| Main purpose | Receiving and handling the reports sent to the association, including notices of illegal content |
|---|
| Sub-purposes | - Receiving a report from anyone, with or without an account (copyright, moderation, bug, GDPR, host, other)
- Notifying the players and team members targeted, and allowing them to contest; allowing the author of a report to contest the decision taken
- Hiding a reported team logo or player avatar, then restoring it or permanently deleting it; removing an image outside any report, on a reason entered by moderation
- Suspending an account contrary to the terms of use (sessions closed, login refused during the suspension), giving its holder the reasons, then lifting it or letting it expire
- Acknowledging receipt of a notice of illegal content, then notifying its author of the decision and the means of redress
- Answering requests to exercise rights and requests sent to the hosting provider, including those from authorities
- Receiving by email or by phone, through the person to contact for requests regarding data, requests to exercise rights and questions about data processing, and answering them
- Receiving the requests sent to the association's own email or phone (published, protected, in the legal notice), and answering them
- Alerting administrators on Discord, without naming anyone
|
|---|
| Legal basis | Legitimate interest (GDPR, art. 6.1.f) of the association in enforcing its terms of use for the moderation of content and accounts contrary to them — review, hiding, removal of an image, suspension of an account, and keeping the decision while it can be contested; legal obligation (GDPR, art. 6.1.c) for requests to exercise rights (GDPR, art. 12), notices of illegal content, in copyright as in moderation (Regulation (EU) 2022/2065, art. 16), requests sent to the hosting provider (art. 11 and 16) and appeals (art. 20), without an agreement box; consent of the reporter (box when sending) for bug and other reports; by email or by phone as through the form (“GDPR” category, « RGPD »), a request to exercise rights or a question about the processing of one's data — which falls under the right of access (GDPR, art. 15) — is based on the same legal obligation |
|---|
| Data subjects | - Reporters, users or not (rights holders, representatives, visitors)
- Players and team members targeted by a report
- Persons, members or not, who send a request regarding their data by email or by phone
- Persons who write to or phone the association
|
|---|
| Data | - Category, description, items designated and page the report came from
- Reporter's account if logged in; email address they provide; for copyright, the name or corporate name of its author, their email address, their capacity (rights holder, representative or third party), the content concerned and where to see it on the site, the reason for the request and a statement of good faith
- Appeals: text, account of their author and optional address
- Hidden team logos and player avatars (file kept offline), date of hiding and of the deadline; reason for a removal decided outside a report (sent to the team or the player, not kept by the site)
- Account suspensions: account targeted, facts relied on, clause invoked, dates of start, expiry and lifting, moderation member who imposed or lifted it
- Requests regarding data received by email or by phone: content of the request and of the reply, sender's email address or number, and often their name
- Requests received at the association's email or phone: same data
|
|---|
| Sensitive data | None |
|---|
| Retention | - Report and appeals: duration of handling, then 30 days after archiving (6 calendar months for a copyright or moderation report sent from an account, its author's period for contesting) — extended as long as a logo or avatar hidden or deleted on the basis of the report can still be contested (6 months at most after the decision)
- Request received by email or by phone: same rule as a GDPR request made through the form — duration of handling, then 30 days after the request is closed (the equivalent of archiving a report), before deletion from the mailbox of the person to contact (email) or from their phone (texts received and sent, voicemail, call log)
- Request received at the association's email or phone: same rule — duration of handling, then 30 days after it is closed, before deletion from the association's mailbox or phone
- Hidden logo or avatar: 6 months at most without a challenge (period for contesting of art. 20.1 of Regulation (EU) 2022/2065, which the association applies), then permanent deletion; if contested, until the decision
- Account suspension: while it runs, then 6 months after it is lifted or expires (same period for contesting), erased at the first login to the site after that period; erased with the account, or when it is anonymized
|
|---|
| Recipients | - The association's administrators
- Players and team members targeted: reason and description of the report, never the reporter's identity
- Holder of a suspended account: the decision, the facts relied on and the clause invoked, never the name of the moderation member who imposed it
- Discord, which delivers the alerts and direct messages (without name, address or description)
- Keryan Houssin, technical host of the site, the person appointed by the association for requests regarding data: requests received by email or by phone
- That person's telephone operator: requests made by phone (call, text, voicemail)
- Microsoft, which hosts that person's mailbox (personal Microsoft account (Outlook.com), governed by the Microsoft Services Agreement and the Microsoft privacy statement, without a processing agreement; storage location not guaranteed by Microsoft; messages not encrypted by the association, readable by Microsoft): requests received and replies sent by email
- Members of the association's board who check its email and phone
- Google (the association's Gmail mailbox, hosted by Google; messages not encrypted by the association, readable by Google): requests received and replies sent by the association's email
- Telephone operator of the association's line: requests made to its phone
|
|---|
| Transfers outside the EU | - United States: Discord (delivery of alerts and direct messages) — Discord, certified under the EU-U.S. Data Privacy Framework: European Commission adequacy decision (EU) 2023/1795 of 10 July 2023 (EU-U.S. Data Privacy Framework)
- Possible to the United States: Microsoft (Outlook.com mailbox of the person to contact, requests received and replies sent by email) — Microsoft, certified under the EU-U.S. Data Privacy Framework: European Commission adequacy decision (EU) 2023/1795 of 10 July 2023 (EU-U.S. Data Privacy Framework)
- Possible to the United States: Google (the association's Gmail mailbox) — Google, certified under the EU-U.S. Data Privacy Framework: European Commission adequacy decision (EU) 2023/1795 of 10 July 2023 (EU-U.S. Data Privacy Framework)
|
|---|
| Security | - Server access restricted to the technical manager (SSH key authentication, automatic banning of failed attempts)
- Encrypted communications (HTTPS)
- Role-based administration rights, limited to what each task requires
- Handling panel restricted to administrators; a report's page open only to the persons targeted
- Sending limits per person and per hour
- Hidden logo or avatar moved out of the folder served by the site; preview restricted to administrators
- Suspension restricted to the moderation permission, impossible on one's own account or on an administrator's; the staff's Discord log carries neither the player's username nor the reason
- Requests received by email or by phone: no measure specific to the association beyond deletion after the retention period; they are protected only by the measures of Microsoft or Google (mailboxes), the telephone operators and the devices that receive them
|
|---|
