visibility.
• Behavioural advertising.
• AI training on any content.

Permitted with parental consent

• Core service provision (profile, career planning, Academy content).
• AI coaching via Race Engineer (with enhanced safety filtering).
• Community messaging between verified peers of similar age.
• Health data (for fitness and nutrition features) where voluntarily provided.

8. Data subject rights for children

• While users below the digital consent age cannot give valid consent themselves, they retain all data subject rights under UK GDPR.
• In England and Wales, where a child is “Gillick competent” (able to understand), they can exercise their own rights. For younger children, rights are exercised through the parent.
• We will not use parental rights to override a Gillick-competent child's wishes unless there is a safeguarding reason.

9. Transitioning from child account to full account

When a user reaches the digital consent age for their country:

• We notify the user and the parent.
• We invite the user to confirm their own account terms.
• The user gains control of their account.
• The parent retains visibility until the user is 18, or earlier if the user requests independence.
• When the user reaches 18, the Parent Portal access ends automatically unless the user explicitly consents to continued visibility.

10. Future jurisdictions

• When we expand to additional countries, we will update this Policy to reflect local digital consent ages and verification requirements.
• For a future US launch, we will implement COPPA-compliant verifiable parental consent for users under 13 in the US.

11. Contact

For any questions about parental consent, contact support@myracingpath.com.