Privacy Policy

1. Data controller

Joonas Laine — laine.joonas@gmail.com

2. Contact person for the register

Same as the data controller above.

3. Name of the register

Haukkastats user and tournament register.

4. Legal basis and purpose of processing

The legal basis for processing personal data is the performance of a contract (the tournament you register for) and the controller's legitimate interest (running public leaderboards, standings, and tournament seeding).

The purpose of processing is to operate tournaments, publish match results and statistics, and maintain player, team, and organization accounts.

Data is not used for automated decision-making or profiling with legal or similarly significant effects.

5. Data content of the register

• Username and password hash (for accounts created without Steam login)
• Steam ID, if you sign in with Steam
• Your PUBG player ID and public match statistics (kills, damage, and similar telemetry)
• Team and organization names and logos (logos are stored with Cloudflare R2)
• IP address and session data recorded in server logs

Data is kept until you request deletion. Website visitors' IP addresses and the cookies necessary for the service are processed on the basis of legitimate interest, for security purposes. We use only a session cookie required to keep you signed in — no analytics or marketing cookies, so no separate cookie consent is requested.

6. Regular sources of information

Data is collected directly from you via account and tournament registration forms, from KRAFTON's Developer API using the player name/ID you provide, and from Steam's OAuth login if you choose to sign in with Steam.

7. Regular disclosures and data transfers outside the EU/EEA

Tournament results, team names, and public match statistics are published on the site's public pages as part of the tournament you register for. Data is not otherwise regularly disclosed to other parties.

Data may be processed by service providers located outside the EU/EEA, specifically KRAFTON (Developer API), Valve/Steam (OAuth login), and Cloudflare (R2 file storage). Where data is transferred outside the EU/EEA, these providers apply appropriate safeguards such as standard contractual clauses.

8. Principles of register protection

The register is handled with care, and data processed via information systems is protected appropriately. Passwords are stored as hashes, not in plain text. Data stored on servers is protected through appropriate physical and digital security measures, and only the site's administrator has access to it.

9. Right of inspection and right to demand correction of data

Every person in the register has the right to check the data stored about them and to demand correction of incorrect data or completion of incomplete data. Requests should be sent by email to the data controller. The controller may ask you to prove your identity, and will respond within the time specified by the GDPR (generally within one month).

10. Other rights related to processing personal data

Every person in the register has the right to request deletion of their personal data from the register ("right to be forgotten"), as well as other GDPR rights such as restriction of processing in certain situations. Requests should be sent by email to the data controller. The controller may ask you to prove your identity, and will respond within the time specified by the GDPR (generally within one month).