BGC Arena Privacy Policy
Version PP-2026-11-04-manual-r5 — effective when published on bgcarena.com. This notice describes the current service and its data processing. Historical r3 notices and actual consent records remain preserved.
1. Who is responsible and what this policy covers
Ventablack Technologies EOOD (ВЕНТАБЛЕК ТЕХНОЛОДЖИС ЕООД) is the controller of personal data processed for BGC Arena. Our Bulgarian company registration number (EIK) is 208945415 and our registered address is 66 Pirin Street, Sandanski, Bulgaria. Website: bgcarena.com. Privacy and support contact: admin@bgcarena.com.
The company director oversees privacy requests. This operational responsibility is not a formal Data Protection Officer appointment. This policy explains our processing; reading or accepting it does not give blanket consent.
Current service status: free gameplay and account services are operating. The manual identity-review service is available when the authenticated VERIFY IDENTITY page allows submission. Payments, ticket purchases, paid tournament participation and prize payouts are not active. Completing document review does not enable payments or guarantee a tournament place. New biometric V5 sessions are not part of this manual service.
2. Information we process
Accounts and authentication. Email address, username, unique Player ID, registration date, salted password hash, email-verification status, login sessions, expiry and revocation information, verification links and verification-email delivery records. We process your password to authenticate you; we do not store it as plaintext.
Gameplay and tournaments. Player and match identifiers, participants, matchmaking category, bracket, entries, authoritative outcomes and completion times. During gameplay we process inputs, positions, health, abilities and reconnect information. We do not retain a full replay of every action. Historical tournament records, where present, may include ticket reservations and consumption, cancellation reasons, replacement-ticket links and result/audit events. A match record relates to its participants. Other players may see your in-game username, participation and results; they are not given your email, credentials or private verification records through the game.
Technical information. Network addresses, connection identifiers and diagnostic/request events needed to operate and protect the service. Hosting providers also process connection and request information. We do not create a dedicated device-fingerprint profile or a complete historical record of every successful login.
Support and privacy requests. Sender address, messages, replies, necessary account/case references, attachments you supply and records of how requests are handled. Do not email passwords, session tokens, authenticator secrets or codes, identity documents, selfies or detailed screening reports.
Manual document review. You submit the front and back of your Danish municipal identity card (Legitimationskort) to Didit Document AI. The founder inspects the card details, separate date of birth, apparent validity, legibility and available security indicators to assess the specified age 18+ and document admission rules. No passport, driving licence, foreign ID or residence permit is accepted. No selfie, ACTIVE_3D liveness, Face Match or routine AML screening is requested in this route. A printed portrait remains part of the card image; this route does not create a face-matching template.
Didit stores the uploaded images and makes them available only through its authenticated Business Console to authorized reviewers. Before photographing your card, physically cover the CPR personal number if printed, while leaving the separate birth date and required review details visible. Do not digitally alter the image. If those details cannot be separated, contact admin@bgcarena.com without sending the document. We do not need or extract a CPR number. If an unnecessary identifier is submitted inadvertently, the founder must arrange deletion and request a minimized resubmission rather than copy or use it. BGC Arena stores authenticated Player ID, provider/session/document references, review status, age-threshold confirmation, document category/country, reviewer/action timestamps, validity deadline and minimal audit/withdrawal records. Its database and privacy ledger do not store document images, full birth dates, CPR numbers, selfies or biometric templates. Raw provider results and images must not be logged or emailed.
Founder administration. The restricted administration system processes the authorized administrator's account ID, authentication/enrollment status, protected authenticator configuration, replay-protection counters, action identifiers and audit events. Password and authenticator verification protect manual identity decisions and sensitive administrative actions. Secrets and one-time codes must not be included in customer audit records.
3. Sources and required information
We receive information from you, from gameplay and service operations, and from our providers. Didit supplies document-processing results based on the information you submit. We send Didit an account-linked reference to associate the results with the correct account.
Account/authentication information is needed for authenticated services. Providing verification information is not a condition of free play. Section 4 describes the manual document-review requirements.
4. Manual Danish ID review, age and eligibility
BGC Arena is intended for adults aged 18 or over. Email verification confirms control of an email address, not identity or age; we do not describe every registered account as a verified adult.
The current route requires a valid Danish municipal identity card (Legitimationskort) and founder confirmation of age 18 or over. Didit Document AI provides collection and document-reading/tampering signals; it does not establish conclusive authenticity, ownership, Danish citizenship or residence. A provider Approved result creates PENDING_REVIEW, never automatic BGC Arena approval. The founder may approve, reject or request resubmission through password- and authenticator-protected administration.
Server-side eligibility requires verified email, a current founder APPROVED manual decision, the required document/age checks, and no withdrawal, expiry, revocation, account-closure or other restriction. Pending or rejected submissions and historical V4/V5 labels alone do not provide manual admission. Existing historical verification and consent evidence is retained under its original meaning, not silently converted to a manual approval.
The manual route has no additional verification fee and does not require biometric verification. Founder approval is limited to the stated manual admission assessment; it must not be presented as an equivalent technical assurance of face ownership. Previous V4/V5 records remain historical records. Contact admin@bgcarena.com if you believe a child has supplied personal information.
5. Purposes and legal bases
Service contract — GDPR Article 6(1)(b). Necessary account and gameplay processing provides registration, email verification, matchmaking and results.
Legitimate interests — Article 6(1)(f). Necessary security, abuse prevention, reliability diagnostics and handling non-contractual enquiries protect the service and its users. Relevant records may also be needed to establish, exercise or defend claims. We assess necessity and balance these interests against your rights; this is not permission for indefinite or unrelated processing.
Legal obligations - Article 6(1)(c). Where a specific legal obligation applies, we process the information necessary to meet it, including handling applicable data-protection rights. A legal duty is not a general reason to collect or keep unrelated information.
Manual review — Article 6(1)(f), legitimate interests. The purposes are enforcing the stated adult/document admission rules and limiting misuse of tournament accounts. We have documented the purpose, necessity, alternatives, impacts and safeguards for this limited manual route. Self-declared age or email verification alone cannot support the intended document inspection; biometrics and routine AML are excluded as more intrusive checks not needed for this route. Free play does not require document submission. You may object and request human reconsideration through admin@bgcarena.com. We do not rely on reading this notice as consent, or claim a statutory AML obligation. CPR numbers are not required and must be covered before capture. If the intended purpose changes or the safeguards cannot be maintained, collection must stop and the assessment be reviewed.
Historical biometric records. Earlier V4/V5 decisions and separately recorded biometric consents remain governed by their actual versions and purposes. Their withdrawal and deletion protections continue. This manual notice neither obtains fresh biometric consent nor authorizes a new biometric or AML session.
We do not currently use advertising or audience-analytics integrations. Any future processing requiring consent needs a separate appropriate choice before it starts.
6. Current service and audit records
BGC Arena currently does not accept payments, sell tournament tickets or process prize payouts. Any future payment service requires an updated notice describing its actual providers and data processing before it is introduced.
Minimal account, gameplay, administrative and privacy audit records support security and handling requests. They are retained only while necessary for their stated purposes, applicable obligations or documented claims. Unnecessary records are subject to deletion or de-identification.
Audit records support security and accountability. Immutability is a security control, not an exemption from retention limits or data-subject rights. Corrections use recorded adjustments where necessary rather than silent rewriting.
7. Recipients and international processing
Render hosts the application and PostgreSQL databases in Frankfurt, Germany. A separate database holds minimal withdrawal/deletion protections. EU hosting does not mean every provider operation, support activity or recovery copy stays exclusively in the EEA. Render publishes a DPA and identifies EU–US Data Privacy Framework certification.
Didit provides hosted document collection, Document AI processing and a protected review console on our instructions. Its Business Terms identify Didit Identity Spain, S.L. as the EEA contracting provider and include a DPA. Didit describes separate controller purposes for limited security, abuse prevention, legal compliance and audit activities. Its notice describes default verification processing in Ireland and international-transfer safeguards, including adequacy decisions or Standard Contractual Clauses where applicable. See the Business Terms/DPA and Verification Privacy Notice. Our settings and processing instructions must match this notice before collection is enabled.
Resend delivers account emails and founder notifications. Founder notifications to admin@bgcarena.com contain only an account reference, submission time, pending status and an authenticated review link; they contain no document attachment, CPR number or birth date. Resend receives recipients and message content. Its published arrangements describe US storage, contractual transfer safeguards and Data Privacy Framework participation; an EU sending region is not a promise of EU-only storage.
Cloudflare Email Routing and Google Gmail deliver/store correspondence sent to admin@bgcarena.com. Messages are forwarded to a consumer Gmail inbox managed by the director. This is not a Google Workspace mailbox covered by a Workspace processor agreement. Google's consumer terms/privacy arrangements apply and processing can be international. Cloudflare's DPA includes contractual safeguards for restricted transfers. We limit this channel to necessary support/privacy correspondence; documents, selfies, raw verification results and detailed AML findings must not be emailed. Underlying KYC review/deletion is handled through restricted BGC Arena and provider procedures, not by collecting identity evidence in Gmail.
Advisers and authorities. Authorized advisers may receive limited existing records where necessary for an applicable obligation or documented claim. Competent authorities or courts may receive relevant information where required. Authorized personnel and providers receive access only for their responsibilities. Private account and audit records are not shared with other players.
Ask admin@bgcarena.com for relevant provider details and available transfer safeguards. Using this service does not waive international-transfer protections.
8. Cookies and browser storage
__Host-bgc_session: necessary authentication cookie, configured for 24 hours, with Secure, HttpOnly and SameSite protections. Logout clears/revokes the session. Blocking it prevents authenticated features.bgc-reconnect:<WebSocket URL>in sessionStorage: supports interrupted-match recovery. Application cleanup and browser-session behavior govern local lifetime; restored browser storage cannot extend the server's reconnect permission.bgc-audio-enabledin localStorage: saves your Sound On/Off choice across visits. It contains a preference, not payment or identity-verification data, and remains until replaced or browser/site storage is cleared. Clearing it resets the preference.bgc_dev_access: a session cookie for restricted development access where applicable; it is not required for the normal public menu. Browser session restoration can affect its local lifetime.
The application does not use advertising cookies or audience-analytics integrations. Additional non-essential storage will be assessed and, where required, used only with consent. Didit's hosted verification flow has its own provider notice for the information and technologies it uses.
9. Retention
We keep information only as necessary for its purpose and applicable duties/claims, and assess valid earlier erasure requests. A technical cleanup interval is not permission to delay a justified erasure.
Operating account cleanup. Login sessions expire after 24 hours; scheduled hourly cleanup removes expired/revoked records when it runs successfully. Email-verification links expire after 24 hours, but expiry alone does not delete their underlying records. Live gameplay/reconnect state is temporary; terminal recovery state normally remains for up to 60 seconds. Displaying the last 20 matches is not a storage limit.
Existing proposed retention schedule. The previously described targets remain subject to implementation and justified exceptions: active accounts until valid closure; unverified registrations 30 days; inactive accounts after 24 months plus 30 days' notice; used/expired email-verification records within a further 24 hours; non-monetary match history 90 days; resolved support correspondence 12 months; minimal completed privacy-request evidence 12 months. These are proposed operating targets, not statutory periods or a claim that scheduled deletion already runs. Account, match-history and old verification-record automatic cleanup is not fully operational. Requests are handled manually where necessary; unnecessary attachments should be removed sooner. Existing records needed for an applicable obligation or documented claim are assessed separately from the non-monetary match target.
Where a specific obligation or documented claim requires limited records to be kept longer, we assess the information and explain the reason and retention criteria. A preservation hold must be limited in scope and reviewed; it does not authorize indefinite retention or keeping unrelated identity information.
Manual document retention. The operational limit for manual session documents is 30 days from collection; rejected, incomplete and abandoned submissions are included. The founder reviews the pending queue daily and must complete review before images expire. The provider retention setting and restricted deletion procedure must be in place before real submissions are enabled. Earlier valid erasure requests are handled without waiting for this limit. A specific lawful preservation exception requires a recorded reason, restricted access and finite review deadline; it is not a default indefinite hold. Provider deletion is recorded as completed only after confirmation. Organization verification-data model training is opted out and must remain off. Historical biometric session/template records retain their separate deletion protections and are not extended by this manual policy.
Local manual decisions and historical KYC. A manual approval expires no later than the card and at most one year. Minimal decision/audit records are reviewed for deletion or de-identification when their admission purpose ends; any dispute or other retention exception must have a recorded basis and finite deadline. The privacy queue is an operator workflow, not a claim of automatic provider erasure. The existing historical KYC process uses a 90-day period after the relevant withdrawal/closure end event for eligible technical records, and 12 months after completion for minimal privacy-case evidence, subject to justified earlier erasure and documented finite holds. Unresolved requests are not marked completed to trigger deletion.
A minimal withdrawal marker remains while needed to prevent delayed webhooks or restored data from reversing withdrawal. The independent ledger contains account/replay identifiers and withdrawal time, not documents or biometrics. Retirement after closure requires review of the relevant retention periods, completed privacy handling and restore checkpoints. Restores must replay withdrawal/deletion protections before verification eligibility can resume. Inconsistency or unavailable ledger verification blocks KYC eligibility; it does not establish permission to reactivate it.
Provider logs, emails and backups. Exact routine provider-log retention and account-specific exceptions are not fully confirmed. Resend's published standard describes 30-day email/delivery retention; this does not determine Gmail correspondence retention. The currently observed Render PITR window is seven days, and generated logical exports have separate retention; downloaded/exported copies do not disappear because PITR expires. Deleting an application record does not selectively erase every older backup. Recovery copies are restricted, separately retained exports must be reviewed, and restored deletions reapplied. We do not promise physical erasure from inaccessible provider copies without evidence.
10. Withdrawal, account closure and privacy requests
Contact admin@bgcarena.com, preferably from your registered address, and identify your account and request. Use an authenticated withdrawal/deletion function where available. We may seek proportionate identity confirmation but will not ask for your password or authenticator code by email.
Withdrawal stops KYC eligibility and starts review; it is not proof of immediate Didit erasure. Account closure, local removal and provider deletion are distinct operations. Logout alone does not delete an account. We preserve legitimate opponents' results while removing unnecessary identifying links where possible; changing a username alone is not anonymization.
Any actual outstanding obligation or unresolved request must be resolved or preserved as necessary, not erased to force account closure. Limited historical evidence may remain restricted under an applicable duty or documented claim. This does not justify retaining unrelated identity information. We explain what remains, why, the relevant period or criteria, and provider or backup limitations. A technical closure restriction does not remove your right to request erasure or receive a reasoned response.
We respond without undue delay and normally within one month. Where permitted because of complexity or request volume, an extension of up to two additional months requires reasons within the first month. Requests are normally free; any lawful fee or refusal will be explained with complaint rights. Our existing operational targets are daily review of verification-related requests, acknowledgement within two working days and completion within seven calendar days where feasible. These targets do not replace statutory deadlines or justify postponing erasure. European Commission guidance on rights requests.
11. Security and automated checks
We use HTTPS, salted password hashing, protected sessions, server-side authorization, request/connection controls and restricted administrative access. Manual identity decisions require founder authorization, password and authenticator verification. No system guarantees absolute security.
The server decides game results and enforces matchmaking, reconnect/forfeit and security rules. For manual identity review, the founder makes the approval decision. Provider rejection, missing requirements, withdrawal, expiry and inconsistent records block admission; automated signals never substitute for founder approval. The founder must examine both sides and confirm the specified document, age, validity and security checks. A review is not proof of ownership or conclusive authenticity.
These checks can restrict identity eligibility. You may ask for human review, explain your position and challenge an inaccurate result through admin@bgcarena.com. There is no dedicated in-app appeal workflow. Human review does not mean staff may bypass identity/security requirements. Where GDPR protections for solely automated decisions producing legal or similarly significant effects apply, those protections remain available; this policy does not waive them.
12. Your rights and complaints
Subject to applicable conditions, you may request access, correction, erasure, restriction and portability, object to processing based on legitimate interests, and withdraw consent without affecting prior lawful processing. A specific applicable retention obligation may limit erasure of particular records, not your other rights. We will explain applicable exceptions.
You may complain to the Bulgarian Commission for Personal Data Protection, the Danish Data Protection Agency — Datatilsynet, or the competent supervisory authority where you live, work or believe an infringement occurred. You need not contact us first.
13. Changes and contact
We will give appropriate notice of material processing changes. A revised policy does not retroactively change the consent you gave or provide consent for future biometric processing. Earlier consent records retain their actual versions; publication of a new notice does not silently relabel them.
Historic consent records retain their actual policy and consent versions, authenticated Player ID, timestamp and consent-text evidence. This revised manual notice does not relabel old consents or request biometric capture. The current manual flow uses the admission policy danish-municipal-manual-v1 and this published notice.
Privacy and support: admin@bgcarena.com.