Privacy Policy

1. Who is responsible

For your account, billing, support messages and the poker-league.app website the controller is ETNASISTEM, obrt za računalne djelatnosti i oglašavanje, Omiška 19, 21000 Split, Croatia, OIB 60534138457, MBO 97699187. Contact for privacy questions: [privacy e-mail, e.g. [email protected]].

For the data inside a league — the players, their results and statistics — the controller is the league's organiser, and we process that data for them. Questions about a league's data are best sent to its organiser; we will help them answer.

2. What we collect

• Account: name, e-mail address, password (stored only as a secure hash), language and notification settings.
• Player profile in a league: name, nickname, photo, short bio, birthday and favourite cards if you add them.
• League activity: tournament registrations and attendance, places, points, knockouts, rebuys and add-ons, and the buy-ins, prizes and other amounts the league records.
• Billing for paid packages: the Stripe customer ID, package, billing period and payment status. Card details are entered on Stripe and never reach us.
• Messages to us: name, e-mail, the message, the league it concerns, plus IP address and browser to fight spam.
• Newsletter, if you subscribe: e-mail address, language, when and how you agreed (the wording, date and IP address) and when you unsubscribed.
• Security and technical data: IP address, browser, login attempts and failed authorisation attempts (kept 30 days), error reports.
• Website statistics: page views counted by Plausible without cookies and without identifying you.

3. Why we use it and on what legal basis

• To provide Poker League — your account, your leagues, the clock, standings and e-mails you need such as invitations and password resets: performance of the contract (GDPR art. 6(1)(b)).
• League data on behalf of organisers: the organiser's legal basis (usually legitimate interest in running the league), with us as processor.
• Payments, invoices and accounting: contract and legal obligation (art. 6(1)(b) and (c)).
• Security, abuse prevention and fixing errors: legitimate interest in a safe, working service (art. 6(1)(f)).
• Reminders, monthly league summaries and push notifications: contract or your settings — you can switch them off in your profile at any time.
• Answering your messages: legitimate interest, or steps before a contract (art. 6(1)(b) and (f)).
• The Poker League newsletter: your consent (art. 6(1)(a)), given with a confirmed e-mail address. Every newsletter has a one-click unsubscribe link, and you can also switch it off under My leagues → E-mail; withdrawing consent does not affect earlier sending.
• Anonymous visit statistics: legitimate interest in improving the website (art. 6(1)(f)).

We do not sell personal data, do not use it for advertising and do not make automated decisions that have legal or similarly significant effects on you. Ratings and statistics are sporting numbers, nothing more.

4. Who can see your data

Members of your league see what the league shows (standings, results, profiles). If the organiser makes the league public, anyone can see its pages. League admins see more, such as e-mail addresses and finances. Our team accesses data only to run and support the service. We use these service providers (sub-processors), each bound by a data processing agreement:

• Railway Corporation (USA) — hosting of the application and its database.
• Cloudflare, Inc. (USA) — domain name service and network protection.
• Mailjet SAS (France, EU) — sending e-mails (invitations, password resets, reminders, receipts).
• Stripe Payments Europe Ltd. (Ireland, EU) and Stripe, Inc. (USA) — card payments and subscriptions for paid packages. Card details go straight to Stripe; we never see or store them.
• Functional Software, Inc. — Sentry (USA) — error reports when the app crashes (technical data such as browser, page and error message).
• Plausible Insights OÜ (Estonia, EU) — privacy-friendly visit statistics on poker-league.app, without cookies and without personal profiles.
• Push services of your browser vendor (Google, Apple, Mozilla, Microsoft) — only if you turn on notifications. We send an empty wake-up signal; the text of the notification is never sent through them.

We disclose data to authorities only when the law requires it.

5. Transfers outside the EU

Some providers above are in the USA. Transfers are protected by the EU–US Data Privacy Framework where the provider is certified, and otherwise by the European Commission's Standard Contractual Clauses.

6. How long we keep data

• Account: until you delete it.
• League data: until the organiser deletes it or the league. When you delete your account, your profile in every league is anonymised ("Deleted player") so that past results and standings stay correct without your name or e-mail.
• Security logs: 30 days.
• Messages to us: as long as needed to handle them, then deleted.
• Newsletter: while you are subscribed. After you unsubscribe we keep only the address and the dates as proof of your consent and its withdrawal; deleting your account removes them.
• Invoices and payment records: as long as accounting and tax law requires (in Croatia up to 11 years).
• Backups: overwritten in a rolling cycle, so deleted data disappears from them too.

7. Your rights

You have the right to access your data, correct it, delete it, restrict or object to its processing, and receive it in a portable format. Much of this you can do yourself: My leagues → Security & privacy has a data export and account deletion; your profile can be edited in each league. For anything else, write to us — we answer within one month.

If you think we handle your data unlawfully, you can complain to the Croatian data protection authority (Agencija za zaštitu osobnih podataka, azop.hr) or the authority in the country where you live.

8. Age

Poker League is for people aged 18 and over. We do not knowingly process data of children; if you believe a minor has been added, tell us and we will remove the data.

9. Security

Connections are encrypted (HTTPS), passwords are hashed, the login session lives in a secure cookie that scripts cannot read, logins are rate-limited and access to data is restricted by role. If a breach puts your rights at risk we will inform you and the supervisory authority as the GDPR requires.

10. Changes

We update this policy when what we do with data changes. The date at the top shows the latest version; important changes are announced by e-mail or in the app.