How player data is processed

The controller is the operator of SandStats. For any question about your data, or to exercise the rights below, write to artem.barsikcool@gmail.com.

SandStats is a public results site. Everything below is visible to anyone who opens it, without logging in, and is served by an API that requires no authentication:

• Your player name, or its masked form if you chose that (see below).
• Your rating, its full history game by game, and your totals and win rate.
• Every game you played, naming your partner and opponents, with the score.
• Which tournaments you are registered for, including while they are still open.

This is the point of the site, and it is what you consent to when you register. Your email address and password are never published.

You can ask us not to have your name shown in full — write to the address below. Every page of the site then renders it masked: "Artem Borzienkov" appears as "Ar*** Bo***", in leaderboards, results, standings and tournament rosters alike. You can ask us to turn this off again at any time.

What this does not do

Masking is applied when a name is displayed. Your real name stays in the database, is still returned by the public API, and is still visible to a tournament organiser who needs to tell players apart in order to record results. So it reduces how visibly your name is published — it is not technical anonymisation, and it does not make you unidentifiable. If you want your name removed rather than masked, use the erasure right below.

Publishing your name and your results rests on your consent (art. 6(1)(a) GDPR), given by ticking the box at sign-up; the moment you gave it is recorded. You can withdraw it at any time (art. 7(3)), which means asking us to remove your published data.

Running your account and the tournaments you enter rests on the agreement between us (art. 6(1)(b)) and on legitimate interest in keeping a coherent competition record (art. 6(1)(f)) — a rating chain with games removed from the middle of it no longer describes anyone accurately.

The site is hosted by a hosting provider acting as a processor, and anonymous usage measurement is provided by Vercel Inc. — only if you allowed it in the cookie banner. No data is sold, no advertising network is used, and no profiling beyond the sporting rating takes place. Where data is transferred outside the EEA it relies on the European Commission's standard contractual clauses.

Your account is kept while it exists. Games and results are kept as part of the competition record, because removing one game changes every rating that followed it; on an erasure request we remove or de-identify your personal data and tell you what that means for the results you appear in.

Under the GDPR you have the following rights over your personal data:

• Access — obtain a copy of the data held about you (art. 15).
• Rectification — have inaccurate data corrected (art. 16).
• Erasure — have your data deleted (art. 17).
• Restriction — limit how your data is used (art. 18).
• Portability — receive your data in a machine-readable format (art. 20).
• Objection — object to processing based on legitimate interest (art. 21).
• Withdrawal — take back your consent at any time, as easily as you gave it (art. 7(3)). This does not affect processing that was lawful before.
• Complaint — lodge a complaint with your national data protection authority (art. 77).