Privacy Notice

This is a working draft for review by a qualified solicitor before launch.

1. Who we are. Hilton Industries (“we” or “us”) operates The Gauntlet. We are the data controller for the personal data described in this notice. Full contact details will be published once the entity is formally registered.

2. What personal data we collect. We collect: your name, email address, account password hash, your role (player or platform owner), the leagues and picks you make, game messages you send or receive, and (for league hosts only) Stripe customer and payment method identifiers. We do not collect player entry fees, stakes or prize money.

3. Lawful basis for processing. We process your personal data because it is necessary to provide the service (contract), because we have a legitimate interest in running and securing the platform, and (where required) because you have given consent.

4. How we use it. We use your data to operate your account, run games, send round reminders and league broadcasts by email, process admin fees (hosts only), and enforce our terms and security controls such as rate limits.

5. Cookies. We use a session cookie to keep you logged in. This is necessary for the service to work and is not used for advertising.

6. Who we share data with. We use the following sub-processors: Cloudflare (hosting, D1 database, KV, Pages, R2 object storage), Stripe (payment processing for hosts only), and Resend (transactional email). We do not sell personal data. Football-data.org is used for fixture data only and does not receive personal data.

7. International transfers. Cloudflare, Stripe and Resend may process data outside the UK. Where this happens, we rely on approved safeguards such as the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses.

8. Data retention. We keep your account data while your account is active. We keep league and pick history for as long as needed for the integrity of completed games and for legal/accounting purposes. Payment records for hosts are kept for at least six years for tax and accounting reasons. You may request deletion of your account; some data may be retained where we are required to keep it by law.

9. Your rights. Under UK data protection law you have the right to access, rectify, erase, restrict, object to, or port your personal data. You may also complain to the Information Commissioner’s Office (ICO). To exercise your rights, contact us at Hilton Industries; full contact details will follow once the entity is formally registered.

10. Security. We use industry-standard hosting and encryption in transit. Stripe handles card data under its own PCI-compliant infrastructure; we do not store full card numbers.

11. Children. The service is not for anyone under 18. If you believe a child has provided us with personal data, please contact us so we can delete it.

12. Changes. We may update this notice from time to time. Material changes will be notified through the service or by email.