Privacy Policy

The Smart Playroom | smartrewardplatform.com

Last Updated: April 2026

M3 Marketing Limited («we», «us», «our») processes personal data through smartrewardplatform.com in compliance with UK GDPR (as incorporated into UK law by the Data Protection Act 2018). Supervisory authority: Information Commissioner's Office (ICO) — ico.org.uk.

1. PERSONAL DATA WE COLLECT

• Account data: email address, username, date of birth (18+ verification), password (bcrypt hash only — never plain text)
• Gameplay data: game results, Smart Coins balance, Smart Rank, Smart Challenge Board progress, session history
• Technical data: IP address, browser type, device type, session timestamps — lawful basis: legitimate interests (security, fraud prevention)
• Payment data (Smart Pass): processed via Stripe. We do not store card numbers.
• Communications: support emails and contact form submissions

2. LAWFUL BASIS (UK GDPR Art. 6)

• Consent (Art. 6(1)(a)): marketing emails, analytics cookies
• Contract (Art. 6(1)(b)): account operation, gameplay, Smart Pass subscription management
• Legal obligation (Art. 6(1)(c)): VAT records (HMRC)
• Legitimate interests (Art. 6(1)(f)): security, fraud prevention, platform improvement

3. YOUR RIGHTS (UK GDPR Arts. 15–22)

• Access (Art. 15): request your data — [email protected]. Response within 1 calendar month.
• Rectification (Art. 16): correct inaccurate data in Settings or via email
• Erasure (Art. 17): Settings → Account → Delete Account. Data removed within 1 calendar month.
• Portability (Art. 20): request data in machine-readable format
• Object (Art. 21): object to legitimate-interest processing
• Complain to ICO: ico.org.uk/make-a-complaint | 0303 123 1113

4. ICO REGISTRATION

M3 Marketing Limited is registered with the ICO as a data controller. ICO Registration Number: [insert upon registration]. Annual renewal required.

5. DATA RETENTION

• Account data: retained while active; deleted within 1 calendar month of deletion request
• Payment records: 6 years (HMRC VAT requirements)
• Technical logs: 90 days

6. INTERNATIONAL TRANSFERS

Some service providers are located outside the UK. Transfers are protected by UK International Data Transfer Agreements (UK IDTAs) or equivalent safeguards under UK GDPR Chapter V.

7. CONTACT

[email protected] | M3 Marketing Limited, 61-63 Saint Peters Street, Bedford MK40 2PR, United Kingdom