Privacy Policy

Privacy Policy for BPL Stadium, a browser-based football simulation game. This Policy explains what personal data we collect, why we use it, how long we keep it, and how you can exercise your rights when using bplstadium.com and related sub-domains. It is written to comply with the UK GDPR and the Data Protection Act 2018.

Last updated: 22 May 2026 · Version 4.0 · Effective immediately

1. Introduction

We respect your privacy and are committed to protecting any personal data you share when interacting with BPL Stadium. This Privacy Policy describes what personal data we collect, why we use it, how long we keep it, and how you can exercise your rights when using bplstadium.com and related sub-domains (the “Service”).

Controller: the publisher of BPL Stadium (“BPL Stadium”, “the Publisher”, “we”, “us”), published as a demonstration / portfolio project.

Contact: privacy@bplstadium.com

Scope & age: This Policy applies to every user of the Service. The Service is intended for individuals aged 18 and over. By using the Service you acknowledge that your personal data will be processed in accordance with this Policy and applicable data-protection laws, including the UK GDPR and the Data Protection Act 2018.

The Service is a browser-based football simulation game. It is published in English; if translated versions become available, the English text controls in case of inconsistency.

2. Personal data we collect

We collect only the data we need to operate, secure and improve the Service.

2.1 Data you provide directly

Depending on how you use the Service, you may provide:

• Account & identity: a username (or display name), a password (stored as a non-reversible hash) and your preferred language and interface settings.
• Player profile: any information you choose to add to your in-game Account, such as a custom display picture or a free-text bio (where such fields exist).
• Predictions & gameplay inputs: selections placed on simulated Matches, top-up package choices and any other interactions with the simulator.
• Custom advertising boards: the text and colour values you submit when publishing a pitchside board through the Advertisers feature.
• Support & communications: messages and attachments you send to us (including support tickets, feedback forms and emails).

Special-category data: We do not seek special-category data (such as health information, political views, religious beliefs or biometric data). If you voluntarily include such data in free-text fields or correspondence, we will process it only as necessary to respond to your request and only on the basis of your explicit consent (see section 3.2). Please avoid including special-category data where it is not strictly necessary.

2.2 Data collected automatically

When you use the Service we automatically collect certain technical and usage information:

• Technical data: IP address, device and browser type, operating system, timezone, language, user-agent string and session identifiers.
• Security telemetry: authentication and access logs, rate-limiting and anomaly logs, abuse / fraud signals and similar security-related information.
• Usage & diagnostics: page views, clicks, navigation paths, features used, top-ups and deductions of in-game currency, error traces and performance metrics.

Where feasible, we use aggregated or pseudonymised data for analytics and diagnostics.

2.3 Data from third parties

Where necessary to provide and secure the Service, we may receive limited personal data from:

• Hosting and CDN providers: infrastructure-level signals such as origin-server logs, uptime checks and request metadata.
• Font provider: when your browser fetches typeface files, the provider may log the request as part of standard CDN operations.
• Open-source 3D library CDN: when your browser fetches the 3D-rendering library used by the stadium scene, comparable request metadata is logged.
• Future payment processors: should real-money purchases be introduced, regulated processors would supply transaction references, status codes, fraud-prevention signals and chargeback notifications. We would not receive or store full card numbers or CVV codes. This sub-section is descriptive of a possible future state only.
• Professional advisers and insurers: information necessary for legal, tax, compliance or insurance purposes.

2.4 User-Generated Content (UGC)

User-Generated Content — including text used in Custom advertising boards, free-text fields, uploads and prompt-style inputs — may contain personal data about you or third parties. You are responsible for ensuring that you have an appropriate lawful basis, notices and permissions to include any third-party personal data in your UGC.

3. Why we process your data & legal bases (UK GDPR)

We process personal data under the UK GDPR and the Data Protection Act 2018 on the following legal bases:

3.1 Performance of a contract

To enter into and perform our contract with you, we process personal data to:

• create, maintain and secure your Account;
• provide the Service, including the simulator, the Predictions interface and the Custom advertising boards feature;
• operate in-game currency and bonus credits, and record the corresponding transactions in your ledger;
• deliver any digital content credited to your Account;
• communicate with you about your use of the Service, in-game transactions and support requests.

3.2 Consent (including marketing & special-category data)

We may rely on your consent to:

• process any special-category data that you voluntarily provide in UGC or correspondence;
• send marketing emails or product newsletters, where you have opted in (for example, updates about new features or seasonal events);
• use your feedback, testimonials or case studies for marketing or product-improvement purposes where you explicitly agree.

You may withdraw your consent at any time by contacting us (see section 12). Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

3.3 Legitimate interests

We may process personal data where necessary for our legitimate interests, provided that your interests and fundamental rights do not override those interests. Such interests include:

• keeping the Service secure (fraud detection, abuse prevention, logging, rate-limiting and incident response);
• ensuring reliable operation of authentication, session management and Dashboard access;
• measuring and improving performance, usability and user experience (using aggregated or pseudonymised analytics where feasible);
• tailoring aspects of the Service at a high level (for example, grouping users by language preference for content prioritisation) without making automated decisions with legal or similarly significant effects;
• sending essential, non-marketing communications (for example, service announcements, security alerts or policy updates).

3.4 Legal obligation

We may process personal data where necessary to comply with legal obligations, including:

• tax, accounting and corporate record-keeping (where applicable);
• responding to lawful requests from public authorities, courts or regulators;
• fulfilling our obligations under applicable consumer-protection and data-protection laws;
• complying with anti-fraud, sanctions and similar regulatory requirements that may apply to our operations.

4. Automated processing, profiling and AI

The Service uses automated processing and algorithms to handle your inputs, for example:

• generating Matches, league tables and other simulator outputs;
• aggregating usage data for statistics and performance monitoring;
• detecting unusual patterns for security and fraud prevention.

Limited profiling may be used to tailor aspects of the Service (for example, prioritising content for users who interact predominantly with one feature, or flagging unusual in-game currency activity for review).

We do not make decisions with legal or similarly significant effects solely on the basis of automated decision-making. You may request human review of any decision that you believe has been taken solely by automated means by contacting privacy@bplstadium.com.

Where we use third-party providers that incorporate AI components, we do so under contractual safeguards and do not knowingly permit them to use your personal data to train public models in a way that would identify you.

5. Sharing and international transfers

We share personal data only as necessary to operate, secure and improve the Service, or to comply with legal obligations. This may include:

• Hosting & IT infrastructure: secure cloud infrastructure, databases, CDN, storage and backups, monitoring and error-tracking services.
• Font and library providers: the typeface provider and the open-source 3D-rendering library CDN that the Service relies on.
• Support & communications: any helpdesk, ticketing or email-delivery services we may use to handle your enquiries.
• Professional advisers & insurers: legal, accounting, compliance and insurance providers where relevant.
• Future payment processing: should real-money payments be introduced, regulated processors and related anti-fraud services would be engaged with appropriate safeguards.
• Corporate transactions: if we become involved in a merger, acquisition, financing or sale of part of our operations, personal data may be transferred as part of that transaction, subject to appropriate safeguards.

Some of our service providers may be located outside the UK / EEA. Where personal data is transferred internationally we implement appropriate safeguards, such as:

• UK adequacy regulations (where the destination country has been recognised as providing an adequate level of protection);
• the UK or EU Standard Contractual Clauses (SCCs); and
• additional technical and organisational measures where appropriate (for example, encryption, access controls and data minimisation).

We do not sell your personal data.

6. Cookies and similar technologies

We use cookies and similar client-side storage technologies (including localStorage and sessionStorage) to:

• run essential functions of the Service (for example, sign-in sessions, security checks and preferences);
• remember your settings (such as language and interface preferences);
• measure performance and reliability;
• where you consent, enable analytics or, if applicable, marketing features.

Strictly-necessary entries are required for core functionality and security and cannot be disabled through our consent tools. Non-essential entries (for example, analytics or marketing cookies) would only be used where you provide consent and could be disabled at any time via our cookie banner or preference centre.

For more detail on the specific entries we currently write to your device and how to manage them, see our Cookies Policy.

7. Retention

We keep personal data only for as long as necessary for the purposes described in this Policy or as required by law. In particular:

• Account & gameplay data — stored locally on the device used at registration and retained for as long as you maintain the Account. Clearing your browser’s local storage erases this data immediately.
• In-game currency & transaction ledger — retained for the lifetime of the Account in local storage. If we introduce a centralised ledger in the future, retention will be aligned with this Policy and announced in advance.
• Server logs & security telemetry — typically 14 days for standard access logs, and up to 6–24 months for security-related telemetry depending on purpose and risk.
• Correspondence — retained for up to 2 years to enable follow-up on support requests, then deleted.

Where feasible, we minimise, pseudonymise or anonymise data as early as possible and then securely delete or irreversibly anonymise it once it is no longer needed.

8. Your rights

Subject to certain legal conditions and limitations, you have the following rights in relation to your personal data:

• Right of access — to obtain confirmation as to whether we process your personal data and to receive a copy.
• Right to rectification — to request correction of inaccurate or incomplete personal data.
• Right to erasure (“right to be forgotten”) — to request deletion of your personal data where there is no longer a legal basis for us to retain it.
• Right to restriction of processing — to request that we restrict processing in certain circumstances (for example, while we verify accuracy of data).
• Right to data portability — to receive certain personal data in a structured, commonly used and machine-readable format and to transmit it to another controller where technically feasible.
• Right to object — to object, on grounds relating to your particular situation, to processing based on our legitimate interests, and to object at any time to processing for direct marketing.
• Right to withdraw consent — where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of past processing.

How to exercise your rights: you may exercise your rights by emailing privacy@bplstadium.com from the address associated with your enquiry. We may need to request additional information to verify your identity. We aim to respond within one month of receiving your request. This period may be extended by up to two further months for complex or numerous requests, in which case we will inform you of the extension and reasons.

9. Security

We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse or alteration. These measures include, where appropriate:

• access controls, role-based permissions and authentication for administrative interfaces;
• encryption in transit (HTTPS / TLS) once the domain is bound to a TLS certificate, and where appropriate encryption at rest;
• network segregation, firewalls and regular backups;
• logging, monitoring and incident-response procedures;
• vendor due diligence and contractual obligations for processors;
• secure software-development and change-management practices.

No system can be guaranteed to be 100% secure, but we continuously improve our controls and will promptly investigate and, where required, notify you and the relevant supervisory authority of any personal-data breach within seventy-two (72) hours of becoming aware of it.

10. Children’s data

The Service is intended for users aged 18 and over. We do not knowingly collect personal data from children. If you believe that a child has provided personal data to us, please contact privacy@bplstadium.com so that we can investigate and, where appropriate, delete the data and close any related Account.

11. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in the Service, applicable law or our data-protection practices.

Material changes will be communicated via an in-product notice and via the “Last updated” field at the top of this document. Updated versions will be effective from the date indicated at the top of this Policy and will apply prospectively.

12. Contact & complaints

Controller: BPL Stadium (Demonstration project)

• Postal address: BPL Stadium (Demo), Demo Lane 4, London, United Kingdom.
• Privacy enquiries: privacy@bplstadium.com
• General: hello@bplstadium.com
• Support: support@bplstadium.com

If you have questions or concerns about how we handle your personal data, please contact us first so we can try to resolve the matter.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) in the United Kingdom. If you are resident in the European Economic Area, you may also have the right to complain to your local supervisory authority — a list is published by the European Data Protection Board.