Privacy Policy & Data Charter

1. Data Controller Identity & Scope

This Privacy Charter delineates the standards and transparent practices under which Lobby Tabletop UK (referred to herein as "we", "us", or "our"), operating the web domain lobbytabletopuk.com, handles data, technical telemetry, and user preferences.

We operate in strict adherence to the United Kingdom General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), and the Privacy and Electronic Communications Regulations (PECR).

2. The Zero-Account Architecture

Our core product philosophy is rooted in consumer privacy through architectural minimisation. Lobby Tabletop UK does not mandate or maintain traditional user account registration. You are never requested to provide a username, password, payment card, home address, or social media link to enjoy any of our 14 browser tabletop games.

Because we do not store customer profiles on remote databases, your personal gaming sessions remain transient, anonymous, and unlinked to your real-world identity.

3. Categories of Information Collected

While using our service, information processing is limited strictly to technical data necessary for delivery and optional direct correspondence:

• Direct Communications Data: When you contact our support desk via email or web dispatch, we process your email address, sender name, and the specific contents of your correspondence to resolve your request.
• Automated Network Telemetry: Standard web server connection records generated when your browser requests web resources (including IP address, browser build identifier, HTTP request headers, operating system, and timestamp of access).
• Local State Artifacts: Client-side preferences stored exclusively on your device, such as ambient sound mute switches, current game session tallies, and personal high scores.

4. Lawful Grounds for Processing under UK GDPR

Every processing activity conducted by Lobby Tabletop UK is justified under a recognised lawful gateway pursuant to Article 6 of the UK GDPR:

• Article 6(1)(f) — Legitimate Interests: To maintain network security, detect server anomalies, prevent abusive automated traffic, and deliver a resilient, high-speed gaming catalog.
• Article 6(1)(b) — Contractual / Service Delivery: To supply the browser-based gaming experience you explicitly requested by opening a specific board table.
• Article 6(1)(a) — Explicit Consent: Applied when you opt-in to optional non-essential client-side cookies or initiate voluntary correspondence with our studio.
• Article 6(1)(c) — Legal Obligation: If disclosure of technical logs is strictly required by statutory British law enforcement or civil court orders.

5. Explicit Purposes of Processing

Any data received is processed solely for explicit, legitimate aims:

• Rendering 14 interactive board games in your browser with real-time responsive DOM updates.
• Generating client-side procedural Web Audio synthesis in harmony with your local sound toggles.
• Responding thoroughly to inbound technical inquiries and customer service messages.
• Preserving server stability and defending our hosting infrastructure against Denial of Service (DoS) attacks.

We categorically refrain from selling, renting, licensing, or commercialising user telemetry to data brokers, analytics syndicates, or behavioural advertising networks.

6. Cookies & Local Storage Governance

Our web platform avoids commercial advertising cookies and invasive tracking beacons. We rely primarily on standard HTML5 Local Storage:

• nord_bgm_muted — Stores your procedural ambient audio mute preference (true/false).
• nord_sfx_muted — Preserves your tactile board effect preference.
• nord_best_[game] — Remembers your personal high score for each of the 14 games on this specific browser.
• ltuk_cookie_consent — Records your confirmation choice on our cookie banner.

All Local Storage tokens remain strictly within your device's browser sandbox and can be wiped instantly at any time via your browser's "Clear Site Data" settings.

7. Data Retention & Secure Disposal

We implement rigorous data lifecycle controls. Temporary server access logs (containing masked IP addresses and resource URLs) are maintained for a maximum duration of thirty (30) days for diagnostic and security audits, after which they are automatically purged or permanently anonymised.

Direct email inquiries sent to our London studio are archived only for the duration necessary to conclude your inquiry, not exceeding six (6) months unless ongoing legal dialogue warrants prolonged retention.

8. Third-Party Disclosures & Infrastructure

Lobby Tabletop UK does not expose your data to external commercial vendors. Our web application is hosted on UK-compliant server nodes operating within secure data center facilities. Any technical infrastructure provider engaged by us acts strictly as a Data Processor bound by comprehensive Data Processing Agreements (DPAs) in total alignment with Article 28 of the UK GDPR.

9. Your Statutory Rights as a Data Subject

Under Chapter III of the UK GDPR, you are endowed with enforceable statutory rights regarding your personal information:

• Right of Access (Article 15): You have the right to request confirmation as to whether personal data concerning you is being processed, and to obtain a copy thereof.
• Right to Rectification (Article 16): You may request the prompt correction of inaccurate or incomplete records.
• Right to Erasure (Article 17): The right to obtain the erasure of your personal data without undue delay where statutory grounds apply.
• Right to Restriction of Processing (Article 18): The right to restrict processing under contested circumstances.
• Right to Object (Article 21): The absolute right to object to processing founded upon legitimate interest grounds.

To exercise any of these privileges, please dispatch an electronic notice to contact@lobbytabletopuk.com. We respond to all verified statutory requests within thirty (30) days free of charge.

10. Technical Security & Encryption Safeguards

We institute robust technical and organisational security controls to protect information traversing our perimeter. All HTTP transmissions are fortified with modern TLS 1.3 cryptographic protocols, HSTS enforcement, and strict content security boundaries to prevent tampering, eavesdropping, or unauthorised packet interception.

11. Inquiries & The UK Supervisory Authority

If you have questions, feedback, or concerns regarding our privacy protocol or data handling practices, our compliance desk is readily accessible:

If you consider our handling of your information to be non-compliant with applicable legislation, you possess the statutory right to lodge a formal complaint with the British supervisory authority:

Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113 • Website: ico.org.uk