Privacy Policy

I. GENERAL INFORMATION

This Privacy Policy contains the rules for the collection, storage, use, and transfer of personal data of users ("User/Users") in connection with their access to and use of the foxwar.lv website ("Website").

The controller of your personal data is SIA Foxwar (Limited Liability Company), registration number: 50203500711, registered in the Commercial Register on 09.08.2023 ("Controller").

The Controller declares that the information collected through the Website is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (General Data Protection Regulation, "GDPR").

You can contact us regarding data protection issues by email: [email protected].

II. INFORMATION YOU PROVIDE TO US

The Controller collects certain information about you when you:
a) Fill out a contact or booking form on our Website;
b) Create an account on the Website with an email address, or by signing in with Google or Facebook;
c) Buy a gift certificate;
d) Contact us by email or phone;
e) Interact with our Website.

We may collect the following data:

• a) First and last name;
• b) Email address;
• c) Phone number;
• d) A password, but only as an irreversible hash, and only if the account was created with an email address;
• e) The identifier of your Google or Facebook account and a link to your profile picture, if you signed in through them;
• f) Booking information (date, selected services);
• g) Bonus points awarded, season rating, and certificates issued to you;
• h) IP address and technical device data;
• i) Content of your messages.

III. ACCOUNTS AND SIGNING IN WITH GOOGLE OR FACEBOOK

An account on the Website can be created with an email address and a password, or by signing in with Google or Facebook.

If you sign in through one of these services, we receive from it your name, email address, a link to your profile picture, and a persistent identifier of your account in that service. With Facebook this identifier is issued specifically for our app: it cannot be used to recognise you in any other app.

We request only the basic profile and the email address. We post nothing on your behalf and receive no access to your friend list, feed, photos, or messages.

What we receive is kept in a sign-in record: the identifier at the provider, the provider's name (google or facebook), the tokens it issued, and their expiry. The tokens exist solely to confirm the sign-in and are passed on to no one.

A session is a separate record with an expiry, an IP address, and a browser string. It keeps you signed in between visits and makes a sign-in that is not yours visible and stoppable.

The account exists to hold your bonus balance, season rating, request history, and purchased certificates. That data is created here, not received from Google or Facebook, and remains yours even if the social sign-in is disconnected.

The legal basis is performance of a contract: the account is maintained at your request. Measures against bots and password guessing rest on the Controller's legitimate interest.

Google Ireland Limited and Meta Platforms Ireland Limited act as independent controllers for the processing that happens on their side during sign-in. It is governed by their own rules: Google Privacy Policy and Meta Privacy Policy.

IV. CATEGORIES OF PERSONAL DATA COLLECTED AND PURPOSES

The Controller may process your personal data to the extent and for the time necessary to perform the contract with you (provision of services), including:
- organizing the events and games you requested;
- maintaining your account, bonus balance, and season rating;
- issuing, charging for, and redeeming gift certificates;
- resolving organizational issues;
- processing claims;
- providing customer service.

In addition, the Controller may process your personal information to comply with applicable tax or financial regulations (e.g., for invoicing).

Based on the Controller's legitimate interests, we may process your data for the following purposes:
- ensuring the security of services, detecting and preventing fraud;
- protecting forms and sign-in against bots and automated password guessing;
- monitoring and analyzing trends and activity on the site using the Google Analytics service to improve the site's performance, understand user needs, and optimize the user experience;
- responding to your comments and questions (via the contact form);
- debt collection, defending legal claims in court;
- statistical analysis and archiving.

The Controller collects information when you interact with the Website. Server log files and analytical data (including browser type, access time, pages viewed, and your IP address) are used to improve our services and optimize website performance.

V. THIRD PARTIES AND DATA TRANSFER

The Controller uses third-party service providers without which the Website and its accounts would not work. Depending on the circumstances, they act as data processors or independent controllers:

• Cloudflare, Inc.: hosting of the Website and its backend, the account database, and the Turnstile service that tells a human from a bot when forms are submitted;
• Google Ireland Limited / Google LLC: the Google Analytics service and signing in with Google;
• Meta Platforms Ireland Limited: signing in with Facebook;
• Stripe Payments Europe, Ltd.: taking payment for gift certificates. Card details are entered on Stripe's side and never reach us: we see only the fact, the amount, and the status of the payment;
• Resend, Inc.: sending email: address confirmation, password recovery, and messages about requests and certificates.

Some of these companies are located outside the European Economic Area or process data outside it. To ensure an adequate level of protection, such transfers are based on appropriate legal agreements and standard contractual clauses approved by the European Commission, as well as on other mechanisms provided for by the GDPR.

You can prevent Google Analytics from using your data by installing the Google Analytics Opt-out Browser Add-on.

VI. YOUR RIGHTS

In accordance with GDPR rules, you have the right to access your personal data, rectify it, erase it, restrict its processing, data portability, as well as the right not to be subject to automated processing and the right to object to the processing of your data.

You can exercise your rights by contacting us using the contact details provided in Section I. How to delete the data received from Facebook, and how to delete the account altogether, is described in Section VIII.

You have the right to lodge a complaint against the Controller's data processing actions with the competent data protection authority of Latvia, the Data State Inspectorate (Datu valsts inspekcija, Elijas street 17, Riga, LV-1050, Latvia).

VII. DATA RETENTION

The Controller retains your personal information for as long as necessary to perform the contract or achieve the purposes for which the data was collected. After that, the data is deleted or anonymized.

Sessions carry their own expiry and are removed when it passes or when you sign out. Links for confirming an address or resetting a password live a matter of hours and stop working once used.

The Controller has the right to retain your information longer if necessary to fulfill legal (tax) obligations or to establish, exercise, or defend the Controller's legal claims.

VIII. DATA DELETION

You may withdraw access and ask for your data to be deleted at any time. There are three routes, and they lead to different things:

• Disconnect Facebook. In Facebook, open Settings & privacy → Settings → Apps and websites, find FOXWAR, and remove it. Facebook notifies us automatically: the Facebook connection and everything we received from it are deleted, and you are shown a page with the date and a confirmation code. Your FOXWAR account itself remains: you can sign in with a password, or, if you never set one, use recovery by email.
• Disconnect Google. Revoking access in your Google account settings stops the Google sign-in, but Google does not notify us. To have the stored connection deleted, write to us at [email protected].
• Delete the account entirely. Write to [email protected] from the email address the account was created with. We will delete the account together with its bonus points, rating, and history. This is done by hand, because deletion cannot be undone and we want to be sure the request is yours.

What remains, and why. Records of invoices issued and payments made must be kept for the period set by Latvian tax law (see Section VII). A gift certificate that has been paid for but not used stays valid until it expires even if the account is deleted: otherwise deleting an account would void a certificate that may be sitting in someone else's wallet.

IX. PROFILING AND COOKIES

Your personal information may be processed in an automated form (including profiling for analytics and marketing), but this will not produce any legal effects concerning you.

Our website uses cookies (including cookies from Google Analytics) to identify users and collect statistics. You can change your cookie settings in your browser at any time or withdraw consent via the cookie settings panel on our website.

Besides the analytical ones there are strictly necessary cookies, which the consent panel does not ask about and which cannot be switched off: the sign-in session cookie (on the auth.foxwar.lv domain) and the Cloudflare Turnstile cookie set when forms are submitted. Without the first you will not stay signed in; without the second a request cannot be sent.