Privacy notice · 13 August 2026

Your data.
Clearly handled.

Who we are

Utomnia Limited is the controller of personal information handled through this website. We are registered in England and Wales under company number 09085136. Our registered office is 20 Lloyd Drive, Kemsley, Sittingbourne, Kent, ME10 2GA.

For privacy questions or to exercise a data protection right, use the UTOMNIA contact form and choose “Privacy or accessibility”.

What this notice covers

This notice covers visits to utomnia.studio, UTOMNIA customer accounts, store transactions, and direct communications with Utomnia Limited. Twitch and Stripe also process information under their own privacy notices when you use their services.

Information we handle

Messages and enquiries: your name, email address, organisation and anything you include when contacting us.
Customer accounts: your name, email address, encrypted password credentials, email-verification status, account preferences and sign-in activity.
Twitch sign-in: your Twitch user ID, username, profile image and verified email address. We do not retain your Twitch access token.
Orders and fulfilment: the products ordered, price, currency, order status, character codes allocated to you, and Stripe customer, checkout, payment, invoice and receipt references. Card details are entered on Stripe and are not stored by UTOMNIA.
Streamer affiliate applications: your Twitch identity, requested affiliate code, legal name, agreement version and text, acceptance timestamp, a protected hash derived from your IP address, browser information, application status and reviewer notes. We also record approved codes against attributed orders.
Technical and security information: IP address, browser and device information, requested pages, timestamps, and server or error logs.
Publisher administration: the name, email address, authentication information and activity of authorised administrators.
Storage preferences: the acknowledgement saved in your browser when you dismiss our storage notice.

We do not use behavioural analytics or advertising trackers. Marketing email is optional and is sent only where you have chosen to receive it.

Why we use it and our lawful bases

To respond to enquiries and discuss possible agreements: our legitimate interests in communicating about our business, or steps requested before entering a contract.
To operate, diagnose and protect the website and administrator area: our legitimate interests in providing a reliable and secure service.
To manage authorised administrators: performance of our agreements and our legitimate interests in controlling access to publishing systems.
To create and secure your account, process orders, deliver products and provide receipts: performance of our contract with you and steps you request before entering it.
To process streamer applications, evidence electronic agreement acceptance, approve and operate affiliate codes, attribute qualifying sales and administer commission: steps requested before entering and performance of the streamer affiliate agreement, plus our legitimate interests in operating and auditing the programme.
To prevent duplicate use or unauthorised disclosure of character codes and investigate fraud: our legitimate interests in protecting customers, developers and our service.
To send optional marketing: your consent, which you can withdraw in account settings.
To establish, exercise or defend legal claims and comply with law: our legitimate interests and legal obligations.

Who receives information

We may use carefully selected providers for website hosting, infrastructure, email, security and technical support. Stripe processes checkout and payment information for us. Twitch provides optional account sign-in. They may process information under our instructions and, where applicable, for their own regulated or security purposes. We may also disclose information to professional advisers, courts, regulators or law-enforcement bodies where reasonably necessary, or as part of a corporate transaction. We do not sell personal information.

International transfers

If a provider processes personal information outside the UK, we use an available UK adequacy regulation or appropriate contractual safeguards, such as the UK International Data Transfer Agreement or the UK Addendum, unless another lawful exception applies. You may ask us for information about the relevant safeguard.

How long we keep it

General enquiries: normally up to 24 months after the last meaningful contact.
Routine server and security logs: normally up to 30 days, unless needed for investigating an incident or legal claim.
Administrator records: while access is active and normally for up to 90 days afterwards, except where a longer record is needed for security or legal reasons.
Customer accounts: while active and normally for up to 24 months after closure, subject to transaction and legal records that must be retained longer.
Orders, invoices and accounting records: normally six years after the end of the relevant financial year, or longer where law or a dispute requires.
Streamer affiliate applications, signed agreement records and attributed transaction records: while the programme relationship is active and normally for six years afterwards, or longer where a dispute or legal obligation requires.
Contracts, transactions and legal records: for the period required by applicable tax, accounting and limitation rules.

We may delete information sooner when it is no longer needed and may retain it longer where law, a dispute, fraud prevention or security reasonably requires.

Your rights

Depending on the circumstances, UK data protection law may give you rights to access, correct, erase or restrict your information; object to processing; receive portable information; and withdraw consent where consent is used. These rights are not absolute. Contact us through the form; we may need to verify your identity.

Complaints

Please contact us first so we can try to resolve your concern. You may also complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint.

Changes

We will post changes here and update the date at the top. Material changes may also be highlighted elsewhere on the website.

Your data.Clearly handled.