Privacy

Controller

The controller responsible for processing is Hamburg Backgammon, Marderstraat 12, 22399 Hamburg, Germany, email: kontakt@hamburg-backgammon.de, represented by Thomas Kazemieh.

Accounts

For an account we process your email address, a password stored in encrypted form, your first and last name, the time of registration and of your last login, the information you voluntarily add to your profile (profile picture, “About me” text, names on online platforms, own site, where you travel from, places where you otherwise play offline) and your preferred language.

As soon as you enter your name when registering or in your profile, the database automatically links your account to the matching player record with your previous tournament results, provided the match is unambiguous. Only if several player records could fit does the tournament management confirm the correct link.

The legal basis is running tournament play, or our legitimate interest in a protected area for signed-in players (Art. 6(1)(b) and (f) GDPR). We delete an account at any time on request. Tournament results are not affected, because they belong to tournament play and not to the account.

Account emails

You receive emails to confirm your email address and to reset your password. They are sent to your address via the Supabase authentication service (see below) and contain only the respective confirmation or reset link. The legal basis is Art. 6(1)(b) GDPR.

Storage of tournament results

For each tournament we store the date, title, venue, participants, placings, ranking points and, where recorded, matches won and lost.

This data is the basis of the ranking, the statistics and the list of champions and is archived permanently. The legal basis is our legitimate interest in a traceable history of Hamburg Backgammon (Art. 6(1)(f) GDPR). Deleting individual results would make the ranking unusable; on request we will consider abbreviating the name.

Publication of names

First and last names appear publicly in the annual ranking, in tournament results, in the list of champions, in the statistics and on the player page. A ranking cannot be run without naming players. In the player directory and in the tournament participant lists, names appear only under the conditions described in the sections on those.

Anyone who objects to the publication of their full name can contact the tournament management. We will then abbreviate the name in the public view (for example “Petra H.”). Participation in tournament play is not affected.

Tournament registration and participant lists

If you register for a tournament, we store the registration with your account, the linked player record, the time and the status. Guests without an account are entered by the tournament management with their name and, where applicable, email address.

Without signing in to this website, only the number of registered players is visible for each tournament, no names. Anyone signed in with an account sees the participant list: the names of everyone registered, including guests, the order of registration and, where applicable, a waiting-list position, together with profile picture and online names. Email addresses never appear. Without signing in, the database does not hand out the names at all; they are not merely hidden in the display.

If you cancel your registration, you disappear from the list; the registration remains stored as cancelled so that the waiting list and number of participants stay traceable. The legal basis is running the tournament (Art. 6(1)(b) GDPR) and our legitimate interest in participant planning that players can follow (Art. 6(1)(f) GDPR).

Public profile

A profile exists only if you have created an account yourself. With the “Show my personal details publicly” switch – when registering or in your profile – you decide whether visitors who are not signed in can also see your voluntary details: profile picture, the “About me” text, your names on online platforms, an own site, where you travel from and the places where you otherwise play offline. With your consent they appear for everyone in rankings, statistics, participant lists, on your player page and in the player directory. The default is off.

Without your consent, visitors who are not signed in see only your name and results, with your initials instead of a photo; they do not see you in the player directory. Anyone signed in with an account sees your profile in full regardless of the switch, with photo, “About me” and online names. The database enforces this itself: without signing in it does not hand out these details.

The legal basis is your consent (Art. 6(1)(a) GDPR): the details are voluntary, and you provide them knowing that signed-in players can see them. You can withdraw the consent for everyone in your profile at any time; the details then disappear immediately for visitors who are not signed in. If signed-in visitors should no longer see them either, clear or delete the fields in your profile.

Profile picture

A profile picture is optional. It is cropped to 512 × 512 pixels in your browser and stored in the Supabase file storage under a randomly generated file name. When you replace it, we delete the previous picture.

The image file is technically accessible via its address. This address cannot be guessed, and the file storage cannot be listed. On our pages the picture is shown to visitors who are not signed in only with a public profile, and always to signed-in players.

You can replace the picture in your profile at any time or delete it with “Remove picture”; the file is deleted as well. The legal basis is your consent given by uploading (Art. 6(1)(a) GDPR).

Player directory

The player directory lists only players who have created an account themselves and whose account is linked to their tournament results. Visitors who are not signed in see only the profiles with consent there. Anyone signed in sees all of these profiles in full, with name, profile picture, online names and ranking position in the current season. Players without an account do not appear in the directory; their names still appear in the ranking and results.

Photos in posts

In tournament reports we publish photos from tournament play. The basis is the consent of the persons shown (Art. 6(1)(a) GDPR, § 22 KunstUrhG). Before every image upload the editors expressly confirm that this consent has been given.

Consent can be withdrawn at any time. After a withdrawal we remove the picture from the post and from storage.

Hosting with Cloudflare

This website is delivered via Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). When you visit, Cloudflare processes technically necessary connection data – IP address, time, requested address and browser identification – to deliver the site and protect it against attacks. We do not analyse this data ourselves and keep no access logs of our own.

Cloudflare processes the data on our behalf; there is a data processing agreement under Art. 28 GDPR. As a transfer to the USA cannot be ruled out, it is based on Cloudflare's certification under the EU-US Data Privacy Framework. The legal basis is our legitimate interest in secure and fast delivery (Art. 6(1)(f) GDPR).

Database, login and file storage with Supabase

The database, login, account emails and file storage are operated via the Supabase platform (Supabase, Inc.). Supabase processes the data named in this policy exclusively on our behalf and according to our instructions; there is a data processing agreement under Art. 28 GDPR.

The data is stored in a data centre in Ireland (EU). Where access from a third country occurs in individual cases, it is based on the standard contractual clauses of the European Commission.

Storage in your browser

The site itself sets no cookies. In your browser's local storage (localStorage) we store three things: after login, your login session so that you stay logged in; the language you selected; and, once you close the privacy notice with “Got it”, that it should not appear again. All three are technically necessary for the function you requested (§ 25(2) no. 2 TDDDG) and do not leave your browser for analysis purposes. The session ends when you log out.

To protect against attacks, Cloudflare may set a technically necessary security cookie.

If you have an account, we also store your preferred language in your profile: the one set at registration, and afterwards the one chosen in your profile. You can change it there at any time.

No analytics tools

We use no analytics tools and no advertising cookies. Should audience measurement be wanted in future, only a cookieless solution without personal analysis will be used.

Fonts

The fonts used (Spectral and IBM Plex Sans) are served from our own server. There is no connection to Google Fonts or any other external provider, and no data is transferred to third parties in the process.

Your rights

You can request access, rectification, erasure, restriction of processing and data portability, object to processing and withdraw consent at any time with effect for the future. A message to kontakt@hamburg-backgammon.de is sufficient.

You can lodge complaints with the Hamburg Commissioner for Data Protection and Freedom of Information.