PRIVACY POLICY

WHO WE ARE

BehaviourOps is a trading name of CRMDA Ltd, a company registered in England. Contact for privacy matters: behaviourops@crmda.co.uk

WHAT DATA WE COLLECT AND WHY

We collect the minimum data necessary to run this service.

Players in our games: On our free public challenges, players enter a display name only - no account, no email. When an organisation runs a private campaign, the campaign owner chooses what their players provide: an alias only, a display name and team (the default), or - only where the organisation actively opts in - name, work email and team. Individual information is collected only to the extent the campaign owner has enabled, and is linked to that organisation's private campaign rather than any public board.

Facilitators (portal users): When you register as a facilitator, we collect your name and work email address. We use this to give you access to the facilitator portal and to send you session reports.

Customers purchasing a licence: We collect your name, company name, and work email address. Payment is processed directly by Stripe - we never see, store, or handle your card details.

People who contact us: Name, email, and the content of your message.

HOW WE USE YOUR DATA

• To create and manage your facilitator account.
• To deliver your licence and send session reports.
• To respond to your enquiries.
• To improve our games and platform.

We do not sell your data. We do not use your data for advertising.

LEGAL BASIS (GDPR)

• Contract performance: delivering the licence you purchased.
• Legitimate interests: platform security and fraud prevention.
• Consent: any marketing emails (opt out any time).

WHO WE SHARE DATA WITH

• Stripe - payment processing (PCI DSS certified). Stripe receives name, email and payment details.
• Base44 - our platform infrastructure provider (SOC 2 Type II and ISO 27001 certified).

No other third parties. We do not sell or share data for marketing.

WHERE YOUR DATA IS STORED

BehaviourOps runs on the Base44 platform. Data is stored on servers in the United States. Base44 uses Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework (DPF) to ensure GDPR-compliant international data transfers.

HOW LONG WE KEEP YOUR DATA

• Facilitator accounts and licence records: duration of licence plus 12 months.
• Session data (team names, scores): 12 months from session date.
• Financial records: 7 years (required by UK law).
• Contact enquiries: 12 months.
• Cyber Awareness Month campaign results (scores and any identification enabled by the campaign owner): retained for the duration of the campaign plus 90 days, then deleted unless the organisation requests otherwise.

You can request deletion at any time.

YOUR RIGHTS (GDPR AND UK GDPR)

You have the right to: access your data / correct inaccurate data / request deletion / restrict processing / data portability / object to processing / withdraw consent.

Email behaviourops@crmda.co.uk. We will respond within 30 days.

COOKIES

See our Cookie Policy.

CONTACT

behaviourops@crmda.co.uk