Privacy & Data

The Brighton Pauper League (“we”, “us”, “our”) is an independent, community-led Magic: The Gathering Pauper league based in Brighton, UK. This policy explains how we handle personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

The data controller responsible for your personal data is Roman Waters. If you have any questions about this policy or how your data is handled, you can contact the data controller by email at contact@brightonpauperleague.com using the subject line “FAO Data Controller”.

We keep the data we collect to the minimum needed to run the league and this website. Depending on how you interact with us, this may include:

• Player name and results. We record the names and match results of players who take part in league nights and events, so we can maintain standings, rankings, and season histories.
• Player profile content. Where a player agrees to a public profile, this may include a chosen display name, a photograph, and biographical details they provide.
• Contact details. If you email us (for example to volunteer or make an enquiry), we receive your email address and anything you choose to include in your message.
• Technical and usage data. When you visit the site, our hosting provider automatically records limited technical information such as your IP address, browser type, and pages visited, in the form of server logs.
• Analytics data. If you consent to analytics cookies, we collect anonymised usage statistics through Google Analytics (see Cookies and analytics).

Under the UK GDPR we must have a lawful basis for processing your personal data. The bases we rely on are:

• Consent. We publish player profiles, photographs, and publicly attributed results on the basis of your consent. We record names and results in order to run the league regardless, but where you would prefer, these can be anonymised on the public site at your request (see Your rights). We rely on consent for analytics cookies.
• Legitimate interests. We use limited technical data to keep the website secure, available, and working correctly. We use contact details you send us to respond to your enquiry.

You can withdraw your consent at any time. Withdrawing consent does not affect any processing carried out before you withdrew it.

Essential cookies needed for the website to function may be set without your consent. We also intend to use Google Analytics to understand how the site is used and to improve it. Google Analytics relies on cookies and is not strictly necessary, so it will only set analytics cookies and collect analytics data about your visit if you give your consent through our cookie banner. You can decline, or later withdraw, your consent at any time, and no analytics cookies will be set.

Google Analytics is provided by Google. Data may be processed outside the UK; see International transfers.

We do not sell your personal data. We share it only with the service providers (“processors”) that help us run the league and website, and only to the extent needed:

• Sanity — our content management system, which stores website content including player profiles and results.
• Vercel — our website hosting provider, which processes server logs.
• Google — provides analytics, where you have consented.
• Scryfall — supplies Magic: The Gathering card images. We do not send any personal data to Scryfall.

We may also disclose data where required by law or to protect our legal rights.

Some of our providers, including Google and Vercel, may process data on servers outside the UK. Where personal data is transferred internationally, we rely on safeguards recognised under UK data protection law, such as adequacy decisions or the International Data Transfer Agreement, to ensure your data remains protected.

We keep personal data only for as long as needed for the purposes described in this policy. Standings, results, and season histories may be retained indefinitely as a public record of the league, in anonymised form where you have requested it. Enquiry emails are kept only as long as needed to deal with your enquiry and any related follow-up. Server logs are retained for a limited period by our hosting provider.

Under the UK GDPR you have the right to:

• be informed about how your data is used;
• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased in certain circumstances;
• restrict or object to processing;
• data portability, where applicable;
• withdraw consent at any time.

In particular, if you would prefer your name not to appear publicly, you can ask us to anonymise your results and remove your public profile, and we will do so. To exercise any of your rights, contact the data controller at contact@brightonpauperleague.com with the subject line “FAO Data Controller”.

We take reasonable technical and organisational measures to keep your data secure and to prevent unauthorised access, loss, or misuse. Access to personal data is limited to those who need it to run the league. No method of transmission or storage is completely secure, but we work to protect your data and to address any issues promptly.

This website is intended for a general audience. We do not knowingly collect personal data from children under 13 without appropriate consent. If you believe a child's data has been collected, please contact us and we will remove it.

We may update this policy from time to time. Any changes will be posted on this page with a revised “last updated” date. Please check back periodically.

If you have any concerns about how we handle your data, please contact the data controller first at contact@brightonpauperleague.com using the subject line “FAO Data Controller”, and we will do our best to resolve them.

You also have the right to lodge a complaint with the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk.