Patrocinador Oficial AlienHost

Privacy Policy

Last updated: 05/10/2026

1. Data controller

ArenCup is the trade name under which this platform operates. The data controller responsible for processing personal data collected through this platform is the natural person identified below.

2. Data we collect

We collect the following types of personal data:

Registration data

  • • Username (nickname)
  • • Email address
  • • Password (stored encrypted)
  • • Avatar/profile photo (optional)

Social authentication data

If you register via Discord, Google, or Steam:

  • • Provider ID
  • • Public profile name
  • • Provider avatar
  • • Associated email (if available)

Usage data

  • • Tournament and team participation
  • • Match results
  • • Messages in the chat system
  • • Last connection date and time
  • • IP address (for security)

📊 Web analytics data (Plausible Analytics)

We use Plausible Analytics, a privacy-friendly web analytics tool, self-hosted on our own servers. Plausible does not use cookies and does not store data on your device, but it processes the following data in an aggregated and anonymous manner:

  • • URL of the page visited
  • • Referrer (origin page)
  • • Browser and operating system (derived from User-Agent)
  • • Country (derived from IP address, which is never stored)
  • • Device screen size
  • • Interaction events (clicks on outbound links, file downloads)

✅ This data does not allow you to be personally identified. The IP is used only to derive the country and is discarded immediately without being stored. No analytics data is shared with third parties since the Plausible instance is hosted on our own European servers.

🎮 Riot Games account data (League of Legends, Valorant, TFT)

If you link a Riot Games account to register for tournaments of these games, we collect the following data, provided by Riot Games through their official API:

  • • Riot ID and tagline (e.g. Player#EUW)
  • • PUUID (unique Riot Games account identifier)
  • • Account region/server
  • • Basic profile information (champion icon, used to verify account ownership)
  • • Official rank (when the game and tournament require it)
  • • Match data played within an ArenCup tournament (result, participants), to verify registrations, rosters, and results

What is public: only your Riot ID (name#tag) is publicly visible on your player profile, team rosters, and tournament brackets. The PUUID, region, and other metadata are for internal use only and are never displayed publicly.

Retention: This data is retained while you keep your Riot Games account linked, and is deleted along with the rest of your personal data according to the general retention policy (see section 5).

Source: This data comes directly from Riot Games (we do not generate or infer it) and is synchronized via the Riot Games official API whenever you link or refresh your account.

Correction or deletion: Since your Riot ID and other data are managed by Riot Games, any correction of that data (e.g., a name change) must be done from your Riot Games account; we reflect those changes upon re-sync. To unlink and delete the data we store about your Riot Games account on ArenCup, contact us at [email protected].

3. Purpose of processing

We use your personal data to:

  • Manage your user account and authentication
  • Enable your participation in tournaments and competitions
  • Facilitate communication between users
  • Display public tournament and team statistics
  • Send notifications related to your tournaments
  • Ensure platform security
  • Aggregated web analytics to improve user experience (via Plausible Analytics, without cookies or personal identification)

4. Legal basis for processing

The processing of your data is based on:

  • • Contract performance: To provide you with the platform services
  • • Consent: For non-essential cookies and marketing communications
  • • Legitimate interest: To improve our services, ensure security, and aggregated web analytics (Plausible Analytics, without personal identification)

5. Data retention

We will retain your personal data while you maintain an active account on the platform. If you delete your account, your data will be deleted within 30 days, except for data we must retain for legal obligations.

Tournament participation data may be retained in anonymized form to maintain the integrity of historical records.

6. Your rights

Under the GDPR, you have the following rights:

📋 Access

Request a copy of your personal data

✏️ Rectification

Correct inaccurate or incomplete data

🗑️ Erasure

Delete your data ("right to be forgotten")

⏸️ Restriction

Restrict the processing of your data

📦 Portability

Receive your data in a portable format

🚫 Objection

Object to the processing of your data

To exercise these rights, contact us at [email protected].

7. Security

We implement appropriate technical and organizational measures to protect your personal data:

  • • Password encryption with secure algorithms (bcrypt)
  • • HTTPS connections across the entire platform
  • • CSRF and XSS attack protection
  • • Rate limiting to prevent brute-force attacks
  • • Restricted access to personal data

8. International transfers

Our servers are located in the European Union. In the event of using third-party services that involve transfers outside the EEA, we ensure that adequate safeguards exist (such as EU Standard Contractual Clauses).

9. Minors

This platform is not directed at minors under 16 years of age. If you are under this age, you will need the consent of your parents or legal guardians to use our services.

10. Changes to this policy

We may update this Privacy Policy occasionally. We will notify you of significant changes through an alert on the platform or by email. We recommend reviewing this page periodically.

11. Contact and complaints

If you have questions or wish to exercise your rights, contact us:

You also have the right to file a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es www.aepd.es.

12. Organization data

If you create or manage an Organization (a club, team, or tournament operator) on the Platform, in addition to your personal account data we process the following additional data. The conduct rules applicable to Organizations are set out in the "Organizations" section of our Terms and Conditions.

Organization profile data

When you create or publish an Organization profile, we collect and make public the following data:

  • • Name, slug (URL), and Organization type
  • • Short description and full description
  • • Country (selected by the owner via a dropdown)
  • • Public contact email (optional, visible on the public profile)
  • • Social media and website links (Discord, Twitter/X, Twitch, YouTube, Instagram, TikTok, Kick)

Sharing with partners: the country and public contact email of Verified or Partner Organizations may be shared with authorized external integrators through our Partner API.

Verification evidence

If you request verification for your Organization (Verified or Partner level), you must attach documents (PDF or images) proving your identity or operation as the owner. These documents may contain personal data (for example, if they include an ID document or third-party names).

Storage: files are stored on private storage, never public or accessible by other users; only the Platform's verification team can access them to review your request.

Retention: evidence is automatically deleted 90 days after your request is reviewed (approved, rejected, or revoked), unless it is subject to an ongoing moderation investigation, in which case it is retained until that investigation concludes.

📊 Organization analytics

We record aggregated metrics for your Organization (profile views, published tournaments, and follower growth) in a daily table that never stores the identity, IP, or any other data of the person visiting the profile — only a per-Organization, per-day counter. These metrics are retained for 730 days for internal statistical purposes.

Organization-specific retention

  • • Reports and appeals related to an Organization are retained for 180 days; after that period, the identity of the reporter or appellant is anonymized.
  • • Posts, reactions, and other content published by an Organization are retained indefinitely as part of the Platform's public history; if the author deletes their account, authorship is anonymized but the content remains.
  • • The trust level (Standard, Verified, Partner) and the Organization's ownership history are retained for as long as the Organization exists on the Platform, and are included in your data export if you are or have been an owner.

Ownership transfer

Transferring ownership of an Organization requires a two-step confirmation (two-factor verification) from the current owner. For your security, we do not disclose to the other party any more personal data than strictly necessary to complete the transfer.

You can exercise the rights described in section 6 over any of this data (profile, verification evidence, or your history as an owner or member of an Organization) by contacting [email protected].

Our Sponsors

AlienHost