Privacy Policy
This Privacy Policy explains how World Poker Club ("we", "us", "our") collects, uses, and protects your personal data when you visit our website at worldpokerclub.co.uk, use our application at app.worldpokerclub.co.uk, or otherwise interact with our services.
We take your privacy seriously and are committed to complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).
01. Who we are
For the purposes of UK GDPR, the data controller is:
World Poker Club
Email: support@worldpokerclub.co.uk
If you have any questions about this policy or how we handle your personal data, please contact us using the details above.
02. What personal data we collect
On the marketing website (worldpokerclub.co.uk)
| Data | When collected |
|---|---|
| Email address | When you submit the early-access / signup form |
| Source tag (e.g. "landing-hero", "landing-cta") | Automatically, alongside your email submission, to help us understand which call-to-action you used |
| Cookie consent preferences | When you make a choice on our cookie banner |
| Usage data (page views, clicks, browser, device, country) | Only if you consent to analytics cookies — see Section 4 |
In the application (app.worldpokerclub.co.uk)
| Data | When collected |
|---|---|
| Username, email address, password (hashed) | When you create an account |
| Two-factor authentication tokens | When you enable 2FA |
| Session tokens (in a secure HTTP-only cookie) | When you log in |
| Game data: tournament settings, player names, buy-ins, results, leaderboard positions | When you create or run a tournament |
| Player photos (optional) | If you choose to upload a photo for a player |
| Technical logs (IP address, timestamps, error logs) | Automatically, for security and debugging purposes |
03. Why we collect it & legal basis
Under UK GDPR, we must have a lawful basis to process your personal data. Here are the bases we rely on:
| Purpose | Legal basis |
|---|---|
| To respond to your email signup and send you launch updates | Consent (UK GDPR Art. 6(1)(a)) |
| To create and manage your account in the app | Contract (Art. 6(1)(b)) |
| To run tournaments and store your game data | Contract (Art. 6(1)(b)) |
| To secure our service (logs, 2FA, fraud detection) | Legitimate interests (Art. 6(1)(f)) — keeping the service safe |
| To analyse how the site is used (analytics cookies) | Consent (PECR & Art. 6(1)(a)) |
| To comply with legal obligations (e.g. responding to lawful requests) | Legal obligation (Art. 6(1)(c)) |
04. Cookies, analytics & tracking
We use cookies and similar tracking technologies on our site. Some are strictly necessary; others require your consent. See our Cookie Policy for the full list and details.
Strictly necessary (no consent required)
- Session and authentication cookies — used in the app to keep you logged in.
- Cookie consent cookie — used to remember the choice you made on the cookie banner so we don't ask you again on every visit.
Analytics & performance (requires your consent)
If you accept analytics cookies, we use the following services:
- Google Analytics 4 — provided by Google LLC. Helps us understand how visitors find and use our site (page views, click paths, traffic sources, country, device type). Data is sent to Google's servers and processed under Google's privacy terms. Google privacy policy.
- Microsoft Clarity — provided by Microsoft Corporation. Captures anonymised session recordings and heatmaps showing how visitors interact with the site (mouse movements, clicks, scroll depth). Form input values are masked by default. Microsoft privacy statement.
These services are not loaded until you give consent. If you refuse, no analytics scripts are added to the page. You can change your mind at any time by clicking "Cookie settings" in the footer.
Google Search Console
We use Google Search Console to monitor how our site appears in Google search results. This service does not set cookies on your browser and uses only aggregated data from Google's side. No consent is required.
05. Who we share data with
We do not sell your personal data to anyone. We share data only with the following categories of third party, and only when necessary:
- Hosting providers — our website and app are hosted on UK-based servers. Hosting providers process technical data (e.g. IP addresses in server logs) on our behalf.
- Analytics providers — Google (Analytics 4, Search Console) and Microsoft (Clarity), only with your consent for Analytics 4 and Clarity. See Section 4.
- Email service providers — if and when we send you newsletters or launch announcements, we may use an email delivery service. We will update this policy with details before such a service is used.
- Law enforcement & legal authorities — where required by law, court order, or to protect our legal rights.
We do not engage in any advertising-based data sharing, retargeting, or audience-building activities.
06. International transfers
Some of our service providers (notably Google and Microsoft) are based outside the UK and may process your data in the European Economic Area (EEA) or the United States.
Where data is transferred outside the UK, we rely on:
- Adequacy decisions — for transfers to countries the UK government has determined provide an adequate level of data protection (including all EEA countries).
- UK International Data Transfer Agreement (IDTA) or Standard Contractual Clauses (SCCs) with a UK Addendum — for transfers to other countries.
- Data Privacy Framework — for transfers to certified US organisations.
07. How long we keep your data
| Data | Retention period |
|---|---|
| Email signups (early-access list) | Until you ask us to delete, or until 24 months of no engagement |
| App account data | For as long as your account is active, plus 12 months after deletion (in backups) |
| Game data and tournament history | For as long as your account is active |
| Security logs | 12 months, then deleted |
| Cookie consent records | 6 months from your choice (then we re-ask) |
| Analytics data | As per Google Analytics 4 default retention (14 months); Microsoft Clarity retains for 13 months |
08. How we protect your data
We use industry-standard security practices to protect your data:
- All data is transmitted over HTTPS (TLS encryption)
- Passwords are hashed using industry-standard algorithms — never stored in plain text
- Two-factor authentication (2FA) is offered on all app accounts
- Session cookies are HTTP-only and Secure-flagged
- Access to the database is restricted and logged
- Regular security reviews and updates
No system is 100% secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours and inform you without undue delay where required.
09. Your rights
Under UK GDPR, you have the following rights regarding your personal data:
- Right to be informed — this policy is part of how we honour that right.
- Right of access — request a copy of the personal data we hold about you.
- Right to rectification — ask us to correct inaccurate or incomplete data.
- Right to erasure ("right to be forgotten") — ask us to delete your data, subject to some legal limits.
- Right to restrict processing — ask us to pause processing in certain circumstances.
- Right to data portability — receive your data in a structured, commonly-used format.
- Right to object — object to processing based on legitimate interests.
- Right to withdraw consent — at any time, where we rely on consent (e.g. analytics, marketing emails).
- Rights related to automated decision-making — we do not make any automated decisions about you using your personal data.
To exercise any of these rights, email us at support@worldpokerclub.co.uk. We will respond within one calendar month.
10. Age restrictions
Our service is intended for users aged 18 years and over. We do not knowingly collect personal data from anyone under 18. If you believe we have collected data from a minor, please contact us at support@worldpokerclub.co.uk and we will delete it promptly.
11. Changes to this policy
We may update this policy from time to time. When we make material changes, we will update the "Last updated" date at the top and, where appropriate, notify you by email (if you have an account) or via a banner on the site.
12. How to contact us
For any questions, requests, or concerns about your personal data or this policy:
World Poker Club
Email: support@worldpokerclub.co.uk