This privacy and cookie notice (the “Privacy and Cookie Notice“) applies only to personal data that Team 17 Digital Limited (“Team17,” “we,” “us” and “our”) collects and processes through this website (www.team17.com) and its subdomains, unless a separate privacy notice applies. Team17 respects the privacy rights of users of this website, is committed to protecting the information collected through this website and is the controller responsible for personal data processed under this Privacy and Cookie Notice.
Team17 is a subsidiary of everplay group plc, and part of the everplay group of companies. Each group company is a separate legal entity and an independent controller for personal data it collects through its own websites, products, services, recruitment activities, or direct interactions with you. When you visit a group company’s website or otherwise deal with that company, please read its privacy and cookie notice.
Unless defined here or the context requires otherwise, terms used in this Privacy and Cookie Notice have the meanings given to them in the EU General Data Protection Regulation (GDPR) (EU) 2016/679, the UK GDPR and the Data Protection Act 2018.
Please read this Privacy and Cookie Notice carefully in full. We may change it from time to time to reflect changes in data protection laws, the way we operate, or our internal policies. If we make material changes, we will provide you with additional notice. We encourage you to review this Privacy and Cookie Notice regularly to stay informed about our data protection practices.
We may also provide separate or additional notices for certain products, services, or activities (for example, recruitment, beta tests, or competitions). Where we do, those notices supplement or replace the disclosures in this Privacy and Cookie Notice in respect of that activity. It is important that the personal data we hold about you is accurate and up to date. Please keep us informed if your personal data changes during your relationship with us.
This Privacy and Cookie Notice applies to you when you access, browse and use our website, subscribe to our newsletter, pitch a game to us through our developer portal or interact with us by contact forms, email and by other means. Our website, newsletter and store are aimed at adults. You must be over the age of 13 years or else have your parent’s or guardian’s consent to do so. Where age-specific rules apply, we explain them in the “Children’s data” section below.
For the avoidance of doubt, this Privacy and Cookie Notice does not apply to websites or services operated by third parties (whether or not those websites or services promote Team17’s products or sell related items), each of which has its own privacy notice.
“Personal data” means information about an individual from which that person can be identified. It does not include information where an individual’s identity has been removed (anonymous data). Throughout this Privacy and Cookie Notice we use the term “processing” to refer to all activities involving your personal data, including collecting, handling, storing, sharing, accessing, using, transferring, erasing and disposing of it.
We may receive your personal data through various means, including:
Direct interactions: As a user of our website, you may give us your Identity and Contact Data when you fill in forms on our websites, buy a product, subscribe to our newsletter, sign up for playtesting, apply for a role, pitch a game, contact our support team, post on our community channels, or correspond with us by post, phone, email or social media. This includes personal data you provide when you give us feedback or contact us.
Automated technologies or interactions: As you interact with our website we collect Technical Data and Usage Data. We collect this by using cookies and other similar technologies. We may also receive Technical Data if you visit other websites using our cookies.
Third parties and platforms: we receive limited information from gaming platforms (e.g. Steam, PlayStation Network, Xbox Live, Nintendo Switch Online), social networks (where you choose to link an account), payment processors, advertising and analytics partners, and recruitment partners.
The personal data we receive about you depends on how you interact with us. Typically, we process the following categories of personal data:
Identity and Contact Data includes name, email address, phone number (if you choose to give it), date of birth or age, and any personal data provided when contacting us.
CVs and job applications if you apply for a role through our website your application is processed by our recruitment service provider on our behalf. We will only use the information you submit to consider your job application and to administer the recruitment process. Recruitment is governed by a separate privacy notice, which we provide to you at the point of application and which prevails over this Privacy and Cookie Notice in respect of recruitment-related processing.
Transaction Data - may include your user ID, country ID, details of products you have bought from us or downloadable content and virtual items you have acquired, together with the order reference and payment confirmation. We do not store full payment card details - these are processed by our payment service providers.
Account Data - includes your user ID and login credentials, the platform(s) you play on, your account settings and preferences, and the record of your interactions with your account (such as your order and download history).
Technical Data - may include internet protocol (IP) address, browser type and version, time zone setting and location, country and language, browser plug‑in types and versions, operating system and platform and other technology on the devices you use to access our website.
Usage Data - information about how you use our website such as the services you view or search, page response times, download errors, length of visits and page interaction information (such as scrolling, clicks and mouse‑overs), traffic data, web logs and other communication data and the resources that you access.
Marketing and Communications Data - includes your preferences in receiving newsletters and marketing communications from us, your communication preferences, and your responses to surveys, polls and competitions.
Email correspondence and support - when you email us or contact us through our contact or support forms, and our support chat (non-live) we collect the personal data you include in your message - such as your name, email address, the platform you play on, and any details you share about your enquiry. We use this information to respond to you and to provide support.
Developer Submission Data - includes your name, email address, country and city, game details and description.
We also collect, use and share aggregated data such as statistical or demographic data for various purposes. Aggregated data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your usage data to calculate the percentage of users accessing our website. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Privacy and Cookie Notice.
We do not collect any special categories of personal data about you (this is personal data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership; genetic data; biometric data for the purpose of uniquely identifying an individual or data concerning health or sexual orientation).
This website uses cookies. We use cookies to personalise content, to provide social media features and to analyse our traffic. In this Privacy and Cookie Notice we use the term “cookies” to refer to cookies and other similar technologies (such as pixels, beacons and Local Storage Objects (LSOs) like HTML5) covered by the Privacy and Electronic Communications (EC Directive) Regulations 2003.
What are cookies?
A cookie is a small text file which is placed onto your device (e.g. computer, smartphone or another electronic device) when you use our website. Cookies are widely used to make websites work, or work more efficiently, as well as to provide information to the owners of the site.
First party cookies are cookies set by the website you’re visiting. Only that website can read them. In addition, a website might potentially use external services, which also set their own cookies, known as third-party cookies.
Persistent cookies are cookies saved on your computer and that are not deleted automatically when you quit your browser, unlike a session cookie, which is deleted when you quit your browser. They will remain on your device for a pre-defined period of time or until they are deleted.
How do we use cookies?
We use cookies on our website as they help to distinguish you from other users. This helps us to provide you with a good experience when you browse our website and also allows us to improve our website. Some of the information will be aggregated or statistical, which means that we will not be able to identify you individually.
What type of cookies we use?
Necessary Cookies. These cookies are strictly necessary for our website to function and cannot be switched off. You can set your browser to block or alert you about these cookies, but some parts of our website will not work as a result.
|
Name |
Provider |
Purpose |
Duration |
Type |
|
__cf_bm [x14] |
Cloudflare |
Supports Cloudflare Bot Management to distinguish humans from bots. |
1 day |
HTTP |
|
__cfuvid |
Cloudflare |
Tracks users across sessions on HubSpot-served resources to maintain session consistency. |
Session |
HTTP |
|
_GRECAPTCHA |
google.com |
This cookie is used to distinguish between humans and bots. |
180 days |
HTTP |
|
CookieConsent [x2] |
Cookiebot |
Stores the user's cookie consent state for the current domain. |
1 year |
HTTP |
|
Cookietest |
Cookiebot |
This cookie is used to determine if the visitor has accepted the cookie consent box. |
Session |
HTTP |
|
GPS |
YouTube |
Used to determine whether the user is logged in on a YouTube account, when watching embedded videos. |
1 day |
HTTP |
|
rc::a |
|
This cookie is used to distinguish between humans and bots. This is beneficial for the website, in order to make valid reports on the use of their website. |
Persistent |
HTML |
|
rc::b |
|
This cookie is used to distinguish between humans and bots. |
Session |
HTML |
|
rc::c |
|
This cookie is used to distinguish between humans and bots. |
Session |
HTML |
|
rc::f |
|
This cookie is used to distinguish between humans and bots. |
Persistent |
HTML |
|
SESS# |
Steam |
Preserves user states across page requests. |
Session |
HTTP |
Analytical cookies. These analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics including the number of visitors, bounce rate and traffic source. If you do not allow these cookies we will not be able to count your visit to our website.
|
Name |
Provider |
Purpose |
Duration |
Type |
|
__hssc |
HubSpot |
Identifies if the cookie data needs to be updated in the visitor's browser. |
Session |
HTTP |
|
__hssrc |
HubSpot |
Used to recognise the visitor's browser upon re-entry on the website. |
Session |
HTTP |
|
__hstc |
HubSpot |
Sets a unique ID for the session. This allows the website to obtain data on visitor behaviour for statistical purposes. |
Session |
HTTP |
|
hs-cta-interactions#cta |
HubSpot |
Collects statistics on the visitor's visits to the website, such as the number of visits, average time spent on the website and what pages have been read. |
Persistent |
IndexedDB |
|
hubspotutk |
HubSpot |
Sets a unique ID for the session. This allows the website to obtain data on visitor behaviour for statistical purposes. |
Session |
HTTP |
Advertising and marketing cookies. These cookies are set on our websites by our advertising partners to build a profile of your interests and to show you relevant adverts on other sites. They may be used to measure the effectiveness of an advertising campaign and to limit the number of times you see the same advertisement. They are placed only with your consent.
|
Name |
Provider |
Purpose |
Duration |
Type |
|
__ptq.gif |
HubSpot |
Sends data to the marketing platform Hubspot about the visitor's device and behaviour. Tracks the visitor across devices and marketing channels. |
Session |
Pixel |
|
__Secure-ROLLOUT_TOKEN [x2] |
YouTube |
Used to track user’s interaction with embedded content. |
180 days |
HTTP |
|
__Secure-YEC [x2] |
YouTube |
Stores the user's video player preferences using embedded YouTube video |
Session |
HTTP |
|
__Secure-YNID |
YouTube |
Used to track user’s interaction with embedded content. |
180 days |
HTTP |
|
LAST_RESULT_ENTRY_KEY |
YouTube |
Used to track user's interaction with embedded content. |
Session |
HTTP |
|
LogsDatabaseV2:V#LogsRequestsStore
|
YouTube |
Used to track user's interaction with embedded content. |
Persistent |
IndexedDB |
|
ServiceWorkerLogsDatabase#SWHealthLog |
YouTube |
Necessary for the implementation and functionality of YouTube video-content on the website. |
Persistent |
IndexedDB |
|
TESTCOOKIESENABLED |
YouTube |
Used to track user's interaction with embedded content. |
1 day |
HTTP |
|
VISITOR_INFO1_LIVE [x2] |
YouTube |
Tries to estimate the users' bandwidth on pages with integrated YouTube videos. |
180 days |
HTTP |
|
YSC [x2] |
YouTube |
Registers a unique ID to keep statistics of what videos from YouTube the user has seen. |
Session |
HTTP |
|
Yt-icons-last-purged |
YouTube |
Necessary for the implementation and functionality of YouTube video content on the website. |
Persistent |
HTML |
|
ytidb::LAST_RESULT_ENTRY_KEY |
YouTube |
Used to track user's interaction with embedded content. |
Persistent |
IndexedDB |
|
YtldbMeta#databases |
YouTube |
Used to track user's interaction with embedded content. |
Persistent |
IndexedDB |
|
gtm_id |
Intercom |
Used to send data to Google Analytics about the visitor’s device and behaviour. Tracks the visitor across devices and marketing channels. |
1 year |
HTTP |
Performance Cookies. These cookies allow us to understand and analyse the key performance indexes of the website which helps in delivering a better user experience for our visitors.
|
Name |
Provider |
Purpose |
Duration |
Type |
|
intercom.intercom-state-# [x2] |
Intercom |
Remembers whether the user has minimized or closed chat-box or pop-up messages on the website. |
Persistent |
HTML |
|
intercom-device-id-# |
Intercom |
Sets a specific ID for the user which ensures the integrity of the website's chat function. |
270 days |
HTTP |
|
intercom-id-# |
Intercom |
Allows the website to recognise the visitor, in order to optimize the chat-box functionality. |
270 days |
HTTP |
|
intercom-session-# |
Intercom |
Sets a specific ID for the user which ensures the integrity of the website's chat function. |
7 days |
HTTP |
|
intercom.intercom-state-zpxshdl4-hc4528 [x2] |
Intercom |
Stores the state of the Intercom chat interface to preserve user experience across pages. |
Persistent |
HTML |
|
intercom.intercom-state-zpxshdl4-hc4534 [x2] |
Intercom |
Stores the state of the Intercom chat interface to preserve user experience across pages. |
Persistent |
HTML |
|
intercom.intercom-state-zpxshdl4-hc4559 [x2] |
Intercom |
Stores the state of the Intercom chat interface to preserve user experience across pages. |
Persistent |
HTML |
|
intercom.intercom-state-zpxshdl4-hc4560 [x2] |
Intercom |
Stores the state of the Intercom chat interface to preserve user experience across pages. |
Persistent |
HTML |
|
intercom.intercom-state-zpxshdl4-hc4561 [x2] |
Intercom |
Stores the state of the Intercom chat interface to preserve user experience across pages. |
Persistent |
HTML |
|
recent_write |
Intercom |
Internal cookie used by the Intercom chat system to ensure messages sync properly and prevent technical playback bugs while a user is typing or sending text. |
Session |
HTTP |
Control your cookie settings
The first time you visit this website, you will be displayed with a banner providing you with information about cookies and linking to this Privacy and Cookie Notice, informing you about consent to the placing of cookies on your device.
Unless you have adjusted your browser settings so that it will refuse cookies, our systems will issue cookies each time you access the website. In the cookie preference banner, you can manage your preferences to allow or refuse the storing of cookies per category. Do note that if you disable certain categories of cookies, you may be unable to access certain parts of the website or use certain functionality.
You can delete all cookies that are already on your device by clearing the browsing history of your browser. This will remove all cookies from all websites you have visited. Be aware though that you may also lose some saved information (e.g. saved login details, site preferences).
For more information on the legislation regarding cookies, please see the Information Commissioner’s Office (ICO) website - https://ico.org.uk/for-the-public/online/cookies.
If you would like to find out more about cookies and other similar technologies in general, please visit http://www.allaboutcookies.org.
The table below identifies, for each activity that we carry out with your personal data, the categories of data involved and the lawful basis on which we rely under the UK GDPR. A "lawful basis" is the legal ground that permits us to use your personal data.
|
Purpose / activity |
Type of data |
Legal basis for processing |
|
Running and delivering the website to you |
Technical Data; Usage Data |
Our legitimate interests (Art. 6(1)(f)) in operating and maintaining the website. |
|
Replying to enquiries you send us by contact form, support chat, email or post |
Identity and Contact Data; the content of your message |
Our legitimate interests (Art. 6(1)(f)) in answering enquiries about our business. Where your enquiry relates to a contract, we also rely on Art. 6(1)(b) (steps taken at your request before entering a contract). |
|
Recruitment process |
Identity and Contact Data; any CV or application information you choose to submit |
The recruitment process is run by our recruitment service provider on our behalf. Recruitment is governed by a separate privacy notice, which we provide to you at the point of application and which prevails over this Privacy and Cookie Notice in relation to recruitment. |
|
Selling games, downloadable content and virtual items through our online store and processing your orders |
Identity and Contact Data; Transaction Data; Account Data |
Performance of a contract with you (Art. 6(1)(b)); compliance with legal obligations (Art. 6(1)(c)). |
|
Sending you our newsletter, updates about our games, offers and competitions where you have signed up |
Identity and Contact Data; Marketing and Communications Data |
Your consent (Art. 6(1)(a)). You can withdraw your consent at any time using the unsubscribe link or by contacting us. |
|
Running our playtesting programme and inviting you to relevant playtests |
Identity and Contact Data; the platforms you play on and game preferences you tell us about |
Your consent (Art. 6(1)(a)) when you sign up; performance of the playtest agreement (Art. 6(1)(b)) once you accept an invitation. |
|
Processing pitches submitted through our developer portal |
Identity and Contact Data; Developer Submission Data |
Steps taken at your request before entering a contract (Art. 6(1)(b)); our legitimate interests (Art. 6(1)(f)) in evaluating developer pitches. |
|
Understanding how visitors use the website so we can improve it |
Technical Data; Usage Data; pseudonymous identifiers set by analytics cookies |
Your consent (Art. 6(1)(a) UK GDPR and Reg. 6 PECR), captured through our cookie banner. You can withdraw your consent at any time. |
|
Keeping the website and our systems secure |
Technical Data; security cookies set by Cloudflare and Amazon Web Services |
Our legitimate interests (Art. 6(1)(f)) in the security and integrity of the website. |
Marketing communications
We will only send you marketing communications by email where you have signed up to receive them. You can unsubscribe at any time using the link at the bottom of any of our marketing emails, by changing your account preferences (where applicable), or by contacting us at dataprotection@team17.com. Unsubscribing from marketing emails will not stop us from sending you transactional or service messages (for example, an order confirmation or a security notification).
We may need to disclose your personal data to the parties set out below, in connection with the activities described in the table above. We share personal data only where it is necessary to do so, and only with parties who are required to keep it confidential and to use it solely for the purposes for which we share it.
Service providers: Third parties that provide products or services to us - including professional advisers, IT and infrastructure suppliers, hosting and content delivery providers, recruitment partners, and other service providers acting under contract with us.
Group companies: Other companies in the everplay group, where this is necessary for internal administrative purposes. Each group company remains a separate controller for its own processing under its own privacy notice.
Advertising and analytics partners. Where you have given consent, we share information collected through advertising and analytics cookies with our advertising and analytics partners so that we can measure and improve our advertising. We do not sell your personal data, and we do not share it for the purposes of cross‑context behavioural advertising except as described in the regional supplements below.
Public authorities and law‑enforcement bodies: Regulators and other authorities with jurisdiction over us - including the Information Commissioner's Office, the Financial Conduct Authority, HM Revenue & Customs, and, where applicable, courts and law-enforcement agencies. We will disclose personal data to these bodies where we are required to do so by law, where we are ordered to do so by a court of competent jurisdiction, or to comply with any other agreement we have with you, or to protect the rights, property or safety of our staff, our users or others.
Counterparties to corporate activity: If we acquire or merge with another business, restructure, sell all or part of our business, or carry out a similar corporate transaction, we may need to disclose your personal data to the counterparty and to its professional and other advisers in the course of the transaction. Any such disclosure will be made on a confidential basis and only to the extent necessary for the purposes of the transaction.
There are circumstances in which we, or our service providers, may need to process your personal data outside the United Kingdom. Where we transfer personal data outside the United Kingdom, we ensure that appropriate safeguards are in place to give your data a level of protection essentially equivalent to that provided under the UK GDPR. In practice, we rely on one of the following mechanisms:
a UK adequacy regulation, where the UK Government has formally recognised that the destination country provides an adequate level of protection for personal data;
the UK Extension to the EU–US Data Privacy Framework, where the recipient is certified under it; or
the International Data Transfer Agreement issued by the Information Commissioner's Office, or the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum, supplemented by additional technical and organisational measures where a transfer-impact assessment indicates these are necessary.
For further information, including details of the specific legal mechanism we use for a particular transfer, or to request a copy of the relevant safeguard, please contact us at: dataprotection@team17.com
We take the security of your personal data seriously. We have technical and organisational measures in place that are designed to prevent your personal data from being lost, misused, altered, or accessed by anyone who has no proper reason to do so. These measures include encryption of data in transit, access controls, firewall-protected systems, secure hosting environments, and supplier due-diligence on the third parties we work with. We follow generally accepted industry standards and review our safeguards regularly to make sure they remain appropriate to the data we hold.
Access to your personal data within Team17 is limited to people who have a genuine business need to process it. Anyone who handles your personal data on our behalf - whether one of our employees or a service provider - does so under our instructions and is subject to obligations of confidentiality and to security obligations equivalent to those imposed on us by Article 32 of the UK GDPR.
If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office without undue delay, and we will inform affected individuals as soon as reasonably practicable.
We keep your personal data only for as long as we need it for the purposes described in this Privacy and Cookie Notice. There is no single retention period that applies to all the personal data we hold - how long we keep your data depends on what it is, why we collected it, and whether the law requires us to retain it for a particular period.
In setting our retention periods, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process the data and whether we can achieve those purposes through other means, the need to be able to deal with any complaint, dispute or legal claim that may arise, and any applicable legal or regulatory requirements.
In broad terms, that means:
Server log files are retained for a short period sufficient to ensure the security and proper operation of the website and may be kept for longer where a specific event (for example, a security incident) requires further investigation.
Account data is retained for as long as your account is active. If your account is inactive, we keep it for the period during which we reasonably expect you to re‑engage with our services; after that period we will delete or anonymise the account data, including your email address and login credentials. We will normally try to notify you before we delete an inactive account so you can keep it active.
Transaction and order data is retained for the period required by applicable accounting and tax law (typically six to seven years from the end of the relevant financial year).
Newsletter and marketing data is retained for as long as you remain subscribed and for a short period after you unsubscribe so that we can evidence your decision to unsubscribe and avoid sending you further marketing communications.
Playtesting data is retained for as long as you remain in the playtesting programme and for a reasonable period after you leave.
Developer pitches are retained for the period needed to evaluate and (if relevant) pursue the pitch, and for a reasonable period afterwards to maintain a record of the submission.
Contact form, email or postal enquiries are retained for as long as is reasonably necessary to deal with your enquiry. Where the enquiry concerns or develops into a contractual or commercial relationship, we may retain the correspondence for the period required by applicable accounting and tax law.
Job applications received through our website are passed to the recruitment service provider that runs the recruitment process on our behalf in accordance with a separate privacy notice, which we provide to you at the point of application.
Cookies and similar technologies are retained for the durations set out in the ‘Cookies and similar tracking technologies’ section of this Privacy and Cookie Notice.
Records of consent and cookie preferences are retained for as long as is necessary to evidence your consent.
Records that we are required to keep to meet legal, regulatory or accounting obligations, or to deal with complaints, disputes or legal claims are retained for the period required by the relevant law or, where there is no fixed period, for as long as is reasonably necessary in light of any limitation period that may apply.
Under the UK GDPR and the Data Protection Act 2018, you have a number of rights in relation to the personal data we hold about you. In summary, you have:
The right of access - ask us for a copy of your data. You can ask us to confirm whether we are processing personal data about you and, if we are, to give you a copy of that data along with information about how we use it.
The right to rectification - ask us to correct your data. If any of the personal data we hold about you is wrong or incomplete, you can ask us to correct it.
The right to erasure - ask us to delete your data. Sometimes called the “right to be forgotten”. You can ask us to delete or remove your personal data where there is no good reason for us to keep using it; where you have successfully objected to our processing; where the processing was unlawful; or where we are required to delete the data to comply with the law. We are not always able to act on a request for deletion - for example, where we need to keep the data to comply with a legal obligation, to defend a legal claim, or to protect the rights of others. If we cannot comply with your request, we will tell you why.
The right to restrict processing - ask us to limit how we use your data. You can ask us to suspend our use of your personal data in certain circumstances, including: where you want us to check whether the data is accurate; where you consider our use of the data to be unlawful but do not want us to delete it; where you need us to keep the data to establish, exercise or defend a legal claim; or where you have objected to our use of the data and we are checking whether we have valid grounds to continue.
The right to data portability - ask us to transfer your data. Where we use your personal data on the basis of your consent or in the performance of a contract with you, and where the processing is automated, you can ask us to provide that data to you (or to a third party you nominate) in a structured, commonly used and machine‑readable format.
The right to object - object to how we use your data. You can object to our use of your personal data where we rely on our legitimate interests as the reason for using it, on grounds relating to your situation. You also have an absolute right to object at any time to your data being used for direct marketing. If you object on legitimate‑interest grounds, we will stop using your data unless we can demonstrate compelling reasons that override your interests, rights and freedoms, or that we need to continue using it to establish, exercise or defend a legal claim.
The right to withdraw consent. Where we rely on your consent for a particular use of your personal data, you can withdraw that consent at any time. Doing so will not affect the lawfulness of anything we did with your data before you withdrew consent, and it will not affect any other reason we may have for using it.
The right not to be subject to automated decision‑making. You have the right not to be subject to decisions that have a legal or similarly significant effect on you and that are made solely by automated means. We do not use your personal data to make decisions about you solely by automated means, including profiling, where those decisions would have a legal or similarly significant effect on you.
Exercising your rights
To exercise any of your rights, please contact us at dataprotection@team17.com, or write to us at Team17 Digital Limited, 3 Red Hall Avenue, Paragon Business Park, Wakefield, West Yorkshire, WF1 2UL, United Kingdom. Please indicate your country of residence so we can apply the right legal framework to your request.
We may need to ask you for some additional information to confirm your identity before we act on your request - this is to protect you against unauthorised disclosure of your personal data. We will respond to you within one calendar month. If your request is particularly complex, or if you have made several requests, we may extend this period by a further two months, in which case we will inform you within the first month.
If you are not satisfied with how we have handled your personal data or your request, you have the right to complain to a data protection supervisory authority. In the UK that is the Information Commissioner’s Office at ico.org.uk. We would, however, appreciate the chance to address your concerns first, so please contact us before approaching a supervisory authority.
United States residents
If you are a resident of a US state that has enacted a comprehensive consumer privacy law - including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Rhode Island, Indiana, Kentucky, and Florida (which applies in more limited circumstances) - you have additional rights in relation to the personal information we hold about you. Depending on your state of residence, these rights may include:
the right to know what categories and specific pieces of personal information we have collected about you, the categories of sources, the purposes for collection, and the categories of third parties with whom we share your personal information;
the right to access a copy of your personal information, including, where technically feasible, in a portable and readily usable format that allows you to transmit it to another controller;
the right to correct inaccurate personal information;
the right to delete personal information we have collected from you, subject to certain exceptions permitted by applicable law;
the right to opt out of the "sale" or "sharing" of your personal information, and of "targeted advertising," as those concepts are defined under applicable state law;
the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning you, where applicable;
the right to limit the use and disclosure of sensitive personal information, where applicable;
the right to exercise opt-out rights through a recognised universal opt-out mechanism (such as the Global Privacy Control), where required by applicable state law;
the right to appeal a decision we make in response to a privacy rights request, where applicable; and
the right not to be discriminated or retaliated against for exercising your privacy rights.
Team17 does not sell your personal information. Some of the targeted advertising we run on our websites with your consent may, however, qualify as “sharing” or “targeted advertising” under US state privacy laws. To opt out, please use the cookie preference link in the footer of our websites or follow the instructions in the “Control your cookie settings” set out above. You may also send an opt‑out request to dataprotection@team17.com.
We will verify your request by asking for information that matches what we already hold about you. You can designate an authorised agent to make a request on your behalf, in which case we will need written authorisation from you and may need to verify your identity directly. We will not discriminate against you for exercising any of your rights.
Brazilian residents
If you are in Brazil, the Lei Geral de Proteção de Dados (LGPD) gives you rights in relation to your personal data that are similar to those described under "Your rights as a data subject" above. Depending on the circumstances, these rights may include:
the right to confirmation that we are processing your personal data, and to access that data;
the right to correct incomplete, inaccurate or out-of-date data;
the right to anonymisation, blocking or deletion of unnecessary or excessive data, or data processed in non-compliance with the LGPD;
the right to data portability to another service or product provider;
the right to deletion of personal data processed on the basis of your consent;
the right to information about the public and private entities with which we have shared your data;
the right to information about the possibility of refusing consent and the consequences of doing so;
the right to withdraw consent, where consent is the basis for our processing;
the right to object to processing carried out on a legal basis other than consent, where there is non-compliance with the LGPD; and
the right to request review of decisions made solely on the basis of automated processing that affect your interests.
You also have the right to lodge a complaint with the Brazilian National Data Protection Authority (ANPD).
Canadian residents
If you are in Canada, you have rights under the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws, including Quebec's Act respecting the protection of personal information in the private sector (commonly known as "Law 25"), British Columbia's Personal Information Protection Act, and Alberta's Personal Information Protection Act. Depending on where you reside, these rights may include:
the right to access and correct your personal information;
the right to withdraw consent, where consent is the basis for our processing;
the right to data portability in a structured, commonly used technological format (in particular under Quebec's Law 25);
the right to be informed when a decision concerning you is based exclusively on automated processing, and to request that it be reviewed; and
in certain circumstances, the right to request that we cease to disseminate your personal information or de-index a hyperlink that points to it.
You also have the right to lodge a complaint with the Office of the Privacy Commissioner of Canada or your provincial privacy regulator, such as the Commission d'accès à l'information du Québec, the Office of the Information and Privacy Commissioner for British Columbia, or the Office of the Information and Privacy Commissioner of Alberta.
Residents of mainland China
If you are in mainland China, the Personal Information Protection Law (PIPL) gives you rights in relation to your personal information. Depending on the circumstances, these rights may include:
the right to be informed about, and to decide on, the processing of your personal information, and to limit or refuse processing by others, except where the law provides otherwise;
the right to access and obtain a copy of your personal information;
the right to correct or supplement inaccurate or incomplete personal information;
the right to delete your personal information in the circumstances specified by the PIPL;
the right to data portability to another personal information handler designated by you, where the conditions set by the relevant Chinese authorities are met;
the right to withdraw consent, where consent is the basis for our processing;
the right to request an explanation of our personal information handling rules; and
the right to request that we explain, and where appropriate review, decisions made on the basis of automated decision-making that have a significant effect on your rights or interests.
You also have the right to lodge a complaint with the Cyberspace Administration of China or other competent authority.
Indian residents
If you are in India, the Digital Personal Data Protection Act 2023 (DPDP Act) gives you rights in relation to your personal data. Depending on the circumstances, these rights may include:
the right to obtain a summary of the personal data being processed and the processing activities we undertake in respect of it;
the right to correction, completion, updating and erasure of your personal data;
the right to readily available means of grievance redressal in respect of any act or omission regarding the exercise of your rights;
the right to nominate another individual to exercise your rights in the event of your death or incapacity; and
the right to withdraw consent, where consent is the basis for our processing.
You also have the right to lodge a complaint with the Data Protection Board of India.
Other regions
If you live in a country whose privacy law gives you specific rights in relation to your personal data - such as Australia, Switzerland, Japan, South Korea or any other jurisdiction with a comprehensive privacy framework - we will honour those rights to the extent they apply to our processing. Please contact us at dataprotection@team17.com and we will respond to your request in accordance with applicable law.
Many of our games are family-friendly and are enjoyed by people of all ages. We take particular care with children's data, and the rules in this section apply on top of everything else in this Privacy and Cookie Notice. The age at which a child can consent to the processing of their personal data varies by country (for example, 13 in the United Kingdom and the United States, between 13 and 16 in the European Economic Area depending on the country). Where we refer to a "child" in this section, we mean anyone under the relevant age in their country.
Our adult-only services
Our website, newsletter, store and playtesting programme are intended for adults. We do not knowingly collect personal data from a child through these services. If you are under the age at which a child can consent to the processing of their personal data in your country, please do not provide personal data through these services without your parent or guardian's involvement.
Rights of parents and guardians
If you are a parent or legal guardian and your child has provided personal data to us, you have the right (in addition to any rights described elsewhere in this Privacy and Cookie Notice) to:
be informed about the personal data we have collected from your child;
request access to a copy of that data;
ask us to correct or delete it;
refuse to allow further collection or use of that data; and
withdraw any consent you previously gave on your child's behalf.
To exercise any of these rights, please contact us at dataprotection@team17.com. Because these rights involve information about a child, we will need to verify that you are the parent or guardian before we act on the request. To help us do this, please include the email address associated with the account (if any) and a brief description of what you would like us to do. We will respond within the timeframes required by applicable law.
If you believe your child has provided us with personal data without your consent, please contact us at the same email address and we will take steps to delete that data unless we are required to retain it by law.
Our website contains links to third-party websites - for example, the websites of our group companies, the websites of our service providers, and other online resources we think may be of interest to you. Where you follow such a link, you will leave our website and visit a site that we do not operate or control. Each third-party site is responsible for its own content and for its own handling of personal data, which will be governed by that site's privacy notice and not by ours. We encourage you to read the privacy notice of any site before you submit any personal data to it.
Some third-party services (including the third-party cookies described in the ‘Cookies and similar tracking technologies’ section of this Privacy and Cookie Notice) may collect or receive information about you when you interact with content embedded on our website or follow a link from it. Please refer to the ‘Cookies and similar tracking technologies’ section for further detail on the third-party technologies and how you can control them.
If you encounter anything that looks suspicious - for example, a link that appears to have been tampered with, content that purports to come from us but does not, or any other activity connected to our website that gives you cause for concern - please tell us as soon as possible.
07/08/2026
This addendum supplements our main Privacy Policy (set out above), and any terms not specifically addressed here remain governed by the Privacy Policy.
|
Personal data collected: |
Any personal data that you share with us when submitting an entry to the Contest or making an enquiry or otherwise liaising with us regarding the Contest. This may include your:
|
|
Purposes of the processing: |
We will use your personal data for the following purposes:
|
|
The lawful basis for the processing: |
Our legitimate interests (Art. 6(1)(f)) in answering your enquiries about the Contest, receiving entries and administering the Contest.
|
|
The recipients or categories of recipients that we may share the personal data with: |
|
|
The details of transfers of the personal data to any third countries or international organisations: |
To HubSpot Inc in the United States under the EU-U.S. Data Privacy Framework and the UK Extension to the same.
|
|
The retention periods for the personal data: |
If you are not successful in the Contest, we will delete your personal data within one month of the Contest closing date.
If you are the winner, we will only retain your personal data for as long as necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements.
|
