Privacy Notice

Data Controller & Contact

The designated Data Controller responsible for personal data processed through this platform is:

We are committed to processing your personal data lawfully, fairly, and transparently, respecting your autonomy and privacy at every stage of engagement.

Information We Collect

We limit our data collection to the minimum required to provide secure, complimentary access to our botanical folios:

• Registration Records: Your electronic mail address, chosen curator screen name, securely salted password hash (never stored in plaintext), and verified date of birth.
• Curatorial Preferences: Your preferred lighting atmosphere (Dawn, Parchment, Twilight) and session reminder intervals.
• Local Device Storage: Client-side identifiers for marked Highland Crests (tph:claims), recently engaged folios (tph:recent), and consent telemetry flags.
• Support Inquiries: Name, contact email, and textual contents of messages submitted through our concierge dispatch form.
• Technical Telemetry: Anonymized server access logs containing truncated IP addresses, user-agent strings, and request timestamps strictly for cybersecurity maintenance.

Lawful Bases for Processing (UK GDPR)

In accordance with Article 6 of the UK GDPR, our processing of your personal information relies upon specific lawful bases:

• Contractual Necessity (Art. 6(1)(b)): To manage your member account, allocate complimentary Play Credits, and maintain your private Credit Ledger.
• Legal Obligation (Art. 6(1)(c)): To verify that participants meet the statutory age threshold of 18 years for adult social entertainment.
• Legitimate Interests (Art. 6(1)(f)): To safeguard platform integrity against brute-force attacks, maintain server performance, and investigate malicious abuse.
• Consent (Art. 6(1)(a)): For optional diagnostic telemetry tokens configured under Google Consent Mode v2. Consent can be updated or withdrawn at any moment.

Data Retention & Storage Security

All user account credentials and support records are preserved in hardened, permission-restricted server environments using exclusive file-locking primitives to prevent concurrency corruption. We employ industry-standard cryptographic hashing (Argon2id/Bcrypt) to secure passwords.

We retain your account details for as long as your curatorial membership remains active. If your account remains dormant for 24 continuous months, we initiate automated purge procedures. Support inquiries are archived for 12 months following resolution and subsequently erased.

Your Statutory Rights

Under Chapter III of the UK GDPR, you hold significant statutory rights concerning your personal information:

• Right of Access: Request a complete electronic copy of all personal data held concerning your account.
• Right to Rectification: Rectify inaccurate or incomplete archival records.
• Right to Erasure ("Right to be Forgotten"): Request the complete deletion of your account and ledger history, subject to statutory retention limits.
• Right to Restrict Processing: Request the temporary freezing of your account processing under contested circumstances.
• Right to Data Portability: Obtain your registration and ledger data in a structured, machine-readable JSON format.

To exercise any of these entitlements, transmit a formal dispatch to privacy@thistleplayhub.com. You also maintain the statutory right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO), should you deem our processing inconsistent with UK data protection legislation.

Third-Party Data Sharing

Thistle Play Hub Ltd maintains an unyielding policy against the commercialization of personal information. We do not sell, rent, monetize, or trade your personal data, email addresses, or usage patterns to advertisers, marketing brokers, or commercial syndicates.

Disclosures occur strictly under limited operational imperatives:

• Infrastructure Service Providers: Trusted enterprise cloud hosting and security infrastructure providers acting strictly under data-processing agreements.
• Statutory Authorities: Where compelled by valid legal summons, court order, or mandatory UK governmental request.