Privacy notice
Last updated: [DATE]
Who is responsible for your data
[TRADER NAME], [GEOGRAPHIC ADDRESS], Ireland, is the data controller. Contact: [PRIVACY EMAIL]. [If a Data Protection Officer is appointed, name and contact here; a DPO is probably not mandatory for this service, but confirm.]
What we collect and why
| What | Why | Legal basis (GDPR Art. 6) | Kept for |
|---|---|---|---|
| Email address | Sign-in links, service messages, receipts | Contract | Until you delete your account |
| Confirmation that you're 18+ (date and time) | To restrict accounts and purchases to adults. We use your date of birth only to check this and do not store it | Legitimate interests / legal obligation [SOLICITOR TO CONFIRM] | Until you delete your account |
| Display name, stadium theme, badge | Your profile and the public league table | Contract | Until you delete your account |
| Game data: answers, guesses, scores, timings, disputes | To run the game, score fairly, handle disputes, and work out how rare each answer is | Contract; legitimate interests (fair scoring, anti-cheat) | Until you delete your account; aggregated counts kept without your identity |
| Guest game cookie (random ID) | To keep a guest's game and streak without an account | Strictly necessary (ePrivacy Regulations 2011, reg. 5(5)) | Up to 13 months |
| Orders, subscriptions, payment status | To provide what you bought and meet tax obligations | Contract; legal obligation | 6 years after the transaction [ACCOUNTANT TO CONFIRM] |
| Private leagues: league names you create, which leagues you're in, and your display name, crowd and streak shown to other members | To run the leagues you choose to join | Contract | Until you leave or delete the league or your account |
| Bug reports: your message, the page, your browser type, and an email address if you choose to give one | To find and fix problems you report | Legitimate interests (keeping the service working) | Until the problem is resolved, then [90] days; deleted with your account |
| IP address and request logs | Security, rate limiting, fraud prevention | Legitimate interests | [30] days |
We do not use advertising, tracking or analytics cookies, and we do not sell your data. Aggregate statistics we show (such as how many players gave an answer) don't identify anyone.
Who we share it with
- Stripe Payments Europe Ltd (Ireland) processes payments. Your card details go directly to Stripe; we never see them. Stripe acts as a separate controller for some purposes; see Stripe's privacy policy.
- [HOSTING PROVIDER] hosts the app and database in [REGION].
- Resend (or another email provider) sends sign-in links and order confirmations.
- Professional advisers and authorities where the law requires.
Where a processor is outside the EEA, we rely on an adequacy decision or Standard Contractual Clauses. [COMPLETE once providers are chosen; sign data processing agreements with each.]
Your rights
You can access, download, correct or delete your data, object to processing based on legitimate interests, restrict processing, and complain to a supervisory authority. Download and delete are available any time on your Account page. For anything else, email [PRIVACY EMAIL]; we reply within one month.
You can complain to the Data Protection Commission (dataprotection.ie) or the authority where you live.
Children
Pack the Stand accounts are for adults. If we learn an account belongs to someone under 18 we will delete it.
Changes
We'll post updates here and tell account holders about significant changes by email.