Privacy
policy

The Bluegenji Esport association — a French nonprofit (law of 1901), registered office: 4 impasse des Cyprès, 51210 Janvilliers, France.

Email: Show email · Phone: Show phone

Person to contact for your requests regarding your data: Keryan Houssin, technical host of the site. Email: Show email · Phone: Show phone

He is not a data protection officer within the meaning of Article 37 of the GDPR: the association remains the data controller. You can also make a request by the means given in section 11.

The player account asks for no real name, no phone number, no postal address: it relies on game usernames. Three exceptions, outside the account: a copyright report states its author's name; a request regarding your data sent by email or by phone carries its sender's address or number, and often their name; and the board members and volunteers presented on the site appear there under their name, with their agreement (register, T07 and T11). Google sends the name of your account with your picture: since September 30, 2026, it is neither used nor kept, an account created through Google receives a neutral username that you replace in My profile, and the picture copied from Google or Discord stays hidden until you choose to show it. An account created through Google before that date may have received the name of that account as its username, and its Google picture may have been copied and displayed: nothing was changed there automatically. Each account linked to Google and created before that date is informed of this once at its next visit, and can change its username and picture, or hide the latter, in My profile.

Mandatory and optional data. To exist, an account only needs a means of logging in — the Google, Discord or Blizzard identifier of the chosen provider — and a site username, assigned automatically at creation. Without a means of logging in, no account can be created: public pages remain readable, but you can neither join a team nor register for a tournament. The provider also sends what the table describes for it, which comes with the login: the Discord username from Discord, the BattleTag from Blizzard (kept up to date at each login as long as the Battle.net account is linked), the picture from Google or Discord (copied, and hidden until you show it). What you fill in yourself (game usernames entered, certification of the Discord tag, uploaded avatar, adulthood) is optional, and the account works without it, with two limits: a tournament may require, to register, a certified Discord tag or a linked Battle.net account, and a member of the streaming staff cannot register as the caster of a match without both.

Minimum age. You must be at least 15 years old to create an account (terms of use). This is the association's choice: it uses the threshold below which a minor cannot consent alone to processing based on their consent for an online service (article 45 of the French Data Protection Act, loi Informatique et Libertés), which is the case of the optional profile data; the account itself is based on the performance of the terms of use. The site does not ask for a date of birth and does not check age; adulthood, which is optional, remains a mere declaration. Membership of the association, separate from the account, follows the age requirement of its bylaws.

Competition results (scores, rankings, brackets) form a sporting record. As such, keeping them indefinitely is based on the association's legitimate interest and the collective memory of the French-speaking esports scene.

Since October 2026, a score is entered map by map: each map carries the replay code of the game, which makes it possible to watch it again in game — and so to read there the in-game identifiers of the players present, including a BattleTag hidden on the site. These codes are visible to the site's logged-in members on the tournament page once recorded by the referees or retained as the result, so that a match streamed live and one that is not offer the same information — while a team proposal is pending, only the two teams of the match and the referees can read it —, and kept with the result they document (a detail that no longer explains it is erased); the account that entered them is only linked internally, and that link disappears when the account is deleted. The game itself is kept by the game's publisher: deleting your account here does not erase your in-game identifiers from a replay, and the codes remain attached to the result they document. The maps you entered appear in the export of your data.

Why legitimate interest. The interest pursued is to keep accurate the results, rankings and achievements, which also belong to the teams and players who competed for them: erasing a player's matches would rewrite the record of their teammates and opponents. What you should know:

• Pseudonymization, not anonymization: a username, a BattleTag or a Discord tag are personal data (online identifiers). The borrowed username replaces yours, but the record kept remains attached to rosters and to a team history through which you can, sometimes, still be recognized.
• Period: no retention period is defined for these results: they remain as long as the site exists. When an account is deleted, they are anonymized — the borrowed username described above replaces yours.
• Prior information: this policy informs users before any registration.
• Right to object: you can object to this retention by contacting us. Each request is examined in the light of article 21 of the GDPR: retention stops, unless there are compelling legitimate grounds that override your interests, rights and freedoms.

BlueGenji uses no advertising cookie, no third-party analytics tracker (Google Analytics, Meta Pixel, etc.). The site's audience measurement sets no measurement cookie (only your possible objection is remembered by a cookie): it is described below.

Here is the list of everything the site sets or reads in your browser (cookies, local storage, session storage, cache):

• bg_session — httpOnly, sameSite=lax session cookie, lasting 30 days, set at login. It only contains a random token, which says nothing about you and allows you to be recognized on the platform; our servers only keep its hash (SHA-256), never the token itself. It is deleted at logout.
• bg_oauth — set for the duration of a login through Google, Discord or Blizzard, and deleted on return. It lasts ten minutes at most and only contains a single-use random token (anti-CSRF protection), the provider's name, the page to bring you back to, the purpose of the login (logging in or linking an account) and whether you accepted the terms of use. No personal identifier.
• bg_suspension_notice — set only if a login is refused because your account is suspended, to display the decision on the login page, which erases it as soon as it is first read (ten minutes at most if it is never read). It only contains the reference of the decision, the facts relied on, the clause invoked and the expiry; it is readable only by the server (httpOnly).
• bg_recr_modal and bg_recr_banner — set only when the window of urgent recruitment announcements is shown to you (the first) or if you close the recruitment banner (the second), so as not to show them to you again. They only contain the numbers of the announcements concerned, never a personal identifier: they allow neither recognizing you nor following you from one site to another (sameSite=strict). The first lasts seven days, the second the duration of your visit.
• bg_terms_later — set only if you postpone accepting the terms of use (“Later” button), so as not to ask you again on every page. It only contains the value “1”, never a personal identifier, lasts twelve hours at most, and disappears earlier at each login or logout, or as soon as you accept.
• bg_a11y — set only if you turn on an accessibility setting (button on the left edge of the screen: contrast, font, focus…), to apply it as soon as the following pages are displayed. It only contains the list of chosen settings, never a personal identifier, lasts one year and disappears when you turn them all off.
• bg_match_focus and bg_power_ignore_perf — two values of your browser's local storage, never sent to the server. The first lightens the site's other tabs during your match (a randomly drawn tab number and a deadline of twenty minutes at most); the second remembers your choice to ignore the eco mode's performance detection.
• bg:last-visit-ping — a session storage value, erased when the tab is closed: the time of the last visit report, so as not to count the same load twice. It identifies no one and is never sent; what the server receives from a visit is described under Audience measurement.
• bg_audience_optout — set only if you object to audience measurement (button of the Audience measurement section), so as to stop reporting and recording your visits. It only contains the value “1”, never a personal identifier, lasts 395 days (thirteen months) and disappears if you turn measurement back on.
• bg_match_launch_dismissed — a session storage value, erased when the tab is closed, set if you close the launch window of a match: the match number and the step of its launch, so as not to reopen it in that tab. Never sent to the server.
• bg_lazy_chunk_reload_at — a session storage value, erased when the tab is closed, set only if part of a tournament page could not load (after an update of the site): the time of the automatic reload that followed, so as not to reload more than once a minute. Never sent to the server.
• bg_rgpd_consent and bg_terms_consent — two local storage values, set on the login page when you continue after reading the information about your data and accepting the terms of use, so as not to present them to you again. They only contain a version number: a new version presents them to you again. The acceptance of the terms is also kept on our servers, with its version number, as soon as your account exists.
• Service worker and “bg-offline” cache — the site installs in your browser, for every visitor, a small program (/push-sw.js) that caches a single page, the site's “offline” page, displayed instead of the browser's error when the network is down. This cache only contains that page, identical for everyone: no data about you. The same program receives notifications, only if you turn them on (see Notifications). It remains until you clear the site's data in your browser.

bg:last-visit-ping is part of audience measurement, whose conditions are described below: it falls within the exemption provided by the CNIL (the French data protection authority) for audience measurement trackers (guidelines of September 17, 2020), which requires a means of objecting and limited retention periods — both are described below. The other items do not require your consent: article 82 of the French Data Protection Act (loi Informatique et Libertés) exempts trackers that are strictly necessary for the service you request, or whose sole purpose is to enable it. None of them is used for advertising or for tracking from one site to another.

No third-party service is loaded in your browser, and no third-party cookie is set. Logging in through Google, Discord or Blizzard takes you to the provider's page, which brings you back here: the exchange that follows takes place between our server and theirs.

Purpose. Knowing how much the site is visited: number of visits over 24 hours, 7 days, 30 days and since the launch, and of unique visitors over 24 hours, 7 days, 30 days and 25 months. No third-party tool is used, and none of it is used for advertising.

What is sent. When you arrive on the site, through any page (including the login page, before any account is created), your browser reports the path of that page to the server, without its parameters. Navigating from one page to another does not do so, and the same tab normally does not do it again for 30 minutes; on the server side, several arrivals within 30 minutes count as a single visit.

What is recorded. The server computes a hash (SHA-256) mixed with a secret that only it holds: it is derived from your account if you are logged in, otherwise from your IP address and your browser (user-agent). It records this hash, the page, the date and a “logged-in visitor” indicator (yes or no). Your IP address, your browser and your account identifier are never recorded as such.

Pseudonymized data, not anonymous. Without the secret, no one can link a hash to a person. But the association holds it: it can recompute the hash of an account, or of an IP address combined with a browser, and find the corresponding visits. These hashes are therefore personal data within the meaning of the GDPR.

Legal basis. The association's legitimate interest in knowing how much its site is visited (art. 6.1.f of the GDPR).

Retention period. Visit details (hash, page, date) are erased after 31 days, after being added to a daily counter that only keeps the number of visits. To count unique visitors, the site also keeps one hash per visitor, without page but with the “logged-in visitor” indicator and the date of the last visit: it is erased 25 months after that last visit — including after an account is deleted, which does not erase it sooner. Hashes recorded before this rule are dated from when it was introduced, as their last visit had not been kept.

Recipients. The association's staff. The totals (numbers of visits and visitors, without any hash) are also displayed by the Discord bot's /stats-site command, open to any member of a server where the bot is installed.

Your right to object. You can object to this measurement (art. 21 of the GDPR) without having to ask. The site respects your browser's Global Privacy Control and Do Not Track signals, and the button below remembers your choice in this browser (bg_audience_optout cookie). A refused visit is not recorded: the server reads these signals itself. It is not even reported to the server when your browser exposes them to the page, as most do (an extension that only adds the header lets the report go, which the server then discards without computing anything). The objection applies to your future visits; for visits already recorded, the right is exercised like your other rights, by the means given in the “Exercising your rights” section.

1. Reporting a problem

The “Report a problem” button, at the bottom of every page, is open to everyone, with or without an account. You choose a category — copyright (« Droit d'auteur »), moderation (« Modération »), bug, GDPR (« RGPD »), host (« Hébergeur »), other (« Autre ») —, describe the problem and, when logged in, designate the players, teams or tournaments concerned. A copyright report states the name or corporate name of its author, their email address, their capacity (rights holder, representative or third party), the content concerned and where to see it on the site, the reason for the request and a statement of good faith: this is what the EU Digital Services Act requires of a notice of illegal content (art. 16). The author of a notice receives, at the address they provide (required for copyright, optional otherwise), an acknowledgment of receipt, then the decision taken on it and the means of redress available to them. If they reported from their account, they can contest that decision — including a decision not to act — through the “Appeal” category (« Contestation ») of the same form, once the report has been archived. In-game behavior (insults, cheating, unsportsmanlike play, dispute on Discord) is not reported through this form but on the association's support portal (hosted by Spiceworks): the site sends nothing there, it is reached through a simple link. A ticket is kept there for as long as it takes to handle it, then 1 month after it is closed (register, T15).

• Data: the category, the description, the items designated, the page the report comes from, the reporter's account if they are logged in, and the name and email address they provide.
• Legal basis: legal obligation for a request to exercise rights (GDPR category — GDPR, art. 6.1.c and 12), a notice of illegal content (copyright or moderation of content on the site — EU Digital Services Act, art. 16), a request sent to the hosting provider (art. 11 and 16) and an appeal (art. 20): no agreement box is asked for, the request is handled. For the other categories (bug, other), consent, collected by a box when sending and withdrawable through the GDPR category. The moderation decisions that follow on content or an account contrary to the terms of use (hiding, removal, suspension) are based, for their part, on the association's legitimate interest in enforcing its rules.
• Reply: a GDPR request, a request sent to the hosting provider, or an appeal requires an email address, except from an account whose Discord tag is certified — the site sends no email, the reply comes from the association, to the address provided or on Discord.
• Recipients: the association's administrators. An alert goes out on Discord (staff channel, direct message to the owner and the president) without the reporter's name, address or description, and without any player's username.
• Period: the time it takes to handle it, then 30 days after archiving — extended as long as a logo or avatar hidden or deleted on the basis of the report can still be contested by its team or player, and raised to 6 calendar months after archiving for a copyright or moderation report sent from an account, so that its author can contest the decision. A deleted account does not leave its username there.

2. The persons targeted are notified

The players designated and the members of the teams designated receive a Discord direct message (if they have linked their Discord account or certified their tag) that leads to the report's page. There they read the reason and the description — never the reporter's identity (neither account, nor name, nor email address) — and only the items that concern them. So that repeated sending does not make the bot write in a loop, a person already targeted by another report less than 24 hours earlier is not notified a second time: the new report remains viewable and can be contested through the form (“Appeal” category, « Contestation »).

3. The right to contest

A person targeted can contest — a designated player, or a current member of a designated team —, from the report's page or through the “Appeal” category (« Contestation ») of the same form. The author of a copyright or moderation report can, for their part, contest the decision taken — including a decision not to act — through the same category, once the report has been archived, if they sent it from their account. The appeal is filed under the original report and read by the administrators, who are notified of it on Discord. Contesting an already archived report reopens it. Neither the author of the report nor the persons targeted are informed of the appeal; it is kept and erased with the report it concerns.

4. A reported logo or avatar: hidden, then restored or deleted

Rather than immediately deleting a reported team logo or player avatar, the association can hide it: it immediately stops being online (the file leaves the folder served by the site), and it is kept separately, offline. The team members, or the player, receive a direct message setting out the reasons for the decision (reason, facts relied on, clause of the terms of use invoked), the means of redress and the date of permanent deletion.

• Period: 6 calendar months, counted from the hiding — the period for contesting a moderation decision that the EU Digital Services Act sets for online platforms (art. 20.1), and that the association applies.
• Without a challenge, the image is permanently deleted when the period ends, from the site as from its backups.
• If contested, it is never deleted automatically: it awaits the association's decision. If the challenge succeeds, it is restored as it was and the person concerned is notified.
• Manifestly illegal content can be deleted without a hiding period. The team or the player is notified in the same way and can contest the decision within the same period; if the challenge succeeds, the image can be uploaded again.

When removed from a team's or a player's page, outside any report, an image is removed on a reason entered by moderation: it is sent to the team or the player with the decision, and the site does not keep it.

5. Suspending an account

A member of moderation can suspend an account contrary to the terms of use, for a fixed or indefinite period: all its sessions are closed and no login is possible while the suspension runs.

• Data: the account targeted, the facts relied on, the clause invoked, the dates of start, expiry and lifting, and the member of moderation who imposed or lifted it.
• Legal basis: the association's legitimate interest in enforcing its terms of use.
• Information: the holder receives the decision, the facts relied on, the clause invoked and the means of contesting it, by Discord direct message if their account is linked to it, and at each login attempt during the suspension. They contest it without logging in, through “Report a problem” (“Other” category, « Autre »), quoting the reference of the decision; the association reviews it, and the matter can then be brought before the competent court. The staff's log on Discord carries neither their username nor the reason.
• Period: while it runs, then 6 months after it is lifted or expires — the period for contesting —, before being erased at the first login to the site after that period; also erased with the account, or when it is anonymized. It appears in the export of your data, without the name of who imposed it.

These rules also apply under the terms of use, which everyone accepts when creating an account or a team.

You can be notified on your phone or computer of the start of your matches, of a score to confirm, of a tournament's kick-off, of match reminders and of what concerns your account or your team. Nothing is sent without your action: notifications are turned on device by device, from My profile (in French), where you also choose the topics.

• What the site keeps: the subscription address your browser gives it, its encryption keys, the date of subscription and of the last notification delivered, and the topics you have turned off.
• Where the message goes: your browser's push service (Google, Mozilla, Apple or Microsoft), which receives it encrypted for your device only and cannot read it. No notification carries a player's username.
• For how long: until you turn them off, your browser revokes the subscription or you delete your account — and at most 180 days without a notification delivered.

The association's site and Discord bot are hosted in France, on a Raspberry Pi installed in Caen, by a volunteer of the association (see the legal notice), and their encrypted backups are stored in Germany. Your data only leaves them for the following recipients — the last three only see what you exchange yourself, by email or by phone, with the association or with the person to contact for your requests regarding your data, without going through the site:

• Discord (United States): the bot's direct messages (login code, match reminders, notifications) and the staff-only channels, which carry no player username; and logging in through Discord, if you choose it.
• Google and Blizzard (United States): only if you log in through one of them, which authenticates you as the controller of its own processing.
• Your browser's push service (Google, Mozilla, Apple or Microsoft): only if you turn on notifications, and it only receives encrypted messages it cannot read.
• Hetzner (Germany): the backups, encrypted before upload with keys Hetzner does not hold — Hetzner stores them without being able to read them, in the European Union.
• Spiceworks (United States): the association's support portal, only if you open a ticket there or are named in one. Spiceworks is a processor of the association, under Spiceworks' data processing agreement (Data Processing Agreement) (register, T15).
• Microsoft (Outlook.com): the personal mailbox of the person to contact for your requests regarding your data is hosted by Microsoft on a personal account, without a processing agreement. An email you send to Keryan Houssin, and the reply he sends you by email, go through it without encryption of the association's own: Microsoft can therefore read them (period: section “Exercising your rights”).
• Google (Gmail): the association's email is a Gmail mailbox. An email you send it, and its reply, go through it without encryption of the association's own: Google can therefore read them (period: section “Exercising your rights”).
• The telephone operators of the person to contact and of the association: only if you call them or leave them a text or a voice message.

Safeguards for transfers. Among these services, those that may process or host data in the United States — not the telephone operators — do so on the following basis: Discord, Google, Microsoft, Apple, Mozilla and Spiceworks (Ziff Davis, Inc.), certified under the EU-U.S. Data Privacy Framework: European Commission adequacy decision (EU) 2023/1795 of 10 July 2023 (EU-U.S. Data Privacy Framework); Blizzard: standard contractual clauses of the European Commission (art. 46 GDPR), included in its terms of use; for Spiceworks, as a fallback, standard contractual clauses of the European Commission (art. 46 GDPR) contained in Spiceworks' data processing agreement. As for the streaming platforms, the site only links to their channels: it sends them nothing and embeds none of their players (“Match streaming” paragraph below).

Backups. They are stored with Hetzner Online GmbH (Germany), Storage Share service, sub-processor of the association through the site's host, who accepted its data processing agreement (Data Processing Agreement, version 1.2) on October 1, 2026; processing exclusively in the European Union or the European Economic Area: no transfer outside the Union. Database archives, images, hidden logos and the deletion log are moreover encrypted on the Raspberry Pi before any upload, with keys held only by the site's host, Keryan Houssin, and never sent to Hetzner; the upload is encrypted in transit (HTTPS/TLS).

Match streaming. A tournament match may be streamed live and recorded on YouTube, Twitch or Kick, on the association's channel or a caster's. What appears is the players' usernames, their team's name and their in-game results and performance — never a webcam or voice chat. This processing is based on the association's legitimate interest in promoting its competitions. Any player can object: they then appear under a neutral name. The request is made through the “Report a problem” button, GDPR category (« RGPD »). A replay link that shows the player is then removed from the site, and a video published by the association's channel is hidden or deleted. Viewers, for their part, watch the stream on the platform, which processes their data as the controller of its own processing (register, T16).

The details, processing activity by processing activity, are given in the register below.

The register describes the processing of personal data by the association's site and Discord bot: purposes, data, retention periods, recipients, transfers and security measures. It is public — viewable and downloadable by anyone, without an account or a request. Here is each of its processing activities, with its legal basis and retention period; the details are in the register.

It also describes the support portal (Spiceworks), match streaming and the web server's technical logs. Managing memberships of the association is not part of the site: the association keeps it outside the site, and this register does not describe it — for any question about it, use the contact details of the privacy policy.

• T01 — Player accounts and profiles: Allowing players to have an account on the tournament platform. Legal basis: Performance of the service requested by the player (contract) for the account; consent for the optional data the player fills in and chooses to make visible. Retention: Lifetime of the account; On deletion: complete erasure if the account has left no trace (no match played, no registration in a solo tournament, no team owned, no tournament organized), immediate anonymization otherwise — the username is replaced by a borrowed username, and only the anonymized account remains, with its tournament and team history; in both cases, the connection data log (T14) is kept until its legal deadline; the information provided when the account was created (username, provider identifiers) is not kept after deletion, apart from the encrypted backup copies (T09, 30 days at most) and the record of the deletion in the log that replays it after a restoration (account identifier and creation date, 60 days); the reports sent by the account are detached from it and follow their own period (T11), and a staff member's refereeing actions remain named in the server logs, according to their rotation (T05); Login sessions: 30 days after login.
• T02 — Authentication: Logging a player into their account without a password. Legal basis: Performance of the service requested by the player (contract). Retention: Login identifiers: lifetime of the account, or until the provider is unlinked; erased when the account is deleted (only the connection data log, T14, outlives it, apart from the encrypted backup copies, T09, 30 days at most); Login codes: valid 10 minutes, purged one day after expiry, erased when the account is deleted.
• T03 — Tournaments, teams and achievements: Organizing amateur tournaments and keeping their results. Legal basis: Legitimate interest (organizing competitions, sporting memory of the scene). Retention: Results and achievements: no defined retention period, kept as long as the site exists; anonymized when the account is deleted (borrowed username); Replay codes: kept with the result they document (a detail that no longer explains it is erased); the link to the account that entered them is erased when the account is deleted, the codes remain (the game is kept by the game's publisher); Right to object available on request.
• T04 — Contacting players during a tournament: Allowing the organizers to reach a player taking part (rescheduling, settling a dispute, confirming a forfeit). Legal basis: Consent for exposing the certified Discord username to the organizers (certification, a separate action taken by the player from their profile — never acquired by logging in alone — and withdrawable by removing their tag); performance of the service requested by the player (contract — terms of use) for presenting the contacts to the parties to a match at its launch and collecting the “Ready”; legitimate interest (smooth running of tournaments) for match reminders and refereeing alerts. Retention: Certified username: until it is changed or the account is deleted; Records of reminders and alerts sent (match and step, without content): kept with the match, so with no time limit; “Ready” and caster of a match: kept with the match; the caster of a deleted account is removed from matches not yet played.
• T05 — Staff activity log on Discord: Keeping the staff informed of notable events on the platform. Legal basis: Legitimate interest (administration and oversight of refereeing). Retention: Discord messages: kept in a staff-only channel, purged manually by the association and by the bot after 365 days (one year), in batches — several nights for a large backlog (processing activity T08); Server logs: according to their automatic rotation.
• T06 — Site audience measurement: Knowing how much the site is visited. Legal basis: Legitimate interest (art. 6.1.f GDPR: knowing how much the site is visited), without a measurement cookie or third-party tracker; right to object (art. 21) applied by the site itself — the browser's Global Privacy Control and Do Not Track signals, or the objection button of the privacy policy (“Audience measurement” section; bg_audience_optout cookie, without identifier): a refused visit is not recorded, as the server reads these signals itself, and is not even sent when the browser exposes them to the page. For visits already recorded, the right is exercised like the other rights: with the person to contact for requests regarding data, through the report form, “GDPR” category (« RGPD »), or with the association. Retention: Visit details (hash, page, date) erased after 31 days, after being added to a daily counter that only keeps the number of visits; One hash per visitor, without page but with the “logged-in visitor” indicator and the date of the last visit, erased 25 months after that last visit (including after the account is deleted, which does not erase it sooner); hashes prior to this rule are dated from when it was introduced; IP address, browser and account identifier never recorded as such.
• T07 — Presenting the association and recruiting volunteers: Presenting the board and the volunteers, and recruiting. Legal basis: Consent of the volunteers and board members concerned. Retention: Duration of involvement in the association, or of publication of the announcement.
• T08 — BlueGenji Discord bot: Providing the bot's services on partner Discord servers. Legal basis: Legitimate interest (operating, moderating and measuring the relay between partner servers); the site's messages fall under the basis of their original processing. Retention: Tracking of relayed announcements: 7 days, erased at the first relay after that deadline and at the latest during the night or when the bot restarts; the copies posted in partner channels remain on Discord until they are deleted (by the author within that period, afterwards by the administrators of each server); Scrims and recruitment: 30 days; then, during the following night (or at a restart), author's identifier erased and rows collapsed into counts per day, server and level or role, kept with no time limit as a history of the bot's activity; Exclusions: record until the exclusion is lifted; its notice and reason (staff's private log channel, and reason copied by direct message to the bot's owner) are deleted when it is lifted — for an exclusion prior to this rule, only the reason posted in the channel, the rest following the log channel's period; Configuration (relayed channels and their rank filters, invitation and refereeing role with the identifier of who set them, bot administration role, modules): until removed by the administrators, at the latest until the bot leaves the server, which erases it (a departure that occurred while the bot was down, which Discord does not report to it, is caught up at its restart); Memberships and scheduled reminders: until the reminder's last sending (for a membership, its expiry date) or its deletion, at the latest until the bot leaves the server where they were recorded, which erases them (departure while the bot was down included, caught up at restart); Activity feed: 30 days, deleted during the following night; Staff's private log channel, and the bot's direct messages to its owner: 365 days (one year), then deleted by the nightly cleanup, in batches (several nights for a large backlog), except the reason posted in the channel for an ongoing exclusion — and, for an exclusion imposed from this rule onward, its notice and the copy of its reason by direct message —, deleted when it is lifted; Server logs: according to their automatic rotation; Backups: 30 days at most (processing activity T09).
• T09 — Backups: Resuming activity after an outage, corruption or a handling error. Legal basis: Legitimate interest (continuity of the service). Retention: Archives: 30 days at most, then permanent deletion; Images: for as long as they are on the site (removed within the hour following their deletion); Deletion log: 60 days per entry; Copy of the bot's database written next to it before a restoration (unencrypted, on the bot's machine): deleted at the next successful restoration, at the latest during the night after it turns 30 days old.
• T10 — Informing players of policy changes: Informing each account of a change in the processing of its data. Legal basis: Legal obligation to inform (GDPR, articles 12 to 14). Retention: Lifetime of the account (erased with it).
• T11 — Reports, appeals and moderation of content and accounts: Receiving and handling the reports sent to the association, including notices of illegal content. Legal basis: Legitimate interest (GDPR, art. 6.1.f) of the association in enforcing its terms of use for the moderation of content and accounts contrary to them — review, hiding, removal of an image, suspension of an account, and keeping the decision while it can be contested; legal obligation (GDPR, art. 6.1.c) for requests to exercise rights (GDPR, art. 12), notices of illegal content, in copyright as in moderation (Regulation (EU) 2022/2065, art. 16), requests sent to the hosting provider (art. 11 and 16) and appeals (art. 20), without an agreement box; consent of the reporter (box when sending) for bug and other reports; by email or by phone as through the form (“GDPR” category, « RGPD »), a request to exercise rights or a question about the processing of one's data — which falls under the right of access (GDPR, art. 15) — is based on the same legal obligation. Retention: Report and appeals: duration of handling, then 30 days after archiving (6 calendar months for a copyright or moderation report sent from an account, its author's period for contesting) — extended as long as a logo or avatar hidden or deleted on the basis of the report can still be contested (6 months at most after the decision); Request received by email or by phone: same rule as a GDPR request made through the form — duration of handling, then 30 days after the request is closed (the equivalent of archiving a report), before deletion from the mailbox of the person to contact (email) or from their phone (texts received and sent, voicemail, call log); Request received at the association's email or phone: same rule — duration of handling, then 30 days after it is closed, before deletion from the association's mailbox or phone; Hidden logo or avatar: 6 months at most without a challenge (period for contesting of art. 20.1 of Regulation (EU) 2022/2065, which the association applies), then permanent deletion; if contested, until the decision; Account suspension: while it runs, then 6 months after it is lifted or expires (same period for contesting), erased at the first login to the site after that period; erased with the account, or when it is anonymized.
• T12 — Push notifications: Notifying a player on their devices, at their request, of what concerns them on the site. Legal basis: Consent (activation on each device, withdrawable at any time, topic by topic). Retention: Subscription: until it is turned off, revoked by the browser, or the account is deleted; Subscription with no notification delivered: 180 days at most; Topics turned off: lifetime of the account.
• T13 — Acceptance of the terms of use: Keeping proof that the site's terms of use have been accepted, and which version of them. Legal basis: Performance of the service requested by the player (contract). Retention: Lifetime of the account; On deletion: complete erasure, whether the account is erased or anonymized — the details of the acceptances as well as the last version accepted and its date.
• T14 — Connection data log: Keeping the data that makes it possible to identify the author of content published by a member (logo, avatar, team name), which the association hosts. Legal basis: Legal obligation (GDPR, art. 6.1.c) of the hosting provider of content: French Act on Confidence in the Digital Economy (« loi pour la confiance dans l'économie numérique », LCEN), art. 6; Decree No. 2021-1362. Retention: 365 days (one year) after each login, then automatic erasure; Kept until that deadline even after the account is deleted (GDPR, art. 17.3.b).
• T15 — Support portal (Spiceworks): Receiving and handling support and moderation requests that do not concern content on the site (in-match behavior, insults, cheating, dispute on Discord). Legal basis: Legitimate interest (GDPR, art. 6.1.f) of the association in enforcing the rules of its tournaments and its community, and in answering the requests sent to it. Retention: Ticket: duration of its handling, then 1 month after it is closed, then deletion by the association.
• T16 — Match streaming: Streaming tournament matches live and keeping the replay. Legal basis: Legitimate interest (GDPR, art. 6.1.f) of the association in promoting its competitions, the purpose set out in its bylaws; right to object (art. 21) open to each player. Retention: Live: nothing kept by the site, which only keeps the link to the channel; Replay link: kept with the match, like its results (T03); the video stays on the platform until it is deleted by the channel that published it; Right to object: on request (“Report a problem” form, “GDPR” category (« RGPD »)), the player appears under a neutral name in subsequent streams, the replay link is removed from the site, and a video published by the association's channel is hidden or deleted.
• T17 — Web server access logs: Ensuring the server's security and diagnosing outages. Legal basis: Legitimate interest (GDPR, art. 6.1.f): security of the service (art. 32). Retention: 14 days at most, by automatic rotation, then deletion.

To exercise one of your rights or ask a question about the processing of your data, write to or phone the person the association has appointed for these requests, Keryan Houssin, technical host of the site (contact details below). The “Report a problem” form, at the bottom of every page, GDPR category (« RGPD »), and the association's contact details (section 01) also remain open. We answer within one month at most (art. 12 GDPR).

A request received by email or by phone (call, text, voicemail) — its content, your address or your number, and often your name —, as well as the reply sent by email or by text, are kept for as long as it takes to handle it, then 30 days after it is closed, before being deleted from the mailbox or phone of the person to contact (register, T11). The same applies to a request sent to the association's email (Gmail) or phone: kept for as long as it takes to handle it, then 30 days after it is closed. A request made through the form follows the rule of the “Reports” section.

This person is not a data protection officer within the meaning of Article 37 of the GDPR: the association remains the data controller and responsible for the answer given to your request.

You can at any time, without first contacting us, lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés, the French data protection authority) at cnil.fr.

When this policy changes, every user registered before the change is informed at their next visit, by a window that summarizes what changes, and, if they do not come back, by Discord direct message or by push notification if they have turned them on. This is information: no agreement is requested, and reading it does not take away any of the rights described above. What is based on your consent is set in “My profile”, without losing your account.