LEGAL

Privacy Policy

Version 1.1 · Effective 2 August 2026

This policy explains what personal information Ludis Sports Ltd collects when you use LudisPortal or play on a Ludis ONE, why we collect it, who else sees it, and the control you have over it. We have tried to write it plainly rather than defensively.

1. Who is responsible for your data

Ludis Sports Ltd is the data controller for your Ludis account — meaning we decide how and why your account data is used. We are registered in England and Wales.

Flat 25, The Cosmopolitan1-3 Commercial RoadPooleDorsetBH14 0FDUnited Kingdom

Data protection queries: george@ludissports.co.

A venue you have joined is a separate controller for its own use of your information. See section 6.

2. What we collect

Account details — always

Your first name and last name, and the display name built from them.
Your username.
Your contact email address, used to recover your account.
Your password, stored only as a secure hash. We never see or store it in readable form.
The date your account was created.

Player profile — optional, and you choose

These are optional. You can add or remove them at any time in your profile, and leaving them blank does not stop you using anything.

Phone number.
Date of birth.
Favourite team.
Positions you play, and your stronger foot.
A profile photo, if you choose to add one.

Gameplay

Sessions you took part in: which device and venue, and when the session started and ended.
Each game played: the game, its version, its settings and its outcome.
Your results: score, placement, whether you won, and game-specific statistics such as where shots landed.
The name shown for you in that session, recorded at the time so historic results stay readable.

Ludis ONE detects where the ball hits the wall. It does not record video or audio of you, and it does not identify you from your appearance.

Joining and claiming

Short-lived codes used to join a device from your phone, and the record that you claimed one.
One-use codes used to attach a result to your account after guest play.

Technical and security

Sign-up and sign-in attempts are rate-limited to stop abuse. To do that we store a salted, one-way hash of the IP address — never the address itself. The hash cannot be turned back into your IP.
Our hosting provider processes standard server logs, including IP addresses, to deliver and protect the site.
We record a limited set of first-party Portal events: successful sign-up and sign-in, which main player pages are opened, and whether device joins or result claims succeed or fail. These events are linked to your account so we can diagnose a problem, but do not contain join codes, result codes, raw IP addresses or your browser’s user-agent string.

We do not collect special category data — such as health, biometric or ethnicity data — and we ask that you do not put it into free-text fields.

3. Where it comes from

From you — when you create an account, fill in your profile, or contact support.
From a Ludis ONE device — results and session records, sent to us by the device after you play.
From a venue — if its staff create an account for you, or link a guest session to your account at your request.

4. Why we use it, and our lawful basis

Under UK GDPR we must have a lawful basis for each use. Ours are:

What we do	Why	Lawful basis
Create and run your account	So you can sign in and we can identify you	Performance of a contract
Record and show your results	The core of what the Portal is for	Performance of a contract
Let you join a device from your phone	So your play is attached to you rather than a guest slot	Performance of a contract
Send account recovery emails	So you can get back in if you forget your password	Performance of a contract
Show you on a public leaderboard	Only if you have switched it on	Consent — you can withdraw it at any time
Store your optional profile details	To personalise your profile and, later, group results fairly	Consent — you can remove them at any time
Rate limiting and anti-abuse	To stop bulk fake sign-ups and protect the service	Legitimate interests — keeping the service secure
Diagnose faults on devices	To keep installations working	Legitimate interests — running our product properly
Measure whether core Portal features work	To find failed joins, result claims and confusing player journeys	Legitimate interests — improving and operating our product
Handle a support request or complaint	To answer you	Legitimate interests, or performance of a contract
Meet legal and accounting obligations	Because we have to	Legal obligation

Where we rely on legitimate interests, we have considered whether it is fair to you, and you can object — see section 11.

We do not use your data for automated decision-making that produces a legal or similarly significant effect on you, and we do not profile you for advertising.

5. Leaderboards and visibility

Public leaderboard visibility is off by default. Your account is not shown publicly until you turn it on yourself, in your profile or during sign-up.

When it is on, other players can see your display name and the results that rank you. Your email address, phone number, date of birth and other profile details are never published on a leaderboard.

You can turn it off at any time, and you will stop appearing.

6. What venues can see

If you joined a venue’s organisation — usually through a sign-up link that venue gave you — the staff administrators of that organisation can see, for their own members:

Your username and display name.
Your contact email address.
Your phone number, date of birth, favourite team, positions and stronger foot, if you provided them.
Whether you have opted in to leaderboards.
Sessions and results recorded on that venue’s devices.

They cannot see your password, and they cannot see results you recorded at a different venue.

The venue uses this information for its own purposes — running its sessions, coaching, and contacting its members — and is a separate data controller for that use. Its own privacy notice applies. If you want to know what a venue does with your details, or you want it to delete them, contact the venue directly. We will help you reach them if you cannot.

Ludis staff can also access records where necessary to support a venue, investigate a fault, or meet a legal obligation. That access is limited to staff who need it.

8. Cookies

We use strictly necessary cookies only. They keep you signed in and keep your session secure. Without them the Portal cannot work.

We do not use analytics cookies, advertising cookies, social media pixels, or any third-party tracking. Our limited first-party operational events do not set a cookie or store anything extra in your browser. That is why you are not asked to accept a cookie banner — there is nothing optional to accept.

You can clear or block cookies in your browser settings, but you will not be able to stay signed in.

9. Where your data is stored

Your account and results are stored on servers in Ireland (European Union).

Some of our providers are based outside the UK and EU, or provide support from outside them. Where personal data is transferred outside the UK or EEA, we rely on the safeguards the law requires — an adequacy decision, or standard contractual clauses together with the UK International Data Transfer Addendum.

10. How long we keep it

Your account and profile — for as long as your account is open. If you ask us to close it, we delete or anonymise your personal details within 30 days.
Your results— when an account is deleted, its results stop being linked to you and remain only as anonymous entries in the venue’s session records. They can no longer identify you.
Result claim codes — 7 days, then they expire.
Device join codes — minutes; they are short-lived by design.
Rate-limiting records — only for the length of the limit window, then removed automatically.
Portal usage events — up to 90 days, then removed automatically.
Support correspondence — up to 2 years after your query is resolved.
Records we must keep by law — for the period the law requires, typically 6 years for financial records.

11. Your rights

Under UK and EU data protection law you have the right to:

Access — get a copy of the personal data we hold about you.
Rectification — have inaccurate data corrected. Most of it you can edit yourself in your profile.
Erasure — ask us to delete your data, where there is no overriding reason for us to keep it.
Restriction — ask us to pause using your data while a concern is resolved.
Portability — receive the data you gave us in a machine-readable format.
Objection — object to processing we base on legitimate interests.
Withdraw consent — for anything based on consent, such as leaderboard visibility, at any time. This does not affect what we did lawfully beforehand.

Email george@ludissports.co to use any of these. We will respond within one month. Using your rights is free, and we will not treat you differently for it.

12. Children

You must be at least 13 to hold a Ludis account. If you are 13 to 15, a parent or guardian must give permission before you create one.

Children can play on a Ludis ONE as guests without an account, and without giving us any personal information.

We keep children’s accounts off public leaderboards by the same default that applies to everyone — visibility is off until it is switched on.

If you are a parent or guardian and believe your child has given us personal data without your permission, email george@ludissports.co and we will delete it.

13. How we protect it

Traffic between you and the Portal is encrypted in transit, and data is encrypted at rest by our providers.
Passwords are stored only as secure hashes.
The database enforces per-user access rules, so one player cannot read another player’s records.
Only authenticated Ludis ONE devices can submit results, using signed requests with replay protection.
Your recovery email address is held privately and is never exposed through public profile data.
Sign-up is protected by rate limiting and automated abuse checks.

No system is perfectly secure. If a breach affects your rights and freedoms, we will tell the ICO within 72 hours and tell you without undue delay where the risk to you is high.

14. Changes to this policy

We may update this policy. The version number and effective date at the top always tell you which version applies. If a change materially affects how we use your data, we will tell you directly and, where the law requires it, ask for your consent again.

15. Contact and complaints

Email george@ludissports.co, or write to us at the address in section 1.

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator, at ico.org.uk or on 0303 123 1113. If you live in the EU, you may complain to your local supervisory authority instead.