Privacy policy

1. Data collected

1.1 At registration: e-mail address (identification, authentication), nickname (public display), hashed password (secure authentication). Legal basis: performance of the contract. No other data is collected: no last name, first name, postal address, phone number, date of birth or banking details.

1.2 Generated by use: predictions and bets placed, Arenas balance and history, login history (security, legitimate interest), browsing statistics through Matomo (consent).

1.3 What we do NOT collect: no IP address stored for tracking purposes, no precise geolocation, no sensitive data within the meaning of art. 9 of the GDPR.

2. Cookies and trackers

2.1 Strictly necessary (no consent required): user session, preferences (theme, language).

2.2 Analytics (consent): Matomo, self-hosted in the EU, with full IP anonymisation.

2.3 Advertising (consent): third-party advertising networks. A cookie consent banner compliant with French data protection guidance is displayed on the first visit; preferences can be changed through "Cookie settings" in the footer.

3. Processors and recipients

Data is never sold. It may be shared with the processors that are strictly necessary:

• OVH SAS — hosting (France, EU)
• Brevo (Sendinblue) — transactional e-mails (France / EU)
• Matomo — self-hosted analytics (OVH server, France)
• Advertising networks — advertising (international, consent required through the cookie banner)

All personal data is hosted within the European Union.

4. Retention periods

• Account data (e-mail, nickname): lifetime of the account + 3 years after last activity
• Prediction and Arenas history: lifetime of the account (anonymised after deletion)
• Login logs: rolling 12 months
• Matomo analytics data: 13 months maximum
• Transactional e-mails (Brevo): 3 years from the last active contact

5. Your rights

Under the GDPR you have the right of access (art. 15), rectification (art. 16), erasure or "right to be forgotten" (art. 17), portability (art. 20), objection (art. 21), restriction (art. 18), and withdrawal of consent. You can exercise them through the Settings page (rectification, account deletion), the cookie banner (consent), or by e-mail to contact@freebetarena.com.

Response time: 30 calendar days at most. When an account is deleted, identifying data (e-mail, nickname) is anonymised or erased; aggregated statistical data (not identifying) may be retained.

6. Data security

HTTPS (TLS) encryption across the whole site, password hashing, rate-limited and IP-restricted back-office access, encrypted daily backups, data access restricted to the administrator, secure hosting with OVH (ISO 27001, HDS). In the event of a data breach involving risk, the French data protection authority is notified within 72 hours and the users concerned are informed as soon as possible.

7. Minors

FreeBetArena is open from the age of 15 and does not knowingly collect data from children under 15 without parental consent. A legal guardian may request the deletion of an account created without permission at contact@freebetarena.com.

8. Complaints to the supervisory authority

You may lodge a complaint with the French data protection authority (CNIL) — www.cnil.fr, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, +33 1 53 73 22 22.

9. Changes

Any substantial change will be notified by e-mail and/or a banner, with 15 days' notice before it takes effect.