Privacy Policy
Last Updated: March 26, 2026
This Privacy Policy explains how Elvion ("Company," "we," "us," or "our") collects, uses, discloses, and otherwise processes personal data when you access or use our website, platform, products, Services, or any related communications.
We are committed to protecting your privacy and handling your data in an open and transparent manner. We designed this Policy to comply with the General Data Protection Regulation ("GDPR"), the General Data Protection Regulation Law ("LGPD"), and other applicable global privacy standards.
If there is any conflict between this Policy and mandatory provisions of applicable law, the applicable law shall prevail.
THE SERVICES ARE NOT DIRECTED TO AND ARE NOT INTENDED ONLY FOR USERS WHO ARE LEGALLY PERMITTED TO USE THEM IN THEIR JURISDICTION.
-
Introduction
This Privacy Policy explains how Elvion ("Company," "we," "us," or "our") collects, uses, discloses, and otherwise processes personal data when you access or use our website, platform, products, Services, or any related communications.
We are committed to protecting your privacy and handling your data in an open and transparent manner. We designed this Policy to comply with the General Data Protection Regulation ("GDPR"), the General Data Protection Regulation Law ("LGPD"), and other applicable global privacy standards.
If there is any conflict between this Policy and mandatory provisions of applicable law, the applicable law shall prevail.
THE SERVICES ARE NOT DIRECTED TO AND ARE NOT INTENDED ONLY FOR USERS WHO ARE LEGALLY PERMITTED TO USE THEM IN THEIR JURISDICTION.
-
Data controller
For the purposes of applicable data protection laws, We are the data controller of your personal information.
The data controller is:
Legal name: Elvion Entertainment B.V.
Company address: 10 Korporaalweg, Willemstad, Curaçao
Company number: 146580
Contact email: privacy@elvionone.com -
Definitions
For the purposes of this Privacy Policy:
- "Personal Data" means any information relating to an identified or identifiable natural person.
- "Data Subject" means the natural person to whom the Personal Data relates.
- "Processing" means any operation performed on Personal Data, whether or not by automated means, including collection, storage, use, disclosure, transfer, erasure, or destruction.
- "Controller" means the entity that determines the purposes and means of the processing.
- "Services" means our website, platform, tournament features, related tools, communications, and any other services we provide or make available.
- "Cookies" means small files that are stored on your device and used to operate, secure, or improve the Services.
- "User," "you," and "your" mean any person who accesses or uses the Services.
-
Purposes of Processing and Legal Bases
We process personal data only for specific, explicit, and legitimate purposes and only to the extent necessary for those purposes. Depending on the context, we rely on different legal bases for processing personal data, while other data may be provided voluntarily by users. Providing optional data is not mandatory and does not affect access to the core functions of the Services.
Some personal data is required to provide the Service, while other data may be provided voluntarily by users. Providing optional data is not mandatory and does not affect access to the core functions of the Services.
Purpose Categories of Personal Data Legal Basis (GDPR) Legal Basis (LGPD) Retention Account creation & login Email address, username/nickname, password (hashed), user ID, country Art.6(b) -Performance of contract and Art. 6(1)(c) - Legal obligation (for eligibility verification (geoblocking)) Art.7(V) - Execution of contract and Art. 7(II) - Legal obligation (for eligibility verification (geoblocking)) For the duration of the active account + statutory limitation period (3 years after account deletion/inactivity) Enabling participation in tournaments and platform features Username, user ID, gameplay data, tournament participation data (results, points, rewards) Art.6(b) -Performance of contract Art.7(V) - Execution of contract For the duration of the active account + statutory limitation period (3 years after account deletion/inactivity) Providing customer support and responding to user inquiries Email address, username, communication content (messages, chat, support requests) Art.6(b) -Performance of a contract and, where applicable, Art.6(f) - our legitimate interests in providing and improving user support Art.7(V) - Performance of a contract and, where applicable, Art.7(IX) – our legitimate interests in providing and improving user support For the duration of the active account + statutory limitation period (3 years after account deletion/inactivity) Ensuring platform security, preventing fraud and abuse IP address, Unique Device ID, user ID, device and technical data, login/activity metadata Art.6(f) - Legitimate interest Art.7(IX) – Legitimate interests Up to 12 months from collection, unless a longer period is necessary to investigate an incident, defend legal claims, comply with legal obligations, or prevent abuse Operating, maintaining, and improving the Services Device type, OS, browser type, platform type, technical logs, usage data, feature interaction data Art.6(a) -Consent, and where strictly necessary for service functionality, Art.6(b) - performance of a contract Art.7(I) - Consent, and where strictly necessary for service functionality, Art.7(V) - performance of a contract Until consent is withdrawn or up to 24 months from collection (in aggregated or pseudonymized form) Analytics and product development Gameplay patterns, feature usage, tournament activity (aggregated or pseudonymized data where possible) Art.6(f) - Legitimate interest Art.7(IX) – Legitimate interests Anonymize after analysis Optional profile information and personalization Phone number, gender, full name, date of birth, full address (country, city, zip code) Art.6(a) -Consent Art.7(I) - Consent Until consent withdrawn Marketing & newsletters Email Art.6(a) -Consent Art.7(I) - Consent Until consent withdrawn Where users voluntarily provide additional personal data that is not required for the core functionality of the Services, such data will be processed solely for the purposes for which it was provided, including account personalization, communication, or user experience improvement, and in accordance with applicable law.
We do not require users to provide sensitive or excessive personal data to access or use the core features of the Services.
-
Categories of Personal Data We Collect
We may collect these following categories of personal data, depending on how you interact with the Services and the information you choose to provide:
-
Account and profile data
This may include your username or nickname, gender, full name (if provided), date of birth (if provided), country of residence, phone number, and address details such as city, ZIP code, street, or other address information you choose to provide.
-
Authentication data
This includes your password, which is stored in hashed form and is not accessible to us in plain text format.
-
Communications data
This includes information you provide when contacting our support team, submitting inquiries, or participating in forums, chats, or other interactive features of the Services.
-
Technical and device data
This includes your IP address, Device ID, unique device identifier, OS and device type, operating system and version, browser type and version, mobile network and version, region, city, or general location derived from your IP address.
-
Usage and gameplay data
This includes information about how you interact with our website and Services, including game statistics, tournaments participated in, points earned, feature usage, and gameplay patterns.
-
Optional information
You may choose to provide additional information that is not required for our use of the Services. Where you choose to provide such information, we will process it only for the purpose for which it was collected and in accordance with this Privacy Policy and applicable law.
-
-
Data Sharing and Disclosure of Personal Data
We may disclose or share personal data available for the following categories of recipients, when necessary for the operation of the Services, the performance of our contractual obligations, our legitimate interests, or compliance with legal obligations, or under applicable legal bases under data protection laws.
-
Service Providers and Processors
We may share personal data with third-party service providers that process personal data on our behalf and under our instructions, including:
- Amplitude – for product analytics, usage performance measurement, and understanding how users interact with the Services. The data shared with Amplitude may include technical data, device information, identifiers, usage data, gameplay statistics, tournament participation data, and general location information derived from IP address, to the extent necessary for analytics and service improvement purposes.
- Google Analytics – for website analytics, traffic measurement, audience, and service optimisation. The data shared with Google Analytics may include technical identifiers, usage data, and event/activity data generated through your use of the Services.
- Analytics providers to help us understand user behaviour and platform performance.
- SendPulse – for sending communications related emails, account-related communications, and other email communications, where applicable. The data shared with SendPulse may include your email address and other data necessary for marketing communications, where applicable, as required by law and in accordance with applicable data protection laws and, where required by law, to the extent necessary for us to bring such communications in line with Section 2 "Data Controller").
These service providers act as processors or sub-processors under applicable data protection laws and are contractually restricted from using personal data for other purposes than providing the relevant services to us, except where otherwise permitted or required by law.
-
Other Disclosures
We may also disclose personal data:
- to our professional advisors, auditors, accountants, lawyers, and insurers, where necessary;
- to competent public authorities, regulators, courts, or law enforcement bodies, where required by law or in order to protect our rights, users, or the security of a similar event, as required by applicable law;
- in connection with a corporate transaction such as a merger, acquisition, sale of assets, or similar event, subject to applicable legal requirements.
-
International Data Transfers
Because our company is established in Curaçao and some of the service providers may be located in or access data from other countries, personal data may be transferred to, stored in, or otherwise processed in countries outside the European Economic Area, including countries outside the European Economic Area, including countries outside Brazil.
Where such transfers occur, we will implement appropriate safeguards recognized under applicable law, such as adequacy decisions or standard contractual clauses, and take all appropriate additional safeguards under applicable law.
-
No Sale of Personal Data
We do not sell personal data with third parties for their own independent marketing purposes unless you have explicitly consented to such sharing. If this position changes, we will update this Privacy Policy and provide any required notices or obtain consent under applicable law.
-
-
Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected, to provide the Services, maintain and improve the Services, ensure security, comply with legal obligations, resolve disputes, and enforce our agreements.
Unless a longer retention period is required or permitted by applicable law, we will retain personal data associated with an active account for up to three (3) years from the date of the last recorded account activity. For purposes of this Privacy Policy, "account activity" may include, for example, logging into the account, participating in a tournament, or otherwise interacting with the account in a way that is recorded by us.
After the retention period expires, we delete or anonymise personal data, or otherwise render it inaccessible, within the scope and technical limits of our systems. We may retain certain information for a longer period where necessary:
- to comply with a legal or regulatory obligation;
- to establish, exercise, or defend legal claims;
- to investigate and prevent fraud, abuse, or security incidents;
- to maintain records required for accounting, audit, or other compliance purposes; or
- where data has been anonymized so that it can no longer identify you.
Where we delete account data, some information may remain in backup copies for a limited period of time until those backups are deleted or otherwise overwritten in accordance with our backup retention schedule. During that time, such data will remain subject to appropriate technical and organisational safeguards and will not be actively used except as required for backup recovery, security, or legal compliance.
Where data is no longer needed for identification purposes, we retain it in an anonymised or aggregated form for analytical, statistical, or service-improvement purposes, provided that it no longer identifies you and is no longer personal data under applicable law.
-
Data Security
We implement appropriate technical and organizational measures designed to protect personal data against unauthorized or unlawful processing, accidental loss, destruction, alteration, or damage. These measures are implemented taking into account the nature of the personal data, the context of processing, the available technology, and the risks to individuals.
Such measures may include, as applicable:
- encryption of personal data in transit using industry-standard protocols such as TLS;
- hashed password storage and related authentication safeguards;
- access controls and role-based permissions;
- authentication mechanisms and account protection measures;
- regular security reviews and vulnerability assessments;
- staff training on confidentiality, privacy, and data protection;
- secure network and system architecture;
- monitoring and logging of access to systems and data, where appropriate;
- contractual and organizational safeguards for service providers and processors.
We restrict access to personal data to personnel and authorized service providers who need such access for legitimate business or operational purposes and who are subject to confidentiality obligations where appropriate.
While we take reasonable measures to protect personal data, no method of transmission over the Internet or method of electronic storage is completely secure. Therefore, we cannot guarantee its absolute security.
If we become aware of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will take appropriate steps to mitigate the risk and, where required, notify the competent supervisory authority and affected individuals.
-
Your Rights
Depending on your location and the applicable data protection laws, you may have the following rights in relation to your personal data:
-
Right of access.You may request confirmation as to whether we process your personal data and, where applicable, obtain access to that data and information about how we process it.
-
Right to rectification.You may request that we correct or update inaccurate, incomplete, or outdated personal data.
-
Right to erasure. In certain cases, you may request that we delete your personal data. This right is not absolute and may be limited where we need to retain data to comply with legal obligations, establish, exercise, or defend legal claims, or for other lawful purposes.
-
Right to restriction of processing. In certain cases, you may request that we temporarily restrict the processing of your personal data, including based on the accuracy or lawfulness of processing.
-
Right to object.In certain cases, you may object to our processing of your personal data, including processing based on our legitimate interests.
-
Right to data portability.Where legally applicable, you may request to receive your personal data in a structured, commonly used, and machine-readable format, or ask that it be transmitted directly to another controller, where technically feasible.
-
Right to withdraw consent.Where we rely on your consent as a legal basis, you may withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
-
Right to information about sharing. You may request information about the categories of recipients or third parties with whom we share your personal data, subject to applicable law.
-
Right to review automated decisions. Where applicable, you may request a review of decisions made solely on the basis of automated processing of your personal data.
You may exercise your rights by contacting us at privacy@elvionone.com. We may ask for additional information to verify your identity before responding to your request. We will respond without undue delay and within the time limits required by applicable law. Under the GDPR, this is generally within one month, subject to permitted extension in complex cases. Under the LGPD, this is generally within 15 days for a full response, depending on the complexity of the request.
If you believe that our processing of your personal data does not comply with applicable law, you also have the right to lodge a complaint with a competent supervisory authority. Under the GDPR, this may be the data protection authority in the Member State of your habitual residence, place of work, or place of the alleged infringement. Under the LGPD, this may be lodged with the Brazilian National Data Protection Authority, where applicable.
Please note that not all rights apply in every situation. The availability of each right depends on the legal basis for the processing and applicable exceptions.
-
-
Cookies and Tracking Technologies
We use cookies and similar tracking technologies to operate, maintain, and improve the Services, as well as to analyze usage and tailor interactions with the Services.
These technologies collect information such as IP address, device information, browser information, and data about how you interact with the Services.
Where required by applicable law, we will only place non-essential cookies on your device with your consent, and you may manage your cookie preferences at any time.
For more detailed information about the cookies we use, please refer to our Cookie Policy.
-
Children’s Privacy
Our Services are not directed to children, and we do not knowingly collect personal data from children below the age of majority applicable in their jurisdiction, or from users who are not legally permitted to use the Services.
If we have collected personal data from a child in circumstances where parental consent or another lawful basis was required, we will delete such data as soon as possible, or otherwise ensure compliance from a parent or legal guardian, in accordance with applicable law.
If you believe that a child has provided us with personal data, please contact us at privacy@elvionone.com so that we can review and take appropriate action.
-
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or operational business needs.
Where updated, we will revise the "Last Updated" date at the top of the Policy.
Where required by applicable law, we will provide additional notice of material changes.
We encourage you to review this Privacy Policy periodically to stay informed about how we process personal data.
-
Contact Us
If you have any questions, requests, or concerns regarding this Privacy Policy or our processing of your personal data, you may contact us at:
Legal name: Elvion Entertainment B.V.
Company address: 10 Korporaalweg, Willemstad, Curaçao
Company number: 146580
Contact email: privacy@elvionone.com