Privacy policy

Data controller

The data collected on this site is processed by XBZ E-SPORT, a non-profit association governed by the French law of 1 July 1901 (RNA W763022514 — SIREN 108 817 677), with registered office at 74 avenue Jean Jaurès, 3e étage, appartement 33, Iléa Verdé, 76140 Petit-Quevilly. For any question about your data, contact us via the official Discord server or by email at support@xbz-esport.com.

Data collected

We collect the information you provide voluntarily, as well as the information the staff enter to present the organisation’s members:

• Recruitment form: category, desired role, full name, age, country of residence, Discord username, username, game, RL Tracker link (optional), experience and motivation (optional), preferred roster (optional).
• Support form: name or username, email address, subject and body of your message.
• Shop orders: items ordered, amount, name, email address and shipping address — and, for a personalised item, the name and number you choose to have printed (if it is another person's name, for example for a gift, make sure you have their agreement) — entered on the Stripe payment page and needed to place and deliver an order. Your card details are handled by Stripe only: they never go through our site and we have no access to them.
• Online withdrawal: full name, email address, order number and details you enter, date and time of your statement, and whether the acknowledgement of receipt was sent.
• Public member profiles: username, name, photo, country, bio, rank, achievements and social-media links, entered by the staff for the players and staff members presented on the site.
• Anti-spam protection: when a form is submitted or a payment is opened, your IP address is briefly recorded to limit repeated attempts. It is never associated with the content of your message and is deleted automatically, at the latest within 24 hours.
• Back-office sign-in: if you click “Sign in with Discord” (or use an email + password account), your Discord ID, username and email address — or your email and an encrypted password — are recorded with our authentication provider (Supabase); for authorised staff, your roles on the server are added.
• Technical logs and error reports: our hosts keep technical logs (IP address, date, page requested, browser), and site errors (error message, page, date) are sent to the staff on Discord. They normally contain only technical information.

The mandatory fields of the forms and the payment page are needed to process your request or order: without them it cannot go through. No sensitive data is requested. We use neither advertising cookies nor trackers (see the legal notice).

Purposes & legal basis

The data from your recruitment and support forms is used solely to process your application or to answer your support request, and to get back to you about it.

The legal basis for processing is your consent (GDPR article 6.1.a), collected via the checkbox on each form. That consent is timestamped when you submit.

The anti-spam protection described above relies instead on our legitimate interest (GDPR article 6.1.f) in protecting the site from automated submissions.

Order data is used to prepare, ship and follow up on your order (customer service, returns, withdrawal, warranties). Processing it is necessary to perform the sales contract (GDPR article 6.1.b), then to meet our legal obligations — accounting and consumer protection, including the acknowledgement of receipt of a withdrawal (article 6.1.c).

Back-office access relies on our legitimate interest (GDPR article 6.1.f) in reserving the administration area for authorised members only and in securing the data it holds.

The public profiles of players and staff present the organisation on the site. They are published with the member’s agreement (consent, GDPR article 6.1.a, and image-rights authorisation), which they may withdraw at any time by contacting us: the profile and photo are then removed from the site. For a minor, the authorisation of their legal guardians is requested.

To run and secure the site and measure its traffic, we use technical logs, error reports and cookieless audience measurement. These rely on our legitimate interest (GDPR article 6.1.f); you may object by contacting us (see “Your rights”).

Retention period

The data from your recruitment and support forms is kept for 24 months from the date you send it in our database, then deleted automatically. The copy of the form sent to the staff on Discord is deleted by the staff within the same period. You can request deletion at any time before that (see “Your rights”).

Orders are the exception: they are accounting records, kept for 10 years as required by law, then deleted or anonymised.

Withdrawal statements are kept for 5 years (the limitation period for actions between a consumer and a seller), then deleted; the order concerned is still kept for 10 years.

Staff sign-in data is kept for as long as the person holds a role that requires access, then deleted; the account of a person refused at sign-in is deleted straight away. Members’ public profiles are kept for as long as the person belongs to the organisation, then removed when they leave or on request.

Recipients & hosting

The data from your forms is accessible only to the XBZ Esport staff authorised to handle applications and support; members’ public profiles, on the other hand, are visible to everyone. Your data is never sold or transferred to third parties for commercial purposes.

To operate, the website relies on the following technical providers:

• Supabase — hosting of the database where applications, messages, orders, member profiles and sign-in accounts are stored (Paris region, France).
• Vercel — website hosting, technical logs and cookieless audience measurement (aggregated visit statistics).
• Render — hosting of the organisation’s Discord bot, which relays received forms and internal notifications to the staff (Frankfurt region, Germany).
• Brevo (a French company) — sending by email the confirmation of your order (your name, email address, the items ordered, including any name and number to be printed, and the amounts) and the acknowledgement of receipt of your withdrawal (your name, email address and the content of your statement); this data passes through it; its servers are located in the European Union.
• Stripe — secure payment of shop orders (Stripe Payments Europe, Ltd, Ireland; its US parent, Stripe, Inc., may have access to some data). Stripe also acts as a controller for its own obligations (fraud prevention): see stripe.com/privacy.
• Discord — when a form is received, the full copy of your application or message (including your email address for support) is posted by our bot in a staff channel; technical error reports are also sent there.

Transfers outside the European Union

Vercel (site hosting), Render (Discord bot hosting) and Discord (internal notifications) are US companies, and Stripe (payment) is a US company whose Irish subsidiary, Stripe Payments Europe, Ltd, processes payments for customers in the European Economic Area: the data these providers process, including by Stripe’s parent company (Stripe, Inc.), may therefore be transferred to the United States. These transfers rely on the European Commission’s adequacy decision for companies certified under the EU–US Data Privacy Framework and, failing that, on the Commission’s standard contractual clauses, included in these providers’ data processing terms. You can obtain a copy by contacting us (see “Your rights”).

The database is hosted in Paris by Supabase (Supabase Inc., a US company); any access from outside the European Union is covered by Supabase’s standard contractual clauses.

Your rights

Under the GDPR, you have the right to access, rectify, erase, restrict and object to processing, the right to data portability, and the right to withdraw your consent at any time.

To exercise these rights, contact us via the official Discord server or at support@xbz-esport.com. We will reply within one month, extendable by two months for a complex request (you would be informed). If there is reasonable doubt about your identity, we may ask for proof of identity.

You may also set directives on the retention, deletion and disclosure of your data after your death.

You may also lodge a complaint with the CNIL, the French data protection authority — cnil.fr.