GDPR – your rights over your data

What the GDPR is

The GDPR is the European law on personal data: Regulation (EU) 2016/679, in force since 2018 across the European Union, Romania included.

The idea behind it is simple: your data stays yours. A site that uses it must tell you clearly what it takes, why, for how long and who it passes it on to, and it must let you see it, correct it and delete it.

This page shows how all of that applies to InkNod, briefly and step by step. The full document, with the legal bases and the exact retention periods, is the Privacy policy.

Who is responsible for your data

The party responsible (in legal language, the controller) is the one who decides why and how the data is used. For this site, that is Web Loft SRL, with its registered office at Str. Buzoieni 14, Sector 5, Bucharest, Romania.

You can write to it at [email protected]. The data protection officer answers at [email protected].

What data we collect

Only what the game needs to work. In short:

Account: your player name, your email address and your password (kept only as a cryptographic hash, never in plain text).
Playing without an account: only a name given by the site (“user” and six digits). No email address, no password.
Profile: your photo, if you add one. It is optional.
Play: the tables you sat at, the matches you played, results and rating, table logs and the messages written in rooms.
Notifications: what appears in the bell, which categories you want to receive and, only if you turn them on, your browser’s notification subscription.
Technical: the session, IP address, browser type, server logs.

We do not ask for your real name, date of birth, phone number, postal address or payment details. The site has no payments.

The full list, field by field, is under “What data we collect” in the Privacy policy.

Why we use the data

So you can have an account and log in.
So we know the email address is yours and can reset your password.
So the match can be played and the table can pick up where it left off.
So a match you won still means something tomorrow. That is why the leaderboard and the history exist.
So the site stays secure: so it cannot be broken into through repeated password attempts, and so we can stop someone who spoils the game for others.

We do not use it for advertising, we do not sell it, we do not track you on other sites and we do not profile you. We do not use Google Analytics or anyone else’s statistics service.

We have self-hosted traffic measurement that counts which pages get read, and it does not start until you allow it. What it sends is described in full in the privacy policy.

What the legal basis is

The law requires every use of data to have a legal basis. We have three:

The contract between us (Art. 6(1)(b) GDPR): for your account, profile, the game itself, the leaderboard, the history and bell notifications. We need this data to give you what you asked of the site.
Our legitimate interest (Art. 6(1)(f)): for security and moderation (sessions, IP address, limits on login attempts, logs, suspensions).
Your consent (Art. 6(1)(a)): for three things: traffic measurement, browser notifications and site news by email. They are the only things on the site that stop if you say no, because they are the only things the site does not need in order to work.

We do not ask for your consent for anything else. News by email goes out only if you ticked that you want it (at sign-up, in your profile or in the notice on the site), and you can stop it at any time from your profile. There are no optional cookies: the site’s three cookies are strictly necessary, so they need no consent; two are set from the first visit, and the third only when you log in. See the list.

How long we keep data

As long as you have an account. Delete it and the data goes too. A few exceptions have their own period:

sessions: 7 days after your last activity;
playing without an account: 30 days after your last activity (with one exception, explained in the policy);
password reset token: 60 minutes;
server logs: 14 months.

After your account is deleted, the matches played and the messages written in rooms remain, because they also belong to the other players who sat at the same table. But only your player name remains, as plain text, with no link to your email address or your account. More under “How long we keep data”.

Who we may share data with

With no one for money and with no one for advertising. Data also reaches:

the hosting provider: OVHcloud, whose servers the site runs on;
Cloudflare, whose network carries traffic to the site;
SMTP2GO, which delivers the confirmation email and the password reset email;
your browser’s notification service (Google, Mozilla, Microsoft or Apple, depending on the browser), only if you turned notifications on; their content travels encrypted and the service cannot read it;
the site’s administrators, who see accounts, tables and room conversations and can take moderation action;
a public authority, if we have a legal obligation, and only within its limits.

What is public to any other player (your name, photo, rating, the conversation at a table) is spelled out under “What is public on the site”.

Your rights

In short, you have the right:

to find out and see what data we hold about you, and to get a copy;
to correct it, if it is wrong or incomplete;
to delete it, along with your account;
to ask us to put it on pause, meaning we keep it but stop using it while something is being sorted out;
to object to its use for security and moderation, giving reasons that relate to your situation;
to take it with you: to receive it in a format another program can read (portability);
to withdraw your consent, where processing is based on it;
to file a complaint with the supervisory authority or go to court.

All of these are free. We do not ask for a reason when you make a request.

How to request access to your data

Some of it you can see on your own at any time, without writing to us: your name, email address and photo are in your profile, your ratings too, and the matches you played are in the match archive.

For a full copy of all your data:

Write to us at [email protected], from the address you used for your account. That is how we know it is you. If you played without an account, tell us the guest name you played under.
Tell us what you want: all your data, or a specific part.
If it is not clear from the email who you are, we may ask for additional proof. We will not ask for a copy of your ID unless there is no other way.
We reply within one month at most. If the request is complicated, we will tell you and the deadline can be extended by two more months.

How to request deletion of your data

You do not need our permission. You delete your account yourself, from your profile, under “Delete account”.

Log in and go to your profile.
Under “Delete account”, enter your current password and your exact player name. There are two keys so it cannot happen by accident and so a stolen session is not enough.
Confirm. The account is deleted on the spot: it does not go into a queue, it does not sit in a trash bin and it cannot be recovered.

If you can no longer log in, write to us at [email protected] and we will handle the request in writing. What remains after deletion (matches and messages, with no link to you) is explained under how long we keep data.

How to withdraw consent

Three things on the site rely on consent: traffic measurement, browser notifications and site news by email. Everything else rests on the contract or on legitimate interest (see the legal basis) and cannot be withdrawn, because without it the site simply does not work.

You can stop news by email from your profile, under “By email”, or from the unsubscribe link in any news email. From that moment nothing more goes out, and the time of your consent is deleted.

For traffic measurement, you make your choice on your first visit, through the banner at the bottom of the page, where “Only what’s necessary” is a button as large as “I agree”. You can change it at any time, with a single click, in the section on measurement. You do not need an account and you do not need to write to us.

Until you say yes, the measurement script does not even load in the page, so there is nothing to stop, because nothing has started. If you withdraw your consent, it stops from the next reload; what was lawfully counted until then stays counted.

Browser notifications can be stopped from your profile, under “Turn off on this device”, or from your browser settings. They stop on that device; on your other devices, turn them off the same way, on each one.

If we ever add anything else that needs consent, we will ask you clearly, through a separate choice that is not ticked in advance, and withdrawing it will be as easy as giving it. You can always write to us at [email protected] as well.

How to file a complaint

Write to us first, at [email protected]. Most of the time that is the fastest way to resolve it.

If you are not happy with the reply, or you would rather not go through us, you can file a complaint directly with the supervisory authority:

AuthorityThe Romanian Data Protection Authority (ANSPDCP)
AddressB-dul G-ral. Gheorghe Magheru 28–30, Sector 1, 010336 Bucharest, Romania
Onlinedataprotection.ro

You also have the right to go to court.

Contact

Data controllerWeb Loft SRL
AddressStr. Buzoieni 14, Sector 5, Bucharest, Romania
Email[email protected]
Data protection[email protected]

The full document is the Privacy policy. The rules for using the site are in the Terms and conditions.