Privacy & your data
A clear explanation of the information involved in Deckmates, what it is used for and how to ask for help.
Contact us about your data →Deckmates is responsible for deciding how personal information is used to run its website and app. For privacy questions or requests, email hello@deckmates.uk.
This notice covers the Deckmates app, shop application process, website and launch mailing list.
The information depends on the features you use. The current app code includes the following categories; some connected features are still being prepared for launch.
Information is supplied by you, generated through your use of the app, or received from connected services and other participants where the feature requires it. Required account information enables registration; without it you may not be able to create an account. Optional features require only the information relevant to taking part.
The proposed lawful-basis mapping for launch is:
These bases need to be confirmed against the launch features and business arrangements. Any sensitive safeguarding information or additional eligibility information needs its own assessment before collection.
We are adopting a category-based approach: keep what is needed for the purpose, then delete it or anonymise it so it no longer identifies someone. These are the proposed operating periods. They must be matched to database jobs, storage, backups and third-party settings before they can be described as enforced limits.
While your account is open. Target: remove or anonymise eligible live records within 30 days of a verified deletion request.
Provide your account, collection and challenge history. Any legally necessary exceptions must be identified separately.
Review after 24 months without a sign-in; give 90 days’ notice before any proposed closure.
Avoid keeping abandoned accounts indefinitely without silently removing a collector’s long-term collection.
12 months after the enquiry is resolved.
Follow up issues and identify recurring service problems.
12 months from the activity, then remove or genuinely anonymise unless needed for an active challenge or dispute.
Support recent participation history without creating a permanent visit trail.
6 months after closure. Approved application records: while the shop relationship continues, with a review within 12 months of it ending.
Handle queries about decisions and administer the shop relationship.
30 days; security investigation records reviewed after 90 days.
Diagnose faults and investigate misuse. Provider-specific limits still need checking.
Until you unsubscribe or the list is closed. Review inactive subscriptions after 24 months; keep only the minimum suppression record needed to respect an opt-out.
Send requested updates and avoid adding unsubscribed people back to marketing.
Where UK company accounting requirements apply, 6 years from the end of the relevant financial year, or longer where legally required.
Meet accounting and tax obligations; this does not justify keeping an entire app profile.
Target: a maximum 35-day rolling window, subject to confirming provider configuration.
Recover from failures. A restore must reapply recorded deletions before normal use.
Case-specific retention, with a recorded reason and review date; routine closed moderation matters targeted for review after 12 months.
Protect people and resolve complaints. Serious safeguarding cases need a separate approved schedule; no automatic purge is proposed.
For context, the ICO explains storage limitation, and GOV.UK explains company accounting record requirements. The non-statutory periods above are Deckmates’ proposed choices, not universal legal deadlines.
The app includes profile and preference settings, optional Discord disconnection and an account-deletion action. Deletion can require resolution of responsibilities such as being the remaining responsible adult or shop owner. Contact us if you cannot complete it or need a broader data request.
Depending on the circumstances, UK data-protection law gives you rights to access your information, correct it, request erasure, restrict its use and receive certain information in a portable format. These rights can have exceptions; we’ll explain any that apply to a request.
Where we rely on consent, you can withdraw it without affecting the lawfulness of earlier processing. We normally respond to a rights request within one month, subject to permitted extensions, and may need information to verify that the request concerns your data.
The app stores authentication sessions and local preferences or cached collection information so it can work across sessions. Camera access is requested when you use card scanning; you can manage permissions in your device settings.
This development website does not include advertising or analytics scripts in its current code. Hosting providers can still process connection information to serve and protect the site. The mailing-list destination and any connected third-party services have their own relevant storage and privacy information.
The current self-service sign-up is limited to adults. Family and protected-space features need age-appropriate privacy information and confirmed guardian arrangements before they are made available. We will not treat a general adult notice as sufficient explanation for children.
Email hello@deckmates.uk with your question or request. Please don’t send a password or identity document in your first message.
You can also complain to the UK Information Commissioner’s Office through the ICO complaints service.
We will update this notice as the remaining launch details are confirmed and identify material changes before new uses of information begin.
