Privacy Policy

1. Company Information

This privacy policy applies to Off The Record Burnley Limited ("we", "us", "our").

2. Introduction

We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our Streaks loyalty programme and related services.

By using our services, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our services.

3. Information We Collect

We collect the following types of personal information:

3.1 Information You Provide

• Name: Your full name for account identification
• Email Address: For account creation, authentication, and communication
• Phone Number: For account verification and notifications (if provided)
• Date of Birth: To verify you are 18 years or older (required for participation)
• Account Credentials: Email and password for account access
• Nickname: Optional display name for leaderboards and photos

3.2 Information Automatically Collected

• Streak Data: Your daily check-in history, current streak count, and streak milestones
• Check-in Information: Timestamps, photos uploaded, and location verification
• Reward Data: Rewards claimed, redemption codes, and validation status
• Usage Data: Information about how you interact with our app
• Device Information: Device type, browser type, and operating system
• IP Address: For security and analytics purposes

3.3 Photo and Media Information

• Photos you upload for check-ins and Tuesday Rewind gallery
• Photo metadata (timestamp, file information)
• Photo moderation status and flags

4. How We Use Your Information

We use your personal information for the following purposes:

• Service Provision: To provide and maintain our Streaks loyalty programme, process your check-ins, and manage your account
• Streak Tracking: To track your daily check-ins, calculate streak counts, and display your progress
• Reward Management: To track and validate rewards you have earned, generate redemption codes, and facilitate reward redemption
• Leaderboards: To display your position and progress (using nickname or name, never email addresses)
• Photo Gallery: To display your photos in the Tuesday Rewind gallery (with your consent)
• Age Verification: To ensure compliance with age restrictions (18+)
• Communication: To send you important updates about your account, rewards, and programme-related information
• Marketing (with consent): If you have opted in, to send you promotional emails and SMS messages about special offers, events, and promotions
• Legal Compliance: To comply with legal obligations and protect our legal rights
• Security: To detect, prevent, and address fraud, security issues, and technical problems
• Analytics: To understand how users interact with our services and improve user experience

5. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Consent: You have given explicit consent for processing your personal data (e.g., privacy policy consent, marketing communications, photo sharing)
• Contract Performance: Processing is necessary to perform the contract with you (providing the Streaks programme service)
• Legal Obligation: Processing is necessary to comply with legal obligations (e.g., age verification, record keeping)
• Legitimate Interests: Processing is necessary for our legitimate interests (e.g., security, fraud prevention, service improvement)

6. Data Storage and Security

We use Firebase (Google Cloud Platform) to store and process your data. Your information is stored securely using industry-standard encryption and security measures.

• Data is stored in secure databases with access controls
• All data transmissions are encrypted using SSL/TLS
• We implement appropriate technical and organisational measures to protect your data
• Access to personal data is restricted to authorised personnel only
• Photos are stored securely and are only accessible to authorised staff for moderation purposes

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.

7. Data Retention

We retain your personal data for as long as necessary to:

• Provide our services to you
• Comply with legal obligations
• Resolve disputes and enforce agreements
• Maintain records of rewards claimed and validations
• Preserve your streak history and achievements

When you request account deletion, we will delete or anonymise your personal data, except where we are required to retain it for legal or legitimate business purposes.

8. Your Rights Under GDPR

As a data subject, you have the following rights:

• Right of Access: You can request a copy of the personal data we hold about you
• Right to Rectification: You can request correction of inaccurate or incomplete data
• Right to Erasure: You can request deletion of your personal data ("right to be forgotten")
• Right to Restrict Processing: You can request that we limit how we use your data
• Right to Data Portability: You can request your data in a structured, machine-readable format
• Right to Object: You can object to processing of your data for certain purposes
• Right to Withdraw Consent: You can withdraw consent at any time (this does not affect processing that occurred before withdrawal)

To exercise any of these rights, please contact us using the details provided in Section 12.

9. Cookies and Tracking Technologies

We use session cookies and local storage to maintain your streak progress, preferences, and authentication state. These are essential for the functioning of our service.

We do not use third-party tracking cookies or advertising cookies without your explicit consent.

10. Third-Party Services

We use the following third-party services:

• Firebase (Google): For authentication, database storage, file storage, and hosting
• Google Cloud Platform: For infrastructure and data storage

These services have their own privacy policies. We encourage you to review them. We are not responsible for the privacy practices of third-party services.

11. Children's Privacy

Our services are intended for users who are 18 years of age or older. We do not knowingly collect personal information from individuals under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately. If we become aware that we have collected personal information from someone under 18, we will take steps to delete that information.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.