Lichess4545 Privacy Policy

Last updated: 20 April 2021

Who we are and how to contact us

The Lichess4545 leagues are officially organised and run by the online chess site Lichess.org (“Lichess”).

The privacy policy of the Lichess4545 league is an additional and optional extension to the original Lichess privacy policy, relevant only to those who optionally choose to play in the leagues.

Consequently, the head office and data controller information in the Lichess privacy policy also applies to the Lichess4545 league. The Lichess privacy policy can be found here: https://lichess.org/privacy.

As Lichess officially organises and runs the leagues, Lichess is the point of contact for any questions or concerns relating to the collection and use of Lichess4545 data. They can be contacted at gdpr@lichess.org.

How we obtain personal information

We require some personal data from a registrant when they complete and submit a registration form to show their interest in competing in one of the Lichess4545 leagues. Namely, the interested registrant must agree to provide us with their valid Lichess username and their own genuine email address, or they cannot register their interest.

We additionally use the personal information held by Lichess about a registrant's accounts, which is subject to Lichess’s own terms of service and privacy policy. The personal data on Lichess associated with a specific account can be accessed via the link https://lichess.org/account/personal-data (login required).

What we use personal information for

We use a registrant's personal information to:

Assess whether the registrant is eligible to play in the leagues according to our eligibility rules. These rules are set out in full in the Lichess4545 Terms of Service.
Support the smooth running of league operations in various ways. For example:
- We share the email addresses of approved registrants with Slack, to automatically email the approved registrant with an invitation to join the Lichess4545 Slack workspace after their registration has been approved by a league moderator.
- Our league software uses players’ Lichess usernames to link information between Lichess, the league Slack workspace, and the league website.
The league website (found here: https://www.lichess4545.com) uses information on players’ Lichess usernames in conjunction with non-personal game metadata recorded by Lichess to publicly document league results and standings. In addition, each player has their own dedicated page for each league they participate in, listing their games and results by season as well as summary performance statistics.
Players’ Lichess usernames and non-personal game metadata are also processed when players sign up to any of the additional leagues and tournaments advertised within the league Slack workspace (summarised here). Most of these leagues are organised using online spreadsheets to document league/tournament pairings, results and standings.

Other than sharing registrants’ voluntarily provided email addresses with Slack for the purposes of inviting them to join our Slack workspace, this data will not be shared with any other individuals or organisations. The only individuals who will have access to a registrant’s Slack email address are Lichess4545 administrators who will only use it for the purposes of processing registrations and assessing a registrants’ eligibility (as described above).

Our justification for using personal information

The following section outlines the lawful bases we rely on under the General Data Protection Regulation (GDPR):

Sharing a registrant's submitted email address with Slack Technologies, Inc.

We rely on execution of a contract (namely, the Lichess4545 Terms of Service) in accordance with Article 6(1)(b) of the GDPR to share a registrant’s email address with Slack Technologies, Inc. This allows us to invite interested players to join our workspace on Slack, an external asynchronous messaging platform which we use for coordinating and ensuring the smooth running of league operations. This is a necessary element of the services offered by the leagues, and is therefore justified by the additional terms in the Lichess4545 Terms of Service, which all league registrants must also agree to.

Documenting player performance statistics

We rely on execution of a contract (namely the Lichess4545 Terms of Service) in accordance with Article 6(1)(b) of the GDPR to document and publish players’ league histories and performance ratings on the Lichess4545 website. This is a necessary element of the services offered by the leagues, and is therefore justified by the additional terms in the Lichess4545 Terms of Service, which all league registrants must also agree to.

Eligibility checking

We rely on our legitimate interests in accordance with Article 6(1)(f) of the GDPR to process registrants’ data to check whether they are eligible to play in the leagues. A registrant will not be allowed to play in the leagues if either:

the registrant has been banned for violating Lichess’s terms of service on any Lichess account; or
the registrant has lost a game that was terminated due to "cheat detected" on any Lichess account; or
any other reason as set out in the Lichess4545 Terms of Service document that makes a registrant ineligible to participate.

The screening of registrants is important for maintaining the overall integrity of the league and is closely related to Lichess’s legitimate interest in preventing and combating fraud on its site.

Facilitating league operations

We rely on our legitimate interests in accordance with Article 6(1)(f) of the GDPR to link information between Lichess, the league Slack workspace, and the league website. This is necessary for:

supporting the administration of our leagues (which typically see over 300 league games played each week); and
optimising the experience of playing in the leagues, such as by minimising the effort required to schedule games with opponents and detecting when leagues games start and finish on Lichess.

This process also captures and records data on Slack members’ local time zones.

Documenting league results

We rely on our legitimate interests in accordance with Article 6(1)(f) of the GDPR to document league games and results on the Lichess4545 website as well as online spreadsheet files that are only accessed by members of the Lichess4545 Slack workspace. The publication of league game URLs and results on the Lichess4545 website or in Google Sheets files is compatible with the initial collection of Lichess usernames and justified by the additional terms in the Lichess4545 Terms of Service, which each entrant must also agree to.

Using Google services to record your Lichess username

We rely on our legitimate interests in accordance with Article 6(1)(f) of the GDPR to store a registrant's Lichess username with Alphabet, Inc. - the parent company of Google - if a registrant voluntarily and additionally registers for one or more of the internal "community" leagues that are organised exclusively for Lichess4545 Slack members.

These leagues typically use forms created with Google Forms to allow players to sign up for new league seasons and Google Sheets spreadsheets to record league pairings and results. No other information besides players’ Lichess usernames are recorded on these forms and spreadsheets.

If a registrant chooses to sign up for a community league, we assume they have already familiarised themselves with Google’s privacy policy (found here: https://policies.google.com/privacy?hl=en-US).

Browser session cookies

We rely on our legitimate interests in accordance with Article 6(1)(f) of the GDPR to use session cookies on the Lichess4545 website that track (logged in) users’ movements from one page to another without needing to repeatedly ask for authentication. Lichess has a legitimate interest in improving the browsing experience on the Lichess4545 website.

Stuff we’re not responsible for

We are not responsible for data processing carried out by Slack or Google, and by consenting to our privacy policy, read in conjunction with our terms of service, a registrant agrees to waive Lichess of any responsibility for issues arising wholly or partly due to either Slack's or Google’s mismanagement, negligence, or irresponsibility.

If a registrant no longer wants Lichess to store their Lichess4545 data with Slack or Google in the very limited ways we do, as set out above, Lichess will endeavour to remove all data as fully as we can. However, in some circumstances the registrant may need to contact Slack and Google individually to ensure they are fully removed from Google’s and/or Slack’s services.

Lichess cannot take responsibility for removing a registrant’s data fully from Slack or Google, beyond a best efforts basis - therefore, all registrants relying on these additional (and in some cases, optional) features must familiarise themselves with how Slack and Google use data. All entrants will be assumed to have done this by the Lichess4545 team.

How we store personal information

Registrants’ information is hosted by a secure professional service provider on servers located in the European Union.

Retention periods

We will keep a registrant’s email address for the duration of the contract, then for the applicable limitation period for the purposes of managing disputes - in principle 5 years - as described in section 7 of the Lichess privacy policy.

For users that are logged in, we will keep session cookies for the duration of each browsing session. Users can configure these cookies from their own browser settings.

We will keep data on Lichess usernames and statistics relating to league games for the time required to keep statistics, in line with the justification set out in section 2.9 of the Lichess privacy policy (“Further processing of data for statistical purposes”).

We will publish players’ league game histories and performance ratings for the duration of the contract, then for the applicable limitation period for the purposes of managing disputes - in principle 5 years - as described in section 7 of the Lichess privacy policy.

Your data protection rights

Under data protection law, you have rights including:

Your right of access. In accordance with Article 15 of the GDPR, you have the right to ask us for copies of your personal information. Also, you can access your personal data on Lichess via this link (if you are logged in): https://lichess.org/account/personal-data.
Your right to rectification. In accordance with Article 16 of the GDPR, you have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Your right to erasure. In accordance with Article 17 of the GDPR, you have the right to ask us to erase your personal information if at least one of the following is true:
- You have withdrawn your consent for the processing of your email address.
- You consider that your personal information has been the subject of unlawful processing by Lichess.
- The personal information must be erased due to a legal obligation.
- The personal information relates to a person who was younger than fifteen (15) years old when the data was collected.
Your right to restriction of processing. In accordance with Article 18, you have the right to ask us to restrict the processing of your personal information in certain circumstances.
Your right to object to processing. In accordance with Article 19 of the GDPR, you have the right to object to the processing of your personal information in certain circumstances.
Your right to data portability. In accordance with Article 20 of the GDPR, you have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one calendar month to respond to you.

Exceptions

Please note that Lichess is entitled to oppose the deletion of certain personal information when their retention is necessary for particularly important reasons, such as the protection and defence of its interests in court. In addition, instead of deleting the information, Lichess may choose to proceed with complete and irreversible anonymisation of the information to allow it to be retained in a format that no longer allows a data subject to be identified (eg for statistical purposes).

How to make a GDPR request or complaint

If you have any concerns about our use of your personal information, you can make a complaint to us, or send any other data query or request to gdpr@lichess.org.

If you are unhappy with how we have used your data, after contacting us in the first instance to resolve the matter informally, you have the right to contact the relevant authority for data protection in France, the Commission Nationale de l'Informatique et des Libertés (CNIL), via its website http://www.cnil.fr or by post to the following address: CNIL - 3, Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07.