Privacy Policy
This policy explains what personal data Bobcat19 Stadium (bobcat-stadium.bobbycato.com, "the stadium", "we", "us") collects, why, how long we keep it, who we share it with and the rights you have. It applies to the website, member accounts, the league, networking and messaging, and the partner application form.
1. Who we are
Bobcat19 Stadium is run by Agile Tech Global Solutions (trading as Bobcat19), which is the data controller for the personal data described here.
Registered address: 27 Old Gloucester Street, London, England, WC1N 3AX.
Registered with the Information Commissioner's Office (ICO), registration number ZB598122.
Contact for anything about your data: [email protected].
2. What we collect
When you create an account
- Your name, email address and a username.
- Your password, stored only as a one-way scrambled code (we can never see it).
- If you choose "Continue with Google": your name, email address, profile picture and Google account ID. We never see your Google password.
- Whether you agreed to this policy and whether you opted in to news and offers by email.
What you add to your profile (optional)
- A profile picture, business name, business category, services, location, website, a short description, and social media handles (Instagram, TikTok, LinkedIn, Facebook, X, YouTube).
While you use the stadium
- Your points: places and rooms you have explored, whether you finished the tour, match results, goals and score predictions.
- Networking: your connections, connection requests, private messages you send and receive, people you block and reports you make.
- Security records: the date, time, IP address and device type of each sign-in, kept so you and we can spot unusual activity.
Partner applications
- The details you enter in the "Become a visiting partner" form: name, job title, email, phone, company, website, sector, size, location, interests, what you can offer, how a partnership would benefit you, budget, timing and anything else you tell us.
Visitors without an account
- Your settings and points are stored only on your own device (in your browser's local storage) until you create an account.
- We count visits anonymously (for example, how many times a diamond or room was visited each day). These counts contain no names, email addresses or device identifiers.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Creating and running your account, the league table, points, matches, networking and messages | Contract: to provide the service you signed up for |
| Approving new members, keeping the platform safe, preventing spam and abuse, handling reports, security logs | Legitimate interests: keeping the community safe and the service working |
| Emails you need, such as confirming your email address and password resets | Contract |
| News and partner offers by email | Consent: only if you tick the box. You can withdraw it at any time |
| Reviewing and replying to partner applications | Legitimate interests (and steps before entering a contract) |
| Anonymous visit counts to improve the stadium | Legitimate interests |
| Meeting legal obligations and responding to lawful requests | Legal obligation |
4. What other members can see
- League table (public): your username, profile picture, points and match record, once your account is approved.
- Directory (signed-in members only): your name, username, picture, business, category, services, location, website, description and social handles, unless you switch "Let other members find me in networking" off in your profile.
- Messages: only you and the person you are writing to can read them. Bobcat19 administrators can read messages only when there is a good reason, such as investigating a report of spam or abuse, and every such look is recorded.
- Your email address is never shown to other members.
5. Who we share data with
We do not sell your data or share it for advertising. We use these service providers, who process data only on our instructions:
- Our web hosting provider: runs the server and the database that store the stadium's data.
- Cloudflare: network security and delivery. It sees your IP address and the pages you request.
- Microsoft (Microsoft 365): sends our emails (from [email protected]).
- Google: only if you use "Continue with Google" (sign-in), or when the partner form shows reCAPTCHA (spam protection), or when you choose to play a YouTube video on the stadium screens. The stadium's lettering is loaded from Google Fonts, which receives your IP address.
Some of these providers may process data outside the UK. Where they do, they use the safeguards UK law requires, such as the UK International Data Transfer Agreement or adequacy regulations.
We may also share data if the law requires it, or to protect the rights and safety of our members or others.
6. How long we keep it
- Your account, profile, points, connections and messages: until you delete your account, or we close it. Messages you delete from your inbox are hidden from you; they are removed completely when both people have deleted them or an account is deleted.
- Sign-in records: up to 30 days.
- Email confirmation and password reset links: they expire within 3 days and 2 hours respectively, and are then removed.
- Partner applications: up to 2 years after we last spoke, unless you become a partner.
- Reports of abuse: up to 2 years.
- Daily database backups: 14 days.
- Anonymous visit counts: they contain no personal data and may be kept indefinitely.
7. Your rights
You have the right to:
- see the personal data we hold about you, and get a copy (use "Download my data" in your account, or ask us);
- correct it (edit your profile, or ask us);
- delete it (use "Delete my account" in your account, or ask us);
- restrict or object to how we use it, and withdraw consent to marketing emails at any time;
- take your data to another service (data portability).
Email [email protected] to use any of these rights. We reply within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office: ico.org.uk, telephone 0303 123 1113.
8. Cookies and local storage
We use only what the stadium needs to work: a secure sign-in cookie while you are signed in, and your browser's local storage for your settings and progress. YouTube videos play only after you allow them. Full details are in our cookie policy, which you can open from the stadium's menu (Menu › Cookies).
9. Children
Member accounts are for people aged 18 and over. If you are under 18, please do not create an account. If we learn that someone under 18 has an account, we will delete it.
10. Keeping data safe
The site uses HTTPS encryption. Passwords are stored only as one-way hashes. The database is on a private server that only Bobcat19 can access, with daily backups. Administrator actions are logged.
11. Changes to this policy
If we change this policy we will update the date at the top, and tell members by email or in the stadium if the change is significant.