Privacy Policy
How Conure Cards collects, uses, stores, and protects personal data.
1. Introduction
The Conure Group ("we", "us", "our") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use our website at mail.conurecards.com and related services.
We are the data controller for your personal data and are registered in England and Wales. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Important: We will never sell, rent, or share your personal data with third parties for their marketing purposes.
2. Data We Collect
We collect different types of personal data depending on how you interact with our Platform:
2.1 Account Information
| Data Type | Purpose | Legal Basis |
|---|---|---|
| Email address | Account identification, login, communications | Contract performance |
| Username | Account identification, public display | Contract performance |
| Password (hashed) | Account security | Contract performance |
| Phone number | Account verification (Level 2), security | Legitimate interest (fraud prevention) |
2.2 Shipping Information (Prize Winners Only)
| Data Type | Purpose | Legal Basis |
|---|---|---|
| Full name | Prize delivery | Contract performance |
| Shipping address | Prize delivery | Contract performance |
Note: Shipping addresses are used solely for prize delivery. You may add an address in your account settings for faster fulfilment, and we will request it if you win a giveaway.
Support photos: when you contact us through the site chat, you may attach photos, for example of a parcel or a prize. We resize each photo, remove its embedded metadata (such as location data) and store it privately for support and prize delivery only. Support photos are visible to you and to our support team, never to other members. Legal basis: contract performance and our legitimate interest in resolving your request.
2.3 Verification Data (Optional)
| Data Type | Purpose | Legal Basis |
|---|---|---|
| Social media handles | Optional account verification, task completion | Consent |
| Identity verification result / reference | Additional fairness review when more than 3 accounts share one IP or when extra compliance checks are needed | Legitimate interest (fraud prevention) |
| Profile picture | Account personalization | Consent |
Important: If we request an additional identity check, we aim to use secure third-party verification partners and store only the minimum outcome or reference needed for review, rather than the raw ID document itself.
2.4 Technical Data (Automatically Collected)
| Data Type | Purpose | Legal Basis |
|---|---|---|
| IP address | Security, fraud prevention, geo-verification | Legitimate interest |
| Browser/device information | Technical support, security | Legitimate interest |
| Cookies and session data | Site functionality, authentication | Consent / Legitimate interest |
2.5 Quest Activity Data (Optional)
| Data Type | Purpose | Legal Basis |
|---|---|---|
| Quest completion status, partner click IDs | Quest validation, reward attribution, fraud checks | Consent / Contract performance |
2.6 Collector Identity and Membership Data
| Data Type | Purpose | Legal Basis |
|---|---|---|
| Qualified activity totals, Level XP, Level, monthly activity status, badge/crown/frame progress, collection records, and member-since duration | Calculate and display collector progression, unlocks, and collection features | Contract performance / Legitimate interests in operating an engaging collector service |
| Collector profile, featured items, equipped cosmetics, and profile/Badge/Binder/profile-plaque visibility choices | Provide the public profile and apply your display preferences | Contract performance / Legitimate interests, balanced by user controls |
| Membership entitlement status, billing-provider customer or subscription references, billing events, cancellation state, and shop-discount use | Provide and administer paid membership if launched, process payments, apply benefits, prevent fraud, and maintain financial records | Contract performance / Legal obligation / Legitimate interests |
Public collector profiles do not show email addresses, Coin balances, Entries, phone or identity-verification data, payment data, or internal fraud and moderation information. Available profile, Badge, Binder, and profile-plaque controls can be changed from your account. Active Club members may choose whether that single plaque shows member time, a labelled Club status, or nothing.
3. How We Use Your Data
We use your personal data for the following purposes:
- Account Management: Creating and managing your account, authentication, and security.
- Service Delivery: Operating the Coins system, quests, giveaways, and referral program.
- Collector Identity: Calculating Levels and unlocks, maintaining virtual collections, rendering equipped identity assets, and applying public-profile visibility choices.
- Membership Administration: If paid membership launches, managing entitlements, recurring billing state, cancellations, receipts, deterministic benefits, and eligible shop discounts.
- Prize Fulfilment: Delivering prizes to winners (shipping addresses collected only when needed).
- Communications: Sending service updates, win notifications, and (if consented) marketing emails.
- Fraud Prevention: Detecting and preventing fraudulent activity, multiple accounts, and abuse.
- Legal Compliance: Meeting our legal and regulatory obligations.
- Platform Improvement: Analyzing usage patterns to improve our services (using anonymized/aggregated data).
4. Legal Basis for Processing
Under UK GDPR, we process your personal data based on the following legal grounds:
- Contract Performance: Processing necessary to provide our services to you (account creation, Coins system, prize delivery).
- Legitimate Interests: Processing necessary for fraud prevention, security, accurate progression, public collector identity with user controls, and platform improvement, after balancing those interests against your rights and reasonable expectations.
- Consent: Processing based on your explicit consent (marketing emails, optional social media verification).
- Legal Obligation: Processing required to comply with applicable laws.
5. Your Rights Under UK GDPR
You have the following rights regarding your personal data:
Right of Access
Request a copy of all personal data we hold about you.
Right to Rectification
Request correction of inaccurate or incomplete data.
Right to Erasure
Request deletion of your data ("right to be forgotten").
Right to Restriction
Request limited processing of your data in certain circumstances.
Right to Data Portability
Receive your data in a structured, machine-readable format.
Right to Object
Object to processing based on legitimate interests or direct marketing.
To exercise any of these rights, please contact us at privacy@mail.conurecards.com or use our contact form. We will respond within 30 days.
6. Data Security
We implement robust security measures to protect your personal data:
- Encryption: All data transmitted to and from our servers uses SSL/TLS encryption (HTTPS).
- Password Security: Passwords are hashed using industry-standard algorithms and are never stored in plain text.
- Access Controls: Access to personal data is restricted to authorized personnel only.
- Regular Audits: We conduct regular security reviews and updates.
- Secure Infrastructure: Our servers are hosted in secure data centres with appropriate physical and technical safeguards.
7. Data Retention
We retain your personal data only as long as necessary:
| Data Category | Retention Period |
|---|---|
| Active account data | Duration of account activity |
| Inactive account data | 12 months after last activity, then deleted |
| Shipping addresses (optional account settings / winners) | 6 months after prize delivery or last update |
| Support conversation messages and photos | Duration of the account; you can ask us to delete a conversation or its photos at any time |
| Transaction/Coins history | 6 years (legal requirement) |
| Collector progression, Digital Items, and display preferences | Duration of the account, subject to correction or earlier deletion rights where applicable |
| Paid-membership billing and transaction records | Up to 6 years after the relevant transaction or contract ends where required for tax, accounting, disputes, or legal claims |
| Marketing consent records | Duration of consent + 2 years |
You can request earlier deletion of your data by contacting us (subject to legal retention requirements).
8. Cookies
We use cookies and similar technologies to:
- Essential Cookies: Enable core site functionality (authentication, sessions).
- Functional Cookies: Remember your preferences and settings.
- Analytics Cookies: Understand how visitors use our site (anonymized data).
- Security Cookies: Prevent fraud and protect your account.
Essential cookies are required for the site to function and cannot be disabled. You can manage other cookies through your browser settings.
9. Third-Party Services
We use the following third-party services that may process your data:
Spam prevention and bot detection. Privacy Policy
SMS verification for phone number verification. Privacy Policy
Email delivery service. Privacy Policy
IP-based location detection for eligibility verification. Privacy Policy
If additional fairness checks are required, we may use secure third-party identity verification providers to confirm that accounts belong to real, distinct people while minimizing the sensitive data stored directly on Conure Cards.
Optional partner quests that award Coins. When you choose to participate, we may share limited data (such as a click identifier or completion status) to validate the reward.
The provider identified at checkout may process payment credentials and billing events. Conure Cards intends to store provider references, entitlement state, and transaction records rather than raw card details.
These services are data processors acting on our behalf and are contractually obligated to protect your data.
10. International Data Transfers
Your data is primarily stored and processed in the United Kingdom. If data is transferred outside the UK:
- We ensure appropriate safeguards are in place (Standard Contractual Clauses, adequacy decisions, or other approved mechanisms).
- Third-party processors in the US may be certified under recognized frameworks.
You can request information about specific safeguards by contacting us.
11. Marketing Communications
We only send marketing emails if you have explicitly opted in during registration or later. Marketing communications include:
- New giveaway announcements
- Special promotions and bonus point opportunities
- Platform updates and new features
You can unsubscribe at any time by:
- Clicking the unsubscribe link in any marketing email
- Visiting your account settings
- Contacting us directly
Note: Unsubscribing from marketing does not affect essential service communications (win notifications, account security alerts).
12. Children's Privacy
Our services are not intended for children under 16 years of age. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child under 16, we will delete it promptly.
If you believe a child under 16 has provided us with personal data, please contact us immediately.
13. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or legal requirements. When we make material changes:
- We will update the "Last updated" date at the top of this page.
- We will notify you via email or a prominent notice on our Platform.
- Your continued use after changes indicates acceptance of the updated policy.
14. Contact Us and Complaints
If you have questions about this Privacy Policy or want to exercise your rights:
- Email: privacy@mail.conurecards.com
- Contact Form: mail.conurecards.com/contact
The Conure Group
Registered in England and Wales
Right to Complain
If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Phone: 0303 123 1113