Privacy Policy

The data controller is eFantasy.gr Games 'n' Comics Private Company (Ιδιωτική Κεφαλαιουχική Εταιρεία), trading as “eFantasy”, based at 13 Iasonidou Leonidas Street, Thessaloniki, Greece.

For any question about your data, or to exercise your rights, contact us at support@efantasy.gr.

• Account data: your full name, email address and password. Your password is stored only in hashed form by our authentication provider — we cannot read it.
• Profile and play data: the game handle(s) you play under, and your event participation, results, wins and league points.
• Results of people without an account: when event results are published, the handle of every participant is recorded, including participants who have no account on this site.
• Technical data: like most websites, our hosting provider processes your IP address and basic request data (browser, pages requested, time) to deliver the site and keep it secure.

We do not ask for payment details on this site, and we do not use advertising or analytics trackers.

• To create and run your account and let you sign in (performance of a contract — Article 6(1)(b) GDPR).
• To record event results, calculate league standings and show them publicly (our legitimate interest in running a transparent competitive community — Article 6(1)(f) GDPR). Public pages show game handles, not your full name or email.
• To keep the site secure, prevent abuse and fix problems (legitimate interest).
• To answer your requests and comply with the law (legal obligation — Article 6(1)(c) GDPR).

We do not sell your data, and we do not use it for advertising or automated decision-making.

This site uses only the cookies it needs to work:

• Sign-in session cookie (set by our authentication provider, Supabase) — keeps you logged in. It is set only when you sign in and is removed when you sign out or it expires.
• Language cookie (arena_locale) — remembers whether you chose English or Greek. It is stored for up to one year and only set when you use the language switch.
• Our hosting and security provider (Cloudflare) may also set a technical cookie to protect the site against bots and abuse.

These cookies are strictly necessary, or a functional choice you ask for, so we do not show a cookie banner. We do not use advertising, analytics or social-media tracking cookies. If that ever changes, we will ask for your consent first and update this page.

We use a small number of service providers (processors) that handle data on our behalf under data-processing terms:

• Supabase — database, authentication and file storage. Our project is hosted in the European Union.
• Cloudflare — hosting, content delivery and security. Requests may be handled by servers outside the EU/EEA; where personal data is transferred to a country without an EU adequacy decision, this relies on the safeguards the provider offers (such as the EU–US Data Privacy Framework or EU Standard Contractual Clauses).

Account emails (confirmation, password reset) are sent on our behalf by our authentication provider. Handles, event results and league standings are visible to anyone who visits the site. We may disclose data where the law requires it or to protect our legal rights.

• Account data: for as long as your account exists. If you ask us to delete your account, we will remove your name, email and profile.
• Event results and league history: kept as part of the competitive record. If you ask, we will remove your handle from results or replace it with an anonymous label.
• Technical logs kept by our providers: for the short periods they define.

Under the GDPR you have the right to:

• access the data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict how we use your data;
• receive your data in a portable format;
• object to processing based on our legitimate interest;
• withdraw your consent, where processing is based on it.

You can change your name and password yourself on the Account page. For anything else, email support@efantasy.gr. We will reply within one month; the law allows us to extend this by up to two further months for complex requests. We may need to verify your identity first.

You can complain to the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα) — www.dpa.gr, complaints@dpa.gr, tel. +30 210 6475600 — or to the supervisory authority of the country where you live.

Arena is meant for people aged 15 or over. We do not knowingly collect data from younger children; if you believe a child under 15 has created an account, contact us and we will delete it.

Data is sent over encrypted connections (HTTPS), passwords are stored hashed, and access to the admin functions is limited to authorised staff.

We may update this policy. The date at the top shows the latest version; we will announce important changes on the site.