Privacy Notice

Last updated: 28 September 2026.

This Privacy Notice explains how personal information is collected and used when you visit winnar.games, join the Win Nar & Loo Sars playtest or launch list, or contact us through the website.

1. Who is responsible for your information?

Win Nar & Loo Sars is responsible for the personal information collected through this website and acts as the data controller for that information.

For privacy, data protection or legal enquiries, contact the Contact Us form.

2. Information we collect

We collect only the information needed for the services offered on this website.

• Playtest and launch list: your email address.
• Contact form: your name, email address, subject and message.
• Optional analytics: if you accept analytics, Google Analytics 4 processes cookie identifiers, page views, session information, browser/device details and approximate location to help us understand visits. We do not send names, email addresses, contact messages or other form contents to Google Analytics. We remove URL query strings and fragments from the page addresses we send and do not send referring page addresses.
• Technical information: limited technical and security information may be processed automatically when you visit the site, such as IP address, request data, device/browser information and security logs, where required to operate, protect and troubleshoot the website.

Please do not send sensitive personal information through the contact form unless it is genuinely necessary for your enquiry.

3. How we use your information

We may use personal information to:

• manage requests to join playtests or receive launch news;
• send communications you have requested or agreed to receive;
• respond to questions, feedback, press, partnership or other enquiries;
• operate, secure, maintain and improve the website;
• prevent abuse, spam, fraud or misuse of the website; and
• comply with legal obligations and protect legal rights.

4. Our lawful bases

Under UK data protection law, we need a lawful basis for each use of personal information.

• Consent: where you actively ask to receive playtest invitations, launch news or other electronic marketing, or choose to accept optional analytics. You can withdraw that consent at any time.
• Legitimate interests: where necessary to respond to enquiries, operate and secure the website, prevent misuse, maintain records and protect our business and legal rights, provided those interests are not overridden by your rights and interests.
• Legal obligation: where processing is necessary to comply with applicable law.

Where electronic marketing rules require consent, we will rely on consent and provide an easy way to unsubscribe.

5. Email communications and marketing

If you join the playtest or launch list, we may send you occasional emails about playtesting, availability and Win Nar & Loo Sars news.

You can unsubscribe at any time using an unsubscribe method provided in the message or by contacting the Contact Us form.

You have an absolute right to object to the use of your personal information for direct marketing at any time.

6. Who processes your information?

We may use trusted service providers to operate the website and communications. At launch these may include:

• Cloudflare, for website hosting, delivery, security and related infrastructure;
• Resend, for delivery of website-generated email and related communications; and
• Google, for Google Analytics 4, only if you accept analytics. See Google’s Privacy Policy and how Google uses information from sites that use its services.

These providers may process limited personal information on our behalf where needed to provide their services. We do not sell your personal information.

7. International transfers

Some service providers operate internationally, which means personal information may be processed outside the United Kingdom. Where required, we expect appropriate legal safeguards to be used for those transfers, such as recognised adequacy arrangements or approved contractual safeguards.

You can contact the Contact Us form if you would like more information about safeguards relevant to your information.

8. How long we keep information

• Playtest and launch list: until you unsubscribe, withdraw consent, or the list is no longer needed, subject to keeping a limited suppression record where necessary to respect an opt-out.
• Contact enquiries: normally for up to 24 months after the enquiry is resolved, unless a longer period is reasonably required for an ongoing relationship, dispute, legal obligation or legal claim.
• Google Analytics: event-level data is retained for 2 months. User-level data is retained for 14 months, with that period reset on new activity. Aggregated standard reports may be retained longer. These server-side periods are separate from the 90-day browser cookie and consent-choice lifetimes described below.
• Technical and security records: for only as long as reasonably necessary for security, diagnostics and legal compliance, taking account of the retention settings of our infrastructure providers.

9. Cookies and similar technologies

Analytics is off by default. We load Google Analytics only after you choose Accept analytics. Choosing Reject analytics leaves it off and does not prevent you from using the site or its forms. We do not use analytics for advertising, remarketing or Google signals.

Our consent controls use basic Google Consent Mode. Analytics and advertising consent start as denied. Accepting enables analytics storage only; advertising storage, advertising user data and advertising personalisation remain denied.

• winnar.analytics-consent.v1: essential browser local storage records your accept/reject choice and its expiry for 90 days, so we can respect your preference. It is not an advertising identifier.
• _ga and _ga_*: optional first-party Google Analytics cookies distinguish visits and sessions. We configure a maximum cookie lifetime of 90 days without extending it on each visit. Your browser may delete them sooner.

Use Cookie preferences at the bottom of any page to change your choice or withdraw consent by selecting Reject analytics. This stops further analytics collection and removes the accessible Google Analytics cookies on this site. Withdrawal does not undo processing that occurred while consent was given. Clearing browser storage or using another browser or device means you will be asked again.

Cloudflare or other infrastructure providers may use strictly necessary technologies or process technical information needed to deliver, secure and protect the website.

10. Your data protection rights

Depending on the circumstances, UK data protection law may give you rights to:

• request access to your personal information;
• ask us to correct inaccurate information;
• ask us to erase information;
• ask us to restrict certain processing;
• object to certain processing, including direct marketing;
• receive certain information in a portable format; and
• withdraw consent where we rely on consent.

These rights are subject to legal conditions and exceptions. To exercise a right, email the Contact Us form. We may need to verify your identity before acting on a request.

11. Complaints

If you have a concern about how we use your personal information, please contact us first at the Contact Us form so we can try to resolve it.

You also have the right to complain to the UK Information Commissioner’s Office (ICO), the UK supervisory authority for data protection.

12. Security

We use reasonable technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse or disclosure. No website or electronic transmission can be guaranteed to be completely secure.

13. Children

This website is not designed to knowingly collect personal information from children. If you believe a child has submitted personal information through the site, contact the Contact Us form.

14. Changes to this notice

We may update this Privacy Notice when the website, our services or legal requirements change. The latest version will be published on this page with an updated date.

15. Contact

For privacy and legal enquiries, use the Contact Us form. Messages can be routed internally to the appropriate legal contact without publishing the mailbox address.