Privacy Notice
Surrey Primarchs leaderboard & league website · Last updated: 19 September 2026
This notice explains what personal information this website collects about you, why, who it is shared with, how long we keep it, and the rights you have under the UK GDPR and the Data Protection Act 2018. We keep it as short and plain as we can.
1. Who we are
The Surrey Primarchs Warhammer 40,000 club runs this website to keep Elo rankings, league standings and match records for its members. The club is the “controller” of your personal data.
2. What we collect and why
| Information | Why we use it | Lawful basis |
|---|---|---|
| Account details — username, password (stored only as a one-way hash), account role, the player profile linked to your account, date of last login | To let you log in, submit and confirm results, and to give club staff the right access | Legitimate interests (running the club’s league) |
| Player name and match records — the games you play, scores, army/faction information attached to a match, resulting Elo rating and league standings | To calculate and publish rankings and league standings, which is the whole purpose of the site | Legitimate interests |
| Profile details you choose to add — first/last name, avatar, army list, theme and accessibility preferences | Personalisation and showing your army list to other logged-in members | Legitimate interests / your choice to provide it |
| Email address (optional) | Password resets and notifications about your match results — but only if the club switches email on (it is currently off, so no emails are sent) | Consent — you can remove it at any time in Settings |
| WhatsApp / mobile number (optional) | Only so that opponents you are currently paired with in the league can message you to arrange a game | Consent — the sharing box is unticked by default and you can remove your number at any time in Settings |
| Push notification subscription (optional) | To alert your device when a result needs your confirmation | Consent — given via your browser prompt; switch off in Settings |
| Security log — time, IP address and username of logins, failed logins and similar security events; standard server request logs | To detect and stop attacks, brute-force attempts and misuse | Legitimate interests (keeping accounts and the site secure) |
| Session cookie | Keeps you logged in and protects forms from forgery | Strictly necessary (no consent needed) |
We do not collect payment details, sell your data, use advertising or analytics trackers, or make automated decisions about you beyond the Elo/standings calculation that ranks results.
3. Who can see your information
- Everyone (including visitors who are not logged in): your player name, Elo rating, league standing, match results and scores, faction label and avatar on the public Top 10 and League pages.
- Logged-in members: additionally, your army list if you have added one.
- Your current league opponents: a WhatsApp button that opens a chat with you only if you have added a number and ticked the sharing box. Your number is never displayed on the page; it is embedded in the WhatsApp link when your opponent clicks the button. Once they are chatting with you on WhatsApp, WhatsApp’s own privacy policy applies.
- Club staff (admins, league managers, match admins, account managers): the above plus what they need to run the site, such as accounts, real names and pending results.
- Your email address, phone number and password are never shown to other members.
4. Organisations that handle data for us
- Hosting provider — the server that stores the site’s data.
- Email service — the club does not currently send email. If that is switched on in future, the provider will be named here and this notice updated.
- Push services (Google, Apple, Mozilla or Microsoft, depending on your browser) — deliver notifications if you enable them.
- Fonts and code libraries are served from this site itself, not from Google or any content network, so your IP address is not sent to them. The site logo may be loaded from the club’s own website (surreyprimarchs.co.uk). If you choose to open the linked Warhammer Community event companion PDF, it is fetched from Warhammer Community.
- WhatsApp (Meta) — only when you or an opponent choose to use the WhatsApp button.
We do not sell or share your data with anyone else, except where required by law. Some of the providers above may process data outside the UK; where they do, they rely on approved safeguards such as UK adequacy regulations or the International Data Transfer Agreement / UK Addendum.
5. How long we keep it
| Information | Kept for |
|---|---|
| Account, email, phone number, push subscriptions | Until you delete your account or remove them yourself |
| Profile details (real name, avatar, army list, preferences) | Until you delete your account |
| Match records, scores and Elo | Kept as the club’s shared historical record (see section 6). You can ask for these to be anonymised |
| Security log (IP address, username) | 90 days, then automatically deleted |
| Login session | Expires automatically (8 hours by default) or when you sign out |
| Server request logs (may include IP address and username) | Kept in rotating log files capped at about 30 MB in total; the oldest entries are discarded automatically, so they only cover recent activity |
6. Deleting your account
You can delete your account yourself any time from Privacy → Delete My Account (you will need your password). This permanently erases your username, password, email, phone number, push subscriptions, login history, real name, avatar, army list and preferences, and removes you from unplayed league pairings.
The record of games you played (player name, scores, results and the Elo ratings that depend on them) is kept, because deleting it would change other players’ results and rankings. If you want your name removed or replaced with an alias on those records, contact us and we will do it.
7. Your rights
You have the right to: be told how your data is used (this notice); access a copy of your data; have inaccurate data corrected; have your data erased; restrict or object to our use of it; and receive it in a portable format. Where we rely on consent (email, phone number, push notifications) you can withdraw it at any time without affecting anything else.
Most of this you can do yourself in Settings and Privacy inside the site. For anything else, contact us (section 1) and we will respond within one month. If you are unhappy with how we handle your data you can complain to the Information Commissioner’s Office: ico.org.uk, 0303 123 1113.
8. Security
Passwords are hashed; email addresses and phone numbers are encrypted at rest (AES-256-GCM); connections use HTTPS; login is rate-limited and optional two-factor authentication is available. If a data breach puts your rights at risk we will tell you and, where required, the ICO.
9. Children
This site is for club members. You must be 13 or over to create an account. If you are under 18, please make sure a parent or guardian is happy for you to use it; a parent or guardian can contact us at any time to see or delete a young person’s data.
10. Changes to this notice
If we change how we use your data we will update this page and the date at the top.