Privacy notice

Data controller: Milton Keynes Ice Hockey Club Ltd, company number 11917911. Our registered office is The Pinnacle, Building A, 150-170 Midsummer Boulevard, Milton Keynes, Buckinghamshire, MK9 1FD. Contact us at [email protected] or write to Planet Ice, Elder Gate, Milton Keynes, MK9 1DL.

Scope of this notice

This notice applies to accounts, purchases, support, protected streaming and broadcast-graphics operations within the Lightning TV service. The main Milton Keynes Lightning website, merchandise shop, venue and external ticket agents may collect information under their own notices. If information from one of those services is provided to Lightning TV, this notice applies to our use of it here.

Information we collect

Draft, subject to legal and organisational approval. Authorised staff may import player names, contact emails and per-fixture discount allocations. We store the contact details, named season, discount percentage, redemption limit, issued code, a contact matching reference and import audit, including accepted or rejected row details. Names form part of the readable code shared with intended viewers. Contact emails support allocation administration and appear in private staff previews and authorised code downloads; they do not restrict player-code redemption to that email. Imports do not create accounts, send emails or record marketing consent. These records follow the commerce retention review period below. Matching player contact records are included in an account's personal-data download. Downloaded staff copies should be kept confidential and removed when their distribution purpose ends.

Draft, subject to legal and organisational approval. Operational request and connection logs record the client IP resolved through approved proxies, the immediate network peer, a request or connection reference, the route, response or disconnect result and elapsed time. These help staff investigate faults and protect accounts without recording passwords, cookies, request bodies, URL query strings or link credentials in those logs. Successful routine health probes are omitted. Access to these logs is limited to authorised technical staff; their storage, access and deletion must follow the approved diagnostic retention period and the production log-storage configuration.

We collect the account details you provide, email-verification status, purchases and billing country, policy acceptances, passes and entitlements, discount-code redemptions, support messages and feedback. For the Game Review Panel, authorised staff may record a person's name and intended account email before registration; we match that address to an existing or later account and audit the resulting automatic broadcast-access grants and any revocation. A discount redemption records the full issued code for authorised internal audit, its type and recipient label, fixture, account and email, time, allocated original and final price, discount and resulting order and entitlement. A multi-game code redemption creates one linked audit record for each included fixture so access and per-fixture limits remain traceable. Rejected attempts retain the matched code where one exists, or otherwise a one-way digest and short ending hint rather than the full unrecognised value. When you use the service, we also record devices, IP addresses, browser details, whether a stream was opened, viewing-session start, heartbeat and end times, player-reported or session-estimated watch time, playback attempts, quality and fault diagnostics, takeovers, security events, and the fixtures you access. If your browser supports it, we record its coarse estimate of connection downlink speed, round-trip time and effective connection category when a protected stream opens.

The connection value is a browser-provided estimate based on recent connection behaviour or connection technology. Lightning TV does not download a separate test file, continuously test the connection or treat the estimate as proof of the actual speed supplied by your internet provider. Some browsers do not provide an estimate.

We receive most information from you and your device. We may also receive payment and billing results from Stripe, discount-code details from authorised clubs, leagues, visiting teams, operational partners, sales or support staff through manual files or configured secure feeds, and broadcast-access results from our streaming providers. Stripe handles payment-card details; Lightning TV does not store full card numbers or security codes.

The configured ICE Account stream-release feed includes an event name and date, booking identifier, season-ticket holder name and email address, released-seat details, generated code and release time. We use only the event date to match the code to a Lightning TV fixture. The discount-code record retains the generated code, matched fixture, recipient name as an operational label and booking identifier as its source reference; the ICE event name, email address, released-seat details and release time are not copied into the discount-code record or import preview.

For match statistics and broadcast graphics, we store league players’ names, team, shirt number, position, GameStats identifier and supplied roster or statistics data. Authorised staff may upload a player headshot. We receive these details from GameStats, the league, teams, players or authorised broadcast staff; they are kept separate from viewer accounts unless a person also chooses to hold an account.

For this open-registration release, we remove the personal records held in the retired beta-access, beta-membership and legacy stream-code credential systems, including access and code values, purchaser details and their legacy access-session records. Existing accounts, orders and account-entitlement history remain where they have a separate access, support or legal purpose. A minimal retirement audit fact records that the former source was revoked without retaining its code value, purchaser details or legacy access-session data. Ordinary protected-playback security and support records are separate from the retired credential system and continue only for the playback retention period below.

Authorised technical staff can create a single-use, five-minute launch link for a view-only stream check. We store only a cryptographic digest of the launch token, the creating staff account, fixture, creation and consumption times, a digest binding the 30-minute preview to one browser session, and the resulting playback diagnostics. The raw launch token and Amazon stream key are not stored.

When you move playback to Google Cast or AirPlay, Lightning TV relays the HLS media through the same site so the receiver is never given the streaming provider's protected URL. We temporarily keep one-way token digests, a controller-network digest, a receiver network and browser-family fingerprint digest, token version, expiry and activity times, and opaque short-lived mappings to the active stream resources. AirPlay uses this information to bind the first eligible native receiver request on the controller's network; changing network requires a new handoff. The temporary mappings and receiver authorization are removed or expire when playback ends.

If you send a fan message with a photo, we record the message, image, file size, account, fixture, moderation state and delivery result. Submission limits use those records to protect the live queue and storage from abuse.

Why we use it and our lawful bases

Draft, subject to legal and organisational approval. We use player discount contact and allocation records under legitimate interests in administering agreed club viewing allocations, matching repeat imports and investigating their use, with access limited to authorised staff and the existing commerce retention review.

• Contract: to create your account, process orders, deliver purchased broadcasts, provide casting, send service messages, handle support and refunds, and give you a portable copy of information you supplied.
• Legal obligation: to keep required payment, tax, accounting, refund and consumer-rights records and respond to valid legal requests.
• Legitimate interests: to administer the invited Game Review Panel, secure accounts and streams, prevent fraud and credential sharing, investigate suspected breaches of the Terms, diagnose playback and connection failures, measure service reliability, protect our legal rights, and improve the service. We balance these interests against your rights and limit the data retained.
• Legitimate interests for match coverage: to maintain accurate team rosters, identify participants, publish match statistics and produce informative live graphics for viewers. We use information connected with a player’s public sporting role and allow corrections through the contact route below.
• Consent: for marketing email and where we introduce an optional storage technology or another use that legally requires consent. You can withdraw consent at any time without affecting earlier lawful processing.

Account, contact and payment-confirmation information is required to enter into and perform a purchase contract. Without it, we cannot create the account, take payment, issue a pass or provide protected playback.

If you separately opt in to marketing email, we use your account email to send Lightning TV news, upcoming broadcast information and offers. Marketing consent is optional, is not shared for another organisation’s marketing, and can be changed at any time from Account. Withdrawing it does not stop necessary account, purchase, security, support or service messages.

Who receives information

Draft, subject to legal and organisational approval. If we use a separate public asset-delivery hostname for website scripts, styles, fonts and branding, the approved hosting or security provider receives ordinary asset-request information such as IP address and browser headers. That public store contains website assets only; account records, uploaded viewer content, private recordings and stream credentials must use their existing protected storage. Asset-delivery logs follow the approved diagnostic retention and access controls.

Access is limited to authorised Lightning TV support, commerce and technical staff who need it. Internal access is enforced through named permission roles and account-specific exceptions: only superusers can create or change role definitions, while authorised access managers can assign those configured roles and exceptions to staff accounts. Authorised commerce staff can see full issued discount-code values and redemption reports, including the account email, for issuance control, fixture operations, reconciliation, support, fraud prevention and financial audit. Authorised staff can use a per-user investigation view showing stream opens, watch time, devices, sessions, attempts, coarse browser connection estimates, purchases, access grants, support cases and feedback when handling support, refunds, security or suspected Terms breaches. Connection estimates are diagnostic indicators only and staff must consider them alongside playback and service records. We use service providers for payment and tax processing, hosting and backups, Amazon IVS streaming, Google Cast delivery, transactional email, monitoring and security. They may process only the information needed for their service under contractual and security controls. We may also disclose information where law requires it or to establish, exercise or defend legal claims.

Player names, team details, shirt numbers, positions, match statistics and selected headshots may be sent to the rink vMix production system and displayed in live or recorded coverage. Only authorised graphics and match operators can configure that transfer.

Temporary TV connections

Draft, subject to legal and organisational approval. Phone approval of a TV records the selected fixture, approving account, creation, approval, connection, expiry and disconnection times, and a link to its viewing session. We temporarily store a confirmation code, a one-way digest of the TV binding secret and an account-authentication digest to invalidate approval after a password change. The binding secret stays in the existing server-side browser session; it is not placed in the QR code. Pairing records become eligible for removal 24 hours after expiry or disconnection and are removed by playback cleanup. Existing viewing and security records follow the retention rules elsewhere in this notice. Your personal-data download includes TV connection activity without its codes, secrets or authentication digests.

TV browser media uses the same protected relay as receiver playback, with the network and browser-family binding described above. A receiver retry may temporarily retain its previous exchange response for up to 60 seconds so a lost acknowledgement can be recovered by that same receiver and request. Retry credentials are excluded from personal-data downloads and expire with the temporary retry record.

International transfers

Away-roster production also records reviewed imports, saved roster revisions, formation assignments, local media references and staff playback commands. The production worker reads selected warmup clips and logos from approved folders on the broadcast computer. Portable exports requested by authorised staff contain the roster and referenced media; they are stored for staff download and must be handled as production material. Source recordings are not deleted when a roster changes. Roster revisions and their source reviews remain linked to the fixture for coverage history and corrections; staff should remove obsolete export copies when their production purpose ends.

Some providers may process information outside the United Kingdom. Where no UK adequacy regulation applies, we require an appropriate transfer mechanism and safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses. Contact us for information about the safeguard relevant to a provider.

Cookies and device storage

Draft, subject to legal and organisational approval. Protected playback may use an Amazon IVS service worker registered on this site to handle streaming requests in compatible browsers. Its code is loaded from Amazon's player delivery service and its registration may remain in the browser until site data is cleared or the browser removes it. The Cookie notice explains its purpose and controls.

We use the strictly necessary cookies and browser storage described in our Cookie notice. We do not currently use advertising or optional analytics cookies on Lightning TV pages.

How long we keep information

• Account, Game Review Panel membership and entitlement information is kept while the account or panel membership is active and afterwards where needed to deal with access, legal or deletion requests.
• Payment, tax, order, discount-code issuance, import, status-change and redemption records are reviewed for deletion or anonymisation after the configured 2555-day period, with recent changes and continuing accounting, tax, refund, access-audit or legal requirements taken into account. Revoking or replacing a code does not erase its historic uses.
• Fixture-bound data created for an internal protected Test fixture may be deleted when staff remove that rehearsal fixture; order, payment and linked support records are retained under their normal periods, with the deleted fixture link removed where necessary.
• Resolved or closed support cases are reviewed after 730 days from resolution or their final update. Active cases, disputes and legal duties are reviewed separately and may require longer retention.
• Playback records are reviewed after the configured 90-day period. Expired diagnostics, telemetry, playback attempts and technical-preview records can be removed by the diagnostic cleanup tool. Viewing sessions, device and TV-handoff records require a controlled review of linked access records and any unresolved security or revocation issue.
• Fan messages and their photos are removed after 30 days once the fixture is no longer live. A live fixture postpones that cleanup until it ends.
• Player identities, roster history and match statistics are kept while needed for current coverage and an accurate historical sporting record. Headshots are reviewed when rosters change and removed or replaced when they are no longer suitable for those purposes or a valid correction or objection requires it.
• Recovery backups normally use a protected 35-day rolling schedule. We also retain at least three verified database backup sets, which can extend that period while backup failures are investigated. Deleted information may remain in restricted backups until the applicable cycle completes. Before restoring information to normal service, we reapply applicable deletion requests and retention rules.

Our recovery design keeps independent backup histories at the rink and an off-site location. Historical backups have separate access credentials from the website. Uploaded images and published clips may be stored in private Cloudflare R2 storage when that hosting option is enabled; Cloudflare also provides website delivery and security services. Access to private viewer content continues to depend on the viewer's current permissions. Recovery copies do not create new permission to use information for marketing or other unrelated purposes.

Personal records in the retired beta-access, beta-membership and legacy stream-code credential tables are not kept under these general periods: they are removed as part of retiring those access systems. This does not delete an account, purchase, refund, support case, ordinary protected-playback record or account-entitlement history that has its own continuing purpose and retention basis.

We review records and securely delete or anonymise them when the applicable purpose and retention period end.

Draft, subject to legal and organisational approval. Authorised staff can permanently remove an account's current sign-in details, including its name, login email, usable password and permissions. The email address is then available for a separate new account. A retired account ID remains to link protected orders, refunds, support, consent, viewing and administrative history for the retention review described here; historic snapshots may still contain personal details. Staff deletion is recorded with the responsible staff member, time and reason. It stops viewing access and any linked Game Review Panel membership and codes. The retired account cannot be restored, and a new account does not inherit its history or marketing permission. This sign-in deletion is separate from a request to review and erase other retained personal information.

Draft, subject to legal and organisational approval. Configured periods guide category-specific review and disposal; they do not mean that every category is deleted automatically. Operators use a read-only inventory, review continuing purposes and documented holds, and record approved deletion or anonymisation. Financial and linked access history is not removed by a general diagnostic purge. Disposal decisions must also be reapplied when recovery copies are restored.

Your rights

Depending on the information and lawful basis, you may ask us for access, correction, deletion, restriction, portability, or to object to processing. You may withdraw consent where consent is the basis. These rights are not absolute; if an exemption applies, we will explain our decision.

Your right to object: you can object at any time to processing based on legitimate interests. Tell us your circumstances and we will stop unless we can demonstrate compelling legitimate grounds or the processing is needed for legal claims. You can always object to direct marketing.

Email [email protected] to exercise a right or make a subject access request. We may need to verify your identity. You can also complain to the Information Commissioner's Office.

Children’s information

Purchases must be made by an adult. The service is not intended to collect information directly from a child without the involvement of a parent or guardian. Contact us if you believe a child has provided account information without appropriate permission.

Automated controls

Automated controls enforce email-verification, payment, entitlement, rate-limit and one-active-viewing-session rules and may flag suspicious activity for staff review. We do not use account data to make solely automated decisions that produce legal or similarly significant effects. Contact support if you believe an automated control made an error.

Browser error diagnostics

Draft, subject to legal and organisational approval. For a complimentary pass granted by staff, we record the receiving account, selected game identifiers, issuing staff account, reason, grant time and optional expiry. When an existing pass supplies the game selection, the audit also records its identifier and name at the time. These records use the existing entitlement and access-audit retention rules above and are available to authorised access staff and in the account's personal-data export. Authorised staff can search accounts and filter by sign-in status and email verification to locate the correct account; staff-account management remains restricted to access managers.

Draft, subject to legal and organisational approval. For staff-created accounts or staff email approval, we record the account, email at the time, staff identity, whether the purpose is testing or acting on the holder's behalf, reason and time. The profile distinguishes staff approval from verification by an email link. Passwords are stored as protected hashes and are not included in account-administration history or data exports. Staff account history and verification method are included in the account's personal-data download; these records follow the account and access-audit retention rules above. Creating an account does not automatically record Terms acceptance, privacy acknowledgement or marketing consent. Generated test login addresses have no receiving mailbox.

Draft, subject to legal and organisational approval. On stream pages we automatically collect limited browser error diagnostics, including errors before video starts. These contain error categories and numeric codes, recognised script filenames and line positions, browser and operating-system versions where available, the site version, fixture, timestamps, and request or viewing-session references where available. They are linked to the signed-in account, or the issuing staff account for a view-only technical preview. We do not collect raw console messages or objects, page contents, form values, full URLs, cookies, passwords or stream tokens through this diagnostic collector. We limit capture to 20 distinct events per page load and 100 events per account in a rolling day. Authorised support staff can download up to 200 recent events from the last seven days; these downloads exclude the account email and raw browser user-agent string. Stored diagnostics follow the playback-diagnostic retention period above and are included in the account's personal-data export. A downloaded report should be handled as confidential support information.

Changes to this notice

The version at the top identifies this notice. We will publish changes here and bring material new uses to account holders’ attention before they begin where required.

Draft, subject to legal and organisational approval. Goal judge phone access records include the issuing staff account, fixture, assigned rink end, issue and redemption times, expiry and revocation status. We store one-way code and session digests and a generated device recording identity, which links shots and undo actions to that assignment without requiring the judge to provide a name or email. Access ends 24 hours after issue or earlier when revoked or the fixture ends. Assignment and match-action audit records remain for match-history and operational accountability and are reviewed for deletion or anonymisation when that purpose ends.

Purchaser email restrictions and optional beta surveys

Draft, subject to legal and organisational approval. Authorised staff may provide a TicketCo purchase identifier and purchaser email to issue a fixture-specific access code. We compare the restriction with your verified account email when you redeem it. The email restriction is part of the discount issuance and import record and follows the commerce retention period above; it is not a marketing opt-in. ICE stream-release imports continue to discard their supplied email and seat details as described above.

After a broadcast, you may rate video/audio, account access, navigation and available automatic match statistics from one to five stars, and optionally leave up to 2,000 characters of comments. You can skip any question or the whole survey. We link a saved response to your account and fixture, with its time, page reference and browser user-agent for support. A later submission updates your response. Only authorised support or analytics staff can review individual responses and rating summaries. Survey records are removed after the configured support retention period of 730 days from creation and are included in your account data export.

Coach reports and match tracking

Draft, subject to legal and organisational approval. Authorised match staff can share a fixture's shots on goal and approved faceoff results with recipients of that fixture's coach password. Results may include players' names, shirt numbers, teams, faceoff locations, opponents and outcomes. The report provides no video, private replay or account information. Manual tracking records the period and game clock when staff press Record stoppage; saved reasons and faceoff results remain part of the match record, and custom reasons become available to other match operators.

Draft, subject to legal and organisational approval. We retain a protected hash of each current coach password and the identity and time of the staff member who last managed access. Replacing or revoking the password removes its previous hash and invalidates existing coach sign-ins. The necessary server-side session records the fixture, access revision and an expiry up to twelve hours after sign-in, without the coach password. We use a salted network-address digest in short-lived sign-in rate-limit records for the configured limit window. These records protect the shared report without creating a coach account or identifying which individual coach uses a shared password. Match records follow the retention and correction arrangements described in this notice; staff should revoke access when its coaching purpose ends.

Commentator reports

Draft, subject to legal and organisational approval. Authorised match staff can share enabled fixture information with recipients of a separate commentator password, including players' names, shirt numbers, team sheets, scoring contributions, penalties and approved faceoff outcomes. Talking points are derived from recorded match data and cached league figures. These reports use the same protected password-hash, last-managing-staff identity and timestamp, fixture approval, access revision, twelve-hour session expiry and short-lived salted network-address rate-limit records described for coach reports. Coach and commentator approvals remain separate. Replacing or revoking a password invalidates existing approvals on their next access check and removes the old hash. No individual commentator account is created, and shared passwords do not identify the individual reader. Match-record retention and correction rules continue to apply; staff should revoke access when its commentary purpose ends.

Draft, subject to legal and organisational approval. Commentator reports use the existing first-party session approval for a fixture-specific live connection. The service rechecks that approval, password revision and expiry while the connection is open; the shared password is not put in the connection URL or sent with each update. Browsing uses the enabled match and player records already described above. Submitted view, search and filter choices appear in page URLs and may remain in browser history. They are not saved as a new server-side preference or local-storage identifier. Existing operational logging and match-record retention rules continue to apply.