Privacy Policy
1. Introduction and Data Controller
Man, 100m, Front (herein: "M100F", "we", "us", "our") operates the website at m100f.net ("the website"). M100F is the data controller responsible for your personal data collected through this website.
If you have any questions about this policy or wish to exercise any of your rights described below, please contact us at:
Man, 100m, Front – Data Controller
Email: webmistress@m100f.net
This policy describes what personal data we collect, why we collect it, the legal basis for doing so, and your rights in relation to that data. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. What Data We Collect
We collect the following categories of personal data:
- Discord account data: Your Discord account ID, username, and avatar image, collected when you sign in via Discord (the only supported sign-in method).
- Discord Guild membership: A list of the Discord servers (Guilds) you belong to, collected at the point of registration only, in order to verify your membership of our Discord server. This list is not stored or monitored after registration.
- Discord OAuth refresh token: A token used to maintain and refresh your Single Sign-On (SSO) session with Discord after initial registration.
- Mission sign-up data: Records of which missions (events) you have signed up for and the role you selected.
- User-generated content: Missions and events you create, and links to images you upload or reference in that content.
- Event-driven data: Logs of actions such as joining or leaving our Discord server, used for moderation and audit purposes.
- Technical/server logs: IP addresses, browser type, pages accessed, and timestamps may be recorded automatically by our hosting provider's server infrastructure. These are used for security, abuse prevention, and diagnosing technical issues.
We do not collect cookies beyond those strictly necessary to maintain your login session.
3. How and Why We Process Your Data
3.1 Legal basis
We process your personal data on the basis of legitimate interests (Article 6(1)(f) UK GDPR). Our legitimate interests are:
- Operating a mission-planning and event-coordination platform for our community;
- Maintaining accurate user profiles linked to Discord identities;
- Keeping audit trails of mission sign-ups and community moderation actions;
- Restricting content creation to verified members of our Discord server.
We have carried out a Legitimate Interests Assessment (LIA) and are satisfied that our interests are not overridden by the interests or fundamental rights of our users. You may request a copy of our LIA by contacting us at the address in Section 1.
3.2 Purposes of processing
| Data | Purpose |
|---|---|
| Discord account ID, username, avatar | Maintain an up-to-date user profile on the website |
| Discord Guild list | Verify server membership at registration only; not stored thereafter |
| OAuth refresh token | Keep your SSO session active without requiring repeated re-authentication |
| Mission sign-up data | Organise missions, allocate roles, and maintain an audit trail |
| User-generated content | Display and manage community-created missions and events |
| Event-driven (join/leave) data | Community moderation; ensuring only server members may create content |
| Server logs / IP addresses | Security, abuse prevention, and infrastructure diagnostics |
4. Data Processors and Third-Party Recipients
We use the following third-party organisations to operate the website. These parties act as data processors on our behalf and are bound by appropriate contractual arrangements (Data Processing Agreements where required under Article 28 UK GDPR):
- Hetzner Online GmbH (Germany) – our web server and infrastructure hosting provider. Data stored on servers located in Germany (EU). As Germany is subject to UK adequacy regulations, no additional transfer safeguards are required.
- Discord Inc. (USA) – provides our Single Sign-On authentication and supplies your Discord profile data to us. Data is transferred to the USA. Discord participates in recognised data transfer frameworks and relies on Standard Contractual Clauses (SCCs) for international transfers. Further details can be found in Discord's Privacy Policy.
We do not sell, rent, trade, or otherwise share your data with any other third party, except where legally required to do so by a competent authority.
5. Data Security
We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, or disclosure. These measures include:
- Encrypted connections (HTTPS/TLS) between your browser and our server;
- Access to personal data restricted to authorised administrative staff only;
- Use of OAuth 2.0 tokens rather than storing passwords;
- Regular software updates and security patching of our server infrastructure.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, affected individuals, in accordance with UK GDPR obligations.
6. Data Retention
We retain your data for the following periods:
| Data category | Retention period | Reason |
|---|---|---|
| Discord account data (profile) | Until you request deletion or anonymisation | Required while you are an active user |
| Mission sign-up records | Indefinitely (anonymised on account deletion) | Audit trail of community events |
| User-generated content (missions) | Indefinitely (disassociated from your identity on deletion) | Community record of past missions |
| Discord Guild list | Not retained beyond initial registration check | Membership verification only |
| OAuth refresh token | Until session expires or you delete your account | Required for active SSO session |
| Server logs | Up to 90 days | Security and diagnostics |
If you leave our Discord server, your account data will be retained until you actively request its deletion. You may request deletion or anonymisation of your personally identifiable data at any time by logging in and using the account deletion feature, or by contacting us directly. On deletion, your personal identifiers will be replaced with an anonymised placeholder; historical mission records will be retained in anonymised form only.
7. Your Rights
Under UK GDPR, you have the following rights in relation to your personal data. To exercise any of these rights, please contact us at the address in Section 1. We will respond within one calendar month of receipt.
- Right of access (Article 15): You may request a copy of the personal data we hold about you.
- Right to rectification (Article 16): You may ask us to correct inaccurate or incomplete personal data.
- Right to erasure (Article 17): You may request that we delete your personal data. Where we are required to retain certain data (e.g. anonymised audit records), we will explain this to you.
- Right to restrict processing (Article 18): You may ask us to pause processing your data in certain circumstances, for example while a dispute about accuracy is resolved.
- Right to data portability (Article 20): You may request that we provide your personal data in a structured, machine-readable format so you can transfer it to another controller.
- Right to object (Article 21): You may object to our processing of your data on the basis of legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
- Rights related to automated decision-making: We do not carry out any solely automated decision-making or profiling that produces legal or similarly significant effects.
8. Right to Complain to the ICO
If you are not satisfied with how we handle your personal data or respond to your rights request, you have the right to lodge a complaint with the UK supervisory authority:
Information Commissioner's Office (ICO)
Website: ico.org.uk
Helpline: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
We would, however, appreciate the opportunity to address your concerns before you contact the ICO.
9. Changes to This Policy
We may update this policy from time to time. The date at the top of this page will always reflect the most recent revision. Where changes are material, we will notify active users via a notice on the website or through our Discord server. Continued use of the website after notification of material changes constitutes acknowledgement of the updated policy. We recommend reviewing this page periodically.