Privacy Policy

Updated: 13 September 2026

Please read this privacy policy carefully.

1. Introduction

1.1 This privacy policy should be read alongside, and in addition to, our Terms and Conditions, which can be found at: www.trickortreatmap.com/terms-and-conditions. Any capitalised terms which are used in this privacy policy but are not defined shall have the same meaning set out in the Terms and Conditions.

1.2 Trick or Treat (TOT) is operated by Community Maps Limited, a company registered in Guernsey, Channel Islands. If you have any questions about this policy, you can contact us at support@trickortreatmap.com

1.3 Community Maps Limited (the “Company” or “We“) respect your privacy and are committed to protecting it through our compliance with this policy.

1.4 This policy applies to information we collect through our website or via email, text and other electronic communications sent through or in connection with the Website.

1.5 This policy does not apply to information that:

1.5.1 we collect offline or including websites you may access through this Website; or

1.5.2 you provide to or is collected by any third party (see “Third-party information collection”) unless this information is provided by them to us.

1.6 If you do not agree with our policies and practices, do not, register with or use TOT. By registering with or using TOT, you agree to this privacy policy. This policy may change from time to time (see “Changes to our privacy policy”). Unless such changes mean changes to your preferences, your continued use of this Website after we make changes is deemed to be acceptance of those changes, so please check the policy periodically for updates.

2. Users under the age of 18

2.1 The Website is not intended for anyone under 18 years of age, and we do not knowingly collect personal data from anyone under 18.

2.2 If we learn we have collected or received personal data from anyone under 18 without parental or legal guardian consent, we will delete that information where feasible. Please note that in some cases, such as competition entries that have already been published or shared publicly, full deletion may not be possible.

3. Identity of Data Controller

3.1 A data controller is a person or organisation who makes decisions about how your personal data is collected, used and handled.

3.2 The Company is the data controller and may be contacted by email at support@trickortreatmap.com

3.3 Community Maps Limited is registered in Guernsey and complies with the Data Protection (Bailiwick of Guernsey) Law, 2017. We also adhere to relevant provisions of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 where applicable to our UK-based users.

4. What information is collected?

4.1 We collect personal data from and about users of our Website (“Data”) directly from you when you provide it to us; and automatically when you use the Website.

4.2 We do not collect special categories of personal data such as information relating to or about the following; Health, Racial or ethnic origin, Political opinions, Membership of a political association, professional or trade association, Membership of a trade union, Religious beliefs or affiliations, Philosophical beliefs, Sexual orientation or practices, Biometric information, Criminal records.

4.3 Data that you provide to us when you download, register with or use this Website may include your First name (or nickname), Postal address, Email address.

4.4 In addition, we may collect other information that is about you but individually does not identify you, such as age or gender. Data may also include:

4.4.1 information that you provide by filling in forms on the Website such as information about your trick or treating stop. first name, last name, email address, and address.

4.4.2 information when you enter a contest or promotion hosted by us;

4.4.3 information that you provide when you complete user surveys or surveys for research purposes;

4.4.4 information you provide to us when you report a problem with the Website;

4.4.5 records and copies of your correspondence when you contact us;

4.4.6 details of transactions you carry out through the Website and of the fulfilment of your orders; and

4.4.7 your correspondence within the Website with other users.

4.5 Third-party information collection

4.5.1 When you use the Website or its content, certain third parties may use automatic information collection technologies to collect personal data about you or your device. These third parties may include:

4.5.1.1 Advertisers, affiliate advertisers, ad networks and ad servers;

4.5.1.2 Analytics companies;

4.5.1.3 Your mobile device manufacturer; and/or

4.5.1.4 Your mobile service provider.

4.5.2 These third parties may use tracking technologies to collect information about you when you use the Website. The personal data they collect may be associated with your Data or they may collect information about your online activities over time and across different websites, apps and other online services or websites. They may use this information to provide you with interest-based (behavioural) advertising or other targeted content.

4.5.3 We do not control these third parties’ tracking technologies or how they may be used. If you have any questions about an advertisement or other targeted content, you should contact the responsible provider directly.

4.5.4 For information about how you can opt out of receiving targeted advertising from many providers, see section 8 below.

5 How Data is collected

Automatic Data collection and tracking

5.1 When you access and use the Website, it may use technology to automatically collect:

5.1.1 Usage details: when you access and use the Website, we may automatically collect certain details of your access to and use of the Website, including traffic data, location data, logs and other communication data and the resources that you access and use on or through the Website.

5.1.2 Device information: we may collect information about your mobile device and internet connection, including the device’s unique device identifier, IP address, operating system, browser type, mobile network information and the device’s telephone number.

5.1.3 Stored information and files: the Website also may access metadata and other information associated with other files stored on your device. This may include, for example, photographs, audio and video clips, personal contacts and address book information. You will be asked for your consent to such access and use of your Data within the Website. You can withdraw your consent at any time via the settings menu.

5.1.4 Location information: the Website with your specific consent collects real-time information about the location of your device. We do not, however, continually collect user location data nor do we collect location data without the user being aware. We store the location of a user at set points, for example when you choose to update your location and when you create/edit a Stop. Some of our location-enabled services require your Data for the feature to work. You will be asked for your consent to such access and use of your Data within the Website. Note, however, that opting out of the Website’s collection of location information will cause its location-based features to be disabled. You can withdraw your consent at any time via the settings menu.

5.2 If you do not agree to us collecting this information, please do not create an account with us.

5.3 The technologies we use for automatic Data collection may include:

5.3.1 cookies (or mobile cookies): a cookie is a small file placed on your smartphone or device. It may be possible to refuse to accept mobile cookies by activating the appropriate setting on your smartphone or device. However, if you select this setting you may be unable to access certain parts of our Website. The cookies we use include:

• Strictly necessary cookies: these are required for the operation of our Website. They include, for example, cookies that enable you to log into secure areas of our Website.
• Analytical/performance cookies: these allow us to recognise and count the number of visitors on and to see how visitors move around the Website when they are using it. This helps us to improve the way our Website works, for example, by ensuring that users are finding what they are looking for easily. These cookies are used to collect information about how visitors use our Website. We use the information to compile reports on general user traffic, conversion statistics and to help us improve the Website. These cookies collect information anonymously.
• Web Beacons: pages of the Website and our emails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags and single-pixel gifs) that permit the Company, for example, to count users who have visited those pages or opened an email and for other related statistics (for example, recording the popularity of certain content and verifying system and server integrity).
• Functionality cookies: these are used to recognise you when you return to our Website. This enables us to personalise our content for you and remember your preferences (for example, your choice of region). By using the Website, you agree to our placement of functionality cookies.
• Targeting cookies: these record your visit to our Website, the pages you have visited and the links you have followed. We will use this information to make our Website and the advertising displayed on it more relevant to your interests. We may also share this information with third parties for this purpose.
• Third-party cookies: the Website may link to other websites owned and operated by certain trusted third parties (for example Meta) who, for example, collect data that helps us track conversions from Facebook ads. These other third-party websites may also use cookies or similar technologies in accordance with their own separate policies. Please note that our advertisers may also use cookies, over which we have no control. For privacy information relating to these other third-party websites, please consult their policies as appropriate.

5.4 We may also use these technologies to collect information about your activities over time and across third-party websites, apps or other online services (behavioural tracking).

5.5 Third-party software/services

We use the following third-party software/services to collect and process your personal data for the following reasons:

5.5.1 Awin: Acquisition Channel Reporting

5.5.2 Amazon AWS: Primary record of user data, logs, performance, debugging

5.5.3 EdenAI: AI-assisted content moderation

5.5.4 Keycloak: Authentication software

5.5.5 Facebook: Acquisition channel reporting

5.5.6 Google Analytics: Feature usage and acquisition channel reporting

5.5.7 PowerBI: Data analytics software

5.5.8 MailChimp: Emailing software

5.5.9 Mapbox: Mapping software

5.5.10 Strapi: Database tool

5.5.11 Stripe: Payment software

5.5.12 Cloudflare Turnstile: Anti-robot check on the account and email forms. When you create an account or ask for an email in the App, Cloudflare checks that a person, not a program, is making the request. To do this Cloudflare receives your IP address and some technical details about your device and browser. It sets no tracking cookies and the check is not used for advertising. Cloudflare’s privacy policy: https://www.cloudflare.com/privacypolicy/

6. How we use Data and lawful basis for processing

6.1 Any or all of the above Data may be required by us from time to time to provide you with the best possible service and experience when using our Website. Specifically, Data may be used by us for the following reasons:

6.1.1 internal record keeping;

6.1.2 improvement of our products / services;

6.1.3 transmission by email of marketing materials that may be of interest to you;

6.1.4 contact for market research purposes which may be done using email, telephone, fax or mail. Such information may be used to customise or update the Website.

6.2 We may use your Data for the above purposes if we deem it necessary to do so for our legitimate interests. If you are not satisfied with this, you have the right to object in certain circumstances (see section 9 below).

6.3 For the delivery of direct marketing to you via e-mail, we’ll need your consent, whether via an opt-in or soft-opt-in:

6.3.1 soft opt-in consent is a specific type of consent which applies when you have previously engaged with us (for example, you contact us to ask us for more details about a particular product/service, and we are marketing similar products/services). Under “soft opt-in” consent, we will take your consent as given unless you opt-out.

6.3.2 for other types of e-marketing, we are required to obtain your explicit consent; that is, you need to take positive and affirmative action when consenting by, for example, checking a tick box that we’ll provide in the registration process.

6.4 If you are not satisfied with our approach to marketing, you have the right to withdraw consent at any time.

6.5 When you register with us and set up an account to receive our services, the legal basis for this processing is the performance of a contract between you and us and/or taking steps, at your request, to enter into such a contract.

6.6 We use your Data to:

6.6.1 set up and operate your TOT account (such processing is necessary for the performance of our contract with you).

6.6.2 provide you with the Website and its contents, and any other information, products or services that you request from us (such processing is necessary for the performance of our contract with you).

6.6.3 give you notices about your account, including expiration and renewal notices (such processing is necessary for the performance of our contract with you and necessary for us to comply with a legal obligation).

6.6.4 ensure that content from our Website is presented in the most effective manner for you and for your computer or device for accessing the Website (such processing is necessary for the performance of our contract with you).

6.6.5 carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collection (such processing is necessary for our legitimate interests (to recover monies due, etc)).

6.6.6 notify you when Website updates are available, and of changes to any products or services we offer or provide through it (such processing is necessary for our legitimate interests (to allow us to provide changes to our software, products or services)).

6.6.7 collect information from surveys that you sign up to take part in (such processing is necessary for our legitimate interests (to improve our services)).

6.6.8 manage your account, including processing payments and refunds and providing notifications, should this service be introduced within the Website (such processing is necessary for the performance of our contract with you and is necessary for our legitimate interests (to process payments)).

6.7 The usage information we collect helps us to improve our Website and to deliver a better and more personalised experience by enabling us to:

6.7.1 estimate our audience size and usage patterns (such processing is necessary for our legitimate interests (for running our services and to study how users use our Website).

6.7.2 store information about your preferences, allowing us to customise our Website according to your individual interests (such processing is necessary for our legitimate interests (for running our services).

6.7.3 speed up your searches (such processing is necessary for our legitimate interests (for running our services).

6.7.4 recognise you when you use the Website (such processing is necessary for the performance of our contract).

6.7.5 provide us with information about how the Website is running or whether there are any faults or issues with our products and services (such processing is necessary for our legitimate interests (for us to deliver a better service to you).

6.8 We use location data to:

6.8.1 provide information about stops within a fixed distance from the user’s set location (such information is necessary for the performance of our contract with you).

6.8.2 allow others to receive information about a user’s stop within their search radius (such information is necessary for the performance of our contract with you).

7. Keeping Data secure

7.1 We have implemented reasonable measures designed to secure your Data from accidental loss and from unauthorised access, use, alteration and disclosure, for example:

7.1.1 access to your account is controlled by a password and a username that is unique to you; and

7.1.2 we store your Data on secure servers.

7.2 The safety and security of your information also depends on you. Where we have given you (or where you have chosen) a password for access to certain parts of our Website, you are responsible for keeping this password confidential. We ask you not to share your password with anyone. We urge you to be careful about giving out information in public areas of the Website like message boards. The information you share in public areas may be viewed by any user of the Website.

7.3 Unfortunately, the transmission of information via the internet and mobile platforms is not completely secure. Although we do our best to protect your Data, we cannot guarantee the security of your Data transmitted through our Website. Any transmission of Data is at your own risk. We are not responsible for circumvention of any privacy settings or security measures we provide.

7.4 If you suspect that there has been a breach of the security of your data you should contact us at: support@trickortreatmap.com and include details of the nature, the date and the full circumstances of the breach.

7.5 On notification of such a breach, we will investigate the matter and, where appropriate and required by law, notify the relevant data protection regulator.

8. How personal data is shared and with whom.

8.1 You may provide information to be published or displayed (“Posted“) on public areas of the Website (collectively, “User Contributions“). Your User Contributions are Posted and transmitted to others at your own risk. We cannot control the actions of third parties with whom you may choose to share your User Contributions. Therefore, we cannot and do not guarantee that your User Contributions will not be viewed by unauthorised persons.

8.2 We may disclose aggregated information about our users, and information that does not identify any individual or device, without restriction.

8.3 In addition, we may disclose Data that we collect or you provide:

8.3.1 to our subsidiaries and affiliates.

8.3.2 to contractors, service providers and other third parties we use to support our business and who are bound by contractual obligations to keep Data confidential and use it only for the purposes for which we disclose it to them.

8.3.3 to a buyer or other successor in the event of a merger, divestiture, restructuring, reorganisation, dissolution or other sale or transfer of some or all of the Company’s assets, whether as a going concern or as part of bankruptcy, liquidation or similar proceeding, in which Data held by the Company about our Website users is among the assets transferred.

8.3.4 to fulfil the purpose for which you provide it. For example, if you give us an email address to use the “email a friend” feature of our Website, we will transmit the contents of that email and your email address to the recipients.

8.3.5 for any other purpose disclosed by us when you provide the information.

8.3.6 for the purposes of academic research.

8.3.7 for any other purpose with your consent.

8.3.8 to comply with any court order, law or legal process, including to respond to any government or regulatory request.

8.3.9 to enforce our rights arising from any contracts entered into between you and us.

8.3.10 if we believe disclosure is necessary or appropriate to protect the rights, property, or safety of the Company, our customers or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

9. What choices you have with respect to how personal data is used.

9.1 We strive to provide you with choices regarding the Data you provide to us. This section describes mechanisms we provide for you to control certain uses and disclosures of your information. You may need to adjust the settings on your device to restrict the collection of information by the Website but this may prevent you from accessing all of the features of the Website.

9.2 Tracking Technologies: you may be able to set your browser or device to refuse all or some browser cookies, or to alert you when cookies are being sent. If you disable or refuse cookies or block the use of other tracking technologies, some parts of the Website may then be inaccessible or not function properly.

9.3 Location Information: you can choose whether or not to allow the Website to collect and use real-time information about your device’s location through the device’s privacy settings. If you block the use of location information, some parts of the Website may then be inaccessible or not function properly. For example, users have the ability to only allow manual geolocation (rather than using their device’s autolocating functionality), the provision of at least one piece of location data (i.e. the user’s search location) is a requirement for the Website to function.

9.4 Promotion by the Company: if you do not want us to use your email address or other Data to send you information, notifications, news, surveys or promote our own products or services, you can opt-out by logging into the Website and adjusting your user preferences in your account profile by checking or unchecking the relevant boxes.

9.5 Targeted advertising by the Company: we do not use information that we collect or that you provide to us to deliver our own advertisements.

9.6 Disclosure of your information for third-party advertising and marketing: we do not share your Data with third parties for advertising and marketing purposes. However, we may include offers from third parties in our marketing materials and via links or pop-ups in the Website.

9.7 We do not control third parties’ collection or use of your information to serve interest-based advertising. However, these third parties may provide you with ways to choose not to have your information collected or used in this way. (Note: In the United States of America you can opt out of receiving targeted ads from members of the Network Advertising Initiative (“NAI“) on the NAI’s website).

10. Your rights with respect to personal data.

10.1 You have the following rights in relation to your Data:

10.1.1 Right to access: the right to request copies of the Data we hold about you at any time. If we provide you with access to the information we hold about you, we will not charge you for this, unless your request is “manifestly unfounded or excessive.” Where we are legally permitted to do so, we may refuse your request. If we refuse your request, we will tell you the reasons why.

10.1.2 Right to correct: the right to have your Data rectified if it is inaccurate or incomplete.

10.1.3 Right to erase: the right to request that we delete or remove your Data from our systems.

10.1.4 Right to restrict our use of your Data: the right to “block” us from using your Data or limit the way in which we can use it.

10.1.5 Right to data portability: the right to request that we move, copy or transfer your Data.

10.1.6 Right to object: the right to object to our use of your Data, including where we use it for our legitimate interests.

10.2 To make enquiries, exercise any of your rights set out above, or withdraw your consent to the processing of your Data , please contact us via this e-mail address: support@trickortreatmap.com.

10.3 If you are not satisfied with the way a complaint you make in relation to your Data is handled by us, you may be able to refer your complaint to the relevant data protection authority. For the UK, this is the Information Commissioner’s Office (ICO). The ICO’s contact details can be found on their website at https://ico.org.uk/.

10.4 We will respond to a request to access, correct or delete any data within 30 days of the date we receive the request.

10.5 We may not accommodate a request to change information if we believe the change would violate or breach any law or legal requirement or cause the information to be incorrect.

10.6 If you delete your User Contributions from the Website, copies of your User Contributions may remain viewable in cached and archived pages, or might have been copied or stored by other Website users. Proper access and use of information provided on the Website, including User Contributions, is governed by our Terms and Conditions.

11. How long personal data is kept?

11.1 Unless a longer retention period is required or permitted by law, we will only hold your Data on our systems for the period necessary to fulfil the purposes outlined in this privacy policy or until you request that the Data be deleted.

11.2 Even if we delete your Data, it may persist on backup or archival media for legal, tax or regulatory purposes.

11.3 Upon deletion of an account, all Data will be removed as soon as possible, and always within 90 days of the deletion request.

12. Changes to this privacy policy

12.1 We may update our privacy policy from time to time. If we make material changes to how we treat our users’ Data, we will notify you by email or via the Website. By continuing to use the Website after notification, you will be deemed to have accepted any changes.

12.2 The date the privacy policy was last revised is identified at the top of the page. You are responsible for periodically visiting this privacy policy to check for any changes.

13. Information

13.1 All questions, comments and requests regarding this privacy policy should be addressed to support@trickortreatmap.com.

14. Links to other websites

14.1 This Website may, from time to time, provide links to other websites. We have no control over such websites and are not responsible for the content of these websites. This privacy policy does not extend to your use of such websites. You are advised to read the privacy policy or statement of other websites prior to using them.

15. General

15.1 You may not transfer any of your rights under this privacy policy to any other person. We may transfer our rights under this privacy policy where we reasonably believe your rights will not be affected.

15.2 If any court or competent authority finds that any provision of this privacy policy (or part of any provision) is invalid, illegal or unenforceable, that provision or part-provision will, to the extent required, be deemed to be deleted, and the validity and enforceability of the other provisions of this privacy policy will not be affected.

15.3 Unless otherwise agreed, no delay, act or omission by a party in exercising any right or remedy will be deemed a waiver of that, or any other, right or remedy.

15.4 This Agreement will be governed by and interpreted according to the law of England and Wales. All disputes arising under the Agreement will be subject to the exclusive jurisdiction of the English and Welsh courts.

16. Changes of business ownership and control

16.1 Trick or Treat may, from time to time, expand or reduce our business and this may involve the sale and/or the transfer of control of all or part of Trick or Treat. Data provided by Users will, where it is relevant to any part of our business so transferred, be transferred along with that part and the new owner or newly controlling party will, under the terms of this privacy policy, be permitted to use the Data for the purposes for which it was originally supplied to us.

16.2 We may also disclose Data to a prospective purchaser of our business or any part of it.

16.3 In the above instances, we will take steps with the aim of ensuring your privacy is protected.

17. Transfers outside the United Kingdom and European Economic Area

17.1 Data which we collect from you may be stored and processed in and transferred to selected countries outside of the UK and European Economic Area (EEA). For example, this could occur where our servers or one of our service providers are located in a country outside the UK or EEA, such as the United States of America.

17.2 We will only transfer Data outside the UK or EEA where it is compliant with data protection legislation and the means of transfer provides adequate safeguards in relation to your data, eg. by way of data transfer agreement.

17.3 To ensure that your Data receives an adequate level of protection, we select the third parties we share your Data with very carefully and ensure their data protection safeguards and procedures are of standards equivalent to those applicable in the UK or EEA.

18. Terms applicable In specific countries

18.1 Users in the United States of America, California Civil Code Section 1798.83 permits users of our Website that are California residents to request certain information regarding our disclosure of Data to third parties for their direct marketing purposes. To make such a request, please send an email to support@trickortreatmap.com.

18.2 US users may also have rights under state-specific privacy laws, such as CCPA.

18.3 Users in Germany may be entitled to compensation if they have suffered harm by the collection, processing or use of personal data in violation of data protection law. This policy sets out how we have exercised due care to ensure the prevention of such harm and users in Germany should not use the Website if they consider that any measure set out in this policy may cause them harm.

18.4 Users in Australia, this policy has been developed in accordance with the Australian Privacy Principles, a copy of which may be accessed here: https://www.oaic.gov.au/privacy-law/privacy-act/australian-privacy-principles

18.5 Users in Canada, this policy takes into account the requirements of Principle 4.1.3 Schedule 1 Data Protection and Electronic Documents Act (Canada) with respect to the storage of personal data outside of Canada.

18.6 Users in South Africa, this policy takes into account the requirements of the Protection of Data Act (South Africa) 2013.

18.7 Users in Singapore, this policy takes into account the requirements of the Personal Data Protection Act (Singapore) 2012.

19. The On Your Street app

19.1 Our mobile application, “On Your Street” (the “App”), is provided by Community Maps Limited and gives access to the same service as the Website. This privacy policy applies to the App in the same way as it applies to the Website, and references in it to the Website include the App.

19.2 Location. The App asks for your permission, through your phone, before it uses your location. Your location is used to show trick-or-treat stops, events and Ghost Hunt ghosts near you, and in the other ways this policy describes for the Website. You can withdraw that permission at any time in your phone’s settings.

19.3 Notifications. If you agree to receive notifications, your phone gives us a notification token - an identifier for your device issued by Apple or Google - which we keep with your account, together with the type of phone and the version of the App, so that we can send you notifications. You can turn notifications off at any time in your phone’s settings, and the token is removed from your account when you sign out of the App.

19.4 Purchases. Purchases made in the App are processed by Apple (the App Store) or Google (Google Play) under their own terms and privacy policies. We do not receive your card or bank details. We receive and keep a record of each purchase - the item, the store’s transaction reference, the amount and currency charged and the date - so that we can provide what you bought and deal with refunds and support requests. Refunds of purchases made in the App are handled by Apple or Google.

19.5 Signing in. You can sign in to the App, or create an account in it, with Apple, with Google, or with an email address and password. Sign in with Apple uses your phone’s own Apple sign-in; Google opens in your phone’s web browser; email and password are entered on the App’s own screen and checked by our sign-in service (Keycloak). In each case your session is then passed securely to the App.

19.6 Tracking. The App does not track you across apps or websites owned by other companies, and does not use advertising identifiers or advertising cookies. We use Google Analytics to understand how the App is used, as this policy describes for the Website.

19.7 Deleting your account. You can delete your account at any time from within the App, on the My Account page.

19.8 Anti-robot check. When you create an account with an email address in the App, or ask us to email you a sign-in or password link, Cloudflare Turnstile checks that the request comes from a person (see 5.5.12). It receives your IP address and technical details about your device, sets no tracking cookies, and is not used for advertising.