Privacy Notice

1. Who we are

GG Entertainment Group Ltd is an independent games shop at 4 Cavendish Walk, Bolsover, Derbyshire, S44 6DB. We are the controller of the personal information described in this notice. That means we decide why and how it is used.

This notice is written under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Our Data Protection Lead is the Managing Director. You can contact us in the shop or through the contact details on ggentertainment.co.uk.

2. What information we collect

We only collect what we need. Depending on how you deal with us, this may include the following.

Customer details: your name, and contact details if you give them to us for an order, a pre-order or a reservation.
GG Guild and membership details: your name, contact details, date of birth or age band, membership status, table and PC time used, and member offer and member drop activity.
Purchase history: what you bought, when, and how you paid. Card payments are taken by our payment provider, and we do not see or store your full card number.
Trade-in seller records: your name, address, the items you sold or traded, the price paid, the date, and a photo of your ID. We cannot pay cash for a trade-in without photo ID recorded on file.
Parental consent records: if you are under 18 and want to use the upstairs gaming room or sell or trade with us, we record the consent of a parent or guardian, and their ID where required.
Website and online order data: account details, order and click and collect details, delivery address if delivery is offered, and technical data such as your IP address and browser type.
CCTV images: only if CCTV is in use at the shop. See our CCTV Policy (POL-18).
Enquiries: messages, emails and notes of conversations when you ask us a question, make a complaint or tell us about a problem.

3. Why we use it and our lawful basis

UK GDPR says we must have a lawful basis for using your information. Ours are set out below.

What we do	Information used	Lawful basis
Sell you goods and take payment	Purchase history, order details	Contract
Run click and collect and any delivery	Order, contact and address details	Contract
Run your GG Guild membership	Membership details, usage	Contract
Buy and record trade-ins, keep seller records and ID	Seller records, ID photo	Legitimate interests (preventing crime and the handling of stolen goods)
Keep accounting and tax records	Purchase and trade-in records	Legal obligation
Check consent for under-18s	Parental consent records	Legitimate interests (safeguarding)
Keep our systems and shop secure	Website data, CCTV if in use	Legitimate interests
Answer enquiries and complaints	Enquiry records	Legitimate interests
Send marketing emails or messages	Name, contact details	Consent

Where we rely on legitimate interests, we have weighed them against your rights and we only use the minimum information needed. Where we rely on consent, you can withdraw it at any time and it will not affect your purchases or membership.

4. How long we keep it

Information	How long we keep it
Trade-in transaction records	6 years from the date of the trade-in, for accounting purposes, then deleted
ID photos	2 years after your last trade-in, unless needed for a police enquiry, then deleted
Sales and purchase records	6 years, for accounting and tax
GG Guild membership data	For the length of your membership plus 2 years, then deleted
Parental consent records	For as long as the young person uses our services plus 2 years
Marketing details	Until you withdraw consent
Website and online order data	Order records for 6 years, technical logs for no more than 12 months
CCTV images, if in use	30 days, unless needed for an incident or by the police
Enquiries and complaints	2 years after the matter is closed

If we need to keep something longer, for example because of a legal claim or a police request, we will keep it only for as long as that need lasts.

We do not sell your information. We use other organisations to help run the business. They are called processors and may only use your information on our instructions. They include the following types of provider.

Our till provider, Epos Now, which holds sales and stock records from our tills.
Our payment provider, which processes card payments.
Our hosting and software providers, which store GG Vault and our website.
Our email provider, which sends order messages and any marketing you have agreed to.
Our accountants and professional advisers, when they need records to do their work.

We may also share information with the police, trading standards or other authorities where the law requires it or where it helps prevent or detect crime, for example a trade-in of items reported stolen.

6. International transfers

Some of our providers may store or access information outside the UK. We only allow this where the transfer is covered by safeguards that UK GDPR accepts, such as a UK adequacy decision or the International Data Transfer Agreement or UK Addendum. If you want to know more about the safeguards for a particular provider, ask us.

7. Children's information

Many of our customers are children and young people. We collect the least information we can about anyone under 18. Under-18s may only sell or trade with a parent or guardian present, who provides their own ID and consents. For under-18s using the upstairs gaming room or a membership, we record a parent or guardian's consent. We do not send marketing to a child without the consent of a parent or guardian.

8. Your rights

Under UK GDPR you have the right to:

be told how your information is used, which is the purpose of this notice
ask for a copy of the information we hold about you
ask us to correct information that is wrong or incomplete
ask us to delete your information, where we have no legal need to keep it
ask us to restrict how we use it, or object to use based on legitimate interests
withdraw consent for marketing at any time
ask for information you gave us to be provided in a portable format, where the right applies

To use any of these rights, tell a member of staff or contact us through ggentertainment.co.uk. We will reply within one month. We may ask you to prove who you are first. Some records, such as trade-in records and accounts, we must keep by law, and we will explain this if it affects your request.

9. Complaints and the ICO

If you are unhappy with how we have handled your information, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator, through ico.org.uk or by calling 0303 123 1113.

10. Changes to this notice

We review this notice at least every 12 months and when our services change, for example when online sales or delivery begin. The latest version is always on ggentertainment.co.uk and available in the shop.