Legal
Privacy Policy
Last updated: 13 October 2026
Translations of this page are provided for convenience. If the English version and a translation differ, the English version prevails, except where mandatory consumer law of your country requires otherwise.
1. Who we are
The controller is GATEX LIMITED, trading as Chunkly. It is a private limited company registered in England and Wales, company number 16888067, with its registered office at Suite 10264, 5 Brayford Square, London, E1 0SG, United Kingdom. GATEX LIMITED is registered with the UK Information Commissioner's Office under reference ZC154034. Privacy contact: [email protected].
We have not appointed a Data Protection Officer because we are not required to.
The UK GDPR and the Data Protection Act 2018 apply. For people in the EU/EEA, the EU GDPR (Art. 3(2)) also applies.
2. What we collect, why, and on what legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| Email, password hash, or Discord account ID/username/email if you use "Continue with Discord" | Create and secure your account | Contract (Art. 6(1)(b)) |
| Your servers: names, settings, files, uploads, worlds, logs, server address | Host and run your Minecraft servers | Contract |
| Billing: name, email, country, plan, payment status, invoices. Card data is handled by Stripe; we never see full card numbers | Payment, subscriptions, tax and accounting | Contract; legal obligation (Art. 6(1)(c)) |
| Your immediate-start request (time and wording) | Proof of your request under consumer law | Legal obligation / contract |
| Technical and security logs: IP address, user agent, timestamps, server console and access logs | Operate and secure the service, prevent abuse and DDoS | Legitimate interest (Art. 6(1)(f)) |
| Support messages (email, tickets, Discord) | Help you | Contract / legitimate interest |
| Google Analytics 4 and Google Ads data (cookies, device and usage data, ad click IDs), only after you click "Accept" | Site statistics, measuring our ads | Consent (Art. 6(1)(a)) |
| Affiliate referral cookie chunkly_ref, only after you accept | Credit the partner who referred you | Consent |
| Marketing and checkout-reminder emails: email, consent record (time, wording version, source, IP and user agent if available), unfinished checkout (plan, price), link clicks recorded on our server (no open-tracking pixels) | Send emails you agreed to, including up to 2 reminders per unfinished checkout (one may include a one-time discount); prove consent | Consent (Art. 6(1)(a); ePrivacy law such as Dutch Telecommunicatiewet art. 11.7 and UK PECR) |
| Confirmation that you are 16 or older | We only take marketing consent from people aged 16+ | Legal obligation |
| Card fingerprint from Stripe when a discount code is redeemed | Prevent misuse of one-time discount codes | Legitimate interest (fraud prevention) |
We do not make decisions based solely on automated processing that have legal or similarly significant effects for you. If an account is flagged automatically for discount abuse, a person reviews it on request.
3. Who processes your data
- Our own infrastructure. Minecraft game servers run on GATEX LIMITED's own network (AS203001) at data-centre locations in the EU.
- Cloudflare, Inc. DNS, CDN, DDoS protection and website hosting/proxying (anycast); Cloudflare Email Routing for incoming email to @chunkly.net; Cloudflare R2 (EU) for temporary uploads, deleted within about 1 day.
- DGN TEKNOLOJİ A.Ş. (AS43260), Bursa, Turkey, is our infrastructure partner and processor: our mail server mail.chunkly.net, which sends all outgoing email, runs in DGN's data centre. See section 4.
- Account database: hosted by a hosting provider in Frankfurt, Germany (EU).
- Stripe (Stripe Payments Europe Ltd / Stripe, Inc.): payments, subscriptions, invoices and customer records. Stripe is also an independent controller for its fraud prevention.
- Google Ireland Ltd / Google LLC: Analytics and Ads, only with consent.
- Discord Inc., only if you sign in with Discord.
- Affiliate partners: we only tell them that a referral led to a sale. We do not share your name or email.
4. International transfers
- EU → UK (to us): covered by the EU adequacy decision for the UK, Decision (EU) 2021/1772 as renewed by Decision (EU) 2025/2574, valid until 27 December 2031.
- UK → EEA (EU/EEA countries, including Germany, Cloudflare R2 EU): the UK recognises the EEA as adequate.
- Turkey (DGN TEKNOLOJİ A.Ş., outgoing email): Turkey has no adequacy decision. We protect these transfers with the EU Standard Contractual Clauses (2021/914, module 2) and the UK International Data Transfer Addendum, supported by a documented transfer risk assessment.
- United States (Cloudflare, Stripe, Google, Discord): covered by the EU–US Data Privacy Framework and its UK Extension where the provider is certified, otherwise by Standard Contractual Clauses and the UK Addendum.
You can request a copy of these safeguards at [email protected].
5. How long we keep data
We keep data for the following periods:
- Account data: while your account exists. Deleted within 30 days after you delete your account.
- Servers and worlds of a cancelled paid plan: deleted 30 days after the paid period ends.
- Backups: overwritten within 30 days.
- Invoices and accounting records: 6 years (UK Companies Act / HMRC); EU OSS VAT records 10 years (VAT Directive art. 369).
- Security and server logs: 90 days.
- Support messages: 2 years after the last contact.
- Immediate-start requests: for as long as the contract runs, plus 2 years.
- Marketing consent records: while consent is active, plus 5 years after withdrawal (proof of consent).
- Checkout-reminder records and discount codes: 24 months.
- Suppression list: as long as needed so we never email you again.
- Google Analytics: 14 months.
- Cookie lifetimes: see the Cookie Policy.
6. Children
You must be at least 16 to create an account. If we learn that a younger child has an account, we delete it.
7. Cookies
See the Cookie Policy.
8. Emails
We send service emails about your account, payments and servers. Marketing and unfinished-checkout emails are only sent if you ticked the box (and confirmed by email if your address was not yet verified). Each marketing email has a one-click unsubscribe link, and you can also unsubscribe in account settings.
9. Security
We use encryption in transit, access control and DDoS protection. No system is perfectly secure.
10. Your rights
You have the right to access, correction, deletion, restriction and data portability, and to object to processing based on legitimate interest. You can always object to direct marketing. You can withdraw consent at any time, without affecting earlier processing. Email [email protected] from your account address. We reply within one month.
11. Complaints
- UK: Information Commissioner's Office, https://ico.org.uk
- EU/EEA: the supervisory authority where you live, work or where the issue happened. In the Netherlands: Autoriteit Persoonsgegevens, https://autoriteitpersoonsgegevens.nl
12. Changes
We will email account holders before material changes take effect.
Questions? Contact us.