Legal

The Games Ark Privacy Policy

Last updated 1 November 2026

This policy explains how Games Ark Ecosystem CIC uses personal information for its public website, mailing lists, enquiries, community activities and events. It also explains the limited browser storage used by the Shipyard demonstration and how we will provide information before launching additional account services.

We handle personal information under the UK General Data Protection Regulation and the Data Protection Act 2018, as amended, and the Privacy and Electronic Communications Regulations where applicable.

1. Who we are

The Games Ark is operated by:

Games Ark Ecosystem CIC

Company number SC902885

The School House, Aberfeldy PH15 2JQ, United Kingdom

For the purposes of data protection law, Games Ark Ecosystem CIC is the data controller for the personal information covered by this policy.

If you have questions about this Privacy Policy or how we use your information, contact us at contact@thegamesark.org.

2. Information we collect

We collect information you give us through forms, email, event registrations, incubation expressions of interest and ARK Framework enquiries. Depending on your request, this includes your name, email and preferred delivery address, country, organisation, role, career or education stage, skills, experience, interests, project and team information, and messages.

For mailing lists, we record your selected topics, date and method of consent and the wording presented. Providing optional information is voluntary. We need an email address to deliver subscribed updates and sufficient contact information to answer your request. If required information is missing, we may be unable to provide the requested service. Public browsing does not require a subscription.

Our hosting and security providers process technical request information such as IP address, browser and device information, requested pages, timestamps and security signals to deliver and protect the website. Browser storage is explained in Section 10.

Most information comes directly from you or your device. Community moderation information may also come from Discord interactions and reports from other members. If we receive information about you from an event partner or another source, we will explain the source and use within the legally required period, unless an applicable exception applies.

Please do not submit sensitive personal information, confidential project material or information about other people unless it is necessary for your request and you are entitled to provide it. Where we need special-category information, such as accessibility or health details, we will explain its purpose and the applicable legal conditions separately.

The Shipyard demonstration uses mock examples and temporary browser state. It is separate from a production account service. Before accepting personal information for any new Shipyard account or pilot feature, we will provide a notice covering the actual features, fields, visibility and recipients. This policy does not describe an unlaunched feature as operational.

3. How we use your information

We use personal information for the following purposes.

Website operation

To:

Operate and maintain the website
Keep the website secure
Prevent abuse and malicious activity
Diagnose technical problems
Improve the website

Incubation programme

If you register your interest in a Games Ark Ecosystem incubation programme, we use the information you provide to:

Understand interest in future programmes
Plan future programmes
Contact you about relevant incubation opportunities
Tell you when applications open
Communicate with you about the programme

Registering your interest does not guarantee a place on an incubation programme.

The ARK Framework™

If you contact us about The ARK Framework™, we use your information to:

Respond to your enquiry
Provide information about the Framework
Discuss licensing
Discuss training or certification
Discuss potential partnerships
Manage communications with organisations interested in the Framework

Events

Where you register for or enquire about a Games Ark event, we may use your information to:

Manage your registration
Communicate important event information
Respond to questions
Manage attendance
Provide information relating to the event

General enquiries

If you contact us, we use your information to respond to your enquiry and manage any resulting conversation or relationship.

Mailing lists

We use your selected email address and topic preferences to send only the optional email updates you choose, manage subscriptions and record consent.

4. Our lawful bases for processing

We use the following lawful bases under UK GDPR.

Consent: optional GDC 2027 emails, general Games Ark News & Events emails and ongoing promotional incubation updates. These use separate, affirmative choices. Giving us information or accepting this policy does not itself constitute marketing consent. You can withdraw consent at any time.

Legitimate interests: answering general and Framework enquiries, planning programmes from expressions of interest, administering free community activities, proportionate moderation, delivering and securing the website, and preventing abuse. Our interests are providing useful services, managing relationships and protecting users. We consider necessity, reasonable expectations and the impact on individuals and do not rely on this basis where your interests or rights override ours.

Contract: processing necessary for a booking or agreed service, or steps towards an agreement that you ask us to take. Where a free activity does not involve a contract, we use legitimate interests for necessary administration. Promotional emails remain subject to consent.

Legal obligations: processing necessary to meet applicable legal duties, including responding to data protection requests and retaining records where the law requires it. Otherwise, keeping proportionate compliance evidence and minimal unsubscribe suppression records is based on our legitimate interests in demonstrating compliance and respecting preferences.

For any special-category data, an Article 6 basis alone is insufficient. We will identify and explain an applicable Article 9 condition before requesting it. We do not switch to legitimate interests to continue consent-based marketing after withdrawal.

5. Incubation Register Interest

Games Ark Ecosystem may operate research-led incubation programmes that test and evaluate approaches to practical experience, team formation and sustainable game studio development.

Our Register Interest form allows people to tell us that they are interested in future programmes. The form may ask for:

Name
Email address
Country
Career or education stage
Primary discipline
Skills
Game development experience
Information about an existing project
Whether you have a team
What you hope to gain from incubation
What you would like to build

We use this information to understand potential interest, inform programme planning and communicate with people about relevant incubation opportunities. Registering interest does not enrol you in a research activity.

We will not sell this information.

We will not use information provided through the registration form for unrelated marketing without an appropriate lawful basis.

You can ask us to remove your information at any time.

We distinguish responding to your specific request from sending future promotional updates. We seek a separate opt-in for ongoing incubation opportunity emails; registering interest does not subscribe you to the general Games Ark or GDC mailing lists. Any later research activity will require separate information and any consent or other lawful basis appropriate to that activity.

6. The ARK Framework™ enquiries

The ARK Framework™ is a framework for responsible volunteer-led and incubation game programmes.

If you contact us about the Framework, we may collect your:

Name
Email address
Organisation
Organisation type
Country
Area of interest
Message

We use this information to respond to your enquiry and, where appropriate, discuss:

Framework licensing
Training
Certification
Programme assessment
Educational use
Partnerships

7. Emails and marketing

The Games Ark offers two separate optional email subscriptions:

GDC 2027 Updates: information about GDC Festival Pass opportunities, Games Ark Voices, networking events and other Games Ark GDC 2027 activities.
The Games Ark News & Events: updates about our community events, programmes, initiatives and opportunities beyond GDC.

You can choose either subscription, both or neither using separate, unticked choices. We rely on your consent for these mailing lists. Joining Discord, registering for an event, making an enquiry, registering incubation interest or using Shipyard does not automatically subscribe you. Choosing neither will not prevent access to unrelated services.

We record the topics selected, the date and method of opt-in and the consent wording presented. We use Google Forms to collect sign-ups, Google Sheets to manage subscription and consent records, and Hostinger Mail for email communications. Only authorised people who need the information can access it.

Every marketing email will identify The Games Ark and provide a simple, free way to unsubscribe, such as an unsubscribe link or instructions to reply. You can also email contact@thegamesark.org to change your preferences or stop either or both subscriptions. We stop marketing on withdrawal and remove the address from active lists within 30 days; this administrative period is not permission to continue sending marketing.

We will review the GDC 2027 list after the event and close it within three months of the event ending, after any relevant follow-up within the original consent. We will not transfer GDC-only subscribers to the general list without a separate opt-in. We review the general list at least annually and remove records where consent is no longer appropriate or reliable. We do not sell email addresses or give mailing lists to partners for their own marketing.

We may send necessary, non-promotional responses and service messages about an enquiry, registration or account independently of marketing preferences. These messages will not be used to bypass an unsubscribe.

We do not sell personal information or provide our mailing lists to partners for their own marketing.

Our service providers include:

Google Forms and Google Sheets for collecting form responses and managing responses, subscriptions and consent records.
Hostinger for domain and DNS services and Hostinger Mail for sending and receiving email.
Lovable for website delivery, with Cloudflare infrastructure for edge delivery and security.
Discord for the community platform, as explained in Section 9.

Authorised staff, volunteers and administrators access information only where needed for their responsibilities. Service providers receive information needed to deliver their services. Where a provider processes information on our behalf, the relationship requires appropriate contractual data protection terms. Providers may also process limited information for their own purposes under their applicable notices, for example service security and account administration.

If an event or opportunity requires sharing details with an organiser or partner, we will identify the recipient or category, purpose and lawful basis at collection or before sharing. Subscribing to updates does not authorise sharing an application with a partner.

We may disclose necessary information where required by law or to establish, exercise or defend legal claims. Before launching a Shipyard account service, we will provide the relevant account-provider and sharing information. A database service being available within the website platform does not mean public visitors have a Shipyard account.

9. Discord

The Games Ark uses Discord as an online community platform.

If you choose to join The Games Ark Discord server, Discord will process your information under its own privacy policy and terms. The Games Ark does not control how Discord processes information on its platform.

Information that is visible to Games Ark administrators or moderators through Discord may be used for legitimate community purposes, including:

Community management
Moderation
Safety
Responding to community issues
Programme administration

Joining the Discord community is optional.

Joining our Discord server does not opt you into either email list. If you follow a sign-up link posted there, the separate form choices govern email subscriptions. Games Ark remains responsible for its own use of information for administration and moderation.

10. Cookies and website technologies

Cookies and browser storage support website delivery, security and user-requested functionality. The same storage rules can apply to cookies, localStorage and sessionStorage, including where the stored information is not personal data.

The website builder’s reported inventory identifies:

__cf_bm: a Cloudflare security cookie for bot protection, normally expiring after 30 minutes of inactivity. It is sent to the hosting and security infrastructure.
__dpl: a hosting cookie used to keep requests on a compatible deployment during updates. The builder reports a lifetime of approximately 24 hours. It is sent to the hosting infrastructure.
tsr-scroll-restoration-v1_3: temporary browser session storage for navigation scroll positions. It remains in the browser during the tab session.
shipyard-demo-state-v1: browser storage for mock demo changes. The updated demonstration uses sessionStorage, created after a user changes the demo, and removes the legacy persistent localStorage copy. Reset demo data clears saved demo changes and restores examples. Demo state is not sent to our database. Browser session restoration can affect how long tab storage persists.

Authentication storage, where a sign-in feature is separately available, uses sb-*-auth-token in localStorage. Access tokens last about one hour and may be renewed using refresh tokens, so the full session may last longer. Sign-out removes local authentication state and revokes refresh tokens; an already issued access token may remain valid until expiry. This description is not an invitation to use an account service that has not been opened for registration.

The inventory is based on reports supplied by the website builder, rather than an independent audit by Games Ark. We keep it under review as the site changes. The unused sidebar cookie is not part of the active inventory. No analytics cookies, advertising cookies or tracking pixels were identified in the builder’s reported tests.

The updated website serves fonts locally rather than loading Google Fonts. Google is therefore not a recipient of font-loading requests in that version. If you access an older deployment or cached page that still loads Google Fonts externally, requests disclose technical information such as your IP address and browser information to Google; the Google Fonts API does not set cookies.

Our Cookie Policy gives further details. The footer link leads to information, not an interactive preference centre. We do not claim that a consent banner or preference switcher exists. Browser settings let you inspect or remove cookies and site storage; doing so may reset the demo or sign you out.

We use an exemption from prior consent only where the relevant purpose and duration meet its conditions. Calling storage functional or using sessionStorage does not itself establish an exemption. Where consent or an objection control is legally required, we must provide it before relying on the relevant use. Clearing browser data is not a substitute for those controls.

11. International data transfers

Our providers operate internationally, so personal information may be processed outside the United Kingdom, including through global website delivery, service support and subprocessors. A UK domain, mail-server address or database region does not mean every copy or access remains in the UK.

Where UK adequacy regulations cover the recipient and transfer, we may rely on those regulations. For restricted transfers not covered by adequacy, we require an applicable safeguard, such as the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any required assessment and supplementary measures. We do not treat a public provider contract template as evidence that a specific account is covered.

Contact contact@thegamesark.org for the relevant countries, the transfer arrangements applicable to your information and a copy or explanation of safeguards, subject to necessary redactions. Any new Shipyard account service will have provider and transfer information available before it accepts registrations.

12. How long we keep your information

We apply the following normal retention schedule and review records at least annually. We delete or anonymise information sooner if it is no longer needed, subject to necessary legal retention.

Mailing-list subscriptions: while the relevant consent remains active, subject to regular review. GDC 2027 subscription records are removed from the active list within three months after the event ends. GDC-only contacts are not moved to the general list.
Unsubscribed contacts: stop marketing on withdrawal and delete from active mailing lists within 30 days. Keep only a minimal suppression record, such as email address, opted-out topics and date, for as long as needed to prevent accidental re-subscription; review this need annually. Suppression records are not used for marketing.
General enquiries: 12 months after the last meaningful interaction.
Event registrations: 12 months after the event.
Incubation expressions of interest: 24 months after the last meaningful interaction, unless removed sooner following withdrawal or a request.
ARK Framework enquiries: 24 months after the last meaningful interaction. If an enquiry becomes an ongoing contractual relationship, retain necessary relationship records for its duration and then under any applicable legal retention requirement.
Shipyard accounts, if offered: necessary account information while the account remains active. Following account deletion, delete or anonymise personal information within 90 days, except where a specific legitimate or legal retention requirement applies. Any different treatment of shared project contributions will be explained before the feature is used. This is a prospective account-retention schedule, not confirmation that registrations are currently open.
Consent records: while consent is active and up to three years after withdrawal or expiry, where necessary to demonstrate compliance. This does not permit further marketing.
Technical and security logs, where collected: normally up to 90 days, unless needed to investigate a specific incident. Necessary incident or moderation records may be retained for up to 24 months after resolution, with longer retention only where justified for safeguarding, legal obligations or claims.

These limits apply across our working copies, including Google Forms, Google Sheets, exports and relevant email records. Deleted information in backups may remain until the provider’s backup cycle overwrites it; it must be isolated from routine use and deletion reapplied if restored. Backup retention depends on the relevant service; contact us for the period applicable to your information.

Where law, safeguarding or the establishment, exercise or defence of a legal claim requires longer retention, we retain only what is necessary, restrict its use and review the need. We can explain an applicable retention period or criterion on request. Truly anonymised statistics may be retained without identifying individuals.

13. Your rights

Under UK GDPR, you may have rights including:

The right to be informed about how we use your information
The right of access to personal information we hold about you
The right to rectification of inaccurate information
The right to erasure in certain circumstances
The right to restrict processing in certain circumstances
The right to data portability where applicable
The right to object to certain processing
The right to object to direct marketing

You may also have rights relating to certain forms of automated decision-making. We do not currently make decisions about incubation participation solely through automated decision-making.

You can object at any time to direct marketing, including related profiling, and we will stop that use. Where we rely on legitimate interests, you can object on grounds relating to your situation; we will stop unless the law permits continued processing, for example because we demonstrate compelling overriding grounds or need the information for legal claims.

Portability normally applies to information you provide that we process automatically on consent or contract. Erasure and other rights depend on the circumstances and are not absolute. Where a request cannot be met, we will explain why and how you can complain. No solely automated decision-making about incubation participation is currently identified; if we introduce significant automated decisions in another service, we will provide the required information and safeguards before doing so.

Where we process your information based on consent, you can withdraw that consent at any time.

To withdraw consent or ask us to remove your information, contact contact@thegamesark.org.

Withdrawing consent does not affect processing that took place before you withdrew your consent.

15. Making a data protection request

To exercise your rights, contact contact@thegamesark.org.

We may need to verify your identity before responding to a request.

We will normally respond within one month, subject to the conditions and extensions permitted by UK GDPR.

Requests are normally free. We ask only for proportionate information needed to identify you or clarify a request. Where the law permits an extension, we will explain the reason and revised response period. A request does not require a particular form or specific legal wording.

16. Security

We take reasonable technical and organisational measures to protect personal information against:

Unauthorised access
Loss
Destruction
Alteration
Unauthorised disclosure
Other unlawful processing

Access to personal information is limited to people and service providers who need it for legitimate purposes.

However, no internet-based service can be guaranteed to be completely secure.

17. Children and young people

The Games Ark website may be accessible to people under 18.

We do not knowingly use this website to collect unnecessary personal information from children.

Where a specific Games Ark programme involves children or young people, we will provide appropriate additional information and safeguards for that programme.

Where an online service is likely to be accessed by children, we will assess the relevant child privacy requirements and use age-appropriate information and safeguards. We will not assume that a child can give valid consent for every purpose. Any age limits or parental authorisation requirements for Shipyard will be explained before access is offered.

18. Third-party websites

The website may contain links to third-party websites and services. These may include:

Discord
Event platforms
Social media
Other games industry websites
Partner organisations

We are not responsible for the privacy practices of third-party websites.

You should review the privacy policy of any third-party service before providing it with personal information.

19. Changes to this Privacy Policy

We may update this Privacy Policy when our website, programmes or data processing practices change.

When we make significant changes, we will update the date at the top of this page and provide additional information where required. We recommend checking this page periodically.

We will not treat continued website use as consent to a new marketing purpose. Before using information for a new purpose, we will explain that use and its lawful basis and obtain fresh consent where required.

20. Complaints

If you have concerns about how we have used your personal information, you can contact us at contact@thegamesark.org. We will try to resolve your concern.

You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO): https://ico.org.uk/make-a-complaint/. You do not have to contact us before complaining to the ICO.

21. Contact us

If you have questions about this Privacy Policy, your personal information or your data protection rights, contact:

The Games Ark