Privacy
What we store when you register, why, for how long — and how to have it deleted.
The German version is the authoritative one.
Controller
Christian Herkner, Schenk-Danzinger-Gasse 4/3/33, 1220 Vienna, Austria
Email: hallo@seestadtspielt.at
An informal email to that address is enough for any data protection question; we answer within one month.
What we store, and why
We collect only what we need to run the tournament:
| Data | Purpose | Legal basis |
|---|---|---|
| Name | participant list, table allocation, prize giving | Art. 6(1)(b) GDPR (performing the participation) |
| Age | checking the minimum age, arrangements for minors | Art. 6(1)(b) GDPR |
| Email address | confirmation, news about this tournament | Art. 6(1)(b) GDPR |
| Nickname (optional) | what we call you at the table | Art. 6(1)(a) GDPR (consent) |
| Name and email address of the parent or guardian (for minors) | recording consent, confirmation, questions | Art. 6(1)(b) and (c) GDPR |
| Free-text notes (optional) | accessibility, arriving late and similar | Art. 6(1)(a) GDPR (consent) |
| Photos of the event | reporting on the tournament | Art. 6(1)(f) GDPR (legitimate interest) |
Optional really is optional: you can take part perfectly well without a nickname and without filling in the notes field. The nickname appears only on the organisers’ internal list — we do not publish it.
We collect no phone numbers — not from parents either. Everything runs through the email address: confirmation, cancellation link and any questions.
We do not ask for health data. The free-text field is meant for organisational notes; please do not put anything sensitive in it that we do not need.
Children’s data
Children are registered by a parent or guardian, who consents at the same time. Children have exactly the same rights as everybody else — access and deletion can be requested at any time by the parent or guardian. We store nothing about children that we do not store about adults.
Who sees the data
- The organising team. Access to the registration list is limited to named, individually authorised email addresses and protected by a sign-in.
- Cloudflare, Inc. (US, with data centres in the EU) as the host of the website and the database. The database is located in the Western Europe region. Processor; the basis is Cloudflare’s data processing agreement including standard contractual clauses.
- Resend (Plus Five Five, Inc., US) for sending the emails (confirmation and cancellation link). Only the recipient address, the participant’s name and the event details are transferred — no age, no nickname, no free-text notes. Processor; the basis is Resend’s data processing agreement including standard contractual clauses for the transfer to the US (Art. 46 GDPR).
Beyond that we pass nothing on — not to sponsors, not to the venue, not to anybody.
Visiting the website
This website uses no cookies, no tracking and no analytics. Technically necessary server logs are created when a page is requested (time, page requested, shortened IP address) and serve the security of operation.
The registration form runs a spam check (Cloudflare Turnstile). It does not build a profile of you.
Cancelling and deleting it yourself
The confirmation email contains a personal cancellation link. Using it deletes the registration completely — no leftover record marked “cancelled”. It is the fastest way to exercise the right to erasure (Art. 17 GDPR), and it does not involve us at all.
If you no longer have that email, enter your address on the cancel page and we send the link again. That page gives no indication of whether an address is registered — the answer is always the same. So nobody can use it to find out who is taking part, and nobody can delete somebody else’s registration: that needs access to the mailbox.
How long we keep it
- Registration data: until four weeks after the tournament at the latest, then deleted.
- Published photos: until you object.
- Anybody who wants earlier deletion gets it — instantly via the cancellation link, or by emailing us.
Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection. Consent given (photos, free-text information) can be withdrawn at any time; this does not affect the lawfulness of processing carried out before the withdrawal.
An informal email to the address in the imprint is enough. We answer within one month.
If you wish to complain, you can contact the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at.
Photos
Photos are taken at the tournament. They may be used to report on the event — on this website, on a notice board at Yella Yella, and in our supporters’ channels. Registering means acknowledging this; registration itself is not conditional on agreeing to photos.
The legal basis is our legitimate interest in reporting on a public neighbourhood event (Art. 6(1)(f) GDPR). Publication is additionally subject to the right to one’s own image (§ 78 Austrian Copyright Act): we publish nothing that puts anybody in a bad light.
Objecting is easy and always possible (Art. 21 GDPR):
A tournament cannot be photographed in a way that reliably leaves individual people out, so we do not promise that. What we do promise: a picture you are not happy with is not used any further and comes off our channels. Tell the tournament management on the day, or email us before or afterwards.
For children, a word from their parents is enough, in advance or on the day. We are careful with photos of children and never publish names with them.
What other guests photograph privately is outside our responsibility.