Privacy Policy

1. About this Privacy Policy

This Privacy Policy explains how LFA Master collects, uses, stores, protects and otherwise processes personal information when you use the LFA Master website and services.

LFA Master aims to process personal information fairly, transparently and in accordance with applicable data protection law, including the UK General Data Protection Regulation and the Data Protection Act 2018.

This policy should be read alongside the Terms of Use and Community Rules.

2. Who controls your information?

The data controller responsible for determining how and why personal information is processed for LFA Master is:

This section must contain the correct legal identity of the person or organisation responsible for LFA Master before this policy is published as the final legal policy.

3. Information we collect

Depending on how you use LFA Master, we may collect and process:

• your email address;
• your username or display name;
• your password in protected hashed form;
• your favourite or selected LFAs;
• your notification preferences;
• your leaderboard visibility preference, including whether you choose to appear on the LFA Master leaderboard;
• browser push subscription information when notifications are enabled;
• sightings, confirmations and other activity you submit;
• contribution activity associated with your account, including activity used to calculate contribution totals;
• achievement, badge and level information generated from your activity on LFA Master;
• information you provide through reports, account settings or other service features;
• information required to manage moderation and account restrictions; and
• technical and security information required to operate and protect the service.

Technical information may include information associated with requests, authentication sessions, security events, browser or device characteristics, timestamps and service diagnostics, where collected.

Contribution, achievement, badge and level information may be calculated automatically from activity you carry out on LFA Master. These values are used to provide the service's contribution and community features.

4. Passwords and Account Security

LFA Master does not store account passwords in plain text.

Passwords are protected using a one-way password hashing mechanism before they are stored.

LFA Master is not able to recover your original password from the stored password hash.

You are responsible for keeping your password confidential and should use a strong password that you do not reuse elsewhere.

5. Why we use personal information

We may use personal information to:

• create and manage your account;
• authenticate you and maintain account security;
• remember favourite LFAs and preferences;
• provide activity and notification features;
• associate sightings and confirmations with your account;
• calculate contribution totals based on activity carried out through your account;
• calculate and display levels, badges and achievements based on applicable LFA Master criteria;
• provide the LFA Master leaderboard where you have chosen to participate;
• display community contribution information where the relevant feature allows it;
• moderate reports, accounts and community activity;
• prevent abuse, fraud and unauthorised access;
• maintain and troubleshoot the service;
• communicate essential service information; and
• send optional communications where you have chosen to receive them and applicable law permits.

6. Lawful Bases for Processing

Depending on the processing involved, LFA Master may rely on one or more of the following lawful bases under the UK GDPR:

7. Sightings, Confirmations and Community Activity

When you submit a sighting or confirmation, the associated information may be stored and displayed as part of the LFA Master community activity system.

Activity may be associated with your account and display name so users can understand who submitted or confirmed a report.

This information helps LFA Master operate the activity system, distinguish independent reports and support moderation and accuracy.

Certain activity may also contribute towards your contribution total, level, badges or achievements where the relevant LFA Master criteria apply.

8. Contributions, Levels, Badges and Leaderboards

LFA Master may provide community features that recognise user participation through contribution totals, levels, badges and achievements.

Contribution totals may be calculated from qualifying activity carried out through your account, including activities such as reporting sightings and confirming sightings through the available community features.

Levels, badges and achievements may be assigned automatically when your activity meets the relevant LFA Master criteria. These features are intended to recognise participation in the community and do not make decisions about your legal rights, access to essential services or other similarly significant matters.

LFA Master may display contribution totals, levels, badges or other achievement information within your account or other community features.

Where LFA Master provides a leaderboard, you may be given a setting allowing you to choose whether your account appears on that leaderboard.

If you choose to appear on the leaderboard, information such as your display name, contribution total, level and applicable achievement or badge information may be visible to other LFA Master users as part of that feature.

If you choose not to appear on the leaderboard, your account will not be included in that leaderboard. Your underlying activity may still be retained and processed where necessary to operate LFA Master, maintain historical community records, calculate account features or meet legal, security or moderation requirements.

LFA Master may update the criteria used to calculate contributions, levels, badges and achievements as the service develops. Where such changes materially affect how personal information is processed, this Privacy Policy may be updated accordingly.

9. Favourite LFAs and Notifications

Favourite LFAs are stored to personalise activity and notification features.

Where you enable browser push notifications, LFA Master stores the browser push subscription information necessary to request notification delivery to the relevant browser or device.

Notification availability also depends on browser permissions, device settings, internet connectivity and supporting third-party infrastructure.

You can manage LFA Master notification preferences through the features provided by the service and can also disable browser notifications through your browser or device controls.

10. Optional Emails

LFA Master may offer optional email communications about service updates, announcements or features.

Optional communications are separate from essential messages necessary to operate your account or provide the service.

Where required by law, electronic marketing communications will only be sent where an appropriate lawful basis and applicable marketing requirements have been satisfied.

You can withdraw an optional email preference through available settings or an unsubscribe mechanism provided in an applicable email.

11. Information Sharing

LFA Master does not sell personal information.

Personal information may be processed by service providers where reasonably necessary to operate the service, including providers supporting hosting, databases, infrastructure, authentication, push notifications, email, security and other technical functions.

Information that forms part of community features may also be displayed to other LFA Master users where the relevant feature permits this, including community activity and leaderboard information where you have chosen to participate.

LFA Master may also disclose information where required to do so by law or where reasonably necessary to protect the service, users or legal rights.

Where third-party providers process personal information on behalf of LFA Master, appropriate contractual and organisational controls will be used where required by applicable law.

12. Third-Party Providers

Depending on the production configuration, LFA Master may use third-party providers for:

• application hosting and infrastructure;
• database storage;
• authentication or supporting infrastructure;
• browser push notification delivery;
• email delivery; and
• security, monitoring and technical services.

The actual providers used by the live service should be identified in the final production privacy information and reviewed whenever providers change.

13. International Transfers

Some providers used by LFA Master may process personal information outside the United Kingdom.

Where personal information is transferred outside the UK, LFA Master will use an appropriate lawful transfer mechanism where required, such as an applicable adequacy arrangement or appropriate contractual safeguards.

The countries or destinations relevant to the live production service should be reviewed and reflected in the final provider-specific privacy information.

14. Security

LFA Master uses reasonable technical and organisational measures appropriate to the information processed and the risks involved to protect personal information from unauthorised access, loss, misuse, alteration or disclosure.

Measures may include access controls, authentication controls, password hashing, encrypted connections, protected infrastructure and other appropriate safeguards.

No internet service can guarantee absolute security. You should also protect your account credentials and notify LFA Master if you believe your account has been compromised.

15. Retention

LFA Master keeps personal information only for as long as reasonably necessary for the purpose for which it was collected, including where needed to provide the service, maintain security, manage moderation, resolve disputes or comply with legal obligations.

16. Your Data Protection Rights

Subject to applicable law and relevant exemptions, you may have rights including:

• the right to be informed;
• the right to access your personal information;
• the right to request correction of inaccurate information;
• the right to request deletion in circumstances where the law provides that right;
• the right to request restriction of processing in applicable circumstances;
• the right to object to certain processing;
• the right to data portability where applicable; and
• the right to withdraw consent where processing relies on consent.

These rights are not absolute and may be subject to legal conditions and exemptions.

These rights may apply to information associated with your contributions, achievements, badges, levels and leaderboard participation, subject to applicable law and relevant exemptions.

17. Exercising Your Rights

Requests about your personal information can be made using the contact method available through the Contact page.

We may need to verify your identity before completing a request to prevent unauthorised disclosure of personal information.

Requests will normally be handled within the period required by applicable data protection law.

18. Cookies and Similar Technologies

LFA Master may use cookies and similar technologies that are necessary for authentication, security, session management, preferences or other core website functionality.

Authentication cookies may be used to keep you signed in and protect access to your account.

Where non-essential cookies or similar technologies are used, LFA Master will follow applicable consent and transparency requirements.

19. Children and Young Users

LFA Master does not intentionally ask users to provide unnecessary personal information about themselves or other people.

Where children are likely to access an online service, UK data protection requirements can include additional expectations around privacy, transparency, data minimisation and safeguards.

LFA Master will apply safeguards appropriate to the risks associated with its processing of personal information and will review its approach as the service develops.

If you believe personal information has been submitted in circumstances where it should not have been, please contact LFA Master.

20. Automated Decision-Making and Profiling

LFA Master does not currently use personal information to make solely automated decisions that produce legal or similarly significant effects on users.

Favourite LFAs and notification preferences may be used to determine which activity is relevant to your account. This is personalisation for the service and is not intended to make significant decisions about you.

Contribution totals, levels, badges and achievements may be calculated automatically from activity associated with your account. These calculations are used to provide community and recognition features and are not intended to produce legal or similarly significant effects.

Moderation and security systems may use technical information or automated checks to identify potential issues, but a technical flag does not necessarily mean that a final moderation decision is made solely by automated processing.

21. Data Breaches

LFA Master maintains measures intended to prevent, detect and respond to personal data security incidents.

Where a personal data breach occurs, LFA Master will assess the incident and take the action required by applicable law, including notifying the Information Commissioner's Office or affected individuals where required.

22. Changes to this Privacy Policy

This Privacy Policy may be updated when the service, processing activities, providers or legal requirements change.

The latest version will be published on this page with its latest update date.

Where a significant change requires additional notice, LFA Master may provide that notice before or when the change takes effect, as appropriate.

23. Complaints

We encourage you to contact LFA Master first so that we have an opportunity to investigate and address a concern about your personal information.

You also have the right to complain to the UK's Information Commissioner's Office where you believe your personal information has been handled unlawfully or your data protection rights have not been respected.

24. Contact

Questions about this Privacy Policy, personal information or data protection rights can be raised through the LFA Master Contact page.