Privacy Policy

SalesGamez is a UK-based B2B SaaS product for sales teams, operating from 80A Ruskin Ave, London, DA16 3QQ, United Kingdom, and trading as SalesGamez.

Privacy, data protection and security questions can be sent to privacy@salesgamez.com, general enquiries to hello@salesgamez.com, or use the contact form on this website. We have not appointed a statutory data protection officer, and privacy questions are handled by the SalesGamez team.

This policy explains how SalesGamez handles personal data under the UK GDPR, the Data Protection Act 2018, PECR and other applicable UK data protection law, and it is governed by the law of England and Wales.

We are a controller for personal data we use for our own purposes, including customer contacts, authorised users, account administration, billing, security, support, limited service-operation information and any future lawful marketing.

Business customers are normally the controller for personal data they or their authorised users enter about salespeople, employees, contractors or other participants. This Customer Data can include a person’s name, optional profile photograph, team or site, sales or activity figures, game participation and leaderboard results. We act as the customer’s processor for that Customer Data and process it on the customer’s documented instructions under our Data Processing Agreement.

A salesperson can be stored as a record without having a SalesGamez login. The relevant customer remains responsible for that record and for dealing with the salesperson fairly and lawfully.

If you are a salesperson or employee whose information was entered by a customer, contact that customer first about the information. We will assist the customer as required by our Data Processing Agreement.

Depending on how the service is used, we may process business contact and account data, such as name, work email address, employer, role, site, account status and authentication identifiers.

You can create an account and sign in either with an email address and password or with an existing Google or Microsoft account. The Google and Microsoft sign-in applications used for this are registered to SalesGamez in our own name, so the permission screen you see identifies SalesGamez as the application you are signing in to. Where you choose Google or Microsoft, we ask only for your email address, a basic profile name and a provider account identifier, which we use to create and identify your account. We do not receive or store your Google or Microsoft password, and we do not request or hold access to your mailbox, contacts, calendar, files or any other provider data. Signing in this way tells Google or Microsoft that you have signed in to SalesGamez, and their own privacy terms apply to what they do with that information. The sign-in exchange itself is carried out by our hosting and backend providers acting for us, and they are listed in our Subprocessor Disclosure.

We process subscription and billing administration data, such as plan, billing frequency, invoices, payment status, customer references, refunds and correspondence. Payments are taken through Stripe, which collects your card details directly on its own checkout. We store the customer, subscription, plan, invoice and payment-status references Stripe returns to us. We do not receive or store full card or bank details.

We may process support and communications data if you contact us, including the name, optional company name, email address and message you send through the contact form, our replies and any later messages in the same conversation. Contact-form enquiries and our replies are stored in the service so the conversation stays together, and a copy is sent to our support mailbox.

We process security and technical data such as timestamps, authentication events, audit records, hashed device and network identifiers used for login-sharing checks, error information and application logs. The login-sharing evidence keeps hashed device and network events for 90 days in active systems.

We process marketing preferences and suppression records, including opt-ins recorded through the sign-up form and the contact form, and the record of anyone who has unsubscribed or objected.

We do not use analytics, advertising, heat-map or social-tracking tools on this website or in the app. Our hosting, backend and email providers create operational logs that are needed to run, deliver and secure the service.

Customer Data may include salesperson or participant names, optional profile photographs, team, site and game membership, sales, activity or performance figures entered by authorised users, leaderboard position, progress and game results derived from those figures, and other content a customer chooses to enter in permitted fields.

Customers and users must not upload special-category data, criminal-offence data, children’s data or content that is not needed to run the service. Free-text fields and uploads can technically receive unexpected content, so customers must use them lawfully and must tell their people what may and may not be entered.

We use controller data to create and administer customer accounts, authenticate users and provide the service. The lawful basis is performance of a contract where the individual is party to it, and otherwise our legitimate interests and the customer’s legitimate interests in providing and receiving the service.

We use controller data to bill customers, administer payments and keep tax and accounting records. The lawful bases are performance of a contract and compliance with legal obligations.

We use controller data to answer enquiries and provide support. The lawful bases are performance of a contract and legitimate interests in supporting customers and improving the service.

We use controller data to secure the service, prevent fraud and misuse, investigate incidents and enforce the Terms. The lawful bases are legitimate interests in protecting SalesGamez, customers and users, and legal obligations where applicable.

We use proportionate technical and usage information to maintain and improve reliability and usability. The lawful basis is legitimate interests in operating and improving a B2B service.

We send marketing only where permitted. The lawful basis may be consent where required, or legitimate interests where appropriate, subject to PECR and the right to object.

Where we rely on legitimate interests, we assess the purpose, necessity and impact on individuals. You may ask us for information about that assessment. We do not use Customer Data for our own advertising, build advertising profiles from it, or sell personal data.

Each customer decides whether and how to use SalesGamez with its workforce and is responsible for identifying and documenting a lawful basis for each use of employee or salesperson data.

The customer must give individuals a clear privacy notice before their data is entered or displayed, comply with employment, equality and data protection law and relevant workplace policies, and ensure that performance information is necessary, proportionate, accurate and not misleading.

The customer must assess whether a data protection impact assessment is required, particularly where monitoring or public display is systematic, extensive or likely to create a high risk.

The customer must decide whether a photograph is necessary and have a lawful basis for it. Consent should not be treated as freely given merely because an employee did not object. Because of the imbalance in an employment relationship, another lawful basis may be more appropriate.

The customer must give individuals a practical way to raise concerns or request correction, removal of a photograph or other appropriate action, limit access and visibility, decide whether a public board link is appropriate, and avoid using the service in a way that bullies, humiliates, discriminates against, unfairly targets or excessively monitors anyone.

SalesGamez displays information supplied by customers. We do not verify sales figures and the service is not an authoritative payroll, commission, disciplinary or employment record.

SalesGamez offers public bearer links for competition boards, Scorez boards, Tournamentz brackets, shared wheels, Suspectz player links and shared learning links. These pages are excluded from our sitemap and carry noindex, nofollow metadata.

For competition boards, a manager can create or reissue a link and can revoke it without deleting the game by disabling sharing and rotating the token. Scorez and Tournamentz public links load only while sharing is enabled. Game deletion also removes the relevant active game record where the available delete control is used.

Anyone who obtains a public or private bearer link may be able to view the information shown through that link without a SalesGamez login, and recipients may forward or capture its contents. The customer must decide what information is suitable for that audience and must not publish employee information more widely than is necessary and lawful. Copies already captured by recipients are outside SalesGamez’s control. Search-engine metadata reduces indexing risk but does not guarantee that a third party will never index or store a copied link.

Service messages about accounts, security, billing, support and material service changes are not marketing.

For marketing emails to corporate subscribers, PECR generally does not require prior consent, but we will identify ourselves and provide a valid opt-out. UK GDPR still applies where a named business contact is identifiable, and we normally rely on legitimate interests after considering the person’s reasonable expectations.

For sole traders and some unincorporated partnerships, we will send electronic marketing only with consent or where all conditions of the PECR soft opt-in are met. We will not describe an enquiry alone as automatically creating a soft opt-in.

Every marketing email will provide an easy unsubscribe route. We will use a suppression record to respect opt-outs and will never send marketing to a person who has objected to direct marketing. The sign-up form and the contact form each include an optional, unticked marketing box. Ticking it records your email address, the name and company you gave, where you ticked it, the date and the exact wording you agreed to, so we can show the consent we hold. You can ask us to stop at any time, or use the unsubscribe link in any marketing email, and we keep a minimal suppression record so we do not contact you again.

Our Cookie Policy describes cookies and similar storage. Non-essential technologies must not be set or accessed before valid consent. Strictly necessary technologies may be used without consent but must still be explained.

We do not use advertising, profiling, heat-map, social-tracking or analytics storage. We do use authentication storage, one sidebar cookie, and local and session storage for the app settings you choose, your progress through shared links, and login-sharing security checks. These are used to deliver the service you have asked for and to keep accounts secure.

We may disclose controller data to suppliers that help us provide hosting, database, authentication, email, support, monitoring or other business services, under appropriate contracts. We may disclose data to payment providers and financial institutions to administer payments, to professional advisers, insurers, auditors and potential investors or purchasers where reasonably necessary and subject to confidentiality, to courts, regulators, law-enforcement bodies or other recipients where required or permitted by law, and where needed to establish, exercise or defend legal claims.

Where you choose to sign in with Google or Microsoft, that provider acts as an independent controller of its own records of your provider account and of that sign-in, under its own privacy terms. It is not our processor and we do not send it any information about salespeople, teams, figures or games.

Our current providers and the role each one plays are set out in the Subprocessor Disclosure. Providers that do not process Customer Data are recorded internally instead. We put written data-protection terms in place with each provider before it processes personal data for us.

We do not allow a processor to use personal data for its own unrelated purposes merely because it supplies us with a service.

SalesGamez is operated from the United Kingdom. Some of our providers, including our hosting, backend, payment and email providers, may store or access personal data outside the UK.

Where a restricted transfer occurs, we rely on a lawful mechanism such as UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, and we carry out any required transfer risk assessment and apply supplementary safeguards where necessary. On request, we will tell you which safeguard applies to a particular provider, subject to any necessary redactions.

We keep personal data only for as long as needed for the purpose for which it was collected, including legal, accounting, security and dispute requirements.

Customer and authorised-user account data should be kept while the subscription is active. Individual users, salesperson records, optional photographs, sales figures and games deleted by a customer should be removed from the live, customer-visible service immediately when deletion succeeds. Public game links stop working when the associated game is deleted, and sharing can also be switched off on its own. Competition, Scorez, Tournamentz and Spinz links check the sharing status before a public page loads.

When an account owner uses the close-account control, the site, its users and its content are deleted from our active systems straight away, so anything still needed should be downloaded beforehand. Where we close an account for another reason, such as non-payment or at a customer’s written request, we keep the data for no more than 30 days so that it can be recovered or supplied to the customer, then delete it or irreversibly anonymise it. There is no automated data export yet, so a copy of your information should be requested from privacy@salesgamez.com before closure or within that 30-day period.

Deleted data may remain in protected rotating backups for no more than 90 days after active-system deletion. It must not be used for ordinary business purposes and, if restored, must be deleted again. Deleting something in the app removes it from the live service immediately, but it does not delete it from backups on the same day. Information a recipient has already copied from a shared link is outside our control.

Security and application logs are kept for up to 12 months, with personal data kept to a minimum. Login-sharing events are cleared after 90 days. Support correspondence, including contact-form enquiries and our replies, is kept for up to 24 months after the matter closes. Billing, invoice and tax records are kept by us and by our payment provider for as long as tax and accounting law requires, which is normally six years after the end of the relevant financial year. Marketing suppression records keep only the minimum needed to honour an opt-out for as long as it remains relevant. Records about legal claims, fraud or regulatory matters are kept longer only where that is necessary for an actual obligation, investigation or claim.

Our controls include separate authorised-user accounts, account authentication through the backend auth provider, role-based checks in application code, row-level database policies, authenticated server functions for user-scoped actions, CSRF middleware for server functions, input validation on server functions, same-site redirect checks on sign-in, signed and timestamp-checked Stripe webhooks, webhook event deduplication, rate limiting on public board reads, noindex metadata on public link pages, public-link revocation checks, and an audit-log table used by some administrative actions.

The project also records hashed device and network identifiers for login-sharing checks rather than storing raw IP addresses for that feature.

No service can be guaranteed completely secure. Customers must use unique accounts, protect credentials, limit roles and remove access promptly when no longer needed. Security concerns can be raised at privacy@salesgamez.com and we investigate reports promptly. We keep access to customer information limited to what is needed to run and support the service, and we rely on our hosting, backend and payment providers for data-centre security, encryption and backups.

For data for which SalesGamez is controller, SalesGamez will assess and document a personal data breach and make notifications to the ICO and affected individuals where the law requires.

For Customer Data, SalesGamez will notify the customer without undue delay after becoming aware of a personal data breach and provide reasonable assistance under the DPA. The customer remains responsible for deciding whether it must notify the ICO or affected people, unless law requires SalesGamez to notify directly.

Suspected breaches can be reported to privacy@salesgamez.com.

Subject to legal conditions and exceptions, individuals may have rights to be informed, access personal data, correct inaccurate data, request erasure, restrict processing, receive portable data in certain cases, object to processing based on legitimate interests, object absolutely to direct marketing, withdraw consent, and complain to the ICO. They also have protections concerning solely automated decisions that produce legal or similarly significant effects.

Account owners can exercise erasure directly. A close-account control in the subscription and payments area of the account cancels any remaining subscription and permanently deletes the account, the site, its users, the content entered in it and the associated billing customer record from our active systems, without needing to contact us first. Closure is immediate and irreversible, so anything still needed should be downloaded beforehand. We send a confirmation email to the account owner’s address recording that any remaining subscription was cancelled and that the account details were deleted. Because no record of the closed site is kept in our active systems, a later registration using the same email address is treated as a brand new site. Backup and legally required retention is described in the retention section.

We do not use solely automated decision-making to make legal or similarly significant decisions about individuals. Customers decide how to interpret or act on displayed performance information.

To exercise a right concerning data SalesGamez controls, email privacy@salesgamez.com or write to SalesGamez, 80A Ruskin Ave, London, DA16 3QQ. SalesGamez may verify identity. SalesGamez normally responds within one month and may extend by up to two further months where permitted, explaining the extension.

For Customer Data entered by an employer or other customer, contact that customer. SalesGamez will assist the customer as required by the DPA. You may complain to the Information Commissioner’s Office at ico.org.uk. Contacting SalesGamez first does not affect that right.

SalesGamez is a B2B workplace service and is not intended for children. Customers must not enter children’s data, special-category data or criminal-offence data unless SalesGamez has expressly agreed in writing and all legal and technical requirements have been met.

We may update this policy to reflect legal, operational or service changes. We will post the new version with its effective date and provide appropriate notice of material changes. A privacy-policy change does not expand our right to process Customer Data beyond the customer’s documented instructions.