M10 Ltd ("the Company," "we," "us," or "our") (40 Rivington Street, London EC2A 4NE, United Kingdom) is the data controller for personal data processed through m10ltd.com under the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018. You can contact us at [email protected].

This policy explains what personal data the Company collects when you visit m10ltd.com, register for early access to Project Adapt, or otherwise engage with M10 as a game studio, and how we use, share, and protect it.

1. Data Controller

The data controller is M10 Ltd, 40 Rivington Street, London EC2A 4NE, United Kingdom. Email: [email protected]. Phone: +44 20 7946 0321.

2. Personal Data We Process

Because M10 operates a pre-launch competitive multiplayer shooter (Project Adapt) and runs an early-access waitlist, the personal data we collect is shaped by those activities:

  • Early-access registration data: email address, preferred platform (PC, PS5, Xbox), display name, and region, submitted when you join the Project Adapt waitlist or complete the registration form at early-access/register.html.
  • Playtesting session data: if you participate in a closed playtest, we collect session identifiers, match telemetry (round outcomes, AI adaptation scores, matchmaking delta), and any feedback you submit. This data is used to tune the adaptive AI system and is never used to train AI models for any purpose other than improving the gameplay experience in Project Adapt. We do not use player behavioural data from playtests to train models without explicit written consent.
  • Contact and enquiry data: name, email address, and any message content you send via the contact form or press enquiry channel ([email protected]).
  • Careers application data: name, email, CV, portfolio links, and cover letter submitted when applying for an open role at the studio.
  • Technical data: IP address, browser type and version, device type, operating system, pages visited, referral source, and session duration, collected automatically when you visit m10ltd.com.
  • Analytics data: aggregated usage metrics collected only after you give prior consent through our cookie banner, as required under the Privacy and Electronic Communications Regulations (PECR).
  • Communications content: content of emails or messages you send to the studio.

M10 does not operate a live game requiring account creation at this stage. The data categories above reflect the Company's current pre-launch activities: waitlist management, closed playtesting, press and media relations, and studio recruitment.

3. Lawful Bases (Article 6 UK GDPR)

We rely on the following lawful bases under Article 6 of the UK GDPR:

  • Contract performance (Article 6(1)(b)): processing your registration details and playtest participation data to fulfil our commitment to include you in early-access sessions.
  • Legitimate interests (Article 6(1)(f)): operating and securing m10ltd.com, responding to press and media enquiries, processing careers applications, and understanding how the site is used to improve the player experience. We have carried out a legitimate-interests assessment and are satisfied that these interests are not overridden by your rights and freedoms.
  • Legal obligation (Article 6(1)(c)): retaining financial and communications records as required by UK law.
  • Consent (Article 6(1)(a)): setting non-essential analytics cookies on m10ltd.com; sending any optional marketing communications about Project Adapt launch updates (where you have opted in). You may withdraw consent at any time without detriment.

4. Recipients and International Transfers

We share personal data only with processors acting on our behalf under Article 28 data-processing agreements. These include hosting infrastructure providers, email delivery services, and analytics platforms selected for the studio's operations.

Transfers to processors outside the United Kingdom are protected by the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or an adequacy regulation made under section 17A of the Data Protection Act 2018, as applicable to the recipient country.

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes.

5. Retention

We retain personal data only as long as necessary for the purpose it was collected:

  • Early-access waitlist data: retained until Project Adapt launches and the early-access programme concludes, or until you withdraw your registration, whichever is earlier. If the project is discontinued, waitlist data is deleted within 90 days of that decision.
  • Playtest session telemetry: retained for 24 months after the relevant playtest session to support ongoing AI model evaluation. Anonymised aggregate statistics derived from telemetry may be retained indefinitely.
  • Contact and press enquiry data: retained 24 months after last contact.
  • Careers application data: retained for 6 months after the close of the relevant recruitment process, then deleted unless you have consented to longer retention for future openings.
  • Technical access logs: retained 90 days.
  • Consent records: retained for as long as necessary to demonstrate compliance, typically 3 years.

6. Your UK GDPR Rights

Under the UK GDPR, you have the following rights in relation to your personal data:

  • Right of access (to obtain a copy of your data);
  • Right to rectification (to correct inaccurate data);
  • Right to erasure (the "right to be forgotten" in applicable circumstances);
  • Right to restriction of processing;
  • Right to data portability (to receive your data in a structured, machine-readable format);
  • Right to object, including to direct marketing at any time without conditions;
  • Rights related to automated decision-making: the Company does not engage in automated decisions that produce legal or similarly significant effects.

To exercise any of these rights, email [email protected] with the subject line "Data Subject Request." We will respond within one calendar month, which may be extended by two further months for complex or numerous requests (we will notify you if an extension applies).

7. Right to Complain to the ICO

You have the right to lodge a complaint with the UK Information Commissioner's Office ("ICO") if you believe we have not handled your personal data in accordance with the UK GDPR. The ICO's website is ico.org.uk; helpline 0303 123 1113. We would appreciate the opportunity to address your concern directly before you contact the ICO, so please reach out to us first.

8. Cookies

See our Cookie Policy for full details of the cookies used on m10ltd.com. Non-essential cookies, including analytics cookies, are not set until you give prior consent through our cookie banner, as required by PECR. You can update your consent preferences at any time using the "Cookie preferences" link in the site footer.

9. Security and Changes

The Company implements technical and organisational measures appropriate to the risk, including access controls, encrypted transmission (TLS), and regular review of data handling practices. No transmission over the internet is entirely secure; if you believe your data has been compromised, contact us immediately at [email protected].

We will reflect any material changes to this policy by updating the "Last updated" date above and, where the changes are significant, by notifying registered early-access users by email.

10. Contact

M10 Ltd
40 Rivington Street
London EC2A 4NE
United Kingdom
Email: [email protected]
Phone: +44 20 7946 0321