Version 1.5 · Effective from 28 July 2026

Privacy Policy

1. Controller

The controller of personal data is Allstars Company s.r.o., Potočná 581/117, 972 47 Oslany, Slovak Republic, Company ID 50 884 590.

Contact for personal data protection: admin@gamebases.gg. Telephone: +421 911 117 247.

Supervisory authority: Office for Personal Data Protection of the Slovak Republic, https://dataprotection.gov.sk/.

2. Scope and sources of data

We obtain data:

directly from you during registration, account use, orders, contests, tournaments, support, complaints and reports,
from use of the platform, in particular security logs, session data and technical data,
from Google if you use Google OAuth,
from Stripe about payment status; we do not store full payment card details,
from a legal guardian when activating a minor’s account, checkout or tournament reward.

We process in particular username, e-mail, password hash, date of birth, age band, country, OAuth identifier, voluntary profile data, user content, messages, orders, Stars and Golds transactions, delivery data, consents, reports, IP address, session and security events.

3. Purposes, legal bases and retention

Purpose	Legal basis	Typical data	Retention criteria
Account creation and login	contract performance	nick, e-mail, password hash, date of birth, country	for the life of the account; after deletion erase/anonymise except statutory records
Community features and content	contract; legitimate interest in running the community	profile, UGC, messages	until removal, account deletion or end of purpose; evidentiary copies as needed
Stars/merch purchase, Golds redemption, invoicing	contract; legal duty (accounting/tax)	orders, payments, billing, consents	accounting/tax records generally 10 years
Guardian checkout for a minor	contract; protection of minors	guardian as buyer, confirmations	under order and accounting periods
Tournament rewards and prize delivery	contract; legitimate interest in delivery	result, claim, delivery data, under-18 guardian confirmation	while fulfilling the reward and then for dispute/accounting periods
Delivery data for organizer/sponsor of a prize	contract; legitimate interest in delivery	name, address, delivery contact	only as needed for delivery; access audited
Security and fraud prevention	legitimate interest	IP, session, logs, device	ordinary logs 90 days; confirmed incident/fraud up to 3 years or for the dispute
Moderation and DSA reports	legal duty (DSA); legitimate interest	report, snapshot, decision, appeal	closed case generally 3 years
Activation of minors 13–15	contract; legitimate interest in protecting minors; guardian consent where required	guardian name and e-mail, status, audit	incomplete up to 30 days; proof of activation then up to 3 years
Incomplete registration	legitimate interest in database hygiene	draft data	30 days

Where processing is based on legitimate interest, you have the right to object. You may object in Workroom or at admin@gamebases.gg. We will assess the objection and stop processing unless we demonstrate compelling legitimate grounds that override, or the processing is for the establishment, exercise or defence of legal claims.

4. Account and login

Mandatory data are username, e-mail, authentication credential, date of birth and country. Without them an account cannot be created or safely provided. Voluntary profile data are not a condition of the account.

The UI language does not change the customer country.

5. Minors and legal guardian

An account is available from age 13. For ages 13–15 we process the legal guardian’s name and e-mail, confirmation status, token hash and activation audit.

For a minor’s paid order the legal guardian is the buyer; we process their billing and contractual data at checkout. For a tournament reward of a winner under 18 we process guardian confirmation before releasing Stars or shipping a physical prize.

We do not provide profiled advertising to minors. For ages 13–17 a short age-appropriate summary of this policy is available (Privacy Policy for Minors); the full text remains decisive.

Information for legal guardians: you may request access, rectification or erasure of the child’s data under the GDPR, contact us at the e-mail above, and lodge a complaint with the Slovak supervisory authority.

6. Profile, content and communication

We process profile data and user content to provide community features, moderation and protection of users' rights.

We retain content until it is removed, the account is deleted or the purpose ends. Content that forms part of a report, dispute or security incident may be retained separately for the necessary evidentiary period.

For private communication, after one account is deleted a copy of a message may remain with the other participant, while we anonymise the sender's identity if further retention of identity is not needed.

7. Stars, Golds, orders and invoicing

We process orders, payments, billing data, consents, refunds and chargebacks for performance of a contract, accounting, fraud prevention and legal claims.

We retain Golds and Stars ledgers of an active account for the life of the account. After deletion the balance expires, but necessary transaction records remain until accounting, security or dispute periods end.

8. Location and country

The "My location" feature starts only after you click it. The browser may temporarily provide coordinates used to determine the country.

We do not store coordinates in the profile or account database. When an external geocoding service is used, necessary data may be sent to its operator to handle the query. On the account we store only the country code.

Country may also be chosen manually without using location.

9. Security and fraud prevention

We process IP addresses, session, login events, device and security logs on the basis of legitimate interest in protecting accounts, payments and the platform. You have the right to object under section 3.

10. Reports and moderation

We process the report, flagged content, snapshot, decision, appeal and audit to meet DSA duties, enforce rules and protect rights.

We do not disclose the reporter's identity to the content author unless required by law.

11. Recipients

Depending on the feature used, data may be processed by:

Websupport as hosting and infrastructure provider,
Stripe for payments,
Google for OAuth or reCAPTCHA if the specific feature is deployed,
iKROS for invoicing,
the e-mail provider (SMTP via hosting),
Nominatim/OpenStreetMap for voluntary country determination,
a carrier for physical delivery,
a verified tournament organizer or sponsor to the extent needed to deliver a physical prize,
public authorities where required by law.

A detailed internal vendor processing register is kept separately.

12. Automated decision-making

We do not carry out decision-making based solely on automated processing that would produce legal or similarly significant effects for the user.

Country, age and contest rules may automatically enable or hide a feature. This is a rule-based technical restriction, not profiling with legal effect. Decisions on reports and sanctions are taken by an administrator.

13. Rights

You have the right of access, rectification, erasure, restriction, portability, objection to processing based on legitimate interest and, where processing is based on consent, to withdraw consent without affecting prior lawfulness.

Rights may be exercised in Workroom or at admin@gamebases.gg. We respond without undue delay, generally within one month.

A complaint may be lodged with the Office for Personal Data Protection of the Slovak Republic (https://dataprotection.gov.sk/) or, where GDPR applies, with the supervisory authority of the place of residence, work or alleged infringement.

14. Backups and changes

We create controlled backups for service recovery. Personal data in backups are retained for at most 30 days. Restoring already deleted personal data into the active system is done only under a controlled procedure.

We publish changes to this policy as a new version. We inform appropriately about material changes.

Version history

1.5 — 26 July 2026