PRIVACY POLICY
Last updated: July 2026 · hellstormwargaming.co.uk
This Privacy Policy explains how Hellstorm Wargaming LTD (Sheffield, UK) collects, uses, and protects your personal data. We are committed to handling your information responsibly and in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
If you have any questions, contact us at HellstormWargaming@gmail.com.
 1. Who We Are
Hellstorm Wargaming is the data controller responsible for your personal data. We operate the website hellstormwargaming.co.uk, including the online shop, event calendar, and mailing list.
Data Controller: Hellstorm Wargaming LTD
Location: Sheffield, United Kingdom
Contact: HellstormWargaming@gmail.com
2. What Data We Collect
Webstore Customers
When you place an order, we collect:
- Full name
- Email address
- Billing address
- Shipping address
- Payment information (see note below)
- Order history
- IP address (for fraud prevention)
Important — Payment details: We do not store your full card number, CVV, or banking credentials on our servers. Payment processing is handled securely by our third-party payment provider. Please refer to their privacy policy for details on how they handle your payment data.
Mailing List Subscribers
When you sign up for event updates, we collect:
- Email address
- Name (optional)
- Subscription date and source (as a record of your consent)
- Email engagement data such as opens and clicks, to understand which content is useful
Tournament Organisers
When you submit an event for our calendar, we collect:
- Name or organisation name
- Email address
- Event details, venue, and address
3. Why We Collect It
We use the data we collect to:
- Process and fulfil your orders, including delivery and returns
- Send order confirmations, receipts, and shipping updates
- Send event update emails to subscribers who have opted in
- Display community events on our public event calendar and map
- Communicate with Tournament Organisers about their event listings
- Prevent fraud and protect the security of our store
- Comply with legal and financial record-keeping obligations
- Improve our website and understand how it is used
We will not use your data for any purpose incompatible with the reason it was originally collected.
4. Legal Basis for Processing
Under UK GDPR, we must have a lawful basis for processing your personal data:
- Processing your order — Contract: necessary to fulfil your purchase
- Sending order emails — Contract: necessary to fulfil your purchase
- Sending mailing list emails — Consent: you opted in and can withdraw at any time
- Publishing event listings — Legitimate interests: promoting community events publicly
- Fraud prevention — Legitimate interests: protecting our business and customers
- Financial records — Legal obligation: required under UK tax and accounting law
Where we rely on consent, you have the right to withdraw it at any time. To unsubscribe from our mailing list, use the unsubscribe link in any email or contact us directly.
 5. How Long We Keep It
- Order and customer records: 7 years (required by HMRC for tax purposes)
- Mailing list subscriptions: until you unsubscribe or withdraw consent
- Tournament Organiser contact details: as long as the event listing is active, or until requested for deletion
- Event listing data: until the event has passed or is removed
- Fraud prevention logs: up to 12 months
When data is no longer required, we delete or anonymise it securely.
6. Who We Share It With
We do not sell, rent, or trade your personal data. We may share it only with trusted third parties who help us operate our services:
- Payment processors (such as Stripe or PayPal) — to process transactions securely
- Delivery and shipping providers — to fulfil and track your order
- Email marketing platform — to send mailing list emails
- Website hosting and e-commerce platform (WordPress / WooCommerce) — to operate our store
- Google — our event calendar uses Google Sheets to store event data
- OpenStreetMap — used to display event locations on the map
All third-party providers are required to process your data in accordance with data protection law and our instructions. We only share the minimum data necessary for each purpose.
We may also disclose data if required to do so by law, court order, or for the prevention of fraud or crime.
7. How We Protect It
We take the security of your personal data seriously and use appropriate technical and organisational measures, including:
- SSL/TLS encryption on all data transmitted to and from our website
- Secure, access-controlled hosting for our website and store
- Payment card data handled exclusively by PCI-DSS compliant payment processors — we never see or store your full card details
- Limiting access to personal data to only those who need it to operate our services
No method of transmission over the internet is 100% secure. If you believe your data has been compromised, please contact us immediately.
8. Your Rights
Under UK GDPR, you have the following rights. You can exercise any of them by contacting us at HellstormWargaming@gmail.com. We will respond within 30 days.
- Right to Access: request a copy of the personal data we hold about you
- Right to Rectification: ask us to correct any inaccurate or incomplete data
- Right to Erasure: ask us to delete your personal data where there is no legitimate reason to keep it
- Right to Restrict Processing: ask us to pause processing of your data in certain circumstances
- Right to Data Portability: request your data in a structured, machine-readable format
- Right to Object: object to processing based on legitimate interests, including direct marketing
- Right to Withdraw Consent: withdraw consent at any time where we rely on it as our legal basis
- Right to Complain: lodge a complaint with the ICO if you are unhappy with how we handle your data
If you feel we have not addressed your concerns adequately, you can contact the Information Commissioner’s Office (ICO):
Website: ico.org.uk
9. Cookies
Our website uses a cookie consent banner to let you control which cookies are set. When you first visit our site, you can choose to accept or reject non-essential cookies, and you can change your preferences at any time.
Cookies on our site fall into these categories:
- Essential cookies: required for the site to work, such as your shopping cart, login session, and remembering your cookie preferences. These cannot be disabled.
- Functional cookies: support features like comments and spam protection (Google reCAPTCHA). The event calendar also stores geocoded address data in your browser’s local storage to speed up load times.
- Marketing / third-party media cookies: used only with your consent. This includes cookies set by YouTube when you interact with an embedded video on our site (for example, on our homepage), which may be used to track viewing behaviour and personalise content. These are blocked until you give consent.
You can control or withdraw your cookie preferences at any time using the cookie settings link on our website, or through your browser settings. Disabling certain cookies may affect the functionality of our website.
 10. Children
Our website and services are not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with their personal data, please contact us and we will delete it promptly.
 11. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the date at the top of this page. For significant changes, we will notify mailing list subscribers by email. Continued use of our website after changes are published constitutes your acceptance of the updated policy.
12. Contact Us
For any questions, requests, or concerns about this Privacy Policy or how we handle your personal data:
Email: HellstormWargaming@gmail.com
Location: Sheffield, United Kingdom
Website: hellstormwargaming.co.uk
We aim to respond to all data requests within 30 days.