Privacy Policy
What data we process, why, and how you can control it. This Policy takes into account the law of the Kyrgyz Republic, the EU General Data Protection Regulation (GDPR), and Steam and Discord requirements.
1.Who processes your data
The controller of personal data is the CYBERSPORT.KG project, Bishkek, Kyrgyz Republic (“we”, “us”). This Policy covers the cybersport.kg website, the Platform’s game servers, its Telegram and Discord bots and the other Services listed in the Terms of Service.
For any data-related questions, including exercising your rights, write to info@cybersport.kg with the subject “Personal data”.
We process data in accordance with the Law of the Kyrgyz Republic “On Personal Information” and, for users in the European Union and European Economic Area, also in accordance with Regulation (EU) 2016/679 (GDPR).
2.Key points
- We collect only what is needed to run the Platform, ensure fair play and keep it secure.
- We do not sell personal data, do not share it with data brokers or ad networks, and do not use it for targeted advertising.
- We never receive your Steam password or bank card details.
- Data received through Discord and Steam is used only for the features you provided it for.
- We do not use your messages or data obtained through Discord to train artificial intelligence models.
- You can get a copy of your data, correct it or ask us to delete it.
3.What data we process
Steam account data. When you sign in with Steam, we receive your Steam identifier (SteamID) and public profile information: name, avatar and profile link. We do not receive your Steam password.
Profile data. Your nickname and its change history, avatar, and information you choose to provide: email address, name, country and city, date of birth, bio, links to your social media pages and Discord.
Linked accounts. If you link Telegram — your Telegram ID and username. If you have a FACEIT account connected to the same Steam account — public FACEIT information (nickname, level, rating and game statistics). If you link Discord — the data described in the “Discord” section.
Game data. Participation in matches, lobbies and tournaments, results, statistics, ratings and achievements; match recordings (demos) and the replays and clips made from them; in-game chat messages on Platform servers; technical data about connections to game servers, including IP address.
Fair-play protection data. Technical information about your device, software environment and network connection, game session data and information about triggers of protection tools — in modes where their use is mandatory or enabled by you. This data is needed to detect cheats, multi-accounting and ban evasion, and to investigate reports.
Content and community activity. Forum posts, comments, chat messages, listings, reviews, uploaded images, videos and demos, reactions, reports (tickets) and correspondence with support.
Moderation data. Warnings, restrictions, bans, their grounds and the history of report handling.
Payment data. When you pay a tournament entry fee — the amount, purpose, status and payment identifiers, as well as payer information provided by the payment service (for example, the payer’s name and payment account identifier). Bank card data is processed by the payment service; we do not receive it.
Website technical data. IP address, browser and device type, language, requested page URLs, date and time of requests, and cookie data. We also collect website visit and usage statistics using a web analytics service (see “Cookies and similar technologies”).
We do not intentionally collect special categories of data (health, religion, political opinions, etc.). Please do not publish such information about yourself or others.
4.Where we get data from
- from you — when you sign in, fill in your profile, play, write and upload materials;
- automatically — from your browser, game client and the Platform’s game servers;
- from services you link or sign in with: Steam, Telegram, Discord, and from the public FACEIT API;
- from the payment service — about payment status and details;
- from other users — for example, in reports, team rosters or messages.
5.Purposes and legal bases
For users in the EU, the legal bases under Article 6 GDPR are listed below. For other users, processing is carried out on the same bases and, where the law requires consent, on the basis of the consent you give by starting to use the Services.
| Purpose | Data | Legal basis |
|---|---|---|
| Creating and maintaining your account, sign-in | Steam, profile, technical | Performance of a contract (Art. 6(1)(b)) |
| Matchmaking, lobbies, tournaments, ratings, statistics, public profiles | Profile, game | Performance of a contract (Art. 6(1)(b)) |
| Fair-play protection: detecting cheats, multi-accounting and ban evasion, investigating reports | Game, fair-play protection, technical, moderation | Legitimate interest in fair competition and community safety (Art. 6(1)(f)); in modes where protection tools are enabled at your choice — also consent (Art. 6(1)(a)) |
| Forum, chats, comments, content moderation | Content, moderation | Performance of a contract (Art. 6(1)(b)); legitimate interest in safety (Art. 6(1)(f)) |
| Collecting entry fees, refunds, paying prizes, preventing payment fraud | Payment, profile | Performance of a contract (Art. 6(1)(b)); legal obligation to keep records (Art. 6(1)(c)); legitimate interest (Art. 6(1)(f)) |
| Match and tournament notifications in Telegram and Discord | Linked accounts | Performance of a contract (Art. 6(1)(b)) at your request to link |
| Levels, statistics cards, roles, personal voice channels and the event log on Discord servers where the Bot is installed | Discord data | Legitimate interest of the server community in engagement and moderation (Art. 6(1)(f)) |
| Publishing clips and highlights on the Platform’s channels | Game (nickname, avatar, match recording excerpts) | Legitimate interest in promoting the community (Art. 6(1)(f)); you may object — see “Your rights” |
| Security and stability of the Services, attack prevention, server logs | Technical | Legitimate interest (Art. 6(1)(f)) |
| Visit statistics and website improvement | Technical, analytics cookies | Legitimate interest in understanding how the website is used (Art. 6(1)(f)); you may object by blocking analytics cookies |
| Responding to requests, complying with the law, defending rights in disputes | As needed for the request | Legal obligation (Art. 6(1)(c)); legitimate interest (Art. 6(1)(f)) |
We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR. Some measures are applied automatically according to predefined rules (for example, a temporary matchmaking restriction for leaving a match, or refusing a connection to a server where fair-play protection is mandatory). You can request human review of such a measure.
6.What other users can see
Publicly visible: nickname, avatar, Steam profile link, profile details you choose to fill in (including age if a date of birth is set, city and social links), teams and clubs, results, statistics and ratings, match recordings and replays, clips, forum posts and comments, last seen time.
Your email address, IP addresses, payment data, fair-play protection data and the content of reports are not published. You can clear optional profile fields in your settings at any time.
8.Where data is stored and international transfers
The Platform’s main data, including data obtained from Steam and Discord, is stored on our servers in the Kyrgyz Republic. Services of international providers are used for networking and domain names.
Some of the recipients listed above are located outside Kyrgyzstan and the EU (for example, in the United States). For EU users: there is no European Commission adequacy decision for the Kyrgyz Republic. Data is transferred to our servers and our recipients because this is necessary for the performance of the contract with you — providing the Services you request (Art. 49(1)(b) GDPR) — and, for transfers to service providers, also on the basis of standard contractual clauses or other mechanisms under Chapter V GDPR where the provider offers them. You may request information about the safeguards applied.
9.How long we keep data
| Data | Retention period |
|---|---|
| Account and profile | For as long as the account exists; after deletion — deleted or anonymised, except for the data in the rows below |
| Tournament and match results, ratings, match recordings | For as long as the Platform operates, as part of competition history; after account deletion, your nickname is replaced with an anonymised label on request |
| Fair-play protection data, data on violations and sanctions | For as long as needed to investigate violations, handle reports and enforce sanctions, including the duration of bans and related disputes |
| Payment data | For the periods required by law for accounting and tax records and for resolving payment disputes |
| Web server logs | Up to 14 days |
| Session cookies and temporary sign-in codes | From a few minutes to 30 days |
| Support correspondence | Up to 3 years after the last request |
| Data obtained through Discord | Member profile and level — while the Bot is installed on the server; event log, voice sessions and daily activity — no longer than the period set by the server administration (180 days by default); everything is deleted within 30 days after the Bot is removed from a server, or on request |
We periodically review the amount of stored data and delete what is no longer needed. Backups are overwritten as they rotate.
10.Discord
This section describes the data we receive through the Discord API when you use the Platform’s Discord bot and link your Discord account.
The Bot may receive and store: your Discord user ID, username, display name, server nickname and avatar; IDs of servers, channels and roles; commands and interactions addressed to the Bot and their parameters.
For the level system and the server log, the Bot records the activity of members of servers where it is installed: the number of messages (without their content), time spent in voice channels and the names of those channels, earned experience and levels, and server events — joining and leaving, role assignments and removals, nickname and avatar changes, moderation actions, message deletions (the fact of deletion, without text), and creation of personal voice channels.
The Bot has no access to the text of members’ messages (the Message Content privilege is not requested) and does not record voice.
When you link Discord from the website, sign-in with Discord (OAuth2) is used with the identify scope and, if you choose, guilds.join to add you to the Platform’s server right away. The Discord access token is used once and is not stored.
This data is used only to operate the Bot’s features: levels and statistics cards, role assignment, personal voice channels, news publishing, the event log for server moderators, and linking your Discord account with your Platform account at your action.
- We do not sell, license or transfer data obtained through Discord to data brokers, ad networks or other third parties, except as listed in “Who we share data with”.
- We do not use data from Discord to train machine learning or artificial intelligence models.
- We do not attempt to de-anonymise Discord users and do not combine Discord data with data from other sources except to link it to your Platform account at your action.
- We delete data obtained through Discord on your request, when you unlink your account, after the Bot is removed from a server (within 30 days), and at Discord’s request.
Discord processes your data under its own Discord Privacy Policy.
11.Steam
We use Steam OpenID for sign-in and the Steam Web API to obtain public profile information. Steam data is requested only in connection with your actions on the Platform (signing in, linking, updating your profile, playing matches) and is stored on our servers in the Kyrgyz Republic.
We store: SteamID, public name and avatar, profile link, and the date of linking. We do not receive your password, Steam email address, Steam payment data, or your inventory contents for any transactions.
Valve processes your data under its own Valve Privacy Policy. The Platform is not affiliated with Valve Corporation.
13.Your rights
You have the right to:
- obtain confirmation of whether we process your data, and a copy of it (access);
- correct inaccurate data — most profile details can be changed in your settings;
- request erasure of your data (“right to be forgotten”);
- restrict processing;
- receive the data you provided in a structured, machine-readable format and transmit it to another controller (portability);
- object to processing based on legitimate interest, including publication of clips featuring you — we will stop unless we have compelling legitimate grounds;
- withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
- unlink Telegram, FACEIT and Discord in your account settings;
- lodge a complaint with a data protection authority: in the Kyrgyz Republic — the authorised state body for personal data protection; in the EU — the supervisory authority of your country of residence, place of work or place of the alleged infringement.
How to exercise your rights: write to info@cybersport.kg from the address in your profile, or include your nickname and Steam profile link in the email. To protect your account from requests by others, we may ask you to confirm ownership (for example, by signing in to the website or sending a message from your linked Telegram). We respond within 30 days; in complex cases this may be extended by another 60 days with notice. Requests are free of charge unless they are manifestly unfounded or repetitive.
Account deletion: we delete or anonymise profile data, linked accounts, content at your choice and technical data. The following is retained in anonymised or minimal form: results of tournaments played (without nickname — on request), payment records for the mandatory period, and data on violations and sanctions for as long as needed to prevent ban evasion and defend rights in disputes.
14.Children
The Services are intended for users aged 14 and over; under 18 — with the consent of a parent or legal guardian. For EU users below the age of digital consent in their country (13–16), consent-based processing is permitted only with parental consent.
We do not knowingly collect data from children below the required age. If you are a parent and believe your child has provided data to us without your consent, write to info@cybersport.kg and we will delete it. A parent or legal guardian of a minor may exercise the minor’s rights listed above.
We recommend that minors do not add their date of birth, city or links to personal pages to their profile.
15.Security
We apply organisational and technical safeguards: encrypted connections (HTTPS), storing passwords (if you set one) only as a strong hash, databases not accessible from the internet, staff access on a least-privilege basis (access to fair-play protection data is limited to a small number of responsible persons), and logging of administrator actions.
No system is completely secure. If a breach occurs that is likely to result in a high risk to your rights, we will notify you and, where required by law, the competent authority within the prescribed time, and Discord if Discord data is affected.
16.Changes to this Policy
We update this Policy when the Services or the law change. The current version is always on this page, with the update date shown above. We give advance notice of material changes — for example, new purposes of processing or new categories of recipients — on the website or via the bot. If a change requires consent, we will ask for it separately.
17.Contacts
- Controller: CYBERSPORT.KG, Bishkek, Kyrgyz Republic
- Personal data questions: info@cybersport.kg, subject “Personal data”
- Phone, WhatsApp, Telegram: +996 600 096 909
Version 1.0, September 16, 2026. This is a translation. In case of any discrepancy, the Russian version prevails. Previous versions are available on request.