Privacy Policy

1. Controller

The controller of personal data is Allstars Company s.r.o., Potočná 581/117, 972 47 Oslany, Slovak Republic, Company ID 50 884 590.

Contact for personal data protection: admin@gamebases.gg. Telephone: +421 911 117 247.

Supervisory authority: Office for Personal Data Protection of the Slovak Republic, https://dataprotection.gov.sk/.

2. Scope and sources of data

We obtain data:

• directly from you during registration, account use, orders, contests, tournaments, support, complaints and reports,
• from use of the platform, in particular security logs, session data and technical data,
• from Google if you use Google OAuth,
• from Stripe about payment status; we do not store full payment card details,
• from a legal guardian when activating a minor’s account, checkout or tournament reward.

We process in particular username, e-mail, password hash, date of birth, age band, country, OAuth identifier, voluntary profile data, user content, messages, orders, Stars and Golds transactions, delivery data, consents, reports, IP address, session and security events.

3. Purposes, legal bases and retention

Where processing is based on legitimate interest, you have the right to object. You may object in Workroom or at admin@gamebases.gg. We will assess the objection and stop processing unless we demonstrate compelling legitimate grounds that override, or the processing is for the establishment, exercise or defence of legal claims.

4. Account and login

Mandatory data are username, e-mail, authentication credential, date of birth and country. Without them an account cannot be created or safely provided. Voluntary profile data are not a condition of the account.

The UI language does not change the customer country.

5. Minors and legal guardian

An account is available from age 13. For ages 13–15 we process the legal guardian’s name and e-mail, confirmation status, token hash and activation audit.

For a minor’s paid order the legal guardian is the buyer; we process their billing and contractual data at checkout. For a tournament reward of a winner under 18 we process guardian confirmation before releasing Stars or shipping a physical prize.

We do not provide profiled advertising to minors. For ages 13–17 a short age-appropriate summary of this policy is available (Privacy Policy for Minors); the full text remains decisive.

Information for legal guardians: you may request access, rectification or erasure of the child’s data under the GDPR, contact us at the e-mail above, and lodge a complaint with the Slovak supervisory authority.

6. Profile, content and communication

We process profile data and user content to provide community features, moderation and protection of users' rights.

We retain content until it is removed, the account is deleted or the purpose ends. Content that forms part of a report, dispute or security incident may be retained separately for the necessary evidentiary period.

For private communication, after one account is deleted a copy of a message may remain with the other participant, while we anonymise the sender's identity if further retention of identity is not needed.

7. Stars, Golds, orders and invoicing

We process orders, payments, billing data, consents, refunds and chargebacks for performance of a contract, accounting, fraud prevention and legal claims.

We retain Golds and Stars ledgers of an active account for the life of the account. After deletion the balance expires, but necessary transaction records remain until accounting, security or dispute periods end.

8. Location and country

The "My location" feature starts only after you click it. The browser may temporarily provide coordinates used to determine the country.

We do not store coordinates in the profile or account database. When an external geocoding service is used, necessary data may be sent to its operator to handle the query. On the account we store only the country code.

Country may also be chosen manually without using location.

9. Security and fraud prevention

We process IP addresses, session, login events, device and security logs on the basis of legitimate interest in protecting accounts, payments and the platform. You have the right to object under section 3.

10. Reports and moderation

We process the report, flagged content, snapshot, decision, appeal and audit to meet DSA duties, enforce rules and protect rights.

We do not disclose the reporter's identity to the content author unless required by law.

10a. Transparent AI labelling

When labelling content created or modified with AI we process in particular: the `ai_disclosure` declaration, content and author identifiers, the original and corrected label values, the correction reason, the objection text, the decision, timestamps, and audit and notification metadata.

Purposes: displaying a transparent label, enforcing platform rules, handling objections, preventing abuse, security, and demonstrating moderation procedure in disputes.

Legal bases: Art. 6(1)(b) GDPR for the author’s declaration and providing platform functionality under the Terms of Use; Art. 6(1)(f) GDPR for corrections, objections, audit, protecting platform integrity, preventing abuse and defending legal claims.

Recipients: the public sees only the resulting AI label on public content; the correction reason, objection text and decision are visible only to the affected user and authorised staff; technical intermediaries only to the extent of hosting, security and notification delivery.

Retention: the declaration on the content itself is kept for the life of that content and is removed or anonymised with it under the general UGC policy; an active correction is kept while it is active; an open objection is never auto-deleted; closed objections are generally kept for three years from the final decision; closed corrections (superseded/reverted/otherwise closed) are generally kept for three years from final closure if no open objection exists; AI audit records with personal data are generally kept for three years from final case closure and then deleted or securely anonymised. The three-year period is an internal retention policy based on the need to resolve disputes, demonstrate moderation procedure and protect the platform; we do not claim that law always requires every record to remain exactly three years. In-app notifications about AI-label corrections and objection decisions are generally kept for 90 days. Removing them does not remove the authoritative correction, objection, decision or audit record, which are retained under the periods above.

We do not use automated decision-making or automated AI detection to label content. The existing right to object to processing based on legitimate interest remains under section 3.

11. Recipients

Depending on the feature used, data may be processed by:

• Websupport as hosting and infrastructure provider,
• Stripe for payments,
• Google for OAuth or reCAPTCHA if the specific feature is deployed,
• iKROS for invoicing,
• the e-mail provider (SMTP via hosting),
• Nominatim/OpenStreetMap for voluntary country determination,
• a carrier for physical delivery,
• a verified tournament organizer or sponsor to the extent needed to deliver a physical prize,
• public authorities where required by law.

A detailed internal vendor processing register is kept separately.

12. Automated decision-making

We do not carry out decision-making based solely on automated processing that would produce legal or similarly significant effects for the user.

Country, age and contest rules may automatically enable or hide a feature. This is a rule-based technical restriction, not profiling with legal effect. Decisions on reports, sanctions and AI-label corrections are taken by an administrator. We do not label content by automated AI detection.

13. Rights

You have the right of access, rectification, erasure, restriction, portability, objection to processing based on legitimate interest and, where processing is based on consent, to withdraw consent without affecting prior lawfulness.

Rights may be exercised in Workroom or at admin@gamebases.gg. We respond without undue delay, generally within one month.

A complaint may be lodged with the Office for Personal Data Protection of the Slovak Republic (https://dataprotection.gov.sk/) or, where GDPR applies, with the supervisory authority of the place of residence, work or alleged infringement.

14. Backups and changes

We create controlled backups for service recovery. Personal data in backups are retained for at most 30 days. Restoring already deleted personal data into the active system is done only under a controlled procedure.

We publish changes to this policy as a new version. We inform appropriately about material changes.

Communication and private messages

We process messages and reports to the extent necessary to provide the service, security, and moderation. Private messages for under-18 accounts are limited to confirmed friends. Blocking and reporting help prevent abuse. We do not publicly label a specific account as under-18.