Privacy notice
Last updated: 1 January 2026
Contents 13 sections
This notice explains how we use your personal data when you use legiongaming.co.uk: when you browse, create an account, buy from the shop, or show your work as a painter. It also explains your rights and how to complain.
1. Who we are
1.1 Legion Gaming is a trading name of Legion Comps Ltd, a company registered in England and Wales with company number 17307226. Our registered office is Unit A 82 James Carter Road, Mildenhall, IP28 7DE, United Kingdom. We're registered with the Information Commissioner's Office under number ZA000000.
1.2 The company is the controller of your personal data. That means it decides how and why your data is used, and it's responsible for looking after it. "We", "us" and "our" in this notice mean the company. As well as this site, the company runs a website under its own name, and it's the controller there too.
1.3 One account works across the company's websites. If you create an account on one, you can sign in to the other with the same email address and password. You sign in to each site separately. What you do on one site isn't shown on the other, apart from your account details. Because it's one account, a request to see or delete your data covers what the company holds about you on both sites, apart from records the law requires us to keep.
1.4 This notice covers legiongaming.co.uk. The company's other website has its own privacy notice for what you do there, which you can read on that site.
1.5 Contact us about this notice or your data at hello@legiongaming.co.uk, by phone on 0800 000 0000, or by post to our registered office. Please mark letters "Data protection".
2. What we collect and why
The table below shows what we collect, what we use it for, and our lawful basis under data protection law.
| What you do | What we collect | What we use it for | Our lawful basis |
|---|---|---|---|
| Create an account | Name, username, email address, password (stored in scrambled form only), phone number (if you give it), and the site you signed up on | To run your account and keep it secure | Contract with you. Legitimate interests (security) |
| Buy from the shop | Your order, delivery name and address, email and phone for the courier, postage choice, payment status and reference. Your card details go straight to our payment provider; we never see your full card number | To take payment, deliver your order, send order emails, and handle returns, refunds and complaints | Contract with you |
| Records of orders and payments | To keep the accounts and tax records the law requires | Legal obligation | |
| Buy as a guest (without an account) | Your name, email address, delivery address and phone number (if you give it), and the order details above | As above. If you later create an account with the same email address and confirm it, or sign in to one, we add the order to that account so you can see all your orders in one place. We don't send guests marketing emails | Contract with you. Legitimate interests (keeping your orders together) |
| Download a digital product | When you agreed to the download starting straight away; each download's date and time, IP address and browser type | To give you your files, show you agreed to immediate supply, and deal with misuse and disputed payments | Contract with you. Legitimate interests (preventing fraud and defending payment disputes) |
| Use the address finder | The postcode you type | To look up your address | Contract with you |
| Contact us or complain | Your messages, and our notes and replies | To answer you and put things right | Contract with you. Legitimate interests (improving our service). Legal obligation, for data protection complaints |
| Report content | Your account, what you reported, why, and any details you add | To review the report, act on it and tell you what we did, as the Online Safety Act 2023 requires | Legal obligation. Legitimate interests (keeping the site safe) |
| Get our marketing emails | Your email address, your Legion Gaming email preference, and when and where you gave it | To send you news and offers from Legion Gaming | Your consent, or our soft opt-in after a purchase (see section 4) |
| Browse the site | IP address, browser type, pages requested, and error reports | To run the site, keep it secure and fix faults | Legitimate interests (running a secure website) |
| Have a painter profile | See section 5 | ||
| Leave a review | See section 6 |
If you don't give us information we need, such as a delivery address, we may not be able to complete your order.
We don't collect special category data (for example, about your health or beliefs) or criminal offence data.
3. Children and young people
You don't have to be a particular age to browse, create an account or buy from us, and we don't ask for your age. Painter profiles are only for people aged 18 or over (see our painter terms). If you're under 13, you need a parent's or carer's permission before you tick the box to get our marketing emails. If you're a parent or carer and you're worried about data your child has given us, contact us (section 1.5).
4. Marketing
4.1 Each site asks separately. Each of the company's websites asks for its own permission to send you marketing. Agreeing to Legion Gaming emails doesn't sign you up to emails from any other site, and agreeing on another site doesn't sign you up here. The unsubscribe link in an email takes you off that site's marketing only.
4.2 Legion Gaming emails. We'll send you news and offers about our shop and painters only if:
- you ticked the Legion Gaming marketing box; or
- you bought from us, we gave you a chance to say no when you ordered, and you didn't. In that case we'll only email you about similar products we sell (this is the "soft opt-in" that the law allows).
4.3 We never use your Legion Gaming account or shopping to send you marketing for the company's other website. You'll only get its marketing if you've agreed to it there.
4.4 When we stop marketing on every site. If you've self-excluded on the company's other website, we won't send you marketing from any of our sites while your self-exclusion lasts. We also stop all marketing to an email address if you report one of our emails as spam, or if emails to it can't be delivered.
4.5 You can unsubscribe at any time, using the link in every marketing email or in your account settings. Unsubscribing from marketing doesn't stop order and account emails.
4.6 We don't sell your data, and we don't share it with anyone else for their marketing.
5. If you're a painter
5.1 Your public profile. If you apply for a painter profile, we collect and publish what you give us for it: your display name, bio, region (a county or town, never your address), avatar and banner images, styles, portfolio pieces (images, titles, descriptions and tags), price tiers and turnaround times, and whether you're taking commissions. Our staff check everything before it goes live. Anyone can see an approved profile, including people without an account. Search engines may index it.
5.2 Your private trader details. We also ask for your legal name, trading name, business address and business email. Only our staff can see these today. We use them to check who you are and to contact you about your profile.
5.3 Moderation. We keep records of our decisions about your profile and content (approvals, rejections, suspensions and the reasons), and of reports other people make about it. When we reject or take down an image, we delete it.
5.4 Lawful bases. Contract with you (hosting your profile under the painter terms). Legitimate interests (running a safe, trustworthy directory). Legal obligation (our duties under the Online Safety Act 2023).
5.5 If and when we open commissions, the law will require us to show customers some of your trader details before they buy from you, such as your trading name and business address. Our payment provider may need to verify your identity and bank details. We may also have to report what you earn through the site to HM Revenue & Customs under the digital platform reporting rules, which would mean collecting your date of birth and tax reference (National Insurance number or UTR). None of this happens yet. We'll update this notice, and tell you, before we start collecting or sharing any of it.
6. Reviews
6.1 Reviews of painters are published with the reviewer's display name, rating, text and date. Only a customer who has completed a commission with that painter can review them. Commissions aren't open yet, so reviews can't be left yet.
6.2 Painters can publish one reply to each review. We check replies before they're published.
6.3 We keep a record of each review, any changes to whether it's shown, and the reasons, so we can show we publish reviews fairly. See our review policy.
6.4 Lawful basis. Legitimate interests (helping customers choose a painter, and meeting our legal duties on reviews).
7. Who we share your data with
7.1 Service providers who work for us under contract and use your data only on our instructions:
| Provider | What they do for us | Where your data is processed |
|---|---|---|
| Railway Corporation | Hosts our website, database and files | EU (Amsterdam). Railway is a US company and may access data from the US |
| DNA Payments | Card payments | UK |
| Mailgun | Sends our emails and records delivery | EU |
| Sentry | Error monitoring, which can include the page and account involved in an error | EU |
| Cloudflare (Turnstile) | Checks that the person using our painter application and painter contact forms isn't a bot. It sees your IP address and browser and device signals when you use those forms | Worldwide, including the US. Safeguard: the UK–US data bridge or UK-approved contract terms (section 8) |
| Ideal Postcodes | Address finder | UK |
| Royal Mail (Click & Drop) | Postage labels and delivery | UK |
| Sendcloud | Postage labels and courier booking | EU (Netherlands) |
7.2 Couriers receive your name, delivery address, and email or phone number so they can deliver your parcel and send you tracking updates.
7.3 The public sees approved painter profiles, portfolio pieces, published reviews and painters' replies. A painter you message sees your name and what you write to them on our site, never your email address, and you don't see theirs. Our staff can read a message only if someone reports it.
7.4 Authorities. We share data with HM Revenue & Customs, the police, Ofcom, Trading Standards, the courts or other authorities when the law requires it, or when it's needed to prevent or detect crime.
7.5 Professional advisers, such as our lawyers, accountants and insurers, when they need it to advise us.
7.6 A buyer of our business. If we sell or reorganise our business, the new owner may receive your data and use it as this notice describes.
8. Data sent outside the UK
Some of our providers process data outside the UK, as the table in section 7 shows. Where they do, we protect it either by using countries the UK government has approved as having adequate protection (including the EU and, for certified US companies, the UK–US data bridge), or by using contract terms approved for UK transfers. Contact us for details of the safeguard for a particular provider.
9. How long we keep your data
| Data | How long |
|---|---|
| Orders (including guest orders), payments, refunds and invoices | 7 years after the order, for tax and accounting and in case of a dispute |
| Download records (IP address and browser) | For as long as we keep the order record* |
| Your account | Until you ask us to delete it. We delete or anonymise it within 30 days, except records we must keep for one of the other reasons in this table |
| Painter profile and portfolio | While your profile is live. If we reject an image, we keep it for 30 days so you can contest it, then delete it; if staff take an image down, we delete it straight away. A rejected application is deleted 6 months after the decision. A suspended profile is deleted 12 months after the suspension, unless it is reinstated first. If you close your profile, we delete it within 30 days. In each case we delete everything except your display name, which we keep with any reviews of you for the review period below |
| Painter moderation records and content reports | 3 years after the decision, so we can deal with repeat problems and complaints. A report we haven't dealt with yet is kept until we have |
| Messages between you and painters | 12 months after the last message in the conversation, or sooner if your account or the painter's profile is deleted |
| Reviews and review records | While the painter's profile is live, then 3 years |
| Complaints and correspondence | 3 years after the complaint closes, or 7 years if it's about an order* |
| Marketing preferences | While you have an account, and a record of an unsubscribe for as long as we need it to make sure we don't email you again |
| Server logs | Up to 90 days |
10. Cookies
At the moment we only use cookies that are strictly necessary for the site to work: to keep you signed in, to remember what's in your basket, and to protect forms against misuse. These don't need your consent. We don't use analytics or advertising cookies on this site. If we ever want to, we'll ask you first, and we'll update this notice.
11. Your rights
You have the right to:
- access the personal data we hold about you;
- correct data that's wrong or incomplete;
- delete your data, where we don't need to keep it;
- restrict how we use it, in some circumstances;
- object to us using it on the basis of our legitimate interests, and object at any time to direct marketing;
- move data you gave us to another provider, where we use it on the basis of your consent or a contract;
- withdraw consent at any time, where we rely on it. This doesn't affect what we did before.
To use any of these rights, contact us (section 1.5). It's free. We may need to check your identity. We'll reply within one month, or tell you if we need longer (up to two further months for complex requests).
12. Complaints about how we use your data
12.1 If you're unhappy with how we've used your personal data, please complain to us first. Use our complaints form and choose "My personal data", or email hello@legiongaming.co.uk with "Data protection complaint" in the subject line.
12.2 We'll acknowledge your complaint within 30 days of receiving it, look into it, keep you updated, and tell you the outcome without undue delay.
12.3 You can also complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113) at any time. The ICO will usually expect you to have complained to us first.
13. Changes to this notice
We'll update this notice when how we use your data changes, and show the date at the top. If a change matters to you, such as a new use of your data, we'll tell you before it happens.
Questions about this page?