Privacy Notice

101st Doom Battalion operates this community website and its personnel, attendance, training, moderation, and administration systems. Where UK data-protection law applies, 101st Doom Battalion is responsible for deciding how and why personal information is processed through the service.

This website supports a gaming community and is not an official public authority, military organisation, or official Star Wars, Arma, Discord, Steam, Valve, Bohemia Interactive, Disney, or Lucasfilm service.

For privacy questions, access requests, correction requests, deletion requests, objections, or complaints, contact CXO 72149 Akhari through the official 101st Doom Battalion Discord or another established unit communication channel.

The website may process member names, callsigns, usernames, email addresses, account identifiers, password hashes, authentication and session records, Discord user IDs and roles, Steam IDs and public profile information, personnel profiles, ranks, roles, attendance, certifications, medals, awards, disciplinary records, administrative notes, audit logs, security information, IP addresses, and device information where those details are logged by the website or its infrastructure. Plain-text account passwords are not stored.

The exact information held for a person depends on whether they are a visitor, registered website user, current member, former member, administrator, or someone using a linking or verification flow.

Information may be provided directly by users, entered by authorised staff, imported or synchronised from connected community systems, generated by website activity, created during account administration, or received from services such as Discord, Steam, hosting infrastructure, and security infrastructure.

Steam linking uses Steam OpenID to confirm the Steam ID returned by Steam. Discord verification uses a short-lived verification code sent through the 101st Discord bot to the Discord account already stored against a personnel record.

Information is used to operate and secure the website, manage accounts and personnel records, administer attendance and training, display service records, assign ranks and roles, record certifications and awards, verify linked accounts, investigate misuse, maintain audit history, and support community governance.

Information is also used to support Arma-related statistics and XP tracking where a member has linked the relevant account information.

Our main lawful basis is legitimate interests: operating a secure membership community, administering personnel and attendance, delivering training and events, maintaining accurate records, enforcing community standards, and protecting the website and its users. We balance those interests against their effect on members and limit access through roles and permissions.

We may also process information where it is necessary to provide a service you requested, to comply with a legal obligation, or for a specific optional activity for which consent was requested. Where consent is the basis, it may be withdrawn at any time without affecting processing that was lawful before withdrawal.

Account records may include email addresses, authentication identifiers, password hashes, session information, role tags, permissions, and login-related security information.

These records allow authorised access, restrict administrative areas, prevent unauthorised use, and maintain accountability for changes made through the website.

Personnel records may include names, callsigns, ranks, roles, billets, time in grade, status history, service records, administrative notes, and related profile information.

Personnel information is used to manage the roster, display current records, support transfers, and maintain continuity for current and former members.

Attendance records may include event attendance, non-attendance, excuses, weekly summaries, Discord attendance responses, timestamps, and staff-entered corrections.

Attendance information is used for operational planning, unit administration, event role assignment, historical review, and related community management.

Discord user IDs and verification records may be used to confirm that a person controls the Discord account already linked to their personnel record. Verification codes are short-lived and verification attempts may be logged for security and troubleshooting.

Steam linking uses Steam OpenID. The website does not receive Steam passwords, Steam Guard codes, wallet information, trades, or private Steam credentials. It may store the verified Steam ID, public profile details, linking status, timestamps, and audit records.

The website may store and display certifications, medals, awards, XP, activity statistics, attendance summaries, service history, warnings, disciplinary actions, appeals, bans, and associated evidence links or administrative notes.

Access to sensitive administrative records is restricted by website permissions. Public profile and recognition information may be visible more broadly where it forms part of the community record.

Audit and security logs may record account IDs, personnel IDs, actions, changed values, timestamps, request information, IP addresses, device information, and errors where needed to secure the website and investigate issues.

These logs support accountability and troubleshooting for account, personnel, attendance, linking, and administrative changes.

Information may be processed by providers that help operate the service, including the website host, Cloudflare for delivery and security where enabled, Discord for community and bot workflows, Steam or Valve for Steam verification, GitHub for release and deployment workflows, and an email provider if email functionality is configured.

Information may also be visible to authorised 101st Doom Battalion staff where needed for administration, moderation, and technical support.

The live application stores account, personnel, attendance, audit, and operational records in a privately managed, self-hosted PostgreSQL database. It does not use Supabase for the live website database or authentication.

Website accounts, password hashes, sessions, permissions, and operational records are handled by the application's native account system and PostgreSQL. Access is restricted to authorised users and services, and protected backups are created through a restricted backup account.

The website host may process technical logs, IP addresses, requests, and device information needed to serve the website, diagnose errors, and protect the service.

Cloudflare may process request and security information when its DNS, proxy, performance, or attack-protection services are enabled.

Discord, Steam, Cloudflare, GitHub, and other configured providers may process information outside the United Kingdom. Their safeguards and privacy terms apply to that processing.

The website's live PostgreSQL database is privately managed rather than hosted by Supabase. We limit information sent to each external integration to what is needed for the relevant feature.

Information is kept only for as long as reasonably needed for its original purpose, operational continuity, historical personnel records, audit and security needs, or dispute resolution. The period depends on the type of record and the member's relationship with the unit.

Normal website login sessions last up to eight hours and Steam linking browser sessions up to 30 minutes unless ended earlier. Short-lived verification and linking records expire automatically. Personnel, attendance, training, award, operational, audit, removal, moderation, and disciplinary records may be retained for unit history, accountability, safety, and dispute handling.

When a member leaves, access permissions and active roles may be removed or changed. A limited personnel history, rank history, awards, audit records, and administrative or moderation records may be archived rather than immediately deleted where needed for community history, security, accountability, or continuity.

Depending on applicable law, you may ask for access to your personal information, correction of inaccurate or incomplete information, deletion where there is no overriding reason to retain it, restriction of processing, portability where the legal conditions apply, or withdrawal of consent where consent is the lawful basis.

You may object at any time to processing based on legitimate interests. Some rights can be limited where information must lawfully be retained for security, audit, legal, governance, or overriding legitimate reasons.

The website may calculate indicators such as attendance summaries or promotion readiness, but it does not make solely automated decisions that produce legal or similarly significant effects. Authorised unit personnel remain responsible for administrative decisions.

Contact CXO 72149 Akhari and identify the account or profile concerned. We may request enough information to confirm identity before disclosing or changing records. We will respond within the period required by applicable law and explain any lawful reason why a request cannot be completed in full.

Please raise privacy concerns with CXO 72149 Akhari first so they can be investigated. You also have the right to complain to the UK Information Commissioner's Office (ICO) if you remain unhappy with how your information has been handled. ICO complaint information is available at ico.org.uk/make-a-complaint/data-protection-complaints/.

This Privacy Notice may be updated as the website, community tools, legal requirements, or providers change. The Last Updated date and version on this page identify the current published version.