Privacy Policy

Last updated: 16 July 2026

This Privacy Policy explains how IWG-IT ("we", "us", "Loadout") collects and uses personal data when you use the Loadout platform at loadout.be and its venue subdomains — the booking and player platform for airsoft, paintball and laser tag venues.

We are the data controller for the Loadout platform. Each venue ("operator") you book with is a separate business that acts as its own controller for the bookings, check-ins and any bans it records at its venue; Loadout processes that data on their behalf to run the service.

1. Data we collect

Player accounts

• Email address and a hashed password.
• Display name, and optionally a phone number and profile picture.
• Optionally, your home address — used only to compute approximate coordinates so venues can be shown on a map and, if you opt in, so you can appear in the "players near me" list. Your exact address is never shown to other players.
• Your email preferences, last sign-in time, and gameplay data (bookings, XP, badges, rankings, saved loadouts/gear).

Operators, staff and marshals

• Email, display name and role, linked to the venue you run or help run.

Bookings and payments

• The events you book, spots reserved, gear selected, check-in status and payment status.
• Card payments are processed by Stripe on Stripe's own hosted checkout. We do not receive or store your full card details — only a payment reference and status.

Location

• "Find venues near me" uses your browser's geolocation only if you allow it, in your browser, to sort venues by distance. We do not store this location.

Venue hardware (operators & marshals)

• Where a venue uses Loadout's BLE/MQTT tracking during a game, tag proximity and the label assigned to a tag (which may be a player's name) are processed to run and score the game.

Bans / blacklist

• An operator may record that a player is banned from their venue, with a reason. Depending on the operator's settings this ban may be visible to other Loadout venues to help them enforce their own safety policies.

Technical data

• Standard server logs (such as IP address and request metadata) needed to operate and secure the service.

2. How we use your data, and the legal basis

• To provide the service — creating your account, taking bookings, processing payments, check-in and gameplay (performance of a contract).
• Transactional email — booking confirmations, cancellations, password resets and event reminders (performance of a contract / legitimate interest).
• Optional email — re-engagement, product news and "a friend booked" nudges, which you can turn off at any time (consent; one-click unsubscribe in every optional email).
• Nearby players & the venue map — geocoding your address and showing you in discovery (consent — off by default).
• Security, fraud prevention and venue safety — including the blacklist feature (legitimate interests).
• Accounting and legal obligations — keeping payment and booking records for the period required by law.

3. Sharing and sub-processors

We do not sell your data. We share it only with providers that help us run the service:

• Stripe — payment processing (card payments and operator payouts via Stripe Connect).
• OpenStreetMap — map tiles are loaded in your browser to display maps; Nominatim (OpenStreetMap) is used on our servers to turn an address into coordinates.
• Email delivery — a transactional email provider used to send the emails above.
• Hosting — our infrastructure providers within the EU.
• Venue operators — the venue you book with receives your booking, name and check-in status so they can run the event.

We also disclose data where required by law. See our Cookie & Local Storage Policy for what is stored in your browser.

4. Where your data is processed

Loadout's own infrastructure is in the European Union. Some providers, notably Stripe, may process data outside the EU under appropriate safeguards (such as the EU Standard Contractual Clauses).

5. How long we keep it

We keep your account data while your account is active. When you delete your account we anonymise your personal data so it can no longer identify you, while keeping records we are legally required to retain (for example payment and accounting records). Server logs are kept only as long as needed for security and operations.

6. Your rights

Under the GDPR you can:

• access, correct or delete your personal data;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent at any time (for example, turning off optional emails or discovery);
• lodge a complaint with your supervisory authority — in Belgium, the Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données, gegevensbeschermingsautoriteit.be).

You can manage your profile, email preferences and delete your account from your account settings in the app. For any other request, contact us at privacy@loadout.be.

7. Children

Loadout accounts are intended for users aged 16 or older. Individual venues may set higher age limits for their activities. If you believe a child has given us personal data, contact us and we will remove it.

8. Changes

We may update this policy; we will change the "last updated" date above and, for material changes, give notice in the app.