How we handle your data

This page covers the Ideals Precision Series rewards portal — the pilot rewards programme running alongside the event. It is deliberately specific, and it describes what the software actually does rather than what a policy template would say: what is stored, what is logged, who can see it, what leaves the server, how long it is kept, and exactly what the two buttons at the bottom of this page do.

Who is responsible

Ideals runs this programme and decides what happens to the information in it. Questions, corrections and complaints go to rewards@idealsprecisionseries.com.

What the portal stores about you

Your name and corporate email address. From the event registration list, from a colleague's invitation, or from what you type when you sign in. The email address is your identity here — there is no password.
Your company, when the registration list supplies it.
Your points ledger. Every movement, with its reason, who or what made it, the time, and a link to the email we sent you about it.
Submissions you make. Photos and screenshots you upload, the link to any social post you share with us, any note you write with them, and the review decision and reviewer's note. A post link is stored as the address itself — we do not fetch the page, copy its contents or keep anything from it.
Colleagues you invite. Their name and corporate email address, so we can send the invitation and credit you once it has been reviewed.
Reward requests. Which reward, how many points, the status, and your fulfilment choice (voucher type, garment size) where one is needed.
Sign-in records. When you ask for a sign-in link we store a one-way hash of the link, your email address, the IP address the request came from and the time. When you sign in we store a hash of the session, the IP address and a one-way hash of your browser's user-agent string, so a stolen session cannot be replayed from another device.
A record of every email we send you — recipient, subject, template, delivery status, and the message text with any sign-in link removed from it (see below).
An audit trail of actions taken on your account by the team — a submission approved or refused, points adjusted, a reward moved along — with who did it, when, and the IP address they did it from.

What is written to the server's logs

This is the part most privacy pages leave out, so it is stated plainly here. Every single request to this site writes one line to the server's log — not just sign-ins, and whether or not you are signed in. That line contains the time, the method, the path you asked for (the part after the ? is stripped first, so a sign-in link never reaches a log), the response status, how long it took, and a shortened form of the IP address the request came from. Shortened means the part that identifies one device is removed before the line is written: an IPv4 address loses its last number (203.0.113.42 is written as 203.0.113.0) and an IPv6 address keeps only its first three groups. That is enough to see that one network is misbehaving and not enough to follow one attendee around the portal. Your full address is never written to a log file by the portal. The web server sitting in front of it keeps a similar access log, also without the query string.

Those logs live on the same machine as the portal, are readable only by whoever administers that machine, and are not sent to any analytics or monitoring service. They are destroyed with the machine when the pilot ends. Your full IP address is still used — held in memory while sign-in attempts are being rate-limited, and stored on the database rows described above (the sign-in link, the session and the audit trail), where it lasts only as long as those rows do.

Cookies and what the page loads

The portal sets no advertising or analytics cookies and contains no trackers. The only cookies it sets are the ones that keep you signed in, protect forms against cross-site request forgery, carry a one-off status message between pages, and remember the address you last signed in with on this device so you do not have to retype it on a phone. That last one holds the address and nothing else — it is never used to decide anything, and choosing Use a different address on the sign-in screen clears it. Every one of them is signed, marked HttpOnly so no script can read it, and sent only on requests that start from this site.

One thing does leave our server: the pages use the Montserrat typeface, which is loaded from Google's font service (fonts.googleapis.com and fonts.gstatic.com). Loading it discloses your IP address and your browser's user-agent string to Google, as any request to a third-party server does. It sets no cookie, and it is the only third-party request the pages make — the portal's security policy blocks every other outside host. If you would rather avoid it, blocking those two domains leaves the portal fully usable in your device's default typeface.

Why we are allowed to hold it

Legitimate interests — running a rewards programme for people who attended the event, and being able to show that every point movement was correct and notified. This covers your account, your ledger, your reward requests and the email record.
Consent — the photos and screenshots you choose to upload. You do not have to upload anything, and asking us to remove an upload does not affect points already awarded.
Legitimate interests (security) — the IP addresses, user-agent hash and request logs described above, to keep the portal and your account safe from abuse.

Who can see it

The Ideals concierge team running the pilot. They review submissions, confirm reward requests and answer queries. Their screens sit behind a separate password-protected login that is never linked from this portal, and what they do is written to the audit trail.
Your uploaded photos are visible to that concierge team. They are stored outside the web root under names the server generates, are never given a public or guessable link, and are served only to a signed-in administrator, as a download, with scripting disabled on the response. Assume a person on the team will look at anything you upload; do not upload anything you would not want them to see.
Whoever administers the server can, like any system administrator, read the files on it — the database, the uploads and the logs.
Our email provider, when live delivery is switched on, receives your address and the message being sent to you. When live delivery is off, nothing is sent and messages stay in a file on our own server.
Nobody else. Your data is not sold, not shared with advertisers, and not used to train anything. Apart from the typeface described above and the email provider, nothing on this site talks to a third party.

Sign-in links are never stored

A sign-in link is a credential: whoever holds it can sign in as you. The portal keeps only a one-way hash of it, so the link cannot be recovered from the database, and the copy of the email kept for our records has the link removed before it is written. Where live sending is switched off — as it is during testing — the link is written to one owner-only file on the server so the team can sign in during a rehearsal; that file is treated as a password file and is deleted at the end of the pilot.

How long it is kept

Sign-in links expire after 20 minutes, work once, and the record of them is deleted about a day after expiry by a job that runs every minute.
Sessions expire after 30 days and are deleted immediately when you sign out, or by the same job once they expire.
Your account, ledger, submissions, reward requests, email records and the audit trail have no automatic expiry. They are kept for the pilot and for the review that follows it, because they are the evidence of whether the mechanic worked and of whether every allocation was notified, and they are destroyed when the pilot's data is destroyed.
Uploaded photos also have no automatic expiry. An upload stays on the server until somebody on the team removes it or the pilot's data is destroyed.
Backups. During the event the database and the uploads folder are copied on the same server so a crash cannot lose your points; those copies are deleted after seven days.
Server logs — see above.
An erasure request is actioned sooner. See the last section.

"Destroyed" here means what it says: this is a temporary pilot on a temporary server, and the plan is to take the whole machine down after the programme.

How it is protected

No attendee password exists to be stolen: sign-in is a one-time link.
Sign-in and session tokens are stored only as SHA-256 hashes, so a copy of the database does not let anybody sign in as you.
Uploads are written with owner-only permissions, under names the server generates — your file name is kept as a label only, and is never used as a path.
Every page is served with a strict content security policy, no inline scripts, and cookies that are HttpOnly, SameSite and — in production — Secure. Traffic is encrypted in transit.
Point balances are never stored as a number that could be edited; they are always the sum of an append-only ledger.

Your rights

You can ask for a copy of your data, correct it, have it deleted, restrict or object to how it is used, and ask for it in a portable format. Two of those are self-service below. For the rest, contact rewards@idealsprecisionseries.com and we will respond within one month. If you are not satisfied, you can complain to your data protection regulator — in the UK that is the Information Commissioner's Office.

Getting a copy of your data

Signed in, Download my data returns a JSON file immediately. It contains your account record, your full points ledger with the reason for each movement, your submissions with the review decision and the details of each file you uploaded (file name, type, size and time), your reward requests, the colleagues you invited, and a list of the emails we sent you with their subject, template, status and timestamps. It contains your rows and nobody else's.

Two things are deliberately left out: the image files themselves, which are not something a JSON file can carry — ask us and we will send them — and the text of the emails. The server's logs and the internal audit trail are not part of the download either; ask rewards@idealsprecisionseries.com if you want what they hold about you.

Asking for your data to be erased

Be clear about what the button does, because the honest answer is not "delete everything now". Request erasure records your request and emails it to the concierge team. It does not delete anything by itself. A person reads it, checks whether any reward is mid-flight, and completes the erasure within 30 days, confirming to you by reply.

Until that is done your account carries on working: you can still sign in, your points are still there, and an open reward request is still open. If you would rather nothing happened in the meantime, say so in a reply to the acknowledgement and the team will hold your account instead.

The request itself is recorded — who asked, when, and from which IP address — so we can show when it was made and when it was completed. That record is what survives the erasure.