Privacy Policy
How Board Game Mondays collects, uses, protects, and lets you control your personal data.
Who We Are
Board Game Mondays ("we", "our", "us") operates this website. We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
What Data We Collect
We collect and process the following personal data.
Account Information
- Username: Your chosen login name
- Email address: Used for password recovery and account notifications
- Display name: The name shown to other members
- Password: Stored securely using industry-standard hashing
Profile Information (Optional)
- Profile photo or avatar
- Profile tagline
- Favourite game
- Play style description
- Fun fact about yourself
Activity Data
- Game night attendance records
- Game results and scores
- BGM Coin balance and transactions
- Bets placed and outcomes
- Reviews and ratings submitted
- Want-to-play votes
Technical Data
- IP address, for security and consent audit purposes
- Browser type and version (user agent)
- Consent records and timestamps
How We Use Your Data
We use your personal data for the following purposes:
| Purpose | Lawful basis |
|---|---|
| Providing and maintaining your account | Contract performance |
| Tracking game night attendance and results | Legitimate interests (community features) |
| Displaying leaderboards and statistics | Legitimate interests (community engagement) |
| Sending password reset emails | Contract performance |
| Sending email confirmation requests | Contract performance |
| Security and fraud prevention | Legitimate interests |
We do not sell your personal data to third parties or use it for marketing purposes without your explicit consent.
Your Rights Under UK GDPR
You have the following rights regarding your personal data:
- Right of access: You can request a copy of all personal data we hold about you. Export my data.
- Right to rectification: You can update inaccurate data in Account settings.
- Right to erasure: You can request deletion of your account and personal data through Delete my account.
- Right to data portability: You can receive your data in a machine-readable JSON format.
- Right to object: You can object to processing based on legitimate interests.
- Right to withdraw consent: Where processing is based on consent, you can withdraw it at any time.
To exercise another right, use the legal contact details at the end of this page.
Data Retention
We retain your data for the following periods:
| Data type | Retention period |
|---|---|
| Account data (username, email, display name) | Until account deletion, plus a 30-day grace period |
| Profile information | Until account deletion |
| Game statistics and results | Anonymised upon account deletion and preserved for community records |
| Consent records | 3 years for legal compliance |
| Security logs, including IP addresses | 90 days |
Data Security
We implement appropriate technical and organisational measures to protect your data:
- Passwords are hashed using industry-standard algorithms
- Data transmission is encrypted using HTTPS and TLS
- Authentication cookies use HttpOnly, Secure, and SameSite protections
- Rate limiting protects against brute-force attacks
Contact and Complaints
Use the legal contact address at the end of this page if you have questions or want to exercise your data-protection rights.
You also have the right to complain to the Information Commissioner's Office if you believe your rights have been violated.
Changes to This Policy
We may update this Privacy Policy from time to time. Significant changes will be shown through the version number and last-updated date. Where required by law, we will request your consent to material changes.