Privacy Policy
Last updated: 10/28/2026
Article 1 - Data Controller
The data controller responsible for the collection and processing of personal data in connection with the use of the UpFrag.gg Platform is:
- Company name: 411BIT
- Registered office: 411BIT
- Data controller contact: [email protected]
- Data Protection Officer (DPO): Ezzedine REZGANI - [email protected]
This policy is drawn up in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (hereinafter the "GDPR") and French Law No. 78-17 of 6 January 1978 on Information Technology, Data Files and Civil Liberties, as amended (hereinafter the "French Data Protection Act").
Article 2 - Data Collected
In connection with registration, use of the Platform and the completion of transactions, the following categories of personal data are collected:
| Category | Data collected | Primary purpose |
|---|---|---|
| Steam identity | Steam ID, username, avatar | Authentication, matchmaking |
| Contact | Email address | Verification, communication, support; with the User's consent: UpFrag announcements |
| Phone | Mobile phone number | Verification by SMS or WhatsApp, anti-smurf mechanism; with the User's consent: reminders of their tournaments and UpFrag announcements on WhatsApp |
| Technical data | IP address, user agent, connection data | Security, anti-cheat, abuse prevention |
| Game data | Match history, ELO score, in-game statistics | Matchmaking, ranking, service improvement |
| Transaction data | Purchase history, Stripe payment identifiers | Order processing, accounting, support |
Article 3 - Purposes and Legal Bases for Processing
Personal data is processed for the following purposes, on the corresponding legal bases:
(a) Performance of the contract (Article 6(1)(b) GDPR): creation and management of the User account, provision of the matchmaking service, processing of transactions, delivery of digital products, management of the ELO ranking.
(b) Legitimate interest of the data controller (Article 6(1)(f) GDPR): Platform security, combating cheating and fraud, prevention of multiple accounts (anti-smurf), community moderation, improvement and optimisation of the Platform.
(c) User consent (Article 6(1)(a) GDPR): placement of analytical cookies, sending of marketing communications and newsletters, sending of tournament reminders and UpFrag announcements on WhatsApp, participation in satisfaction surveys. This consent (announcements by email, announcements and reminders on WhatsApp) is collected through a single box, unticked by default, at registration or in the onboarding. Each channel can then be withdrawn separately and at any time from the account settings, through the unsubscribe link in emails or by replying STOP to a WhatsApp message. The reward offered in the onboarding, granted for all of these consents, is kept if they are withdrawn afterwards.
(d) Legal obligation (Article 6(1)(c) GDPR): retention of billing data in accordance with accounting and tax obligations, response to judicial requisitions.
Anti-cheat: automated checks and external indicators
To fight cheating and the circumvention of sanctions, the Platform automatically analyses match demos and may consult public sources using the User's public Steam ID: Steam (account age, VAC and game bans, including those of friend accounts), FACEIT and Leetify. Only the public Steam ID is sent to these services to query them. If the User links a Discord account, the Platform checks, at the time of linking, the list of Steam accounts connected to that Discord account to verify that none of them is sanctioned for cheating. Only the outcome of this check is kept, for 30 days; the list of accounts is not stored. These indicators never form the sole basis of a sanction: they direct a review by the team. Legal basis: legitimate interest (Article 6.1.f GDPR).
Article 4 - Data Recipients
The personal data collected may be communicated to the following categories of recipients, strictly to the extent necessary for the identified purposes:
(a) Authorised members of the publisher's team, responsible for administration, support, moderation and technical operations.
(b) The payment service provider Stripe, Inc. (processor within the meaning of the GDPR), for transaction processing.
(c) The hosting provider OVHcloud (processor), for storage and technical infrastructure.
(d) Cloudflare, Inc. (processor), for CDN and security services.
(e) Twilio Inc. (processor), for sending verification codes and messages by SMS and WhatsApp.
(f) Brevo (Sendinblue SAS) (processor), for sending SMS.
(g) Meta Platforms Ireland Ltd. (processor), for delivering WhatsApp messages.
(h) The competent judicial or administrative authorities, where required by law.
No personal data is sold, rented or disclosed for commercial purposes to third parties.
Article 5 - Data Transfers Outside the European Economic Area
Certain processors (in particular Stripe, Cloudflare and Twilio) are established in the United States of America. Data transfers to the United States are governed by the EU-U.S. Data Privacy Framework (DPF), Standard Contractual Clauses (SCCs) adopted by the European Commission and/or any other appropriate safeguard in accordance with Articles 46 et seq. of the GDPR.
For Users residing in North Africa, transfers are carried out in compliance with applicable local data protection regulations and, where appropriate, on the basis of the User's consent.
Article 6 - Data Retention Period
Personal data is retained in accordance with the principles of data minimisation and storage limitation:
(a) Account data (identity, contact, phone): for the entire duration of the account's existence, then deleted within thirty (30) days following the request for account deletion.
(b) Game data (match history, statistics, ELO): for the duration of the account's existence. Following account deletion, this data is anonymised and may be retained for up to three (3) years for the purposes of ranking system integrity and anti-cheat enforcement.
(c) Transaction data: retained for the statutory retention period for accounting records, namely ten (10) years from the date of the transaction, in accordance with Articles L.123-22 of the French Commercial Code and L.102 B of the French Tax Procedures Code.
(d) Technical data (IP addresses, connection logs): retained for a maximum period of twelve (12) months in accordance with applicable legal obligations, unless extended by reason of an ongoing investigation.
(e) Match demos (the recording of the match by our servers: positions, aim, shots and the commands sent by the game to the server): kept for ninety (90) days on our servers; access by Users is limited according to their plan. Demos used to calibrate and verify the Platform's anti-cheat are kept for at most twenty-four (24) months in a restricted area accessible only to the technical team, then deleted. They are neither published nor disclosed to third parties.
Article 7 - Cookies and Trackers
7.1 - Essential Cookies
Cookies strictly necessary for the operation of the Platform (authentication, session management, Cloudflare security) are placed without prior collection of the User's consent, in accordance with Article 82 of the French Data Protection Act and the guidelines of the CNIL (French Data Protection Authority). These cookies cannot be disabled.
7.2 - Analytical and Audience Measurement Cookies
Analytical cookies may be used to measure the Platform's audience and understand Users' browsing behaviour. The placement of these cookies is subject to the User's prior consent, collected via the cookie management banner displayed upon the first visit. The User may modify their preferences at any time via the cookie manager accessible in the Platform settings.
7.3 - Absence of Advertising Cookies
The Platform does not use advertising cookies or trackers for targeting or advertising profiling purposes.
Article 8 - Rights of Data Subjects
In accordance with Articles 15 to 22 of the GDPR and Articles 48 et seq. of the French Data Protection Act, the User has the following rights regarding their personal data:
(a) Right of access (Article 15 GDPR): to obtain confirmation that data concerning them is being processed and to receive a copy thereof.
(b) Right to rectification (Article 16 GDPR): to obtain the correction of inaccurate or incomplete data.
(c) Right to erasure (Article 17 GDPR): to obtain the deletion of their data in the cases provided for by law.
(d) Right to restriction of processing (Article 18 GDPR): to obtain the restriction of processing in certain circumstances.
(e) Right to data portability (Article 20 GDPR): to receive their data in a structured, commonly used and machine-readable format.
(f) Right to object (Article 21 GDPR): to object to the processing of their data based on legitimate interest.
(g) Right to withdraw consent at any time for processing based on consent, without affecting the lawfulness of processing carried out prior to such withdrawal.
(h) Right to define directives regarding the fate of their data after death (Article 85 of the French Data Protection Act).
To exercise any of these rights, the User shall send their request to: [email protected] or [email protected]. The publisher undertakes to respond within a maximum period of one (1) month from receipt of the request, extendable by two (2) additional months in the event of complexity, in accordance with Article 12(3) of the GDPR.
Temporary automated measures and human intervention
When the automated analysis finds consistent elements, the Platform may, without prior human intervention, freeze the User's winnings and suspend their tournament and ranked registrations for no more than 7 days, pending a review by the team. The User is informed. No permanent ban is issued without human review. In accordance with Article 22 GDPR, the User may submit observations by ticket, obtain human intervention and contest the decision; if the review confirms nothing, the measure is lifted and the winnings are restored.
Article 9 - Account Deletion
The User may delete their account at any time from their account settings or by sending a request to [email protected]. Account deletion results in the irreversible erasure of the User's personal data, with the exception of:
(a) anonymised match statistics, retained for the integrity of the ranking system;
(b) billing data, retained in compliance with statutory accounting and tax obligations.
The User is informed that account deletion is final and irreversible. All UpCoins and virtual items associated with the account shall be permanently lost.
Article 10 - Data Security
The publisher implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR. These measures include, but are not limited to: encryption of data in transit (TLS/SSL) and at rest, role-based access control, access logging, continuous system monitoring and regular security testing.
Article 11 - Specific Provisions for Minor Users
In accordance with Article 8 of the GDPR and Article 45 of the French Data Protection Act, use of the Platform is restricted to persons aged at least sixteen (16) years. For Users aged 16 to 18, consent to data processing is deemed to have been given or authorised by the holder of parental authority. The publisher reserves the right to request proof of such authorisation.
Article 12 - Specific Provisions for North African Users
Users residing in a North African country (in particular Morocco, Tunisia, Algeria) benefit, in addition to the rights provided for by the GDPR, from the rights recognised by applicable local data protection legislation - in particular Law No. 09-08 in Morocco, Organic Law No. 2004-63 in Tunisia, Law No. 18-07 in Algeria. In the event of a discrepancy between the GDPR and local legislation, the provision most protective of the User shall apply.
Article 13 - Complaints to a Supervisory Authority
If the User considers that the processing of their personal data constitutes a violation of the GDPR or applicable legislation, they have the right to lodge a complaint with a competent supervisory authority:
(a) In France: Commission Nationale de l'Informatique et des Libertés (CNIL) - www.cnil.fr
(b) In Morocco: Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP) - www.cndp.ma
(c) In Tunisia: Instance Nationale de Protection des Données Personnelles (INPDP)
(d) In Algeria: Autorité Nationale de Protection des Données à caractère Personnel (ANPDP)
(e) In any other EU Member State: the data protection authority of the User's habitual place of residence.
Article 14 - Amendments to the Privacy Policy
The publisher reserves the right to amend this policy at any time. In the event of a substantial modification, the User shall be informed by email and/or by notification on the Platform at least fifteen (15) days before the changes take effect. Continued use of the Platform after the amendments take effect shall constitute acceptance of the updated policy.