Which data we process, why, on what legal basis and for how long. No tracking, no ad networks.
The controller within the meaning of the GDPR is:
Name or company, Address, Email address.
Data protection officer, if appointed: Name and contact.
Email address, username, password (as a hash only), time of last login
Providing the account and login
Optional details such as a profile banner and linked social usernames
Displaying the profile to other users
Participation in rounds, executed trades, portfolio values, rating, chip account movements
Running and settling rounds, the leaderboard, traceability of bookkeeping
IP address and request time in server logs
Operation, security and limiting abusive access
We set no cookies for advertising or analytics. In your browser’s local storage we keep: the login token that keeps you signed in, your choice of light or dark appearance, your language choice, and whether you have dismissed a one-time hint. This information is required for operation and does not leave your browser, except for the login token, which is sent with every request.
For operation we use service providers, in particular for hosting and database: Hosting provider and location. We have data processing agreements with them under Art. 28 GDPR. Any transfer to third countries takes place only where the conditions of Art. 44 et seq. GDPR are met.
We obtain price data from an external source. No personal data of our users is transmitted in the process; the request is made by our server, not by your browser.
Username, rating, placements and round results are visible to other users. That is part of the contest. Your email address is not.
We store account data as long as the account exists. After deletion we remove it, unless statutory retention obligations apply. Bookkeeping data is retained where required to keep completed rounds traceable; it is decoupled from the person as far as possible. Server logs are deleted after number of days.
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw any consent given at any time with effect for the future.
You also have the right to lodge a complaint with a data protection supervisory authority, usually where you reside or where we are established.
Email address for data protection requests