Who we are
Draft Unleashed is run by Coastal Coding Limited, a company registered in England and Wales, company number 14771208. We're the controller of the personal data described here. Write to us at privacy@draftunleashed.com about anything in this policy. We haven't appointed a data protection officer.
This policy covers this website and its waitlist. When the game itself opens, we'll extend it to cover the game, and change the date above.
What we collect, why, and on what basis
The waitlist
When you join the waitlist we keep the email address you give, whether you run your league or play in one, how many teams it has, its format, when it might move, and your answer to "What's the one thing you'd love your league to have?" if you give one. That answer is free text, so it holds whatever you type: please don't put anyone else's details in it. We also keep when you signed up and when you confirmed.
We use it to confirm your address, to tell you when your league can move, and to send you occasional development updates. Our lawful basis is your consent, which you give by sending the form and pressing the button in our confirmation email. You can withdraw it at any time with the unsubscribe link in every email, or by writing to us.
If you don't confirm, we send you nothing more, and keep your answers only to count, with everyone else's, how many leagues are interested; they are deleted within 30 days.
The confirmation email
To confirm that the address is yours, we email it a link. We keep the times we sent confirmation emails to an address, held only as a keyed hash of the address (a code that can't be turned back into it), and a count of the emails we send each day. That stops anyone using the form to flood someone else's inbox: an address gets at most one confirmation email in any 10 minutes, and three in any 24 hours. Our lawful basis is our legitimate interests in confirming the address you gave and keeping the form from being misused.
When you unsubscribe
If you unsubscribe, or ask us to remove you, we delete your sign-up and keep a keyed hash of your address, with the date, so that we don't email it again. Our lawful basis is our legitimate interests in honouring your request.
The check on the form
Cloudflare Turnstile checks your browser when you use the form, to tell people from bots. To do that, Cloudflare processes information about your browser, device and connection, such as your IP address. Our lawful basis is our legitimate interests in keeping the form secure. Turnstile is the only service from anyone else that our pages load.
Measuring the site
Today this site sets no cookies and records no visits. We plan to
count how people find and use it with one cookie of our own,
du_vid, a random identifier kept for 13 months, with a
session cookie and a note of where a visit came from, and events
about the pages, with no name and no email address in them. We'll
use them only for statistics about the site, in aggregate. Our
lawful basis will be our legitimate interests in
understanding and improving the site; for the cookie, we'll rely on
the UK's exemption for storage used only to collect statistics that
improve a service, with clear information and a free way to object.
A "Don't track me" link on every page will turn it off for your
browser. We'll update this policy, and its date, before any of that
starts.
When you write to us
If you email us, we keep your message and our reply as ordinary correspondence, to deal with what you asked.
We keep no logs of your visits to this site.
Who receives it
Cloudflare, Inc. processes it for us, as our processor: it hosts this site and its database, sends and routes our email, and runs Turnstile. When we choose a service to send the development updates, we'll name it here before it receives anything. We don't sell your data, and we don't share it with anyone for their own use.
Transfers outside the UK
Cloudflare may process data in the United States and elsewhere. Transfers to the United States are made under the UK Extension to the EU-US Data Privacy Framework, the UK-US data bridge, under which Cloudflare is certified. Other transfers are protected by the European Commission's standard contractual clauses with the UK's International Data Transfer Addendum, in Cloudflare's data processing addendum.
How long we keep it
- A sign-up that isn't confirmed is deleted within 30 days of being made. A confirmation link works for seven days.
- A confirmed sign-up is kept until you unsubscribe or ask us to delete it. When every league can move, we'll decide whether to keep the list for updates, and tell you.
- Unsubscribing deletes your sign-up straight away. The keyed hash that stops us emailing you again is kept for six months.
- The record of confirmation emails is deleted within two days of the last email, and the daily counts within three days.
- Backups: our database keeps its own history for up to 30 days, so a deleted sign-up stays there until that history expires. We don't use it from there, and if we ever restore the database, we delete again whatever was removed since.
Your rights
You have the right to ask for a copy of your data (access), to have it corrected (rectification) or deleted (erasure), to restrict how we use it, to object to how we use it (including to the measures, once they start, by the "Don't track me" link), and to have it in a form you can take elsewhere (portability). You can withdraw your consent at any time; that doesn't affect what we did with it before.
To use any of these rights, write to privacy@draftunleashed.com from the address in question. We answer only the address itself, so that nobody can find out who is on the list, or take someone off it, by naming an address. If you write from a different address, we'll send a message to the one you named and act once it has been answered from there. We'll reply within a month.
Complaints
If you're unhappy with how we handle your data, please tell us first. You also have the right to complain to the Information Commissioner's Office, the UK's regulator: ico.org.uk, or 0303 123 1113.
Do you have to give it?
No. Nothing here is required by law or by a contract, and you choose whether to join. Without an email address and the answers the form asks for, we can't put you on the waitlist.
Automated decisions
We make no decisions about you by automated means that have legal or similarly significant effects, and we don't profile you. The measures, once they start, are looked at only in aggregate.
Children
Draft Unleashed is for people aged 13 and over. If you're under 13, please don't join the waitlist.
Changes
This policy lives at this address, draftunleashed.com/privacy. When we change it, we change the date at the top, and we'll tell people on the waitlist about any change that matters to them.