GDPR & Data Protection

1. Who We Are

PokerPals operates the PokerPals platform at joinpokerpals.co.uk. We are the data controller responsible for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What Data We Collect

• Account information: name, email address, username, password (hashed)
• League data: games played, finishing positions, points earned, venue registrations
• Venue information: venue name, address, contact details (for venue owners)
• Technical data: IP address, browser type, device information, cookies
• Communications: any messages you send via contact forms or email

3. How We Use Your Data

• Provide and operate the PokerPals league platform
• Process your account registration and authentication
• Track league standings, results, and player statistics
• Send you service-related communications
• Improve our platform and user experience
• Comply with legal obligations

4. Legal Basis for Processing

• Contract: processing necessary for providing the PokerPals service
• Legitimate interests: improving our platform, preventing fraud, ensuring security
• Consent: where you have given explicit consent (e.g., marketing emails)
• Legal obligation: where required by law to retain certain data

5. Data Retention

We retain your personal data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, except where legally required to retain certain records. League results and anonymised statistics may be retained indefinitely after account deletion.

6. Data Sharing

We do not sell your personal data. We may share your data with:

• Supabase: our database and authentication provider (hosted in the EU/UK)
• Venue owners: limited data (player name, league results) for league management
• Law enforcement: where required by law or legal process

7. Your Rights

Under UK GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — request correction of inaccurate or incomplete data
• Erasure — request deletion of your personal data ("right to be forgotten")
• Restriction — request restriction of processing in certain circumstances
• Portability — request transfer of your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests
• Withdraw consent — withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at privacy@joinpokerpals.co.uk

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS) and at rest, role-based access controls, and regular security assessments.

9. International Transfers

Your data is primarily stored and processed within the United Kingdom and European Economic Area. Where data is transferred outside these areas, we ensure appropriate safeguards are in place.

10. Complaints

If you are not happy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk

11. Contact Us

For any data protection queries, email: privacy@joinpokerpals.co.uk