Privacy Policy

Privacy policy (English)

Last updated: 19.10.2026. The German version prevails if the texts differ.

1. Controller

The controller for the processing of personal data on this website is:

Steven Winter

Auf der Hahnenruh 10

66955 Pirmasens

admin@20esports.org

01748079242

No data protection officer has been appointed because the law does not require one.

2. General

This website is a community and league site for online games. It consists of the content management system nexpell (account, forum, comments, messages, news and further modules) and the 20ESPORTS event system (tournaments, Gather, Quickplay, teams, rankings). We process personal data only as far as needed to run the site and its features. Legal bases are Art. 6(1)(b) GDPR (providing the features you use), (f) (legitimate interest, e.g. security) and (a) (consent).

3. Hosting and server log files

The website is hosted by ALL-INKL.COM – Neue Medien Münnich (Hauptstraße 68, 02742 Friedersdorf, Germany). The host processes data on our behalf under a data processing agreement (Art. 28 GDPR).

On every request the server stores technically necessary data in log files: IP address, date and time, requested page, status, amount of data, browser and operating system. This serves security and stability (Art. 6(1)(f) GDPR). Retention follows the host's rules. We do not merge the logs with other data.

4. Registration and user account (nexpell)

Many features require an account. On registration we process your username, email address and password. The password is stored only as a secure hash. We also process the time of registration and last login and security data (login attempts, possible lockouts, and, if you enable two-factor login, a code sent by email). You confirm your account through a link in an email we send.

You may voluntarily add more to your profile, such as profile picture, name, country, language, description, contact details, links, projects and teams. You decide what to enter and who can see which details.

Legal basis: Art. 6(1)(b) GDPR (providing the account), for voluntary profile details (a). The data is kept until you delete your account. You can do that yourself under Edit profile → My data & privacy, where you can also download your data.

5. Cookies and similar technologies

We only set cookies that are necessary to operate the site. No consent is needed for these (Section 25(2) no. 2 TDDDG; Art. 6(1)(f) GDPR).

6. Community features (nexpell)

Depending on the modules you use we process:

• Forum: topics, posts, likes, read status and uploaded images with your username and the time. Posts can be readable by guests depending on settings.
• Comments and ratings under posts, news and downloads.
• Private messages between logged-in users. Only sender and recipient, and technically the administration, can read them.
• News: author information on published posts.
• Downloads: a log of who downloaded what and when [verify if active].
• Applications (“Join us”): details you enter in the application form.
• Online status / visitor counter: who is online and how many visitors there are [verify whether and which identifier is stored].
• Game server display (Gametracker): shows the status of game servers and logs actions by administrators.

Legal basis: Art. 6(1)(b) GDPR (using the offered features) and (f) (operation and security of the site). You are responsible for your own posts; do not post third parties' data without their consent. Posts and comments remain if you delete your account; they are then shown as “Gelöschter Benutzer” (deleted user) without a link to you. Private messages and your profile are deleted.

7. 20ESPORTS event system (tournaments, Gather, Quickplay, teams)

To take part we create a player profile linked to your account. We process:

• Player name, platform, country, Discord name and game accounts (e.g. in-game IDs). You choose which of these others can see; default: logged-in users only.
• Teams: memberships, invitations and applications, and a team password (stored only as a hash).
• Tournaments and matches: registrations (depending on the tournament with name, age or email address if you give them), check-in, line-ups, results, disputes, Elo rating and rankings. The rating is calculated automatically from results and has no legal effect.
• Match chat (tournament, Gather, Quickplay), readable only by match participants and administrators.
• Screenshots as proof of results. On upload we remove metadata such as location and camera data.
• Notifications about matches and teams, visible only to you.
• Abuse protection: we count requests with a hashed identifier (no plain IP address) for at most 24 hours to limit spam and automated attacks (Art. 6(1)(f) GDPR).

Public visibility: results, tournament brackets, team names and rankings are visible to everyone, including guests, with your player name (not your real name), because tournaments could not otherwise be followed. You can object (see section 14); we then replace your name with a pseudonym.

Legal basis: Art. 6(1)(b) GDPR (running tournaments and your participation) and (f) (traceable results and rankings).

Retention: tournament chats are deleted after 180 days, Gather/Quickplay chats after 90 days, read notifications after 180 days and all notifications after 365 days at the latest. Results and rating are kept as tournament history for [define period]. Screenshots are kept until the purpose ends, but no longer than [define period].

Manage your data: under Profile → My data & privacy you can download and delete your event system data. On deletion we remove your profile with game accounts, Discord link, chats, notifications, friends, applications and rating. Results and tournament history stay anonymised as “Gelöschter Spieler” (deleted player) so that other players' results and rankings stay correct.

8. Discord link

You can link your Discord account for match rooms and roles; from 2v2 on it is required to take part because teams coordinate in Discord. You are redirected to Discord. We request only the “identify” permission and receive your Discord ID and username. We check whether you are on our server and store these details to assign you match rooms and roles. We do not store an access token. Bot jobs (create room, set permissions) are deleted 30 days after completion.

The provider is Discord Inc., USA, which transfers data to the USA. In its privacy policy Discord names two bases: participation in the EU-US Data Privacy Framework (adequacy decision of the EU Commission) and standard contractual clauses for transfers outside the EEA. Legal basis: Art. 6(1)(b) GDPR (requirement from 2v2), otherwise (a). You can unlink at any time in your profile. You end your membership of the Discord server yourself by leaving it. Discord's own privacy policy applies to your use of Discord.

9. Challonge

If tournaments are synchronised with Challonge (USA), we send team or participant names to the service so the bracket can be shown. Legal basis: Art. 6(1)(b) GDPR.

10. Fonts and external content

Fonts are hosted locally on our server; no data is sent to Google or other providers for them.

11. Twitch and other embeds

If pages embed videos or streams from Twitch (Twitch Interactive, Inc., USA), your browser sends your IP address to Twitch when loading, and Twitch may set cookies. We load such content only after your consent (click on “Load video”; Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can refuse at any time; the site works without it. 

12. Recipients and transfers to third countries

Recipients of your data: our host ALL-INKL.COM (processor), other users and administrators within the features (e.g. opponents, team), Discord Inc., Challonge, Twitch. Discord, Challonge and Twitch are based in the USA. A transfer only takes place on the basis of an adequacy decision (EU-US Data Privacy Framework, where the provider is certified) or standard contractual clauses. We do not pass data to other third parties unless legally required.

13. Retention

We store data only as long as the purpose requires or the law demands. Account and profile data are kept until you delete your account. Specific periods are in sections 3, 7 and 8. Afterwards we delete or anonymise data unless a statutory retention duty applies.

14. Your rights

You have the rights of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw any consent at any time with effect for the future.

You can download your data yourself under Edit profile → My data & privacy (website data and event system data separately) and delete your account. Or write to datenschutz@20esports.org ; we reply within one month. We may ask questions to verify your identity.

You also have the right to lodge a complaint with a data protection supervisory authority; ours is [supervisory authority of your state, e.g. by your place of residence].

You are not legally obliged to provide your data; without the details required for the account (username, email, password) we cannot offer you an account or participation. No automated decision with legal effect takes place.

15. Minors

Participation is open from age 16. Younger users need the consent of their legal guardians. The system does not check age technically. Discord itself requires a minimum age (13 according to Discord, higher in some countries).

16. Security and changes

We protect the site with technical and organisational measures (HTTPS encryption, hashed passwords, access restrictions, automatic deletion periods). We update this policy when the site or the law changes; the version published here applies.