PRIVACY POLICY
How we collect, use, and protect your personal information
Last updated: March 6, 2026 — Version 2.0
Who We Are
The controller is IESF (International Esports Federation), an organization with its registered seat at 615, 6F, Suyeonggangbyeon-daero 140, Haeundae-gu, Busan, Korea (further referred to only as "IESF" or "controller").
Data Protection Officer (DPO):
IESF has appointed a Data Protection Officer responsible for overseeing data protection strategy and compliance. For any questions, concerns, or requests related to the processing of your personal data, you may contact the DPO directly:
Email: [email protected]
Address: Data Protection Officer, IESF, 615, 6F, Suyeonggangbyeon-daero 140, Haeundae-gu, Busan, Korea
Data We Collect
We collect and process the following categories of personal data depending on how you interact with our services:
Account Registration Data
- Full name, email address, and password (hashed)
- Date of birth (to verify age eligibility and enforce age requirements)
- Nationality and country of residence
- Profile picture (optional)
OAuth Provider Data
If you choose to sign in using a third-party OAuth provider, we receive and store the following data from the respective provider:
- Google: Name, email address, profile picture, and Google account ID
- Discord: Username, discriminator, email address, avatar, and Discord user ID
- Twitch: Display name, email address, profile image, and Twitch user ID
We do not receive or store your passwords from OAuth providers. We only request the minimum permissions necessary for authentication.
Technical Data
- IP address, browser type, and user agent string
- Device information and operating system
- Access timestamps and referring URLs
Legal Bases for Processing (GDPR Article 6)
We process your personal data only when we have a valid legal basis under Article 6 of the General Data Protection Regulation (GDPR). The following table outlines the legal basis for each processing activity:
Account Creation and Management
Legal Basis: Article 6(1)(b) — Performance of a contract
Processing is necessary for the performance of the contract between you and IESF when you create an account and use our services.
Competition Registration and Participation
Legal Basis: Article 6(1)(b) — Performance of a contract
Processing your data (name, DOB, nationality, team affiliation) is necessary to register you for and administer esports competitions.
Age Verification and Guardian Consent
Legal Basis: Article 6(1)(c) — Legal obligation
Processing date of birth and guardian details is necessary to comply with legal obligations regarding the protection of minors.
OAuth Authentication (Google, Discord, Twitch)
Legal Basis: Article 6(1)(a) — Consent
You provide explicit consent when authorizing IESF to access your account data from a third-party OAuth provider during sign-in.
Newsletter and Marketing Communications
Legal Basis: Article 6(1)(a) — Consent
We only send marketing communications with your explicit opt-in consent, which you may withdraw at any time.
Security, Fraud Prevention, and Anti-Cheat
Legal Basis: Article 6(1)(f) — Legitimate interest
Processing IP addresses, device data, and behavioral patterns is necessary for our legitimate interest in maintaining platform security and competition integrity.
Analytics and Platform Improvement
Legal Basis: Article 6(1)(f) — Legitimate interest
Aggregated and anonymized usage data is processed for our legitimate interest in understanding how our services are used and improving the user experience.
Data Sharing with Member Federations and Partners
Legal Basis: Article 6(1)(b) — Performance of a contract / Article 6(1)(f) — Legitimate interest
Sharing competition-related data with member federations and tournament partners is necessary for the performance of competition services and our legitimate interest in organizing international esports events.
Competition Data Handling
When you participate in IESF-sanctioned esports competitions, we collect and process additional data specific to the competition context:
- Player Profiles: In-game names, game-specific IDs, team affiliations, and player rankings
- Match Data: Competition results, match statistics, scores, and performance metrics
- Eligibility Data: Passport or national ID information (for nationality verification), date of birth verification, and anti-doping compliance records
- Media Content: Photos, videos, and livestream footage captured during competitions
Competition results and player rankings are considered public information and may be published on the IESF website, shared with media partners, and distributed to member federations. Individual player statistics may also be shared with game publishers for the purpose of anti-cheat enforcement.
Retention: Competition data, including match results and player statistics, is retained indefinitely as part of IESF's historical records. Personal eligibility documents (passport copies, ID scans) are retained for the duration of the competition season plus 2 years, after which they are securely deleted.
Cookies
We use cookies and similar technologies to enhance your experience on our platform. When you visit our login page, we set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.
When you log in, we set cookies to save your authentication session. These cookies are essential for the platform to function and include JWT authentication tokens. Session cookies expire when you log out; persistent login cookies (if "Remember Me" is selected) last for up to two weeks.
For more detailed information about the cookies we use and how to manage your cookie preferences, please see our Cookie Policy.
Embedded Content from Other Websites
Pages on this site may include embedded content (e.g. videos, images, articles, social media feeds). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.
These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.
Who We Share Your Data With
We may share your personal data with the following categories of recipients:
- IESF Member Federations: National esports federations that are members of IESF, for the purpose of organizing and administering national and regional competitions
- Tournament Platform Partners: Third-party platforms used to host IESF-sanctioned competitions
- Anti-Cheat and Integrity Providers: Services that ensure fair play and competition integrity
- Service Providers: Hosting, email, analytics, and other infrastructure providers that process data on our behalf under data processing agreements
- Legal and Regulatory Bodies: Where required by law or to protect IESF's legal rights
Personal data may be transferred to countries outside the European Economic Area (EEA). Where such transfers occur, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission or transfers to countries with an adequacy decision.
How Long We Retain Your Data
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. Specific retention periods include:
- Account data: Retained for the lifetime of your account, plus 2 years after account deletion to comply with legal obligations
- Competition results and rankings: Retained indefinitely as part of IESF's historical sports records
- Identity verification documents: Retained for the competition season plus 2 years, then securely deleted
- Technical logs: Retained for 12 months for security and debugging purposes
- Consent records: Retained for 5 years after consent is withdrawn, as required for compliance documentation
When data is no longer required, it is securely deleted or anonymized so that it can no longer be associated with you.
What Rights You Have Over Your Data
Under the GDPR and applicable data protection laws, you have the following rights regarding your personal data. If you exercise any of the rights below, we will respond to your request within 30 days of its receipt. In justified cases, we may extend this period to 60 days, which we will inform you about.
Right of Access
You have the right to obtain from the controller confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data and the following information: the purposes of the processing; the recipients or categories of recipient to whom the personal data have been disclosed, in particular recipients in third countries; the envisaged period for which the personal data will be stored. The data subject also has the right to obtain a copy of the personal data that are being processed.
Right to Rectification
If you believe IESF is processing incorrect, inaccurate, or outdated personal data about you, you have the right to obtain the rectification of personal data. It is important for us to process accurate personal data about you, so be sure to use this right whenever any of your personal data, which is important to your relationship with us, changes. Based on your corrected or up-to-date information, we will rectify the personal data we process about you.
Right to Erasure ('Right to be Forgotten')
You shall have the right to obtain from the controller the erasure of personal data concerning you where one of the following grounds applies and there are no statutory exclusions:
- The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed
- The data subject withdraws consent on which the processing is based, and where there is no other legal basis for the processing
- The data subject objects to the processing of personal data, processed on the basis of legitimate interest, due to their specific situation and there are no overriding legitimate grounds for the processing
Right to Restriction of Processing
You shall have the right to obtain from the controller restriction of processing where one of the following applies:
- If you contest the accuracy of the personal data being processed, for a period enabling the controller to verify the accuracy
- The processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead
- We no longer need the personal data for the processing, but they are required by you for the establishment, exercise, or defence of legal claims
- You object to the processing of personal data pending the verification of whether the legitimate grounds of the controller override those of the data subject
In these cases, IESF will not delete your personal data but will mark it and restrict its processing for certain purposes.
Right to Data Portability
You shall have the right to receive the personal data concerning you, which you have provided to a controller, and the processing is carried out by automated means in a structured, commonly used, and machine-readable format. You have the right to transmit those data to another controller. If it is technically feasible, we will directly transmit your personal data to another controller.
Right to Object and Automated Individual Decision-Making
You shall have the right to object, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on our interest, including profiling based on those provisions. Where personal data are processed for direct marketing purposes, you shall have the right to object at any time to the processing of personal data concerning you.
You also have the right to object if your personal data is processed automatically, which may result in a decision that has legal effects on you or otherwise affects you significantly.
In the event of an objection to the processing of your personal data that are being processed on a legal basis of IESF's legitimate interest, IESF will assess the situation based on the information provided by you and inform you whether IESF's legitimate interest prevails in a particular situation and the processing will continue or your rights as a data subject prevail and the processing will be stopped.
Right to Withdraw Consent
If your personal data are being processed based on the consent, you are entitled to withdraw this consent at any time. However, withdrawal of consent has no impact on the legality of processing resulting from consent before its withdrawal.
Right to Lodge a Complaint
If you believe that IESF is processing your personal data in violation of the GDPR or applicable data protection laws, you have the right to lodge a complaint with a supervisory authority in the EU/EEA Member State of your habitual residence, place of work, or place of the alleged infringement.
How to Exercise Your Rights
You may exercise any of your data subject rights by contacting our Data Protection Officer at [email protected].
Important: Please state your name, surname, e-mail address, or permanent address in your request. If you do not provide us with this information, your request will not be accepted. We require this additional information to verify your identity and not to disclose your personal information to an unauthorized person.
Data Breach Notification
IESF takes the security of your personal data seriously. In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, IESF will:
- Notify the supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Article 33. The notification will include the nature of the breach, categories and approximate number of individuals affected, likely consequences, and measures taken or proposed to address the breach.
- Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms, as required by GDPR Article 34. The notification will describe the nature of the breach in clear and plain language, provide the DPO's contact details, describe likely consequences, and outline the measures taken to address or mitigate the breach.
- Document all breaches regardless of severity, including the facts of the breach, its effects, and the remedial actions taken. This documentation is maintained to enable the supervisory authority to verify compliance.
Reporting a suspected breach: If you believe your personal data has been compromised or you have identified a security vulnerability on the IESF platform, please contact our Data Protection Officer immediately at [email protected].
Questions About Privacy?
If you have any questions about this Privacy Policy or our data practices, please contact our Data Protection Officer.
Contact DPO