1. Who controls your information
The FUT Bunker is the controller of personal information used for the FUT Bunker Companion app, Bunker Portal, Bunker Giveaways, Bunker Assistant and our connected Discord services. This notice explains what we use, why, who receives it and the choices available to you.
For privacy requests, account deletion or questions, email [email protected]. For ordinary service help, email [email protected].
2. Information we collect
- Account and community details: Discord user ID, username, email address, server nickname, avatar, guild membership, roles, boost status and duration, server tag, invite attribution and OAuth account information you authorise Discord to provide.
- Service records: profile, subscriptions, entitlements, Academy enrolment and progress, tactic requests and credits, Bunker Points, monthly rarity, discounts, giveaway entries, votes, reviews and preferences.
- Orders and billing: product, amount, currency, payment status, provider and transaction references. Stripe and Google process full payment credentials; we do not need to store your complete card number.
- Transactional email records: the destination email address, whether a purchase confirmation was accepted for sending, the sending time and any delivery-attempt error needed to diagnose a failure.
- Communications: support, Ask a Trader and tactic-request forms, app messages, Bunker Assistant DMs and staff replies synchronised to restricted Discord forums.
- Device and technical details: app version, device/platform information, push-notification token and permission state, IP address, dates and times, security events, diagnostics, crash/error details and website session or essential-cookie data.
- Content you submit: review rating, subject and text; Academy or tactic interactions; giveaway answers; and files or links you choose to send.
- Boosting handover details: the account email, password, platform or launcher, platform backup or recovery code and EA backup code you submit for a paid boosting order. These are encrypted and kept separately from ordinary support messages.
- Boosting delivery evidence: encrypted images taken by the assigned booster at the beginning and end of an order, together with the file details, upload time, integrity check and an audit record of authorised access.
- Stripe Identity information for eligible boosting orders: Verification Session and Customer references, verification status and completion time. Stripe collects the identity document, selfie or biometric information required by the selected verification flow, together with device, fraud-prevention and cookie information. We ordinarily use the result and references rather than storing a separate copy of your identity document in Bunker systems.
- Boosting audit information: checkout and consent version, timestamps, trusted price, IP address, browser information, order and Stripe references, assigned internal actor references, credential-access events, evidence hashes and access history, progress and corrections, completion, refunds and disputes.
3. Where information comes from
- Directly from you when you sign in, buy, learn, enter, vote, submit content or contact us.
- From Discord when you authorise sign-in or use guild-connected features, including current role and membership checks.
- From Stripe, Google Play and other payment providers when they confirm an order, renewal, refund, cancellation or dispute.
- From Stripe Identity when it creates, processes, verifies, rejects, cancels or redacts an identity-verification session.
- From our systems when they record delivery, activity, eligibility, security and support events.
- From content partners where needed to provide partner tactics or verify the source of content; they do not receive unrelated account information from us.
4. Why we use it and our lawful basis
- Contract: to create and secure your account; deliver purchases, subscriptions, Academy access, tactics, credits and support; send purchase and renewal confirmations; administer giveaways you enter; and keep balances and entitlements accurate.
- Contract: for a boosting order, to give the assigned booster the temporary access needed to deliver it, verify the starting and finishing account state, and remove the handover when the work is completed.
- Legitimate interests: to operate and improve the Services, measure feature performance, prevent spam and abuse, moderate content, verify Discord eligibility, publish genuine reviews, keep audit records and defend legal or payment claims. We balance these interests against your rights.
- Legitimate interests and contract: to apply a proportionate identity check before higher-value boosting orders, prevent payment fraud and account misuse, avoid unnecessary repeat checks, and establish or defend payment and legal claims. Where biometric processing requires consent or another condition under applicable law, Stripe presents the relevant collection notice and consent step before collecting it.
- Legal obligation: to keep required financial records, respond to lawful requests, protect consumer rights and meet tax, accounting, fraud-prevention and data-protection duties.
- Consent: for optional push notifications and any non-essential device or website storage that legally requires consent. You can withdraw consent without affecting earlier lawful use.
- Legal claims and substantial public interests where applicable: to investigate and respond to fraud, threats, security incidents or disputes.
5. Discord relays, reviews and public information
- A case created in the app or Discord may be copied between your Bunker Assistant DM, the app and a restricted staff forum. Authorised staff can see the case information needed to respond.
- Published reviews are public on our website and may also be posted in the Discord reviews channel. They can show your server nickname or chosen author name, avatar, rating, review text, date and the experience reviewed.
- Giveaway winner information and entries are shown only as described by the giveaway. Public Discord announcements can include a Discord mention or display name.
- Do not submit information you do not want included in the relevant case or public feature. Ask [email protected] to correct or remove eligible content.
6. Automated checks and decisions
Our systems automatically calculate points, rarity, credits, discounts, course progress and published giveaway eligibility from recorded rules. A trusted server calculation also decides whether a GBP boosting quote meets the £50 Identity threshold. Stripe performs the configured verification checks and returns a status; a passed status permits the payment handoff, while another status pauses it. Security and anti-abuse controls can rate-limit activity or flag an account for review. Ask support for a human review or information about an alternative route if you believe a verification or automated result is wrong. We do not use personal information for solely automated decisions that produce legal or similarly significant effects without a lawful basis and appropriate safeguards.
7. Who receives information
- Discord, for sign-in, guild and role checks, bot messages, forum relays, reviews and announcements.
- Stripe and Google Play, for checkout, purchase verification, subscriptions, refunds and disputes.
- Microsoft, through Microsoft Graph and Exchange Online, to send transactional purchase confirmations from [email protected]. The message contains the customer name, order summary, amount, provider, date, order reference and relevant account link.
- Stripe Identity, as our identity-verification provider for eligible boosting orders. Stripe collects and processes verification and device information under the notices shown in its hosted flow and its privacy policy, including for its own security, fraud-prevention and legal purposes where it acts as a controller.
- Hosting, database, security, push-notification, diagnostics and delivery providers acting for us under appropriate instructions and safeguards.
- The booster assigned to your active order and authorised FUT Bunker Owners where access is genuinely required to supervise or resolve it. They receive only the order information needed for that work, and access is recorded.
- Customers receive order progress and delivery evidence but are not shown the assigned team member's name, Discord account or internal identifier. This protects staff privacy and does not prevent us from identifying the responsible person internally or investigating a complaint.
- Tactic or content partners only where needed to deliver or link the disclosed partner feature.
- Professional advisers, insurers, payment-dispute handlers, regulators, courts or law enforcement where reasonably necessary or legally required.
- A successor involved in a genuine merger, restructure or sale, subject to confidentiality and continued protection.
- We do not sell personal information.
8. International transfers
Some providers, including Discord, Google, Microsoft and Stripe, may process information outside the United Kingdom. Where UK law requires it, we rely on an adequacy regulation or approved safeguards such as the UK International Data Transfer Agreement, the UK Addendum to standard contractual clauses, and relevant supplementary protections. Contact [email protected] for information about the safeguard used for a particular transfer.
9. How long we keep it
- Account and entitlement information is kept while the account is active and for a limited period afterwards to complete deletion, restore genuine purchases, answer disputes and meet legal duties.
- Order, refund, tax and accounting records are kept for the period required by applicable law. Evidence relevant to an active chargeback, fraud report or legal claim is kept until the matter and any applicable claim period end.
- Support, trader and tactic-request case records are kept only as long as reasonably needed for service history, quality, safeguarding and disputes, then deleted or anonymised.
- Giveaway eligibility and entry records are kept long enough to audit the draw, deliver prizes and handle complaints. Winner and financial records may be kept longer where law requires.
- Security, audit, invite, activity and diagnostics records use risk-based retention periods and are deleted or anonymised when no longer needed. Public content remains until removed, the account is deleted, or continued retention is lawfully required.
- We review retention by purpose, sensitivity, legal requirements, risk and whether anonymisation can meet the same need.
- Boosting handover details are permanently removed when the order is completed. If an order is returned after its details were opened, they are removed and fresh details are required. Starting and finishing evidence is removed after 180 days.
- If a boosting payment dispute is active, scheduled deletion of its delivery images is suspended until the dispute closes; the 180-day period then restarts. The chronological order ledger, consent record, Stripe references and image integrity hashes are retained under our risk-based legal-claims, fraud-prevention and financial-record criteria even when the encrypted image itself is deleted.
- Stripe retains Identity verification information under its own documented retention settings and legal obligations. We retain the Verification Session reference, status and verification time while reasonably needed to avoid repeat verification, prevent fraud and establish or defend claims. We can request Stripe redaction where appropriate, subject to legal, fraud-prevention and dispute-preservation needs.
11. Security
We use access controls, authentication, encrypted transport, restricted staff permissions, monitoring and audit records designed to protect information. Boosting handovers and delivery images are encrypted at rest with authenticated encryption and order-specific derived keys. Only the assigned booster and authorised Owners can open an active handover, and that access is audited. No service can promise absolute security. Protect your Discord account and device, never send payment credentials or recovery codes outside the designated handover, and report suspected compromise promptly.
12. Your rights
Email [email protected]. We may ask for proportionate proof that you control the account. Rights are not absolute; if an exemption applies, we will explain the lawful reason. We normally respond within one month, subject to permitted extensions for complex or numerous requests.
Your right to object: you can object to processing based on our legitimate interests, including fraud-prevention and audit processing, by emailing [email protected]. We will stop unless we demonstrate compelling legitimate grounds or the processing is needed for legal claims.
- Ask for access to your personal information and an explanation of how it is used.
- Ask us to correct incomplete or inaccurate information.
- Ask us to delete information, or restrict its use, where the legal conditions apply.
- Object to processing based on legitimate interests and object at any time to direct marketing.
- Ask for portable information you provided where processing is automated and based on consent or contract.
- Withdraw consent at any time, without affecting processing already carried out lawfully.
- Complain to a data-protection regulator. We will not treat you unfairly for exercising a right.
13. Account deletion
Use the account-deletion option in the Companion app where available, or email [email protected] from an address or account we can verify. Deleting an account does not automatically cancel an app-store or payment-provider subscription, so cancel recurring billing separately. We delete or anonymise information that is no longer needed, while retaining the limited records required for purchases, fraud prevention, disputes, safety or law.
14. Children
The Services are not directed to children below the minimum age permitted by Discord, the relevant app store or local law. We do not knowingly collect a child's information unlawfully. A parent or guardian who believes a child has provided information without required permission should contact [email protected].
15. Complaints and changes
Please contact [email protected] first so we can investigate. You can also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint, by telephone on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
We may update this notice when the Services, providers or law change. We will publish the new date here and give a prominent notice where a change materially affects how we use your information.