Privacy policy

Monopoly Run “Live” is a not-for-profit event run by volunteers for Scout and Guide groups across the UK. The data controller for coordinator accounts, grant fund applications, this website and the operational information we hold about groups, teams and the game is Oakhanger & District Scout Council, who runs the event on behalf of the organising team.

For the records of individual players that a coordinator enters into the booking system, the coordinator’s own group or organisation is the data controller. We process those records on its behalf so we can run the event. Our contact details are at the end of this page.

• Coordinators. When a leader registers a group we collect their name, email address, phone number and a password, plus the group’s name, district and county. We keep a record of the terms they accepted and when, of the payments they made, and of the emails we sent them.
• Players. For each place booked we hold a name and a role, such as Scout, Guide or leader, entered by the coordinator or imported from Online Scout Manager if the coordinator chooses to link it. We do not hold dates of birth, addresses or contact details for players. Where a date of birth comes from Online Scout Manager it is used only to work out the role, and is not kept.
• Teams. Team name, team speed, Start Zone, which players are in it, and two contact phone numbers per team so we can text the team pack and reach the team in an emergency.
• Payments. Card payments are taken by Stripe on its own pages. We never see or store card details. We keep a record of what was paid and refunded.
• On the day. Check-ins, scores, quiz answers, challenge photos and live chat are covered by the app privacy policy.
• Grant fund applications. The applicant’s name, role, email address, phone number and group, the application itself, the quotes uploaded with it, and the group’s bank details for paying an award.
• Visitors to this website. Which pages are viewed, how long for, how far down the page and which links are clicked. We do not store IP addresses. Visitors are told apart by a salted code that changes every day, so nobody can be followed from one day to the next.
• Help centre and live chat. Anything you send us through the help centre or chat, which is provided by Crisp.

We use this information to take and manage bookings, put players into teams and teams into games, allocate Start Zones and start times, send team packs and login codes, reach teams and coordinators about the run they have booked, publish results, run the grant fund, keep this website working and answer your questions.

Our lawful basis under UK GDPR is performance of our contract with the coordinator who books, legitimate interests in running the event safely and well, and legal obligation for keeping payment records. We only email and text about the run you have booked or the application you have made. We do not send marketing, and announcements about future runs go out on our website and social media rather than by email.

Booking emails are sent through Amazon Web Services. They carry a tracking pixel and tracked links so we can tell whether important messages were delivered, opened and clicked, and chase the ones that were not. We record the delivery, open and click times against the email address they were sent to.

Team packs, login codes and urgent alerts on the day are sent by text through Vonage and TextLocal to the team phone numbers the coordinator gave. Our organising team also receives internal alerts about bookings and payment problems through Slack.

We do not sell personal data, and none of our systems carry advertising. To run the event we use these services:

• Amazon Web Services, in London, which hosts this website, the booking system, our database and uploaded files, and sends our email.
• Stripe, for taking payments and making refunds.
• Vonage and TextLocal, for text messages.
• Online Scout Manager, only where a coordinator chooses to link their account to import players. We read what they choose to share and never write back.
• Google, for push notifications to the app, travel-time calculations between locations, and maps.
• Crisp, which hosts our help centre and live chat.
• Sentry, for error reports from the booking system, this website and the app.
• Laravel Cloud, which hosts the server that pushes live updates to the app on the day.

Google and Sentry may process data in the United States. Where they do, the transfer is covered by the UK addendum to the standard contractual clauses. Crisp is based in France. We may also share information if the law requires it.

After the run we publish results on this website. They show team name, group name, position, bank balance, the game the team played in, its Start Zone and its team speed. They never include individual names. The results archive stays on this website from year to year.

Each team also gets a detailed results page showing its route, check-ins, quiz answers and challenge photos. It is protected by the team’s login code rather than a password, is sent to the coordinator, and stays up for about a week after the run.

Most players are under 18, and the minimum age is 10. Bookings are made by an adult leader, not by young people, and the coordinator’s organisation is the data controller for player records. All we hold about a player is a name and a role, which the coordinator can correct or remove in the booking system until the cut-off.

The coordinator is responsible for holding parental or carer consent for players under 18. A parent, carer or young person can ask us what we hold or ask us to delete it, using the contact details below. We will usually check with the group’s coordinator to confirm the request relates to their group.

This website and the booking system set only the cookies they need to work: a session cookie and a security token that protects forms. Both expire when your session ends. We do not use advertising cookies or third-party analytics. Our own visitor statistics use no cookie at all.

Stripe sets its own cookies on its payment pages, and Crisp sets its own on the help centre and in live chat. Their policies explain those.

• Booking data. Coordinator accounts, player names, teams and phone numbers are cleared from the booking system after each run, before bookings reopen in November. Groups register afresh every year.
• Payment records. A record of what was paid and refunded is kept for as long as accounting rules require, currently six years. Stripe keeps its own records under its own policy.
• Email delivery records are cleared with the booking data.
• Results. Published results, which name teams and groups only, are kept as a permanent archive.
• Grant fund applications. Kept while the round is open and for our record of what was awarded. Bank details are stored encrypted and deleted once an award has been paid or the application declined.
• Help centre and chat. Conversations are kept until the following year’s run.
• Error reports. Deleted by Sentry after 90 days.
• Website statistics identify nobody and are kept so we can see how the site is used over time.

Everything travels over an encrypted connection. Passwords are stored hashed, and grant fund bank details are stored encrypted and can only be revealed by an admin who re-enters their password. Access to booking data is limited to the organising team by role, and coordinators see only their own group. Card details never touch our systems. No method of storage or transmission is completely secure, and we will tell you if a problem affects your data.

You can ask for a copy of the information we hold, ask us to correct it, ask us to delete it, and object to or restrict how we use it. Coordinators can correct their own details and their players in the booking system, and can delete their account there. Deleting an account does not by itself refund anything or remove the group’s players; the help centre explains how to do that.

To exercise your rights, contact us through the help centre. We will reply within one month. You can also complain to the Information Commissioner’s Office at ico.org.uk.

When we change this policy, the new version is published here with the date it takes effect. Earlier versions stay available from the list on this page.

Use our help centre. Questions about a specific booking are usually quickest that way too.