Command Arena Privacy Policy
This Privacy Policy explains how Command Arena Limited collects, uses, shares, stores and protects personal information when you use Command Arena.
1. Who controls your information
Command Arena Limited is the organisation responsible for the personal information described in this policy. We are incorporated in New Zealand.
Privacy contact and New Zealand Privacy Officer: 
.
2. Information we collect
Depending on how you use the Service, we may collect the following categories of information:
- Account information: email address, callsign, account identifiers, password hash, verification status, settings and legal-document acceptance records.
- Gameplay information: matches, scores, rankings, teams, game actions, achievement or moderation information, and anonymised historical game records.
- Communications: support messages, reports, appeals, and chat messages where they are stored, reported or required for moderation.
- Subscription and transaction information: Premium status, billing interval, amount, currency, Stripe customer/subscription/payment references, receipts, cancellation status and recurring-payment consent records. We do not receive your complete card number.
- Technical and security information: IP address, date and time, browser, device type, operating system, session identifiers, login history, referral URL, security events, error logs and approximate location inferred from IP where used.
- Cookie and preference information: necessary login/security cookies and, if enabled with appropriate notice or consent, analytics or advertising preferences.
- Privacy-request information: the request, verification information, correspondence, outcome and audit record.
3. How we collect information
We collect information directly from you when you create or manage an account, communicate with us, play games or purchase Premium. We also collect technical and gameplay information automatically as the Service operates.
We may receive limited information from service providers such as Stripe, hosting providers, email-delivery providers, fraud/security services and analytics providers. If we begin collecting personal information indirectly from additional sources, we will update this policy and provide any notice required by law.
4. Why we use information
We use personal information to:
- create, authenticate and manage accounts;
- operate multiplayer games, matchmaking, rankings, callsigns and gameplay records;
- provide Premium, process subscriptions, send receipts and manage cancellation;
- send verification, password-reset, email-change, deletion, billing, security and service notices;
- detect cheating, fraud, abuse, attacks, account compromise and other security risks;
- moderate chat and enforce the Terms of Service;
- debug, maintain, measure and improve the Service;
- respond to support, legal and privacy requests;
- comply with tax, accounting, consumer, privacy, law-enforcement and other legal obligations;
- send marketing only where permitted and with any consent required by law.
5. Legal bases for European users
Where the GDPR or similar European law applies, we rely on the following legal bases:
- Contract: account creation, authentication, gameplay, Premium delivery, billing and requested support.
- Legitimate interests: securing the Service, preventing fraud and cheating, moderating abuse, diagnosing faults, maintaining records and improving ordinary service performance, balanced against user rights.
- Consent: optional marketing and non-essential cookies or similar tracking where consent is required. Consent may be withdrawn without affecting earlier lawful processing.
- Legal obligation: tax, accounting, consumer, regulatory and lawful disclosure duties.
- Legal claims and vital interests where applicable in exceptional circumstances.
6. When we share information
We may disclose information only as reasonably necessary to the following recipients:
- Payment processor: Stripe, for subscription and payment processing.
- Hosting and infrastructure providers: currently intended to include DigitalOcean infrastructure in the United States, plus network, backup, monitoring and security providers.
- Email-delivery provider: for account and transactional emails.
- Analytics or advertising providers: only if enabled and described in the Cookie Notice. At launch, the recommended approach is no personalised behavioural advertising.
- Professional advisers: lawyers, accountants, auditors, insurers and consultants subject to confidentiality obligations.
- Authorities and affected parties: where reasonably necessary to comply with law, protect rights or safety, investigate fraud or security incidents, or respond to valid legal process.
- Corporate transactions: a buyer, investor or successor in a genuine financing, sale, merger or reorganisation, subject to appropriate confidentiality and continued legal protection.
We do not sell personal information for money. This policy assumes we do not share personal information for cross-context behavioural advertising. If that changes, we will update the policy and provide legally required opt-out controls before the change takes effect.
7. International data transfers
Command Arena is based in New Zealand and uses service providers in other countries, including the United States. Privacy protections and government-access rules may differ between countries.
We use contracts, provider due diligence and other safeguards required by applicable law. For European personal data, this may include European Commission Standard Contractual Clauses, adequacy mechanisms or another valid transfer basis. For New Zealand personal information, we assess and manage overseas disclosures and processing in accordance with the Privacy Act 2020.
8. How long we retain information
We keep personal information only for as long as reasonably necessary for the purposes described in this policy, including security, dispute, tax and legal requirements.
Account data is generally retained while the account is active. After confirmed deletion, login access is disabled and direct identifiers are removed from live systems within the operational period stated in our internal retention schedule, subject to legal exceptions. Deleted information may remain in protected backups until those backups cycle out.
Security logs may be retained for up to 12 months. Subscription-consent evidence may be retained for at least three years or one year after termination, whichever is longer. Tax and transaction records are retained for the period required by law.
Match or leaderboard records may be retained indefinitely only after they have been genuinely anonymised so they no longer identify or can reasonably be linked to you.
9. Your choices and privacy rights
You may update certain account information in Account Settings and may request account deletion through the email-confirmed deletion process.
Depending on where you live and the law that applies, you may have rights to be informed, access personal information, correct it, request deletion, restrict processing, object, receive portable data, withdraw consent, opt out of sale/sharing or targeted advertising, and not be discriminated against for using privacy rights.
To make a request, email . Describe the request and the account email concerned. We may take proportionate steps to verify identity and authority. We aim to respond within one month where GDPR applies and within any other period required by local law.
Some rights have exceptions. For example, we may retain information needed for tax records, fraud prevention, security, legal claims or another legal obligation. We will explain any material refusal or limitation where required.
10. Additional notice for United States residents
US state privacy laws apply only where their scope and thresholds cover Command Arena. Where applicable, residents may exercise the rights described above.
In the preceding 12 months, we may have collected the categories described in section 2 and disclosed them to service providers for the business purposes described in sections 4 and 6. We do not knowingly sell personal information, and this draft assumes we do not share it for cross-context behavioural advertising.
We do not use sensitive personal information to infer characteristics about users. We do not offer financial incentives in exchange for personal information.
An authorised agent may submit a request where permitted by state law. We may require proof of authority and may verify the request directly with the account holder.
11. Children's privacy
Command Arena is a general-audience service and is not directed to children under 13. People under 13 must not create an account or provide personal information.
If we learn that we collected personal information from a child under 13 without legally valid parental permission, we will take reasonable steps to delete it. A parent or guardian may contact .
Where local law gives additional protections to teenagers or requires parental permission for consent-based processing, we will apply those requirements.
12. Cookies and similar technologies
We use necessary technologies for login sessions, security, fraud prevention, user preferences and core operation. These cannot always be disabled without preventing the Service from working.
If we use non-essential analytics or advertising technologies, we will describe them in the Cookie Notice and request consent where required. You can change optional choices through Cookie Settings. Browser privacy signals will be handled where legally required.
13. Security
We use reasonable administrative, technical and organisational safeguards designed for the nature of the information and risks involved. Measures may include password hashing, encryption in transit, access controls, administrator MFA, logging, rate limiting, backups, token expiry and incident response.
No online service can guarantee absolute security. You should use a unique password and contact us promptly if you suspect unauthorised access.
14. Privacy breaches
We maintain a process to assess, contain, document and respond to privacy and security incidents. We will notify affected people and regulators when required by applicable law.
15. Automated decisions
We may use automated systems to detect likely cheating, spam, fraud or security threats. We do not intend to make decisions based solely on automated processing that produce legal or similarly significant effects without safeguards required by law. Material enforcement decisions may be reviewed through support or an appeal process where appropriate.
16. Complaints
Please contact first so we can investigate.
New Zealand residents may complain to the Office of the Privacy Commissioner. European users may complain to the data protection authority where they live, work or believe an infringement occurred. US residents may contact the regulator or attorney general responsible under applicable state law.
17. Changes to this policy
We may update this policy to reflect legal, provider, security or product changes. We will post the updated version with a new effective date and provide additional notice for material changes where required.
18. Contact
Command Arena Limited
Privacy Officer: