Privacy information
How personal data is processed on luborek.com (GDPR / RODO). Updated 7 October 2026.
Who controls the data
The controller is Lubor Kulich, a private individual based in Poland. Contact for questions and data rights: info@luborek.com. A Slovak company pays for hosting and the domain but, under the operating arrangement, has no access to visitor data.
Account and Arena
Google sign-in provides an account identifier and verified email; it may also provide a name and profile image URL. Arena stores your gaming nickname, age band, profile choices, entries and results. Account management, participation and requested features are processed to provide the service (GDPR Article 6(1)(b)); optional publication of profile details and optional notifications rely on consent (Article 6(1)(a)). Required fields are needed for the corresponding feature; without them that feature cannot be provided.
Email sign-in
Alternatively, use a verified email and password. Passwords are stored only as one-way hashes. Registration links last 24 hours; reset and password setup links last 1 hour. They are single-use, with only the token hash in the token table. Expired requests are removed by cron. The controller receives a one-time email notice of account creation. Password reset invalidates older sign-ins. Passwords are never emailed.
What others can see
Players aged 16 or over can have a public gaming nickname, avatar, biography, gaming preferences, results and player card. Discord is optional and appears publicly only when its visibility is enabled. Account and parent emails are not public. Other people can copy or share public information. Do not put your address, phone number or sensitive information in your nickname, bio or messages.
Players younger than 16
Google sign-in starts an incomplete account. Before confirming registration, we will contact the parent or legal guardian at the email address provided. The parent receives information and a consent request; after confirmation the organiser reviews and manually approves the request. Clicking an email link alone does not prove parental responsibility. The minimum information needed to handle the request is processed for the legitimate interest of safe registration (Article 6(1)(f)); the described subsequent processing of the younger player is based on parental consent (Article 6(1)(a) and Article 8). Younger players have no public profile, personal photo, bio or Discord contact. After approval their gaming nickname, preset avatar and results may be public, as explained in the consent request. Parents can withdraw approval or delete the account using their private link. The newsletter is available only to people aged 16 or over and requires a separate age declaration. Private chat for younger players requires sign-in to an approved Arena account and separate parental consent, which can be granted or withdrawn through the parent link. Messages and nickname are visible to Luborek; new messages may also be forwarded to his mailbox. The player receives no email alerts. Deleting the Arena account deletes its website chat; already delivered email copies are handled separately. An age declaration does not verify identity.
Messages, playing together and newsletters
For contact and private chat I process the supplied name or nickname, message and optional email to reply and continue the conversation (legitimate interest, Article 6(1)(f); Article 6(1)(b) for service requests). Details submitted for community gaming sessions are used to organise participation. Optional email notifications and newsletters require separate email confirmation and consent (Article 6(1)(a)). Every newsletter has an unsubscribe link. I may manually group subscribers, for example normal, TOP or GOLD, for relevant community updates; this is not automated decision-making with legal effects. Arena registration does not subscribe anyone to the newsletter.
Measurement and security
With permission for website statistics we measure page and article views, clicked links, sections, dates and approximate country. Private messages and form contents are not recorded in these statistics. The online counter uses a random identifier; country lookup may send your IP to IPWhois. Google Analytics has a separate choice and processes technical data, identifiers and website usage. Optional measurement relies on consent (Article 6(1)(a)), which can be refused or withdrawn in Cookie settings. Optional measurement is unavailable to visitors who do not declare that they are at least 16. Technical security records and spam prevention protect the site based on legitimate interest (Article 6(1)(f)), independently of analytics consent.
Who receives data
Websupport provides hosting and email and processes necessary information for servers, backups and mail delivery. Google provides sign-in, remote fonts and, depending on your choices, analytics or YouTube playback. Fonts load when an ordinary page is displayed; Google receives technical information including IP for this request, which does not enable Google Analytics. IPWhois receives an IP only when website statistics are allowed and country lookup is needed. Links to YouTube, Discord, Twitch and Fortnite lead to separate services governed by their own policies. I do not sell your data. Information is provided to authorised authorities only to the extent required by law.
International services
Google and IPWhois may process information outside the EEA. These transfers require safeguards under GDPR Chapter V, such as an applicable adequacy decision or standard contractual clauses; ordinary cookie consent does not replace them. You may request information about the applicable safeguards and a copy by emailing info@luborek.com. Provider policies are linked below.
How long data remains
An Arena account and associated results remain during use until account deletion. A parent confirmation link lasts 7 days; unconfirmed parent requests and their queued emails are removed by cron after 30 days, while the incomplete private player account remains until deletion. Confirmations and review notes remain until account deletion. Consent can be withdrawn without deleting the account; participation then stops.
Other records
Messages, contact emails and organisational records are kept during communication and afterwards only while needed for related requests or specific legal claims. Removal is manual rather than automatic after a fixed number of days. Newsletter membership lasts until unsubscribe; a minimal unsubscribe record may remain to prevent further sending and document consent. The mail queue retains delivery status and recipient; message content is reduced after processing. Aggregate page and click counts support comparisons across periods without message contents. Short-lived online records are regularly pruned; online activity means the last 90 seconds. Storage lifetimes are listed on the cookies page. Google retention, email archives, server logs and backups also depend on provider settings; contact the controller for specific information. Withdrawing cookies does not retroactively delete already stored data.
Your rights
You may request access, a copy, correction, erasure, restriction and, where applicable, portability. You may object to processing based on legitimate interest. You may withdraw consent at any time without affecting the lawfulness of earlier processing. Email info@luborek.com; where necessary I will proportionately verify the requester’s authority. I normally respond within one month; complex requests may require a lawful extension, of which you will be informed. You may complain to the Polish supervisory authority UODO or the competent authority in your country of residence.
Demo shop
The shop is a demonstration. It accepts no orders or payments and submission of order details is blocked. The cart and currency selector are for exploring the demo only.
Private messages between players aged 16+
Arena supports text messages between registered players who declare an age band of 16+. We store message content, sender and conversation participants, timestamps, read status, blocks and reports. The operator can review active and historical conversations and reports in Studio for moderation; this is not end-to-end encrypted messaging. Messages and reports remain while participant accounts exist. Deleting either participant account removes the whole conversation including messages and related reports. Optional email alerts are off by default, contain no message text and can be disabled in Messages. Parental consent for younger players to chat with the operator does not grant access to these player-to-player messages.
Community sessions and the public roster
New Today we play registrations are linked to an Arena account. I store registration or waiting-list order, public-list preference, reminder choice and language. The public count includes players whose names are hidden. A player aged 16+ appears by nickname and avatar only after voluntarily opting in for that event; they may turn this off at any time. Younger players require parental approval and remain anonymous in this roster. The organiser sees Epic nicknames to arrange the session. Registration confirmations and waiting-list promotions are service emails about the requested participation; reminders are optional. For younger players these emails go to the approved parent. They do not subscribe anyone to the newsletter. Cancelled entries remain in organisational history; deleting the account also deletes these registrations.
Websupport · Google · IPWhois · UODO