TomAndThat account

TomAndThat Ltd privacy notice

This privacy notice tells you what to expect us (TomAndThat Ltd) to do with your personal information.

The short version

  • You can take part in most things on tomandthat.com without making an account or telling us who you are.
  • If you make an account, we keep your email address and the month and year you were born. We use your birthday to check you are old enough for an account and for the things you play.
  • Some games show other players the name you pick and your score. If you are under 18, you only appear anywhere public if you choose to.
  • Other players never see your email address.
  • We only send you news or reminders if you tick a box to say yes. You can stop them at any time, with one click in any of those emails.
  • If you send us something to put on the site, like a picture, we check it first. If it passes, everyone on the site can see it.
  • A few companies help us run the site, like the ones that host it and send our emails. The rest of this notice says who they are.
  • You can delete your account whenever you like, and everything our games hold about you goes with it.
  • If you have a question, or want to see what we hold about you, email hello@tomandthat.com.

The full version

  • Contact details
  • What information we collect, use, and why
  • Lawful bases and data protection rights
  • Where we get personal information from
  • How long we keep information
  • Who we share information with
  • Sharing information outside the UK
  • How to complain

Contact details

Email: hello@tomandthat.com

What information we collect, use, and why

We collect or use the following information to run your account and our games:

  • Your email address, so you can sign in and we can send you sign-in links and notices about your account
  • Your birth month and year, to check you are old enough to have an account and to keep under-18s off public leaderboards unless they choose to appear
  • Account information: your user ID, how you sign in, when you signed up and when you last visited
  • If you sign in with Google, Google's ID for your Google account

We collect or use the following information to send you emails you have asked for:

  • Your email address
  • Which mailing lists you have joined or left, when, and a copy of the exact wording you agreed to
  • Whether you have unsubscribed from all our emails or reported one of them as spam

We collect or use the following information to keep the site secure and stop abuse:

  • Your IP address and browser details when you visit
  • A record of every change to your account's email address, so we can put your account back if someone else takes it over

We collect or use the following information for dealing with queries, complaints or claims:

  • Your name and contact details
  • Account information

In our games

Each game also collects the information listed for it here.

Traitors

  • To run the game: the display name you choose, the leagues you join, and your bets and scores

Which Is The Best Thing

  • To run the game: the things you submit, meaning the thing's name, its image, and the credit and link you give for the image
  • To check submissions before they appear on the site: the image and text you submit
  • To keep the game secure and stop abuse: an identifier stored in a cookie on your browser, so we can limit how fast one browser can vote or submit

Lawful bases and data protection rights

Under UK data protection law, we must have a "lawful basis" for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO's website.

Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO's website:

  • Your right of access - You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for.
  • Your right to rectification - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
  • Your right to erasure - You have the right to ask us to delete your personal information.
  • Your right to restriction of processing - You have the right to ask us to limit how we can use your personal information.
  • Your right to object to processing - You have the right to object to the processing of your personal data.
  • Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
  • Your right to withdraw consent - When we use consent as our lawful basis you have the right to withdraw your consent at any time.

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

Our lawful bases for the collection and use of your data

Our lawful basis for collecting or using personal information to run your account and our games is:

  • Contract - we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply, except the right to object.

Our lawful basis for collecting or using personal information to send you emails you have asked for is:

  • Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

Our lawful basis for collecting or using personal information to keep the site secure and stop abuse is:

  • Legitimate interests - we are collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to data portability. Our legitimate interests are protecting the site, your account and our games from bots, abuse and account takeover.

Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:

  • Legitimate interests - we are collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to data portability. Our legitimate interest is answering you and putting things right.
  • Legal obligation - where your request is a data protection rights request, we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

In our games

Running a game and keeping it secure use the lawful bases above. Where a game uses information for anything else, its lawful basis is listed here.

Which Is The Best Thing

Our lawful basis for collecting or using personal information to check submissions is:

  • Legitimate interests - we are collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to data portability. Our legitimate interest is making sure nothing offensive or unlawful is published on the site.

Where we get personal information from

  • Directly from you
  • From Google, if you sign in with your Google account: your email address and Google's ID for your account
  • From our email provider, Postmark, if you unsubscribe from all our emails or report one of them as spam

How long we keep information

  • Your account. Your email address, birth month and year, mailing-list choices and the record of changes to your email address are kept until you delete your account. You can delete it yourself from your account page. When you do, we also delete everything our games hold about you. A deletion is only complete once every game has confirmed it, and we keep trying until they have.
  • Playing without an account. If you play a game without signing up, what the game holds about you is deleted after 90 days without a visit.
  • Staying signed in. You stay signed in until you sign out, or until 14 days pass without a visit.
  • Signing up. Sign-in links stop working after 15 minutes. An unfinished sign-up is deleted after 30 minutes. If you are too young to have an account, nothing you entered is kept.
  • Emails. We do not keep copies of the emails we send you. Postmark keeps a copy of each email and a record of its delivery for 45 days. If you unsubscribe from all our emails, report one as spam, or an email to you cannot be delivered, Postmark keeps your address on a block list so our mailing-list emails do not reach you again. That block stays after you delete your account.
  • Security. Vercel keeps technical records of visits to the site, such as IP addresses, for no more than 30 days. We use short-lived counters to stop the site being flooded with requests; they hold your IP address or email address only in a scrambled form that cannot be read back, and are deleted within a day.
  • Traitors. Your display name, leagues, bets and scores are kept until you delete your account, or for 90 days without a visit if you play without one. They are not deleted when the series ends. Leaving a league removes you from it straight away.
  • Which Is The Best Thing. We keep the things you submit, including ones we do not publish, so we have a record of what was submitted and why it was or was not published. We do not keep a record of individual votes, only the running totals. The cookie that identifies your browser lasts up to one year.

For more information on how long we store your personal information or the criteria we use to determine this please contact us using the details provided above.

Who we share information with

Data processors

Vercel

This data processor does the following activities for us: Hosts our website and runs the systems behind it. When you visit, Vercel processes technical information such as your IP address and browser details so the site can load, stay secure and be monitored for problems.

Google Cloud (Firestore)

This data processor does the following activities for us: Stores your account and activity: your profile, your mailing-list choices, your games and your votes and submissions.

Google Cloud (Cloud Storage)

This data processor does the following activities for us: Stores the images uploaded to the site, including photos you submit.

Postmark

This data processor does the following activities for us: Sends our emails, including account emails, game reminders and any mailing lists you have joined. It also tells us if you unsubscribe or mark one of our emails as spam, so we can stop emailing you.

Google (Gemini API)

This data processor does the following activities for us: Automatically checks what you submit to Which Is The Best Thing, both the image and the text, to make sure it follows our content rules before it appears on the site.

Services run by Google under its own terms

Sign in with Google

If you sign in with your Google account, Google confirms who you are and shares your email address and Google's ID for your account with us so we can create and open your account. Google's own privacy policy covers how it handles that sign-in.

Google reCAPTCHA

Helps protect Which Is The Best Thing from bots and abuse by checking signals from your device and browser. Google's own privacy policy and terms cover this.

Others we share personal information with

  • Publicly on our website, where a game shows it: the name you choose, your score, and things you submit once they are published
  • Other players in a game, where the game shows them your name and score
  • Traitors: your display name and score appear on the public leaderboard if you choose to appear on it. Members of a league you join can see your display name and score in that league.
  • Which Is The Best Thing: things you submit are public once they are published.

Sharing information outside the UK

Where necessary, our data processors may share personal information outside of the UK. When doing so, they comply with the UK GDPR, making sure appropriate safeguards are in place.

Organisation name: Vercel Inc.
Category of recipient: Website hosting provider
Country the personal information is sent to: United States
How the transfer complies with UK data protection law: The country or sector has been assessed as providing adequate protection to data subjects (also known as Adequacy Regulations or UK data bridge)

Organisation name: Google LLC
Category of recipient: Cloud hosting, database and file storage provider, and AI content moderation service
Country the personal information is sent to: United States
How the transfer complies with UK data protection law: The country or sector has been assessed as providing adequate protection to data subjects (also known as Adequacy Regulations or UK data bridge)

Organisation name: ActiveCampaign, LLC (Postmark)
Category of recipient: Email delivery provider
Country the personal information is sent to: United States
How the transfer complies with UK data protection law: The country or sector has been assessed as providing adequate protection to data subjects (also known as Adequacy Regulations or UK data bridge)

How to complain

If you have any concerns about our use of your personal information, you can make a data protection complaint to us:

Email: hello@tomandthat.com

If you remain unhappy with how we have used your data after raising a complaint with us, you can also complain to the ICO.

The ICO's address:

ICO Head Office
4th Floor, No.3 Circle Square
5 Hawkshaw Street
Manchester
M1 7BL

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint