Privacy Policy

  1. Introduction

    This Privacy Policy explains how Duelport ("Company", "we", "us", "our") collects, uses, discloses, stores, and otherwise processes personal data when you access or use our website, platform, products, services, or any related communications.

    We are committed to protecting your privacy and handling your data in an open and transparent manner. We designed this Policy to comply with the General Data Protection Regulation ("GDPR"), the General Personal Data Protection Law ("LGPD"), and other applicable global privacy standards.

    If there is any conflict between this Privacy Policy and mandatory provisions of applicable law, the applicable law shall prevail.

    THE SERVICES ARE NOT DIRECTED TO CHILDREN AND ARE INTENDED ONLY FOR USERS WHO ARE LEGALLY PERMITTED TO USE THEM IN THEIR JURISDICTION.

  2. Data controller

    For the purposes of applicable data protection laws, we are the data controller of your personal information.

    The data controller is:

    Legal name:Duelport Entertainment B.V.

    Company address:10 Koгpoгaalweg, Willemstad, Curaçao

    Company number:146580

    Contact email: privacy@duelport.com

  3. Definitions

    For the purposes of this Privacy Policy:

    • "Personal Data" means any information relating to an identified or identifiable natural person.
    • "Data Subject" means the natural person to whom the Personal Data relates.
    • "Processing" means any operation performed on Personal Data, whether or not by automated means, including collection, storage, use, disclosure, transfer, erasure, or destruction.
    • "Controller" means the entity that determines the purposes and means of the processing of Personal Data.
    • "Services" means our website, platform, tournament features, related tools, communications, and any other services we provide or make available.
    • "Cookies" means small text files or similar technologies that may be stored on your device and used to operate, secure, or improve the Services, where applicable.
    • "User", "you", and "your" mean any person who accesses or uses the Services.

  4. Purposes of Processing and Legal Bases

    We process personal data only for specific, explicit, and legitimate purposes and only to the extent necessary for those purposes. Depending on the context, we rely on different legal bases under applicable data protection laws, including the GDPR and LGPD.

    Some personal data is required to provide the Services, while other data may be provided voluntarily by users. Providing optional data is not mandatory and does not affect access to the core functionality of the Services.

    Purpose Categories of Personal Data Legal Basis (GDPR) Legal Basis (LGPD) Retention
    Account creation & login Email address, username/nickname, password (hashed), user ID, country Art.6(b) -Performance of contract and Art. 6(1)(c) - Legal obligation (for eligibility verification (geoblocking)) Art.7(V) - Execution of contract and Art. 7(II) - Legal obligation (for eligibility verification (geoblocking)) For the duration of the active account + statutory limitation period (3 years after account deletion/inactivity)
    Enabling participation in tournaments and platform features Username, user ID, gameplay data, tournament participation data (results, points, rewards) Art.6(b) -Performance of contract Art.7(V) - Execution of contract For the duration of the active account + statutory limitation period (3 years after account deletion/inactivity)
    Providing customer support and responding to user inquiries Email address, username, communication content (messages, chat, support requests) Art.6(b) -Performance of a contract and, where applicable, Art.6(f) - our legitimate interests in providing and improving user support Art.7(V) - Performance of a contract and, where applicable, Art.7(IX) – our legitimate interests in providing and improving user support For the duration of the active account + statutory limitation period (3 years after account deletion/inactivity)
    Ensuring platform security, preventing fraud and abuse IP address, Unique Device ID, user ID, device and technical data, login/activity metadata Art.6(f) - Legitimate interest Art.7(IX) – Legitimate interests Up to 12 months from collection, unless a longer period is necessary to investigate an incident, defend legal claims, comply with legal obligations, or prevent abuse
    Operating, maintaining, and improving the Services Device type, OS, browser type, platform type, technical logs, usage data, feature interaction data Art.6(a) -Consent, and where strictly necessary for service functionality, Art.6(b) - performance of a contract Art.7(I) - Consent, and where strictly necessary for service functionality, Art.7(V) - performance of a contract Until consent is withdrawn or up to 24 months from collection (in aggregated or pseudonymized form)
    Analytics and product development Gameplay patterns, feature usage, tournament activity (aggregated or pseudonymized data where possible) Art.6(f) - Legitimate interest Art.7(IX) – Legitimate interests Anonymize after analysis
    Optional profile information and personalization Phone number, gender, full name, date of birth, full address (country, city, zip code) Art.6(a) -Consent Art.7(I) - Consent Until consent withdrawn
    Marketing & newsletters Email Art.6(a) -Consent Art.7(I) - Consent Until consent withdrawn

    Where users voluntarily provide additional personal data that is not required for the core functionality of the Services, such data will be processed solely for the purposes for which it was provided, including account personalization, communication, or user experience improvement, and in accordance with applicable law.

    We do not require users to provide sensitive or excessive personal data to access or use the core features of the Services.

  5. Categories of Personal Data We Collect

    We may collect and process the following categories of personal data, depending on how you interact with the Services and the information you choose to provide:

    1. Account and profile data

      This may include your email address, username or nickname, gender, full name (if provided), date of birth (if provided), country of residence, phone number, and address details such as city, ZIP code, street, or other address information you choose to provide.

    2. Authentication data

      This includes your password, which is stored only in hashed form and is not accessible to us in plain-text format.

    3. Communications data

      This includes information you provide when contacting our support team, submitting inquiries, or participating in forums, chats, or other interactive features of the Services.

    4. Technical and device data

      This may include your IP address, unique device identifier, User ID, Amplitude ID, device type, operating system and version, browser type and version, library versions, mobile carrier information (where applicable), platform type (web or mobile), and region, city, or general location derived from your IP address.

    5. Usage and gameplay data

      This may include information about how you interact with our website and Services, including game statistics, tournaments participated in, tournament period, results, rewards, points, feature usage, and gameplay patterns.

    6. Optional information

      You may choose to provide additional information that is not required for core use of the Services. Where you choose to provide such information, we will process it only for the purpose for which it was collected and in accordance with this Privacy Policy and applicable law.

  6. Data Sharing and Disclosure of Personal Data

    We may disclose or make personal data available to the following categories of recipients, where necessary for the operation of the Services, the performance of our contractual obligations, our legitimate interests, compliance with legal obligations, or other applicable legal bases under data protection laws.

    1. Service Providers and Processors

      We may share personal data with third-party service providers that process personal data on our behalf and under our instructions, including:

      • Amplitude – for product analytics, usage analysis, performance measurement, and understanding how users interact with the Services. The data shared with Amplitude may include technical data, device information, identifiers, usage data, gameplay statistics, tournament participation data, and general location information derived from IP address, to the extent necessary for analytics and service improvement purposes.
      • Google Analytics – for website analytics, traffic measurement, audience analysis, and service optimization. The data shared with Google Analytics may include technical data, identifiers, usage data, and event/activity data generated through your use of the Services.
      • Analytics providers to help us understand user behavior
      • SendPulse – for sending service-related emails, account-related communications, notifications, and other email-based communications, where applicable. The data shared with SendPulse may include your email address, username, and other information necessary to deliver such communications. Where we send marketing communications, we will do so in accordance with applicable data protection laws and, where required, based on your consent or another valid legal basis. You may opt out of receiving marketing communications at any time by following the unsubscribe instructions included in such communications or by contacting us directly (you may find contact data in Section 2 "Data controller").

      These service providers act as processors or equivalent service providers under applicable data protection laws and are contractually restricted from using personal data for purposes other than providing the relevant services to us, except where otherwise permitted or required by law.

    2. Other Disclosures

      We may also disclose personal data:

      • to our professional advisors, auditors, accountants, lawyers, and insurers, where necessary;
      • to competent public authorities, regulators, courts, or law enforcement bodies, where required by law or to protect our rights, users, or the security of the Services;
      • in connection with a corporate transaction such as a merger, acquisition, restructuring, sale of assets, or similar event, subject to applicable legal requirements.

    3. International Data Transfers

      Because our company is established in Curaçao and some of our service providers may be located in or access data from other countries, personal data may be transferred to, stored in, or otherwise processed in countries outside your country of residence, including countries outside the European Economic Area and, where applicable, outside Brazil.

      Where such transfers occur, we will rely on appropriate transfer mechanisms recognized under applicable law, such as adequacy decisions or standard contractual clauses, and we will implement additional safeguards where required.

    4. No Sale of Personal Data

      We do not sell personal data in exchange for money. We do not share personal data with third parties for their own independent marketing purposes unless you have explicitly consented to such sharing. If this position changes, we will update this Privacy Policy and provide any required notices or choices under applicable law.

  7. Data Retention

    We retain personal data only for as long as necessary for the purposes for which it was collected, including to provide the Services, maintain and improve the Services, ensure security, comply with our legal obligations, resolve disputes, and enforce our agreements.

    Unless a longer retention period is required or permitted by applicable law, we will retain personal data associated with an inactive account for up to three (3) years from the date of the last recorded account activity. For the purposes of this Privacy Policy, “account activity” may include, for example, logging into the account, participating in a tournament, using the Services, or otherwise interacting with the account in a way that is recorded by us.

    After the retention period expires, we will delete or anonymize the personal data, or otherwise render it inaccessible, within the scope and technical limits of our systems. We may retain certain information for a longer period where necessary:

    • to comply with a legal or regulatory obligation;
    • to establish, exercise, or defend legal claims;
    • to investigate or prevent fraud, abuse, or security incidents;
    • to maintain records required for accounting, audit, or other compliance purposes; or
    • where data has been anonymized so that it can no longer identify you.

    Where we delete account data, some information may remain in backup copies for a limited period of time until those backups are overwritten or deleted in accordance with our backup retention procedures. During that time, such data will remain subject to appropriate technical and organizational safeguards and will not be actively used except as required for backup recovery, security, or legal compliance.

    Where data is no longer needed for identification purposes, we may retain it in anonymized or aggregated form for analytical, statistical, or service-improvement purposes, provided that it no longer identifies you and is no longer personal data under applicable law.

  8. Data Security

    We implement appropriate technical and organizational measures designed to protect personal data against unauthorized or unlawful processing, accidental loss, destruction, alteration, disclosure, or damage. These measures are implemented taking into account the nature of the personal data, the context of processing, the available technology, and the risks to individuals.

    Such measures may include, as applicable:

    • encryption of personal data in transit using industry-standard protocols such as TLS;
    • hashed password storage and related authentication safeguards;
    • access controls and role-based permissions;
    • authentication mechanisms and account protection measures;
    • regular security reviews and vulnerability assessments;
    • staff training on confidentiality, privacy, and data protection;
    • secure network and system architecture;
    • monitoring and logging of access to systems and data, where appropriate;
    • backup and recovery procedures; and
    • contractual and organizational safeguards for service providers and processors.

    We restrict access to personal data to personnel and authorized service providers who need such access for legitimate business or operational purposes and who are subject to confidentiality obligations where appropriate.

    While we take reasonable steps to protect personal data, no method of transmission over the Internet and no method of electronic storage is completely secure. Therefore, we cannot guarantee absolute security.

    If we become aware of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will take appropriate steps to contain, investigate, and address the incident and, where required by applicable law, notify the competent supervisory authority and affected individuals.

  9. Your Rights

    Depending on your location and the applicable data protection laws, you may have the following rights in relation to your personal data:

    • Right of access.You may request confirmation as to whether we process your personal data and, where applicable, obtain access to that data and information about how we process it.

    • Right to rectification.You may request that we correct or update inaccurate, incomplete, or outdated personal data.

    • Right to erasure / deletion.In certain cases, you may request that we delete your personal data. This right is not absolute and may be limited where we need to retain certain data to comply with legal obligations, establish, exercise, or defend legal claims, or for other lawful reasons.

    • Right to restriction of processing.In certain cases, you may request that we restrict the processing of your personal data.

    • Right to object.In certain cases, you may object to our processing of your personal data, including processing based on our legitimate interests.

    • Right to data portability.Where legally applicable, you may request to receive certain personal data in a structured, commonly used, and machine-readable format and, where technically feasible, have it transmitted to another controller.

    • Right to withdraw consent.Where we rely on your consent as a legal basis, you may withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

    • Right to information about sharing.You may request information about the categories of recipients or third parties with whom we share your personal data, subject to applicable legal limits.

    • Right to review automated decisions.Where applicable, you may request review of decisions made solely on the basis of automated processing of personal data that affect your interests.

    You may exercise your rights by contacting us at privacy@duelport.com. We may ask for additional information to verify your identity before responding to your request. We will respond without undue delay and within the time limits required by applicable law. Under the GDPR, this is generally within one month, subject to permitted extensions in complex cases. Under the LGPD, access requests are generally answered immediately in simplified form or within 15 days for a full response, depending on the form of the request.

    If you believe that our processing of your personal data violates applicable data protection law, you also have the right to lodge a complaint with the competent supervisory authority. Under the GDPR, this may be the data protection authority in the Member State of your habitual residence, place of work, or place of the alleged infringement. Under the LGPD, you may also raise complaints with the Brazilian National Data Protection Authority, where applicable.

    Please note that not all rights apply in every situation. The availability of each right depends on the legal basis for processing, the nature of the request, and any applicable legal exceptions or limitations.

  10. Cookies and Tracking Technologies

    We use cookies and similar tracking technologies to operate, maintain, and improve the Services, as well as to analyze usage and user interactions.

    These technologies may collect information such as IP address, device identifiers, browser information, and data about how you interact with the Services. We may use both first-party and third-party tools, including analytics providers, for these purposes.

    Where required by applicable law, we will obtain your consent before placing non-essential cookies or using similar technologies.

    For more detailed information about the cookies we use, the purposes for which we use them, and how you can manage your preferences, please refer to our Cookie Policy.

  11. Children’s Privacy

    Our Services are not directed to children, and we do not knowingly collect personal data from children below the age of majority applicable in their jurisdiction, or from users who are not legally permitted to use the Services.

    If we learn that we have collected personal data from a child in circumstances where parental consent or another lawful basis is required, we will take appropriate steps to delete such data or, where applicable, obtain the necessary consent from a parent or legal guardian, in accordance with applicable law.

    If you believe that a child has provided us with personal data, please contact us at privacy@duelport.com so that we can review and take appropriate action.

  12. Changes to This Privacy Policy

    We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other operational or business needs.

    When we update this Privacy Policy, we will revise the “Last Updated” date at the top of the Policy.

    Where required by applicable law, we will also provide additional notice of material changes.

    We encourage you to review this Privacy Policy periodically to stay informed about how we process personal data.

  13. Contact Us

    If you have any questions, requests, or concerns regarding this Privacy Policy or our processing of personal data, you may contact us at:

    Legal name:Duelport Entertainment B.V.

    Company address:10 Koгpoгaalweg, Willemstad, Curaçao

    Company number:146580

    Contact email:privacy@duelport.com