Privacy

Controller

The controller responsible for processing is Hamburg Backgammon, Marderstraat 12, 22399 Hamburg, Germany, email: kontakt@hamburg-backgammon.de, represented by Thomas Kazemieh.

Accounts

For an account we process your email address, a password stored in encrypted form, your first and last name, the time of registration and of your last login, and any information you voluntarily add to your profile (Galaxy name, short text, other tournaments, preferred language).

As soon as you enter your name when registering or in your profile, the database automatically links your account to the matching player record with your previous tournament results, provided the match is unambiguous. Only if several player records could fit does the tournament management confirm the correct link.

The legal basis is running tournament play, or our legitimate interest in a protected area for signed-in players (Art. 6(1)(b) and (f) GDPR). We delete an account at any time on request. Tournament results are not affected, because they belong to tournament play and not to the account.

Account emails

You receive emails to confirm your email address and to reset your password. They are sent to your address via the Supabase authentication service (see below) and contain only the respective confirmation or reset link. The legal basis is Art. 6(1)(b) GDPR.

Storage of tournament results

For each tournament we store the date, title, venue, participants, placings, ranking points and, where recorded, matches won and lost.

This data is the basis of the ranking, the statistics and the list of champions and is archived permanently. The legal basis is our legitimate interest in a traceable history of Hamburg Backgammon (Art. 6(1)(f) GDPR). Deleting individual results would make the ranking unusable; on request we will consider abbreviating the name.

Publication of names

First and last names appear publicly in the annual ranking, in tournament results, in the list of champions, in the statistics, on the player page and in the tournament participant lists. A ranking cannot be run without naming players.

Anyone who objects to the publication of their full name can contact the tournament management. We will then abbreviate the name in the public view (for example “Petra H.”). Participation in tournament play is not affected.

Tournament registration and public participant lists

If you register for a tournament, we store the registration with your account, the linked player record, the time and the status. Guests without an account are entered by the tournament management with their name and, where applicable, email address.

The participant list of every tournament is public and visible without logging in. It shows the names of everyone registered, including guests, the order of registration and, where applicable, a waiting-list position. Profile picture and Galaxy name appear there only with a public profile (see below). Email addresses never appear.

If you cancel your registration, you disappear from the list; the registration remains stored as cancelled so that the waiting list and number of participants stay traceable. The legal basis is running the tournament (Art. 6(1)(b) GDPR) and our legitimate interest in open participant planning (Art. 6(1)(f) GDPR).

Public profile

With the “Show my profile publicly” switch – when registering or in your profile – you decide whether your profile picture, short text (bio) and Galaxy name appear publicly: in rankings, statistics, participant lists, on your player page and in the player directory. The default is off. Without your consent only your name and results appear, with your initials instead of a photo.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it in your profile at any time; the information then disappears immediately from all public views.

Profile picture

A profile picture is optional. It is cropped to 512 × 512 pixels in your browser and stored in the Supabase file storage under a randomly generated file name. When you replace it, we delete the previous picture.

The image file is technically accessible via its address. This address cannot be guessed, and the file storage cannot be listed. On our pages the picture is shown only with a public profile.

You can replace the picture in your profile at any time or delete it with “Remove picture”; the file is deleted as well. The legal basis is your consent given by uploading (Art. 6(1)(a) GDPR).

Player directory

The directory is public. It shows only profiles whose owners have switched on “Show my profile publicly” and that are linked to a player record: name, profile picture, Galaxy name and ranking position in the current season – the same information that also appears publicly in the ranking and statistics.

Photos in posts

In tournament reports we publish photos from tournament play. The basis is the consent of the persons shown (Art. 6(1)(a) GDPR, § 22 KunstUrhG). Before every image upload the editors expressly confirm that this consent has been given.

Consent can be withdrawn at any time. After a withdrawal we remove the picture from the post and from storage.

Hosting with Cloudflare

This website is delivered via Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). When you visit, Cloudflare processes technically necessary connection data – IP address, time, requested address and browser identification – to deliver the site and protect it against attacks. We do not analyse this data ourselves and keep no access logs of our own.

Cloudflare processes the data on our behalf; there is a data processing agreement under Art. 28 GDPR. As a transfer to the USA cannot be ruled out, it is based on Cloudflare's certification under the EU-US Data Privacy Framework. The legal basis is our legitimate interest in secure and fast delivery (Art. 6(1)(f) GDPR).

Database, login and file storage with Supabase

The database, login, account emails and file storage are operated via the Supabase platform (Supabase, Inc.). Supabase processes the data named in this policy exclusively on our behalf and according to our instructions; there is a data processing agreement under Art. 28 GDPR.

The data is stored in a data centre in Ireland (EU). Where access from a third country occurs in individual cases, it is based on the standard contractual clauses of the European Commission.

Storage in your browser

The site itself sets no cookies. In your browser's local storage (localStorage) we store three things: after login, your login session so that you stay logged in; the language you selected; and, once you close the privacy notice with “Got it”, that it should not appear again. All three are technically necessary for the function you requested (§ 25(2) no. 2 TDDDG) and do not leave your browser for analysis purposes. The session ends when you log out.

To protect against attacks, Cloudflare may set a technically necessary security cookie.

If you have an account, we also store your preferred language in your profile: the one set at registration, and afterwards the one chosen in your profile. You can change it there at any time.

No analytics tools

We use no analytics tools and no advertising cookies. Should audience measurement be wanted in future, only a cookieless solution without personal analysis will be used.

Fonts

The fonts used (Spectral and IBM Plex Sans) are served from our own server. There is no connection to Google Fonts or any other external provider, and no data is transferred to third parties in the process.

Your rights

You can request access, rectification, erasure, restriction of processing and data portability, object to processing and withdraw consent at any time with effect for the future. A message to kontakt@hamburg-backgammon.de is sufficient.

You can lodge complaints with the Hamburg Commissioner for Data Protection and Freedom of Information.