Legal · Privacy
Privacy Policy
TurboBattle has no accounts. You do not register, you do not log in, and your balance of virtual Bolts sits in your own browser where we cannot read it. That leaves very little personal data, and this page is the full account of it: one contact form, three strictly necessary cookies, an ordinary server log, analytics that run only if you say yes, and a self-exclusion list for anyone who asks to be kept out.
Data controller
Turbo Battle Interactive Ltd.
Company no. 14872305 (England & Wales)
86 Paul Street, London, EC2A 4NE, United Kingdom
Data and rights requests: [email protected]
Legal notices: [email protected]
Site: turbobattle.com
Turbo Battle Interactive Ltd. decides what personal data turbobattle.com collects and why. It is therefore the controller under the UK General Data Protection Regulation and the Data Protection Act 2018, and under Regulation (EU) 2016/679 for readers in the European Economic Area.
Write to [email protected] about anything on this page. That mailbox reaches the controller directly and skips the support queue, so a request under section 10 does not sit behind questions about a game.
We have not appointed a Data Protection Officer. The Regulation does not require one here: we run no large-scale monitoring and no profiling, and we handle no special category data as a core activity. The mailbox above is answered by the people who would otherwise hold the post.
This is a free social casino. Six casino-style games, all free, all played with virtual Bolts. For entertainment purposes only, with no real-money gambling anywhere on the site. That is a privacy fact as much as a gaming one: with no money moving, there is no payment data, no identity check and no financial history to hold about you.
Nothing you do inside a game is transmitted to us. We do not know which game you opened, how long you played, what your balance is or whether a round went well. Those numbers exist only in your browser, and this page explains why that was the design rather than an accident.
Everything below is specific. Where a section names a cookie, that cookie exists in the code. Where it names a period, that is the period we work to. If the site changes, this page changes with it.
1. Who is responsible for your data
The controller is Turbo Battle Interactive Ltd., company no. 14872305 (England & Wales), of 86 Paul Street, London, EC2A 4NE, United Kingdom. Data enquiries go to [email protected].
This policy applies to turbobattle.com and to the correspondence you send us about it. It does not apply to any other site, including one you reach by following a link from here. We link out rarely, and never to a real-money gambling service.
If you would rather write on paper, the postal address above works. Put a return email address in the letter and the answer will come back faster.
2. What this policy covers
There is no sign-up on turbobattle.com, no password, no profile and no player database. We hold no record that you visited, no history of what you played and no score attached to your name, because we never asked for your name in order to play.
Your balance of virtual Bolts is not data we hold. It is a number written by the wallet script into your browser local storage under the key tb_wallet_v1. It stays on that device, in that browser. It is never sent to our server, never backed up by us, and we could not retrieve it if you asked us to. Bolts are play money for free social games: no cash value, no exchange, and nothing about them ever leaves your machine.
So personal data can arise in three places, and they are the main subject of this page: the contact form, the technical log our web server writes, and a small set of cookies. There is a fourth, smaller one, and it is the single exception to everything this page says about deletion: if you ask to be self-excluded under section 10 of the Responsible Social Gaming Policy, your email address goes on a suppression list that has to outlive the rest. Sections 5 and 7 set out exactly what that list holds and how long it keeps it.
3. What we collect
a) What you hand us yourself
The contact form asks for your name, your email address, a topic chosen from a fixed list, and your message. It also records two ticks: that you are 18 or over, and that you have read this policy and understand how the message is handled. The second tick is an acknowledgement, not a consent: the lawful basis for handling your message is the legitimate interest set out in section 5. Nothing else is asked for, and there is no hidden field that collects anything about you.
The rest of the message is there because you typed it, so send only what the question needs. In particular do not send passwords, card numbers, or anything about your health, beliefs or finances. We do not need any of it, and no reply from us will ever ask for it.
If you write to one of our mailboxes directly, we hold whatever your email contains, in the ordinary way of correspondence.
b) What the server writes down on its own
Like every web server, ours keeps an access log: the IP address making the request, the date and time, the page or file asked for, the response code, the number of bytes sent, the referring page if your browser supplied one, and the browser and operating system string. We do not use it to identify anybody and we do not resolve an IP address to a location. It exists so the site can be kept standing, faults found and abusive traffic blocked.
While the contact form is open, a temporary PHP session also holds a one-time token proving the form came from this site, and the time of your last submission, which stops the same form being fired a hundred times a minute.
c) Cookies
Three cookies are strictly necessary and are set without asking, because the site cannot do its job without them. Two of them last a year; the third exists only while the contact form is open. Analytics cookies are set only after you press Accept all. Section 6 lists all of them, and the Cookie Policy goes through them one by one.
d) What stays in your browser and never reaches us
- tb_wallet_v1 — local storage holding your virtual Bolts balance, the number of rounds played, your best round and the time of your last free top-up
- tb_session_start and tb_break_next — session storage that times how long this sitting has lasted, so the break reminder appears once rather than on every page
These are written by your browser, read by your browser, and gone when you clear your site data. They are not cookies, they are never attached to a request, and they never reach our server. There is no copy of them anywhere else.
4. What we deliberately do not collect
Most of the short list above is the result of decisions to leave things out. For the record, here is what is not here:
- No accounts — no usernames, no passwords, no email list, nothing to register and nothing to breach
- No gameplay profile on our servers — we do not log which game you opened, how long you played, what you staked in virtual Bolts or how a round ended
- No card or bank details — in-game purchases are available as a feature, but payments are not connected yet, no card field appears anywhere on the site and nothing can be charged today
- No identity documents and no dates of birth — the age check is a yes-or-no question and we store the answer as a yes or a no
- No advertising identifiers, no cross-site tracking, no fingerprinting, no social plugins, no third-party scripts of any kind in these pages
- No location beyond whatever a raw IP address implies, which we do not look up
- No data bought from anyone, and none sold, rented or handed to an advertiser. Not now, not later, not as part of any arrangement we would be uncomfortable describing here
5. Why we use it, and on what lawful basis
Every use has a purpose and a lawful basis under Article 6 of the GDPR. Both are in the table.
| What | Why we use it | Lawful basis |
|---|---|---|
| Name, email, topic and message from the contact form | To read your message, answer it, and keep track of the exchange until it is finished | Legitimate interests, Article 6(1)(f): dealing with correspondence addressed to us. Where the message concerns an in-game purchase, performance of that contract, Article 6(1)(b) |
| The 18+ confirmation on the form | To show that we correspond with adults, and to keep an 18+ service away from minors | Legitimate interests, Article 6(1)(f) |
| Self-exclusion register: an email address, the period it asked for and the date the request arrived | To keep you out for as long as you asked, and to be able to show that we did | Legitimate interests, Article 6(1)(f): honouring a request you made to be kept out, and being able to prove we honoured it |
| tb_age_ok cookie | To remember that you confirmed your age, so the question is not put to you again on every page | Legitimate interests, Article 6(1)(f). Strictly necessary, so no cookie consent is required for it |
| tb_cookie_choice cookie | To record your answer to the cookie banner and honour it on every page | Legitimate interests, Article 6(1)(f), together with our duty to demonstrate consent, Article 7(1) |
| Form session: one-time token and time of last submission | To prove the form was sent from this site and to stop it being submitted repeatedly by a script | Legitimate interests, Article 6(1)(f): keeping the form usable and safe |
| Server access log | To keep the site running, find faults, and block traffic that attacks it | Legitimate interests, Article 6(1)(f) |
| Optional analytics | To count how many people open each free game, in aggregate, so we know what to improve | Your consent, Article 6(1)(a), given by pressing Accept all and withdrawable at any time |
| Purchase and billing records, once in-game purchases are connected | To supply the virtual Bolts bought, answer billing questions and keep our accounts | Performance of a contract, Article 6(1)(b), and legal obligation, Article 6(1)(c) |
Where we rely on a legitimate interest we have weighed it against your interests and rights, and concluded that a site holding this little cannot reasonably intrude on anybody: there is no profile to build, no third party to pass anything to, and nothing that could surprise a reasonable visitor. You can object at any time on grounds relating to your particular situation — see section 10.
We do not use your data for anything you were not told about here. If we ever need it for a new purpose, we will say so and, where the law requires it, ask first.
6. Cookies and browser storage
Four kinds of cookie can exist on this site, and none of them follows you off it:
- tb_age_ok — records that you confirmed you are 18 or over. Set when you answer the age check. Twelve months. Strictly necessary
- tb_cookie_choice — records your answer to the cookie banner, accepted or rejected. Twelve months. Strictly necessary
- PHPSESSID — a temporary session, created only on the contact page, that carries the anti-forgery token. Gone when you close the browser. Strictly necessary
- an analytics cookie, set only if you press Accept all. Press Essential only and nothing analytic is written at all
At the date at the top of this page no third-party analytics service is embedded in these pages. The fonts, images, scripts and styles all come from turbobattle.com, so opening the site sends your browser to nobody else. We ask for your answer all the same, so that nothing can be switched on later without it.
You can change your mind whenever you like: the Cookie settings button in the footer brings the banner back. Clearing site data in your browser removes the cookies, the stored balance and the session timers together, and the site starts again from 5,000 virtual Bolts at no cost. Cookie by cookie detail is in the Cookie Policy.
7. How long we keep it
| What | How long |
|---|---|
| Contact messages and our replies | 24 months after the exchange ends, then deleted from the mailbox |
| Self-exclusion register | For the period requested, and where the request was permanent, indefinitely — a suppression list only works if it outlives everything else. You can ask us to erase the record at any time, which simply ends the exclusion |
| Server access log | 30 days on a rolling basis. A specific entry is kept longer only while a security incident is being investigated |
| Form session data | Until you close your browser |
| tb_age_ok and tb_cookie_choice | Twelve months, or until you clear them or press Cookie settings |
| Analytics data, if you ever consent to it | 14 months at most, in aggregate form |
| Purchase and accounting records, once purchases are connected | Six years, because UK company law requires it |
| Your virtual Bolts balance and session timers | Until you clear site data. They are in your browser, not with us, so this one is entirely yours to end |
When a period ends, the data is deleted. We keep no archive copy for sentimental reasons and no backup that quietly outlives the schedule above. One entry in that schedule is meant to outlive the rest, and it is named there rather than hidden: the self-exclusion register. A permanent exclusion is only worth asking for if the record of it lasts, so that one stays until you tell us to erase it.
8. Who else handles it
Nobody sees your data because they paid for it. Two suppliers see it because the site cannot be published without them, and each acts as our processor under a written contract meeting Article 28 of the Regulation:
- our hosting provider, which runs the server and therefore holds the access log and the files of the site
- our email provider, which carries and stores the messages sent through the form and the replies we write
A payment provider joins that list when in-game purchases are connected. It will handle card details as a controller in its own right, and we will receive a record of the transaction and never a card number.
Beyond that we may disclose data to our professional advisers, or to a court, regulator or public authority where we are legally obliged to. If the business is ever sold or reorganised, data may pass to the successor, which would then be bound by this policy or by one no less protective. That is the complete list. There is no advertising network, no data broker and no fourth party.
We do not sell personal data.
Not to advertisers, not to brokers, not to anyone running a real-money gambling service. We do not rent it, trade it or share it for anyone else’s marketing. This is a flat statement, not a policy that can be revised quietly.
9. Where the data goes
Our servers and mailboxes sit in the United Kingdom or the European Economic Area, and in the ordinary course your data stays there.
Where a processor has to handle data outside the UK or the EEA — a support engineer working elsewhere, for instance — the transfer is covered by one of the following, and by a transfer risk assessment where the law asks for one:
- UK adequacy regulations, or an adequacy decision of the European Commission, for the country concerned
- failing that, the UK International Data Transfer Agreement, or the UK Addendum to the European Commission’s Standard Contractual Clauses
- for transfers out of the EEA, the Standard Contractual Clauses under Article 46, with whatever additional safeguards the case requires
You can ask us for a copy of the safeguards that apply to a particular transfer by writing to [email protected].
10. Your rights, and how to use them
The Regulation gives you the following rights. We would rather you used them than wondered.
- Access — ask what we hold about you and be sent a copy of it
- Rectification — have anything inaccurate or incomplete corrected
- Erasure — have it deleted, where the law allows
- Restriction — have us pause our use of it while a dispute about it is settled
- Portability — receive the data you gave us in a structured, commonly used, machine-readable form, and have it sent elsewhere where that is technically feasible
- Objection — object to any use based on a legitimate interest, on grounds relating to your particular situation
- Withdrawing consent — take back a consent at any time, without affecting what was lawfully done before you took it back. For analytics, the Cookie settings button in the footer does it in one press
How to use them. Write to [email protected], or use the contact form and choose the privacy topic: the form addresses that one topic to the controller and sends every other topic to support, so a rights request does not queue behind questions about a game. It is a routing rule in the form, not a separate system. Say plainly what you want; you do not need legal wording and you do not need to name an article.
What happens then. We acknowledge within two business days and answer within one month. If a request is genuinely complicated we may take up to two further months, and we will tell you inside the first month if that is going to happen. There is no charge, unless a request is manifestly unfounded or excessive, in which case we will say so plainly rather than let it go quiet.
We may need enough information to be sure we are answering the right person. In practice the only key we hold is the email address you wrote from, so a request sent from that address is usually all it takes. If we hold nothing about you at all, which is the common outcome, we will simply say so.
11. Complaining to a supervisory authority
If you think we have handled your data badly, please tell us first at [email protected]. Most of what goes wrong is fixed faster by email than by anything else.
You also have the right to complain to a data protection supervisory authority. Ours is the Information Commissioner’s Office, the UK supervisory authority, whose site is ico.org.uk and which takes complaints online, by post and by telephone.
If you live or work in the European Economic Area, you may complain instead to the supervisory authority of your own country, in the place where you live, where you work, or where you think the problem happened. Going to an authority does not stop you from going to a court, and neither route requires our agreement.
12. People under eighteen
TurboBattle is for adults of 18 and over. Social casino games look like adult games because they imitate them, and the site is rated accordingly. We do not knowingly collect or process the personal data of anybody under 18, and the age check on entry exists precisely so that we do not.
If we learn that we hold data about someone under 18, we delete it. There is no assessment step and no waiting period: the message goes out of the mailbox, any related log entry is dropped at the next rotation, and we keep no copy of what we deleted beyond a note that a deletion happened.
If you are a parent or guardian and believe a child has written to us, write to [email protected]. We will not demand proof of anything beyond the plausibility of the request, and we can talk you through clearing the stored balance and the cookies from the device. The Responsible Social Gaming Policy covers device-level controls that keep the site shut on a shared machine.
13. How we keep it safe
The strongest protection here is that there is almost nothing to protect. Beyond that:
- the site is served over HTTPS, and every cookie it sets is marked SameSite=Lax and, on a secure connection, Secure — including where a proxy ends the encryption in front of us and the server would otherwise think the request arrived in the clear
- PHPSESSID is also HttpOnly, so no script can read the session that carries the form token. tb_age_ok and tb_cookie_choice are deliberately not: our own script in your browser has to read them to keep the age check and the cookie banner from reappearing. Between them they hold a digit and a word
- the contact form carries a one-time anti-forgery token, a hidden trap for scripts and a rate limit, and every field is validated on the server rather than in the browser
- a content security policy allows scripts, styles, fonts and images from turbobattle.com only, so no third-party code can be injected into a page
- the support and privacy mailboxes are reachable only by the people who answer them
- no card data is ever received, so none can ever be lost
- we collect as little as the site can run on, which is the only security measure that never fails
No system is perfect. If a breach occurs that is likely to risk your rights and freedoms, we will notify the supervisory authority within 72 hours of becoming aware of it, and tell you directly where the Regulation requires it. We will describe what happened in plain terms, not in the language people use when they hope you stop reading.
14. No profiling, no automated decisions
We build no profile of you, score nothing about you, and make no decision by automated means that produces a legal effect or anything similarly significant, within the meaning of Article 22.
Nothing on this site is personalised. Every visitor sees the same six games, the same packs of virtual Bolts and the same pages. No game adapts itself to how long you have played, what your balance is or whether you have ever spent anything: each round is decided by a random generator that knows nothing about you and has nothing to know. Success in social casino games does not imply future success in real-money gambling, and no number we hold about you would change that.
15. Changes to this policy
We revise this page when the site changes or the law does. The date at the top is always the date of the version you are reading.
Where a change materially affects you — a new purpose, a new processor, a longer retention period — we will say so on the site rather than hope you notice. If a change needs your consent, we will ask for it before the change takes effect, not afterwards.
Previous versions are kept. Ask us and we will send you the one that applied on a given date.
16. How to reach the controller
Turbo Battle Interactive Ltd.
Company no. 14872305 (England & Wales)
86 Paul Street, London, EC2A 4NE, United Kingdom
Personal data and rights requests: [email protected]
General support: [email protected]
Legal notices: [email protected]
The contact form has a privacy topic, and the form addresses that topic to the mailbox above rather than to support. Requests are acknowledged within two business days and answered within the statutory period.
The short version, for anyone who skipped to the end.
No account, no profile, no tracking, no advertising, no sale of anything about you. A contact form kept for two years, a server log kept for a month, and a handful of cookies. One exception: if you ask to be self-excluded, your email address stays on a suppression list for as long as you asked, and permanently means permanently until you ask us to erase it. Your virtual Bolts balance never leaves your browser. Write to [email protected] and we will tell you exactly what we hold in your case, which is usually nothing.