Privacy policy

1 Who we are

1.1 This privacy policy explains how Joel Bondoux, trading as Hill to Die On (“we”, “us”, “our”) collects and uses personal data through the website at directorofrealms.com, including its subdomains (the “Site”), and the rights you have over that data.

1.2 We are the controller of the personal data described in this policy for the purposes of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.

1.3 You can contact us about this policy or your personal data by email at dor@joelbondoux.net.

1.4 This policy covers the Site and our limited use of details Patreon makes available to us when you join our linked A Hill to Die On creator membership. Patreon is a separate service and handles its own account, payment and cookie data under its privacy policy and cookie policy. The Director of Realms software will have separate privacy information before its public release.

2 Personal data we collect, and why

2.1 Technical data when you visit the Site. When your browser requests a page or file from the Site, it sends information to our hosting provider, Cloudflare, Inc. (“Cloudflare”), including your IP address, the date and time of the request, the address of the page or file requested, the address of the page you came from and your browser’s user-agent string. Cloudflare uses this information to deliver the Site to you and to protect it, for example against denial-of-service attacks and malicious bots, and may set a strictly necessary security cookie to do so, as described in our cookie policy.

(a) Purpose: to provide the Site and keep it secure.

(b) Lawful basis: our legitimate interests in operating a secure, working website (Article 6(1)(f) UK GDPR).

2.2 We do not add analytics, advertising or tracking technologies to the Site, and we do not use technical data to identify you, to build a profile of you or to follow you across other websites. Cloudflare’s dashboard shows us statistics about traffic to the Site, such as the number of requests and the countries they come from, and details of individual requests that its security features block or challenge. We use these only to keep the Site running and secure.

2.3 When you email us separately. If you email us, we receive your email address, your name if you include it, the content of your message and anything in its attachments or signature.

(a) Purposes: to read and reply to your message and, only if you explicitly ask by email, to send you Director of Realms development news.

(b) Lawful bases: our legitimate interests in answering enquiries about our work (Article 6(1)(f) UK GDPR), for replies; and your consent (Article 6(1)(a) UK GDPR), for separate email news. You can withdraw that consent at any time by telling us. Clicking the Patreon link or joining there does not give consent to a separate email list on this Site.

(c) We will only send you news about Director of Realms. We will not sell, rent or share your email address with anyone for their own marketing.

2.4 Patreon free membership. The Site has an ordinary link to our A Hill to Die On creator page on Patreon. This Site does not embed Patreon code or send your name or email address to Patreon. If you follow the link, your browser visits Patreon; joining there is optional and Patreon handles the account under its own policies. Patreon may then make your profile name, email address (depending on your settings) and membership status available to us as the creator. We use those details to administer the membership and respond to member enquiries. Patreon may deliver our creator updates through your Patreon account or email under your Patreon settings. Our lawful basis for our limited use of member details is our legitimate interest in running the creator community you chose to join (Article 6(1)(f) UK GDPR). We do not add Patreon members to a separate Site mailing list merely because they joined.

2.5 The build number. Pages on the Site show the current development build number of Director of Realms. Your browser fetches it from the Site itself, at /api/version, and that request is handled like any other request under clause 2.1. The Site reads the number from our code repository on GitHub on its own behalf; no information about you is sent to GitHub.

2.6 Your browser’s storage. The Site stores one item in your browser’s local storage to record that you have read the cookie notice, as described in our cookie policy. It holds the version of the notice and the date you read it, stays on your device and is never sent to us.

2.7 We do not make decisions about you based solely on automated processing, including profiling.

2.8 The Site is not directed at children, and we do not knowingly collect personal data from children under 13. If you believe a child has sent us personal data, please contact us and we will delete it.

3 Who we share personal data with

3.1 We use the following service providers, who process personal data on our behalf, only on our instructions and under contracts that require them to keep it secure:

(a) Cloudflare, Inc., which hosts, delivers and protects the Site; and

(b) our email hosting provider, which receives, stores and sends our email.

3.2 Patreon is not an embedded service on this Site. When you choose to visit it, Patreon handles your account and may share membership details with us as described in clause 2.4. Patreon's own privacy policy explains its sharing and your account controls.

3.3 We may also disclose personal data where the law requires us to, or where it is necessary to establish, exercise or defend legal claims.

3.4 We do not sell personal data.

4 International transfers

4.1 Cloudflare operates a global network, and our service providers may process personal data outside the United Kingdom, including in the United States. Where personal data is transferred outside the United Kingdom, it is protected by a safeguard recognised by UK data protection law, such as UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework, for providers certified under it), or the International Data Transfer Agreement or International Data Transfer Addendum issued by the Information Commissioner.

4.2 If you choose to join on Patreon, it may process your account and membership details internationally as described in Patreon's privacy policy. Our access to the membership details it makes available to us is described in clause 2.4.

5 How long we keep personal data

5.1 Technical data under clause 2.1 is kept by Cloudflare for the limited periods set out in its own policies. We do not keep our own copies.

5.2 We keep correspondence for as long as we need it to deal with your enquiry, and then for up to two years in case you contact us again about the same matter, unless you ask us to delete it sooner.

5.3 If you separately asked by email for development updates, we keep your address until you ask us to stop contacting you, or until twelve months after Director of Realms is first released to the public, whichever comes first.

5.4 We access member details within our Patreon creator account as needed to manage your membership. Patreon determines how long it keeps information on its platform under its own privacy policy. Any separate correspondence you send us is handled under clause 5.2.

5.5 We may keep personal data for longer where the law requires it, or where it is needed to establish, exercise or defend legal claims.

6 Your rights

6.1 Under UK data protection law you have the right to:

(a) be informed about how we use your personal data, which is the purpose of this policy;

(b) access your personal data and receive a copy of it;

(c) have inaccurate personal data corrected, and incomplete data completed;

(d) have your personal data erased;

(e) restrict how we use your personal data;

(f) object to our use of your personal data where we rely on our legitimate interests, and to direct marketing at any time;

(g) receive personal data you have given us in a structured, commonly used and machine-readable format, and have it sent to another controller, where we process it on the basis of your consent and by automated means; and

(h) withdraw your consent at any time, where we rely on it.

Some of these rights apply only in certain circumstances.

6.2 To exercise any of these rights, email us at dor@joelbondoux.net. We may ask you to confirm your identity before we act on a request. We will respond without undue delay and in any event within one month of receiving your request. We may extend that by up to two further months if a request is complex, or if you have made several, and if we do we will tell you why within the first month. We do not normally charge a fee.

6.3 If you have a concern about how we handle your personal data, please tell us first so that we can try to put it right. You also have the right to complain to the Information Commissioner’s Office, the UK’s data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

7 Security

7.1 We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss and misuse. The Site is served over encrypted HTTPS connections, and its pages load no third-party scripts. No method of transmission or storage is completely secure, however, and we cannot guarantee the security of information you send us by email.

8 Changes to this policy

8.1 We may update this policy from time to time, for example as Director of Realms develops. The date at the top of this page shows when it last changed. Where a change significantly affects how we use personal data you have already given us and we have your email address, we will tell you before the change takes effect.