Version 2.4
Last updated: 1 October 2026
In brief: The GML E-SPORTS association is responsible for your data. We have not designated a Data Protection Officer (DPO): here is why.
The EVA Bet site (evabet.gg) is published by the GML E-SPORTS association, an association governed by the French law of 1901 with no share capital, whose registered office is located at 23 allée des Açores, 35200 Rennes, France. It is the controller of your personal data within the meaning of article 4.7 of the GDPR.
We have not designated a Data Protection Officer (DPO). EVA Bet is not a public authority, does not carry out large-scale regular and systematic monitoring of individuals and does not process sensitive data on a large scale, within the meaning of article 37.1 of the GDPR. This analysis is reassessed upon any significant evolution of our processing.
The association keeps its record of processing activities up to date and reassesses the need for a data protection impact assessment (article 35 of the GDPR) upon any significant evolution of its processing.
For any question about your data, write to us at asso.gml.esports@gmail.com (recommended and traced channel), or by postal mail to the address of the registered office above.
In brief: We collect your data when you create an account, when you use the Site, and automatically as you browse.
You provide certain data to us directly: upon registration (email, username, password or Google/Discord account), by using the service (predictions, participation in prize draws, subscription, donations, reports) or by contacting us.
If you register or log in via Google or Discord, these services transmit your email and your public profile to us. You are informed, upon redirection, that this provider receives the information that you are accessing EVA Bet (see §5 and §6).
Some data is collected automatically as you browse, for the security and proper functioning of the Site: IP address, browser type, connection logs.
The table in §3 details, purpose by purpose, which specific data we process and for how long we retain it.
In brief: This table lists, processing by processing, what we do with your data, on what legal basis, and for how long we keep it.
In accordance with articles 13 and 14 of the GDPR, here are all the personal data processing operations implemented by EVA Bet.
| Purpose | Legal basis | Data | Retention period |
|---|---|---|---|
| Account creation and management | Performance of the contract (article 6.1.b of the GDPR) | Email, username, password (hashed, never in plain text), avatar, language, acceptance of the ToS (version, date), age certification | Lifetime of the account, then 30 days after the deletion request (cancellable grace period, see §12) |
| Authentication by email and password | Performance of the contract (article 6.1.b of the GDPR) | Email, hashed password (Argon2), login sessions (device, sign-in and last activity dates) | Lifetime of the account; login sessions and tokens deleted once expired, at the latest 31 days after sign-out or last activity |
| Account management emails | Performance of the contract (article 6.1.b of the GDPR) | Email, single-use temporary token - only for registration, address confirmation, password reset and account deletion | Lifetime of the account; no marketing or prospecting emails |
| Authentication via Google (OAuth) | Consent (article 6.1.a of the GDPR) | Email and public Google profile (scope requested: profile, email) - no password transmitted | Lifetime of the account; revocable at any time from your Google account settings |
| Authentication via Discord (OAuth) | Consent (article 6.1.a of the GDPR) | Email, public Discord identifier and avatar (scope requested: identify, email) - no password transmitted | Lifetime of the account; revocable at any time from your Discord account settings |
| Predictions and game statistics | Performance of the contract (article 6.1.b of the GDPR) | Predictions made, points, ranking, success rate, streaks | Lifetime of the account; anonymised as soon as the account is deleted (no read-only retention after deletion) |
| Public rankings and search by username | Performance of the contract (article 6.1.b of the GDPR) | Username, avatar, points, rank, success rate - always visible, regardless of the "public profile" setting (see §7) | Duration of the account; anonymized upon account deletion |
| Prize draws (giveaways) | Performance of the contract (article 6.1.b of the GDPR) | Participation, draw result, winner or disqualified status and reason for disqualification (published only if the organizer activates publication of winners), prize delivery terms | Duration of the competition, then aligned with retention of the account's predictions |
| Subscription and billing (Stripe) | Performance of the contract (article 6.1.b) and legal accounting obligation (article 6.1.c of the GDPR) | Offer subscribed, price, periodicity, billing history - credit card data is processed directly by Stripe, never stored by us | Accounting documents: 10 years from the closing of the financial year (article L. 123-22 of the French Commercial Code) |
| Proof of waiver and withdrawal | Legal obligation (articles L221-13 and L221-18 of the French Consumer Code) and legitimate evidentiary interest (article 6.1.c/f of the GDPR) | Contract concerned, date, amount refunded, period, IP address and User-Agent at the time of the action, including the waiver linked to the assignment of a subscription | 5 years (civil limitation period, article 2224 of the French Civil Code); IP address and User-Agent erased after 12 months |
| Prevention of abuse of the free trial period | Legitimate interest - prevention of commercial fraud (article 6.1.f of the GDPR) | Normalized email, pseudonymized fingerprint of the credit card (Stripe fingerprint, never the card number) | 3 years from the first use of the free trial |
| Legal documents ("My documents") | Legal obligation (article L221-13 of the French Consumer Code) and performance of the contract | Subscription confirmations, waiver and withdrawal acknowledgments, cancellation notices, renewal notices (Chatel), formal notices, moderation decisions, ToS/T&Cs acceptances | 5 years from the closure of your account or the end of your subscription, whichever is later: kept as long as your account is open; document not linked to an account: 5 years after it was issued (durable medium, CJEU case law BAWAG, C-375/15) |
| Donations | Performance of the contract (article 6.1.b) and legal accounting obligation (article 6.1.c of the GDPR) | Donor's email, donation amount, honorary badge awarded | Amount kept indefinitely (accounting obligation); email anonymised after 10 years |
| Reports and moderation (article 16 of the DSA regulation) | Legal obligation (articles 16 and 17 of Regulation (EU) 2022/2065) | Content reported, reason, report reference, reasoned decision, identity of the reporter (name, and email if you provide one), IP address and User-Agent | Report closed without action: 1 year. Report resulting in a decision: 5 years. IP address and User-Agent: erased after 12 months |
| Suspension and moderation decisions | Legal obligation (article 17 of the DSA regulation) and legitimate interest - community safety | Facts alleged, article of the ToS concerned, scope and duration of the measure, means of appeal | Duration of the measure; reasoned decision deleted 5 years after the decision; the copy provided in "My documents" follows the retention of those documents (above) |
| Account transfer and delegation | Performance of the contract (article 6.1.b of the GDPR) | Identity of the sending and receiving accounts and of the delegate, delegated rights, transferred items, transfer summary, end date of the assigned organizer access where applicable, data of participants in the competitions concerned. No banking data is passed on to the recipient. | Duration of the delegation or transfer, aligned with the duration of the competitions concerned; transfer summary: as for documents in the "My documents" area; record of the subscription assignment: 5 years |
| Badges and gamification | Performance of the contract (article 6.1.b of the GDPR) | Badges obtained (game, donations, seniority) | Lifetime of the account |
| Clicks on ambassador and partner links | Legitimate interest - internal audience measurement (article 6.1.f of the GDPR) | Account identifier, link clicked, platform targeted (no IP address) | 12 months |
| Authorised third-party applications (public OAuth2 API) | Consent given on a dedicated screen, per application (article 6.1.a of the GDPR) | Username, public identifier, avatar, streaks, history of your predictions - depending on the authorisations you grant | Duration of the authorisation; revocable at any time upon request to asso.gml.esports@gmail.com (see §8) |
| Outgoing webhooks | Performance of the contract, at the initiative of a subscribed organizer (article 6.1.b of the GDPR) | Ranking (username, avatar, points, success rate) of the top 20 participants, number of participants, prize draw results (see §9) | Duration of the webhook's activation by the organizer; delivery log (content sent) deleted 90 days after sending |
| Ambassadors and partners (their own published identity) | Consent (article 6.1.a of the GDPR) | Name, photo, social media (see §10) | Until consent is withdrawn |
| Anti-bruteforce security log | Legitimate interest - Site security (article 6.1.f of the GDPR) | Identifier attempted, IP address (automatic lockout after 5 failures, 30 minutes) | 30 days |
| Audit log | Legal obligation and legitimate interest - traceability of critical actions (article 6.1.c/f of the GDPR) | Action performed, timestamp, author - no email or username | 3 years |
| Server logs (Nginx, applications) | Legitimate interest - technical security and diagnosis (article 6.1.f of the GDPR) | IP address, User-Agent, request made | 12 months |
| Off-site backups | Legitimate interest - continuity and security of the service (article 6.1.f of the GDPR) | Encrypted copy of the database and media files | 1 year |
In brief: EVA Bet only uses cookies strictly necessary for the operation of the Site. No advertising or tracking cookies: no banner is required.
This site uses no advertising or tracking cookies. No consent banner is therefore necessary, in accordance with article 82 of the French Data Protection Act (loi Informatique et Libertés) and CNIL deliberation no. 2020-091 of 17 September 2020.
Access token (JWT access token)
Essential - exempt from consent - 15 minutes
HttpOnly, Secure, SameSite cookie - authentication, issued by EVA Bet
Refresh token (JWT refresh token)
Essential - exempt from consent - 30 rolling days
HttpOnly, Secure, SameSite cookie - session maintenance, issued by EVA Bet
Anti-CSRF token (csrftoken)
Essential - exempt from consent - 1 year (Django default value)
Django cookie, not HttpOnly (read by the frontend to sign requests) - protection against CSRF attacks
Preferred language (NEXT_LOCALE)
Essential - exempt from consent - 1 year
Non-HttpOnly cookie - remembers the display language chosen (fr/en/es/de)
Closed banners
Local storage (localStorage), exempt - Until erased by you or your browser
Remembers the information banners you have closed, so as not to display them again
Email of ongoing registration
Session storage (sessionStorage), exempt - Duration of the open tab
Temporarily retains the email entered during the registration process
When you are redirected to Stripe (payment), Discord or Google (authentication), these services place their own cookies on their domains. They are governed by their respective policies: Stripe (https://stripe.com/privacy), Google (https://policies.google.com/privacy), Discord (https://discord.com/privacy).
In brief: We never sell your data and send no marketing emails. It is only shared with the providers essential to the service.
Your personal data is neither sold nor rented to third parties, and we send you no marketing emails. It may be communicated to the following recipients, each contractually bound to protect it:
We use no advertising or commercial profiling tools.
The only emails we send you relate to the management of your account: registration confirmation, email address confirmation, password reset and account deletion. We send no marketing email, no reminder and no newsletter.
In brief: Some data is transferred outside the EU to our US providers, under safeguards recognised by European law.
Google LLC (authentication) - United States: transfers governed by the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023).
Google LLC (off-site backups, Google Drive) - United States: [Transfer safeguard applicable to the Google account used: Data Privacy Framework or standard contractual clauses - being confirmed - GAP-03].
Discord Inc. - United States: transfers governed by standard contractual clauses (SCC) approved by the European Commission.
Sentry (Functional Software, Inc.) - United States: transfers governed by standard contractual clauses (SCC).
Stripe Payments Europe Limited - headquartered in Ireland (EU), with possible access by Stripe, Inc. (United States) for global technical support: transfers governed by the Stripe clauses (DPA + SCC).
You may obtain a copy of the applicable transfer safeguards on simple request to asso.gml.esports@gmail.com.
In brief: Your username, your avatar and your game results are always visible. The "public profile" setting only controls access to the detail of your profile page.
EVA Bet is a competitive prediction platform: your username, your avatar, your points, your rank and your success rate are always visible in rankings, in username search, in the lists of winners and disqualified participants of prize draws, and in an organizer's outgoing webhooks. This publication is inherent to the service and cannot be disabled as long as your account exists. As the rankings of public competitions can be viewed without an account, they may be indexed by search engines.
The "Public profile" setting, in your account settings, only controls access to the detail of your profile page: detailed prediction statistics, your prediction history, streaks, registration date and badges obtained. This setting is "private" by default: this information is then only visible to you.
When you enable "Public profile", your profile page becomes viewable by other logged-in members of the Site. You may switch back to private at any time, with no effect on rankings.
These processing operations rely on performance of the contract (article 6.1.b of the GDPR): the competitive nature of the platform implies the publication of rankings and results.
In brief: You can authorise an external application to read some of your data. That application then becomes solely responsible for what it does with it.
EVA Bet offers a public API allowing third-party developers to register an application. If you choose to authorise such an application, a dedicated consent screen precisely indicates to you which data it will be able to read (for example your username, your avatar, your streaks, or the history of your predictions).
Once your authorisation is given, the third-party application receives this data and becomes solely responsible for its subsequent processing: it does not act on our behalf and is not a processor within the meaning of article 28 of the GDPR. We do not control what it does with your data once transmitted.
You may withdraw your authorisation at any time by writing to us at asso.gml.esports@gmail.com. We then revoke the application's access, which immediately loses access to your data.
In brief: A subscribed organizer can automatically push their competition's ranking to a destination of their choice.
A subscribed organizer may activate a webhook on a competition or session: at each event, an excerpt of the ranking (the top 20 participants), the number of participants and the prize draw results are automatically transmitted to a web address or Discord server they have chosen.
These transmissions contain the username, avatar and ranking statistics of the participants concerned, whether their profile is public or private (see §7). They never contain your email address, or the access codes of private competitions.
This processing is implemented at the initiative of the subscribed organizer, on the basis of performance of the contract that binds us to them (article 6.1.b of the GDPR).
In brief: The name, photo and social media of an ambassador or partner are only published with their explicit agreement, kept on our side.
Certain ambassadors or partners of EVA Bet agree to have their name, photo and social media published on the Site, as part of a collaboration with the association.
This publication relies on the explicit consent of the person concerned, collected and archived before any publication. Where the collaboration is paid, the mention "Commercial collaboration" is displayed on the corresponding card.
An ambassador or partner may request the withdrawal of their published data at any time, by writing to us at asso.gml.esports@gmail.com.
In brief: We implement serious technical measures to protect your data. No system is infallible: here is our procedure in the event of an incident.
In accordance with article 32 of the GDPR, we implement the following technical and organisational measures:
In the event of a data breach presenting a risk to your rights, we notify the French National Commission for Informatics and Liberties (CNIL) within 72 hours of becoming aware of it (article 33 of the GDPR), and inform you without delay if the risk is high (article 34 of the GDPR). Every breach, even when no notification is required, is recorded in an internal register (article 33.5 of the GDPR).
In brief: Access, rectification, erasure, portability, restriction, objection: here is how to exercise them, and within what timeframes we respond.
In accordance with the GDPR, you have the following rights regarding your personal data:
Obtain confirmation that data concerning you is being processed, and receive a copy of it.
Have inaccurate or incomplete data concerning you corrected.
Request the deletion of your data, subject to legal retention obligations.
Receive your data in a structured, machine-readable format.
Request the restriction of the processing of your data in certain cases provided for by the GDPR.
Object, for legitimate reasons, to the processing of your data.
Exporting and deleting your data is available directly from your account, on a self-service basis. The "My documents" area gives you access to the history of your contractual documents. Deletion of the account is subject to a 30-day grace period, which you can cancel at any time during this period.
We cannot immediately delete an account with an active subscription, an open invoice, or, if it holds paid organizer access, an active competition of which it is the organizer (see article 14 of the ToS): these situations must first be regularized. The holder of parental authority for a minor's account may request deletion via the manual process described in §16.
We respond to your request within a maximum period of one month from its receipt, extendable by two months for complex requests with reasoned information within the initial period (article 12.3 of the GDPR). Proof of identity will only be requested from you in case of reasonable doubt as to your identity.
You may send us instructions on the fate of your data after your death, general or specific to EVA Bet (article 85 of the amended law of 6 January 1978).
In case of difficulty or an unsatisfactory response, you can lodge a complaint with the French National Commission for Informatics and Liberties (CNIL): www.cnil.fr, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.
To exercise these rights, write to us at asso.gml.esports@gmail.com or by postal mail to: Association GML E-SPORTS, 23 allée des Açores, 35200 Rennes, France.
In brief: An email and a username are necessary to create an account. Without them, registration cannot be completed.
Providing an email and a username is necessary to create an account and use the service. If you refuse to provide this data, registration cannot be finalized. Choosing an avatar is optional: a default avatar is assigned.
In brief: When processing is based on your consent, you can withdraw it at any time, without affecting what has already been done before the withdrawal.
When processing is based on your consent (for example a login via Google or Discord, or the authorisation of a third-party application), you can withdraw it at any time, without this affecting the lawfulness of the processing carried out before this withdrawal. You can exercise this right by contacting us, by revoking access from your Google or Discord account settings, or by deleting your account.
In brief: Your game statistics are calculated automatically, but no automated decision having consequences for you is applied.
EVA Bet automatically calculates your game statistics (points, ranking, success rate, streaks, badges) from the results of your predictions. This processing constitutes profiling within the meaning of article 4.4 of the GDPR, but produces no legal effect or similarly significant effect within the meaning of article 22 of the GDPR. No purely automated decision having consequences for you is applied.
In brief: EVA Bet is accessible from age 15. Between 15 and 17, the agreement of your legal representative is required to subscribe to a paid subscription.
Registration on EVA Bet is open to persons aged 15 and over, in accordance with article 45 of the French Data Protection Act (loi Informatique et Libertés). Upon registration, you certify that you are at least 15 years old and, if you are under 18, that your legal representative agrees. This certification is retained on our side.
Subscription to a paid Organizer subscription is reserved for persons of legal age, or for persons aged 15 to 17 who have the express agreement of their legal representative.
If an account belonging to a person under 15 is reported to us, we carry out a verification. If the report is confirmed, the account is suspended and then deleted.
The holder(s) of parental authority may request the deletion of their minor child's account by writing to asso.gml.esports@gmail.com, accompanied by proof of their status. This request is handled as a priority.
In accordance with article 17.1.f of the GDPR, data collected during a user's minority benefits from a reinforced right to erasure: a request made upon reaching adulthood is honoured with no further justification required.
In brief: We may modify this policy. Any substantial modification is notified to you and its acceptance is explicitly collected.
We reserve the right to modify this privacy policy. Any substantial modification is brought to your attention upon your connection to the Site. The date of last update and the version of the policy are indicated at the top of this page. The history of published versions is kept by the editor.
Only the French version of this document is authoritative. Translations are provided for information purposes only.