Privacy Policy

Effective date: 2026-09-28

Plain-English summary

Airsoft Defence operates a digital record and verification service. We collect information needed to operate accounts, record qualifying activities, verify identity information, calculate Defence Status, support authorised checks, protect the Service, and meet legal and compliance obligations. We do not sell personal data or use it for behavioural advertising.

1. Who we are

Airsoft Defence Ltd is the controller for personal data processed by Airsoft Defence for its own Service. Registered office: 36 King Richards Hill, Earl Shilton, Leicester, England, LE9 7EY. Company number 17107541. ICO registration ZC173832. Contact: support@airsoft-defence.co.uk.

2. Information we collect

• Account: name, email, password credentials, date of birth, address, telephone, role, and account identifiers.
• Profile: photograph and information needed to display and verify the account.
• Attendance: player, Site, and date of check-in.
• Identity verification: verification results, verifier, date/time, and relevant checks.
• Penalty points: reason, point value, explanatory text, issuing Site, and dates.
• Defence Status: status, status reasons, and the inputs used by the calculation.
• Police and Customs: authorised searches, holds, permitted notes, and access audit records.
• Verification audit: who viewed an account, when, and the status returned at the time.
• Site/Store: organisation information, URI codes, access records, and Site insurance certificates/expiry dates.
• Transactions: membership, listing, and payment identifiers.
• Security: login events, failed-login events, IP addresses where captured by security logs, rate-limit events, and related telemetry.
• Communications: information contained in support requests and other correspondence.

3. Under-18 users

Users aged 17 may create accounts and build game history before reaching 18. Because the Service is likely to be accessed by people under 18, Airsoft Defence applies age-appropriate privacy safeguards and takes particular care with under-18 personal information.

Under-18 accounts may appear in the Marketplace, but Defence Status remains invalid for RIF-related purposes until the age requirement is met. Airsoft Defence does not use children's data for behavioural advertising or targeted marketing.

4. How we use information

We use information to create and operate accounts; authenticate users; record attendance; maintain historical records; verify account information; calculate and display Defence Status; provide permission-based player sharing; allow authorised Site, Store, Police, and Customs functions; maintain audit trails; prevent fraud and misuse; administer payments and Marketplace listings; send transactional emails; store Site insurance evidence; comply with legal obligations; secure the Service; and enforce our Terms.

5. Lawful bases

• Contract: account operation, requested Service functions, membership, and purchases.
• Legitimate interests: platform operation and security, audit, fraud prevention, reliable records, verification, and protection of users and the Service.
• Legal obligation: where necessary to comply with law.
• Consent: where specifically requested and appropriate.

Where criminal-offence data or related security measures are processed, an additional Article 10 / Data Protection Act 2018 condition may be required and will be identified and documented where applicable.

6. Automated Defence Status

The Service automatically evaluates age, membership, qualifying game history, identity verification, penalty points, and police holds against configured rules. The result may change when an underlying record changes or expires.

The purpose is to report whether recorded verification criteria are satisfied. It is not intended to make a legal determination of RIF entitlement. Users can see relevant status reasons where provided and can seek correction of inaccurate underlying information.

Airsoft Defence will assess the UK GDPR rules on solely automated decisions with legal or similarly significant effects and apply required safeguards where relevant.

7. Identity verification and photographs

Authorised Site or Airsoft Defence staff may check whether the address appears to match, whether the photograph appears to depict the user, and whether the photograph is suitable for identification. The current photograph process is a visual aid, not biometric identification. Ordinary player accounts do not currently involve external government-ID document verification.

8. Police holds and criminal-offence-related information

Approved police users may place holds. A player-facing status may say "Invalid - Police Hold" and may contain a limited contact instruction. Restricted notes may contain operational information and are limited to authorised roles.

Information concerning suspected offences, investigations, or related security measures may be criminal-offence data. Airsoft Defence limits access, minimises the information recorded, audit logs access, and applies the additional legal requirements that apply.

Police and Customs remain responsible for their own processing under the law applicable to them. Airsoft Defence will share information with authorities only where there is a lawful basis and any additional condition required by law, or another lawful route applies.

9. Sharing and access

We do not sell personal data.

• Sites and Stores receive information necessary for permitted functions.
• Police and Customs receive information appropriate to their approved roles.
• Players may share limited information through one-time codes or permission requests.
• Service providers may process information on our behalf.
• We may disclose information to competent authorities where required or permitted by law.
• Professional advisers may receive information where reasonably necessary and subject to confidentiality.
• Third parties collecting information independently of Airsoft Defence may have their own data-protection responsibilities.

10. Service providers

• DigitalOcean: hosting, infrastructure, and backups. Primary application region: London 1.
• Amazon SES: transactional email. Current region: eu-west-1.
• Stripe: payment processing and payment-related identifiers.
• Google reCAPTCHA: abuse prevention and security. Current implementation: v3 with v2 fallback.

Future image storage may use Amazon S3 or equivalent. Material changes to providers or processing will be reflected in this policy.

11. International transfers

Airsoft Defence aims to use UK or European infrastructure for the Service. Global providers may operate support, infrastructure, or subprocessors outside the UK/EEA. Where personal data is transferred internationally, an appropriate lawful transfer mechanism and safeguards will be used where required.

12. Retention

Game history is currently retained for seven years to preserve historical evidence and support legitimate lookup, audit, compliance, and law-enforcement-related needs. This is not represented as a statutory period.

Verification-check records are currently retained for the lifetime of the relevant account, subject to future retention review. Security and audit logs are retained as reasonably necessary for security, fraud prevention, accountability, legal claims, and operational purposes. Airsoft Defence intends to move to defined retention schedules.

Insurance documents are retained as reasonably necessary for Site compliance, audit, and legal purposes. Payment/accounting records may be retained for periods required by law. When information is no longer required it will be deleted, securely disposed of, or irreversibly anonymised where appropriate.

13. Account deletion

When an account is deleted, identifying fields are overwritten. For example, a name may become "Deleted User" and an email may be replaced by a generated deletion address.

The application does not retain a normal account mechanism for restoring the original values. Historical attendance and audit records may remain where necessary to preserve the integrity of the historical record or meet legitimate retention, security, compliance, or legal needs. Where retained information remains personal data under applicable law, it continues to be handled as such.

14. Security

Airsoft Defence uses role-based access, authentication, rate limiting, audit logging, backups, and other technical and organisational measures appropriate to the risks. Failed logins are rate limited and security events are logged. No internet service can be guaranteed completely secure. Users should use unique passwords and enable two-factor authentication where available.

15. Your rights

Subject to legal exceptions, you may have rights to access, correct, erase, restrict processing, object to certain processing, and obtain data portability. You may ask us to review information used in a Defence Status where an underlying record is inaccurate.

Rights may be restricted where disclosure would prejudice crime prevention/detection, compromise an investigation, reveal confidential information, or another legal exemption applies. Contact support@airsoft-defence.co.uk. We may verify identity before responding. You may complain to the Information Commissioner's Office.

16. Complaints

Please contact support@airsoft-defence.co.uk first so we can investigate and attempt to resolve the issue. ICO registration number: ZC173832.

17. Cookies

The Service uses essential cookies and similar technologies for authentication, security, sessions, and requested functionality. Google Analytics is not intended to be used in the current configuration. Google reCAPTCHA may use cookies or similar technologies for security and abuse prevention and may process technical information under Google's own privacy information.

Appropriate information and consent will be provided where legally required for non-essential technologies.

18. Changes

We may update this Privacy Policy when the Service, processing, providers, or legal requirements change. The latest version will show its effective date and material changes will be notified where required.

19. Contact

Airsoft Defence Ltd, 36 King Richards Hill, Earl Shilton, Leicester, England, LE9 7EY. Company number 17107541. ICO registration: ZC173832. Email: support@airsoft-defence.co.uk.