Privacy Policy
Last updated: 10 September 2026
Introduction
ArcadeGeek LTD ("we", "us", or "our") is committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, store, and protect information when you visit WhoTookWhat or use the WhoTookWhat application.
We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy should be read alongside our Cookie Policy.
Data Controller
The data controller responsible for your personal data is:
ArcadeGeek LTD
Company Registration Number: 07582886
Registered in England and Wales
Incorporated 2011
Northampton, United Kingdom
Information We Collect
Information you provide
- Account information: name, email address, and a hashed password. If you sign in with Google, Microsoft, or Apple, we receive the name and email that account shares with us, and a profile photo if the provider sends one.
- Organisation data: organisations, including name, members, and roles.
- Register data: assets (including description and tags), sites, locations, people, checkouts, reservations, inventory counts, and photos or documents you upload.
- Alert preferences: an email address if your organisation turns email alerts on.
- Billing: when you subscribe, Stripe processes the payment. We do not store card numbers. We keep Stripe customer and subscription identifiers so we can manage the plan for each Organisation.
Information collected automatically
- Technical data: IP address, browser type and version, operating system, and device information.
- Usage data: pages visited and similar analytics via Google Analytics, only with your consent.
- Cookie data: described in our Cookie Policy, including the wtw_consent preference cookie and the Laravel session cookie used by /admin.
- Signed photo and document URLs: time-limited (60 minutes) links that let a browser fetch a file you already stored.
How We Use Your Information
| Purpose | Legal basis |
|---|---|
| Creating and administering your WhoTookWhat account and organisation | Contract performance |
| Storing the asset register, checkouts, reservations, inventory, and uploads | Contract performance |
| Sending optional email alerts | Legitimate interest / your request |
| Processing subscriptions and payments through Stripe | Contract performance |
| Website analytics and performance monitoring | Consent (for Google Analytics) |
| Keeping the service secure and preventing abuse | Legitimate interest |
| Complying with legal obligations | Legal obligation |
Data Sharing and Third Parties
We do not sell, rent, or trade your personal data. We may share your information with:
- Google Analytics: for website analytics (with your consent). Google processes data in accordance with their Privacy Policy.
- Google, Microsoft, and Apple: if you choose their sign-in.
- Stripe: to take payment and manage subscriptions. Card numbers stay with Stripe; we keep customer and subscription identifiers.
- Service providers who host or operate the application, bound to keep data confidential.
- Legal requirements: when required by law, court order, or to protect our legal rights.
International Data Transfers
Some of our third-party service providers (such as Google, Microsoft, Apple, and Stripe) may transfer your data outside the UK and European Economic Area (EEA). When this occurs, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the UK Information Commissioner's Office (ICO), transfers to countries with adequate data protection laws as determined by the UK government, and Binding Corporate Rules where applicable.
Data Retention
- Organisation register data: while the Organisation exists, then deleted within 30 days of that Organisation being deleted unless law requires longer. Closed user accounts stay disabled (we keep the email so the same address cannot start another trial) until you ask us to erase the account and you are not the last Owner.
- Analytics data: 26 months (Google Analytics default retention period).
- Cookie consent preferences: 1 year.
- Security logs: only as needed to keep the service secure.
Your Rights
Under UK GDPR you have the right of access, rectification, erasure, restriction, data portability, to object to processing based on legitimate interests, and to withdraw consent at any time where processing is based on consent (for example analytics cookies).
To exercise any of these rights, contact us at privacy@arcadegeek.co.uk. We will respond within one month.
Data Security
We implement appropriate technical and organisational measures to protect your personal data, including encryption of data in transit using SSL/TLS (HTTPS), access controls, and signed time-limited URLs for stored photos and documents.
Children's Privacy
WhoTookWhat is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected information from a child, contact us so we can delete it.
Changes to This Policy
We may update this Privacy Policy from time to time. We will post any changes on this page with an updated revision date.
Complaints
If you have concerns about how we handle your personal data, contact us first. You also have the right to lodge a complaint with the UK supervisory authority:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
Contact Us
Questions: privacy@arcadegeek.co.uk
ArcadeGeek LTD · Company No. 07582886 · Northampton, United Kingdom