1.Who we are
MetaDuels is operated by [Registered company name], a company registered in Kenya under number [Company registration number], with its registered office at [Registered office address], Nairobi, Kenya. We are the data controller responsible for your personal data on the Platform. We are registered with the Office of the Data Protection Commissioner (ODPC) of Kenya under registration number [ODPC registration number].
Our Data Protection Officer is [Data Protection Officer name], reachable at privacy@metaduels.com. Write to the same address for any question about this policy or your data.
This policy is designed to meet the Kenya Data Protection Act, 2019 and its regulations, the EU and UK General Data Protection Regulation (GDPR), the principles of the US Children's Online Privacy Protection Act (COPPA), and US state privacy laws such as the California Consumer Privacy Act (CCPA). Where local law gives you more protection, we apply it.
2.Data we collect
| Category | Examples | Source |
|---|---|---|
| Account | Gamer tag, email, phone number, country, hashed password, Google sign-in identifier if used | You |
| Age | Date of birth and the age tier derived from it | You |
| Guardian contact | Parent or guardian email (and phone where given), consent status and date | The minor and the guardian |
| Gameplay | Arcade input logs and replays, scores, match reports, results, screenshots you upload, rankings, fair-play flags and strikes | You and our servers |
| Linked game accounts | Lichess username, Clash Royale or Brawl Stars player tag, and match data retrieved from those publishers' APIs | You and the publisher's API |
| Communications | Chat messages, Showdown room activity, support requests | You |
| Payments (adults) | Wallet transactions, Paystack payment references, card brand and last four digits, mobile-money number, payout records | You and Paystack |
| Identity verification (adults) | Name, ID document details and proof of payout-method ownership, only when you withdraw or the law requires it | You |
| Technical | IP address, approximate location derived from it, device and browser type, time zone, session and security logs, essential cookies | Your device |
Card data. Card payments are handled by Paystack, a PCI DSS-certified payment processor. We never receive or store your full card number or security code.
We do not collect sensitive personal data such as health, biometric, religious or political information, and we ask you not to share it in chat.
3.How we use data and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Create and run your account, place you in the right age tier, run competitions, verify results, award prizes | Performance of our contract with you |
| Process deposits, entry fees, escrow and withdrawals | Contract; legal obligation |
| Verify identity and age, prevent money laundering and fraud, keep financial records, withhold tax where required | Legal obligation |
| Detect cheating, bots, collusion and multi-accounting; keep the Platform secure; moderate chat and names | Legitimate interests in fair, safe competition |
| Process children's data for competitions | Consent of the parent or guardian |
| Send service emails: password resets, security alerts, prize and withdrawal notices | Contract; legitimate interests |
| Send news and offers (adults only, never children) | Your consent, which you can withdraw at any time |
| Improve the Platform using aggregated statistics | Legitimate interests |
Automated decisions. Our systems automatically check arcade runs and match data for signs of cheating. A run that fails a check is held, and a member of staff reviews it before any penalty that significantly affects you. You can ask for a human review of any decision and contest it under the Fair Play Policy.
We do not sell personal data, we do not show third-party advertising, and we do not build advertising profiles.
4.Children's data
We treat everyone under 18 as a child for data-protection purposes, and we apply extra safeguards:
- Guardian consent first. A minor can create an account and browse, but we collect only what is needed for that, and the account cannot compete until a parent or guardian gives verifiable consent through the link we email them.
- Data minimisation. We collect only what is reasonably necessary for the child to take part. We do not require children to disclose more information than an activity needs.
- No public exposure. Junior profiles are hidden from public pages and rankings, their country is not shown, and only gamer tags appear. Juniors chat with preset messages only; Youth chat is filtered to block contact details and off-platform invitations.
- No money, no marketing. Children have no cash wallet, receive no marketing emails, and are never profiled for advertising.
- Prizes. Junior prizes are school items. We use the guardian's contact details to notify them and arrange delivery.
Guardians' rights. A parent or guardian can review the child's personal data, have it corrected or deleted, refuse further collection or use, and withdraw consent at any time by writing to privacy@metaduels.com from their registered address. Withdrawing consent ends competitive access; deletion closes the account. If a parent or guardian has not approved a minor's account within 30 days of sign-up, including where they decline, we delete the account together with the guardian's contact details, sessions and sign-in links. Financial ledger records are kept where the law requires them.
If you believe a child has given us personal data without the required consent, contact us and we will act promptly.
6.International transfers
We are based in Kenya and our service providers operate in several countries, including the United States and the European Union. When we transfer personal data outside the country where it was collected, we do so in line with sections 48 to 50 of the Kenya Data Protection Act and Chapter V of the GDPR, using adequacy decisions, standard contractual clauses, or other appropriate safeguards. You can ask us for a copy of the safeguards that apply.
7.How long we keep data
| Data | Retention |
|---|---|
| Account data | While your account is open, then up to 2 years to handle disputes, unless you ask for earlier deletion and no legal duty requires us to keep it |
| Financial and identity-verification records | 7 years after the transaction, as tax and anti-money-laundering laws require |
| Arcade replays, match results and evidence | Up to 24 months, to support rankings, appeals and fair-play investigations; results in public brackets may be kept as part of the event history |
| Chat messages | Up to 12 months, longer if needed for an investigation |
| Security and login logs | Up to 12 months |
| Session cookies | 30 days, or until you sign out |
| Password reset links | 30 minutes, single use |
| Email confirmation links | 48 hours, single use |
| Minor accounts not approved by a parent or guardian | Deleted 30 days after sign-up |
When data is no longer needed, we delete it or anonymise it so it no longer identifies you.
8.Your rights
Depending on where you live, you have the right to:
- be informed about how we use your data (this policy);
- access a copy of your personal data;
- have inaccurate data corrected;
- have your data deleted;
- restrict or object to processing, including processing based on legitimate interests;
- receive your data in a portable format;
- withdraw consent at any time, without affecting earlier processing;
- not be subject to decisions based solely on automated processing that significantly affect you.
California and other US states. You can request to know what personal information we collect, use and disclose; ask us to delete or correct it; and you will not be discriminated against for exercising these rights. We do not sell or "share" personal information for cross-context behavioural advertising, and we have not done so in the past 12 months.
Some rights are limited by law, for example we must keep financial records even if you ask us to delete your account.
9.How to exercise your rights
Email privacy@metaduels.com from the address on your account, saying which right you want to exercise. We may ask for information to confirm your identity. We respond within one month, or sooner where local law sets a shorter deadline, such as the timelines in the Kenya Data Protection (General) Regulations, 2021. Requests are free unless they are manifestly unfounded or excessive.
If you are not satisfied with our response, you can complain to the Office of the Data Protection Commissioner in Kenya (odpc.go.ke), to the data protection authority in your EU or UK country of residence, or to your local regulator.
10.Security
We protect personal data with measures appropriate to the risk, including:
- encryption in transit (TLS) on every page;
- passwords stored only as salted bcrypt hashes, and session and reset tokens stored only as SHA-256 hashes;
- a tamper-evident ledger for wallet and escrow transactions, and two-person approval for larger withdrawals;
- strict access controls for staff, and audit logs of sensitive actions;
- login rate limiting and lockouts, and security alerts when your password changes.
No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will notify the ODPC within 72 hours of becoming aware of it, and tell you without undue delay, as the law requires.
12.Changes to this policy
We will post any update here with a new "Last updated" date. If a change materially affects how we use your data, we will tell you by email or on the Platform before it takes effect, and ask for fresh consent where the law requires.
13.Contact
Data Protection Officer, [Registered company name], [Registered office address], Nairobi, Kenya. Email: privacy@metaduels.com. General support: support@metaduels.com.
Documentos relacionados