Boadman — Privacy Policy

Version: v1.3 Effective from: 15 October 2026 Last updated: 15 October 2026

What changed in v1.3: you can now choose to receive push notifications (alerts on your phone or computer, such as "check-in is open" or "your lobby details are ready"). They are off until you allow them in your browser, and you can turn them off at any time in your notification settings or your browser. We also now send the lobby-details email once, when the lobby is first published; later changes to lobby details are notified in the app and by push only. See §3.5, §4, §6, §7 and §8.

1. Who we are

Boadman ("we", "us", "our") operates an online platform where competitive gamers create, host, and join individual and team-based competitions, followed by a spectator audience. We are based in the United Kingdom.

If you have a complaint about our handling of your personal data, you can contact our DPO using the address above. If you believe we have not handled your data correctly, you also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at https://ico.org.uk.

2. What this policy covers

This policy explains:

• What personal data we collect about you
• Why we collect it (the lawful basis for processing)
• How long we keep it
• Who we share it with
• The rights you have under UK GDPR and the Data Protection Act 2018, and how to exercise them

It applies to your use of:

• The Boadman website at https://boadman.com (including www.boadman.com and our other subdomains)
• Any mobile or desktop app we publish
• Email communications you receive from us

This policy covers both competing players and spectators using the platform. See §3.6 for what applies specifically to spectators.

3. The personal data we collect

3.1 At account creation (KYC Level 0)

• Email address (used for authentication, transactional notices, and required regulatory communications)
• Username + display name (publicly visible; you choose them)
• Password (stored hashed by our authentication provider — we never see your plaintext password)
• Date of birth (you must be 18 or older; we verify it against your ID document at KYC Level 1 if required)
• Country of residence (used for geofencing per FATF requirements + service availability decisions)
• Your consent to this Privacy Policy and our Terms of Service (timestamped and version-tracked)

3.2 At first deposit

• Declared legal name (the name on your payment card; locked once set, cannot be self-edited)
• Card payment metadata received from our payment processor (card last 4 digits, card-issuing country, billing-name extract, payment method fingerprint)

3.3 At Level 1 KYC (triggered by first withdrawal or cumulative deposits over £200/30 days)

• Government-issued identity document (passport, driving licence, national identity card)
• Selfie + facial liveness video

These documents are uploaded directly to our identity verification provider (Didit) and held by them, not by us. We receive only the extracted metadata (verified legal name, date of birth, country of issuance, document type, document number hash) and the verdict (approved / declined / requires-review).

Your selfie and facial liveness video are biometric data used to confirm your identity. We process this under a specific lawful condition described in §4 — see the note on special category data.

3.4 At Level 2 KYC (triggered by withdrawal over £2,000 single or £5,000/12 months)

• Proof of address (utility bill or bank statement)
• Source of wealth declaration (questionnaire response)

3.5 During use

• Wallet activity (deposits, redemptions, in-platform stake / win history, all recorded in an append-only ledger)
• Match participation (which competitions you joined or hosted, results, evidence you submitted)
• IP address on our security audit log (when you take certain security- or money-related actions, such as buying coins, cashing out, or creating or hosting a competition, we record your full IP address with that event in our audit log, for security, fraud prevention and anti-money-laundering audit purposes; see §4 and §5)
• Hashed IP address (in our other records, such as session signals, bug reports and cookie-consent records, we do not store your IP address in full; we hash it with a secret salt and use the result only for deduplication and fraud prevention)
• Device session signals (limited fingerprint information, retained 90 days, used solely for fraud and collusion detection)
• Bug reports you submit (your message, the page you were on, your browser type, and a contact email if you give one)
• Product analytics, only if you opt in to analytics cookies: pseudonymous usage events (pages viewed, buttons clicked, and steps such as sign-up, joining a tournament or starting a cash-out), your browser and device type, and your IP address (used only to estimate your approximate location). Events are linked to your account ID, account type, country and verification level — never your name, email or username. With the same consent we also collect heatmap data — where on a page you click, how far you scroll, and where your pointer moves (page coordinates only) — which we view only in aggregate, combined across many visitors, to see which parts of a page are used. We do not record your screen or what you type into forms, and admin pages are not tracked.
• Push notification data, only if you allow push notifications: your browser gives us a push subscription (a web address operated by your browser's push service, plus encryption keys) and we store it with your browser type so we can send you alerts about tournaments you have joined or hosted, matches, and prizes. We do not receive your location or contact list, and push messages never contain your lobby code or host instructions. You can remove a subscription at any time.
• Communications you send to support (email content, attachments, and the messages exchanged on any complaint you raise)

3.6 Spectator data

You can browse public pages on Boadman, such as competition listings and results, without creating an account. When you do, we process only the technical data needed to deliver and secure the service (see §3.5 and our Cookies Policy).

If you create an account without competing, we collect the account-creation data described in §3.1, but KYC (§3.3–§3.4) does not apply to you unless and until you choose to deposit or withdraw funds. We do not use spectator browsing activity for targeted advertising.

3.7 Optional data

• Profile avatar (if you upload one)
• Phone number (if you choose to add one to your profile)
• Waitlist sign-up (if you join our waitlist: your email address, gamer tag, company or studio if you give one, and what you are interested in)
• Marketing preferences (if you opt in to non-essential communications)

4. Why we collect it (lawful basis)

5. How long we keep it

We will anonymise inactive accounts after 3 years of no login activity. You will receive an email warning 30 days before this happens, giving you time to log in if you want to retain your data.

6. Who we share your data with

We share the minimum necessary data with the following providers, all under contractual data-processing agreements:

We do not sell your data to third parties. We do not use your data for behavioural advertising.

We may disclose your data to UK regulators (FCA, ICO, NCA, HMRC) where legally required, including filing Suspicious Activity Reports under the Proceeds of Crime Act 2002.

7. International transfers

Some of our providers are located outside the UK / EEA or may access data from outside it (notably Resend, Vercel, GitHub, and parts of Cloudflare's global network, which are United States companies). Where this occurs, the transfer is governed by the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, as appropriate to each provider, in accordance with UK GDPR Article 46. We apply additional technical and organisational safeguards where required.

PostHog processes analytics data in its EU region (Frankfurt), which the UK recognises as providing adequate protection for personal data.

Push notifications are delivered through the push service run by your browser's vendor (for example Google, Apple, Mozilla or Microsoft), which may process the encrypted message outside the UK. We encrypt the message content end to end, so the push service cannot read it; the transfer is governed by that provider's own safeguards.

If you are based in Nigeria, your data is also subject to the Nigerian Data Protection Act 2023 (NDPA). Transfers of Nigerian users' data follow the same safeguards described above, and we will update this section if the NDPA's own cross-border transfer framework requires a different basis.

8. Your rights

Under UK GDPR, you have the following rights:

We aim to respond to all requests within one calendar month of receipt. Where a request is complex or we have received a high volume of requests, we may extend this by a further two months, and we will tell you within the first month if this applies, along with the reason for the delay.

Important caveat on erasure: when you delete your account, we anonymise your personally identifying data (name, email, etc.) but we are legally required to retain financial records (deposits, redemptions, wallet ledger) for 5 years under the UK Money Laundering Regulations 2017 §40. After 5 years from your last financial activity, those records are also deleted. Deletion under this process is anonymisation of identifying fields, not removal of the underlying ledger entry, which must remain intact as a regulatory record until the retention period expires.

You can also lodge a complaint with the UK ICO at https://ico.org.uk/concerns/.

9. Security

We protect your data through:

• Encryption at rest (AES-256 on our database and file storage)
• Encryption in transit (TLS 1.2 or higher on all connections)
• Row-level security in our database, with column-scoped access controls preventing users from self-modifying compliance-controlled fields (KYC level, account status, verified payout details, etc.)
• Append-only audit log: database-level rules prevent audit records from being altered or deleted, with narrow exceptions that only remove specific personal data when the law requires it (for example, on erasure or at the end of a retention period); retained for the period set out in §5
• Service-role access restricted to backend systems only; never exposed to clients
• Recorded staff access: when our staff access your account for support or compliance purposes, that access is recorded in an admin access log. Staff cannot sign in as you or take actions as you
• MFA / 2FA required for all admin staff
• Regular backups (weekly encrypted database backups)

If a personal data breach occurs that is likely to result in risk to your rights and freedoms, we will notify the ICO within 72 hours per UK GDPR Article 33, and we will notify you directly without undue delay where required by Article 34.

9a. Automated decision-making

Some decisions affecting your account are made using automated or semi-automated processes, including:

• Identity verification verdicts (approved / declined / requires-review), produced by our identity verification provider based on document and liveness checks
• Sanctions and politically-exposed-person (PEP) screening results
• Fraud and collusion detection flags, based on device and session signal analysis

Where an automated decision results in your account being restricted, funds being held, or a verification being declined, you have the right to request a human review of that decision. You can do this by contacting [email protected] or [email protected].

10. Cookies and tracking

Our website uses:

• Strictly necessary cookies for authentication and session management (no consent required under PECR)
• Optional analytics cookies set by PostHog to understand how the service is used, including heatmaps of where people click and scroll (only if you turn on Analytics in the cookie banner)

We do not use behavioural advertising cookies. We do not allow third-party advertising trackers. See our Cookies Policy for details.

11. Children

Boadman is not intended for users under 18. We verify your date of birth at signup and at KYC. If we discover that we have collected data from a person under 18, we will erase that data without delay.

12. Changes to this policy

When we update this Privacy Policy, we will:

• Post the new version at the same URL with an updated "Last updated" date
• Notify you by email of material changes
• Require you to re-accept the new policy at next login if changes are substantial

Previous versions of this policy are available on request from [email protected].

13. Contact

14. Brand accounts and entry-gated tournaments

14.1 Brand account data (KYB)

• When a business applies for a brand account, we collect business-identity data: company name, registration number and country, registered office address, business email, and the identity of the brand managers (natural persons), who each complete individual identity verification as ordinary users.
• We use this data to perform Know Your Business (KYB) checks (including company-registry verification and sanctions screening of the entity, its managers, and its directors and beneficial owners) and to administer the brand relationship.
• Lawful basis: performance of a contract with the brand and compliance with our legal obligations (anti-money-laundering / counter-terrorist-financing customer due diligence on legal persons).
• Brand KYB and sanctions records are retained on the same regulatory record-retention basis as user verification records (see §5).

14.2 Entry-gating application and task-verification data

• A brand-hosted tournament may require an application or task completion/verification to enter. If you choose to enter such a tournament we collect the information you submit in the application and/or the evidence you submit to demonstrate task completion.
• Lawful basis: your consent, given at the point of entry, and performance of the tournament you are entering. You are told what is collected before you submit, and you may withdraw a pending application (which may make you ineligible to enter that tournament).
• This data is retained only as long as necessary to administer the tournament, resolve disputes, and meet applicable regulatory record-keeping, after which it is deleted or anonymised in line with §5. It is not used for unrelated profiling or advertising.

14.3 Sharing data with hosting brands

• In application or task entry modes, the limited participant data necessary for the brand to assess your application or verify your tasks (for example, your in-platform handle and the application/task evidence you submitted) is shared with the hosting brand, with your consent, at the point of entry.
• The hosting brand is an independent controller of the data it receives for its own purposes and is required to use it only to administer that tournament unless you separately consent to other use. The brand's own handling of that data is subject to the brand's own privacy obligations, and a data-sharing agreement is put in place between Boadman and each hosting brand before it runs an entry-gated tournament.
• We do not share your identity-verification (KYC) documents, payment instruments, or financial records with brands. Brands never see more than the entry-gating data described above.
• This sharing is in addition to, and does not change, the list of processors in §6 (brands are recipients, not our processors).