USS Serenity Privacy Policy

Data Protection Notice Under UK GDPR

Last Updated: August 22, 2025

Effective Date: August 22, 2025

Data Controller: USS Serenity Roleplay Community

1. Introduction

Welcome to USS Serenity, a Star Trek-themed roleplay community. This privacy policy explains how we collect, use, and protect your personal data in compliance with the UK General Data Protection Regulation (UK GDPR).

Important Distinction: We process two types of data:

Real Personal Data: Your Steam account information (including Steam ID64 and username) and system usage data
Fictional Roleplay Data: Character profiles and in-game activities (not personal data)

2. Data Controller Information

Data Controller: USS Serenity Roleplay Community

Contact Email: [email protected]

Data Protection Contact: [email protected]

Website: USS Serenity LCARS System

3. Personal Data We Collect

3.1 Real Personal Data

Data Type	Source	Purpose	Legal Basis
Steam ID (64-bit identifier)	Steam API	User authentication	Legitimate Interest
Steam Username	Steam API	Account identification	Legitimate Interest
Steam Avatar Image	Steam API	Profile display	Legitimate Interest
Login timestamps	System logs	Account management	Legitimate Interest
Session cookies	Browser	Website functionality	Legitimate Interest

3.2 Fictional Roleplay Data (Not Personal Data)

Character names, ranks, species, departments, medical records, security reports, and all other roleplay content are fictional and not considered personal data under GDPR.

4. How We Use Your Data

Authentication: Steam ID to verify your identity and manage login sessions
Account Management: Username and permissions to control system access
Security: Login logs and session management to prevent unauthorized access
System Operation: Session data to maintain website functionality
Roleplay Activities: Linking your account to fictional character profiles

5. Data Retention

Data Type	Retention Period	Justification
User Account Data	Until account deletion requested	Service provision
Session Data	1 hour (automatic expiry)	Security
Login Logs	12 months	Security monitoring
Inactive Accounts	24 months of inactivity	Data minimization
Deleted Training Files	90 days in recycle bin	Recovery option

6. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

🔍 Right to Access: Request a copy of all personal data we hold about you
How to exercise: Use the "Download My Data" feature in your account settings
✏️ Right to Rectification: Correct any inaccurate or incomplete data
How to exercise: Edit your profile or contact us for account data corrections
🗑️ Right to Erasure: Request deletion of your personal data
How to exercise: Use "Delete My Account" in account settings or contact us
⏸️ Right to Restrict Processing: Limit how we process your data
How to exercise: Contact us with specific restrictions requested
📤 Right to Data Portability: Receive your data in machine-readable format
How to exercise: Use the data export feature in your account settings
⛔ Right to Object: Object to processing based on legitimate interests
How to exercise: Contact us with your objection

7. Third-Party Data Sharing

7.1 Steam (Valve Corporation)

We use Steam's authentication service, which involves:

Redirecting you to Steam's login page
Receiving your Steam ID and profile information
Making API calls to Steam servers (located in the United States)

Legal Safeguards: Steam operates under Privacy Shield framework and standard contractual clauses for international data transfers.

7.2 No Other Third Parties

We do not share your data with any other third parties, including:

No analytics services (Google Analytics, etc.)
No advertising networks
No social media platforms (beyond Steam authentication)
No email marketing services

8. Data Security

We implement appropriate technical and organizational measures:

Encryption: HTTPS encryption for all data transmission
Secure Sessions: HTTP-only, secure cookies with CSRF protection
Database Security: Prepared statements to prevent SQL injection
Access Controls: Role-based permissions system
Regular Updates: Security patches and vulnerability assessments

9. International Data Transfers

Your data may be transferred to:

Steam Servers (USA): For authentication purposes only
Safeguards: Adequate protection mechanisms in place
Duration: Only during login process

10. Consent and Legal Basis

Legitimate Interest: We process most data based on legitimate interest in operating a hobby roleplay community.

Consent: By creating an account, you consent to data processing as described in this policy.

Withdrawal: You can withdraw consent at any time by deleting your account.

11. Age Requirements

You must be at least 13 years old to use this service (Steam's minimum age requirement). If you are under 18, please ensure you have parental consent before creating an account.

12. Data Breach Notification

In the event of a data breach that poses high risk to your rights and freedoms, we will:

Notify relevant authorities within 72 hours
Inform affected users without undue delay
Provide clear information about the breach and remedial actions

13. Changes to This Policy

We may update this privacy policy from time to time. Changes will be:

Posted on this page with updated "Last Updated" date
Announced to users via system notification
Emailed to users for significant changes (if email addresses available)

14. Contact Us

For any questions about this privacy policy or to exercise your rights:

Privacy Email: [email protected]
General Contact: [email protected]
Data Protection Queries: Use the contact form in your account settings
Postal Address: [To be provided based on actual organization details]

Supervisory Authority: If you have concerns about our data processing, you can contact the UK Information Commissioner's Office (ICO) at ico.org.uk

Return to USS Serenity