Privacy Policy
This Privacy Policy explains how League of Markets, a Germany-based simulated trading competition platform, collects and processes your personal data. *Notice: This document is an initial MVP draft and is subject to legal and operational review prior to official release.
Version: 2026-07-30-r12
1. Controller
League of Markets may collect the following information for service operation and optimization: *Account & Profile: Email address, nickname, password hash, language settings *Access & Session: Registration IP, last login IP, session data *Activity & Trading: Competition participation info, orders, trades, holdings, rankings *Security & Technical: Security and integrity review logs, technical system logs
2. Personal data we process
League of Markets may process the following data for account operations, security, and competition management: *Account & Authentication: Email address, nickname, competition nickname, encrypted password hash, email verification & password reset tokens, terms/privacy consent timestamps, selected language *Security & Technical Data: Registration IP, last login IP, session cookie data, User-Agent, referrer, request path, technical logs, abuse prevention logs *Competition & Trading Activity: Created or joined competitions, invitations, notices, comments, simulated orders & trades, holdings, portfolio valuation, rankings, virtual returns *User Content: User-uploaded profile images, competition logos, and cover images
3. Purposes of processing
*Purpose of Use: Collected data is used for account creation, email verification, password resets, competition management, portfolio and ranking calculations, prevention of abuse and multi-account manipulation, reward eligibility review, service security, and stability improvements. *Shared Network Policy: Considering shared network environments such as schools, offices, or internet cafes, multiple registrations from the same IP address are flagged for review only and will not automatically block account creation.
4. Purposes and legal bases
*Performance of a Contract: Account creation, login, competition management, and invite processing are conducted to fulfill requested services based on performance of a contract or pre-contractual measures. *Legitimate Interests: Processing security logs, abuse prevention, and ensuring service stability are based on legitimate interests in maintaining a secure environment. *Research & Market Demand Analysis: During periods of service research and market demand evaluation, usage patterns, feature adoption, system performance, API call volumes, and failure statistics are analyzed to estimate infrastructure requirements. Aggregated or pseudonymized data is used wherever feasible. *Proof of Consent: Records of user consent are retained to demonstrate compliance and verify user confirmation.
5. Email and service messages
*Service Emails: League of Markets uses email for essential operations, including account authentication, password resets, competition invitations, critical competition updates, and sharing prize-winning contact details as requested by participants. *Marketing & Newsletters: Promotional emails or newsletters are sent only when an appropriate legal basis, such as explicit user consent, has been established.
6. Cookies and sessions
*Data Processed: To ensure service security and fair operation, League of Markets may process login/registration IPs, timestamps, internal security identifiers, invitation networks, competition participation, order patterns, point ledgers, and admin review logs. *Shared Network Assessment: Recognizing that multiple users may share an IP address in schools, offices, households, or public networks, identical IP addresses alone are not treated as conclusive evidence of abuse. Risk is evaluated by combining multiple indicators. *Usage Scope: These data points are processed strictly for security and abuse prevention and are never used for advertising purposes.
7. External providers and recipients
*Retention Purpose & Duration: Account, competition, security, and integrity review data may be retained for as long as necessary to ensure service operations, abuse prevention, auditability, reward/point settlement verification, and competition record preservation. *Account Deletion: To maintain competition integrity, data from deleted accounts may be anonymized or soft-deleted rather than permanently removed.
8. Third-country transfers
Some service providers, including Google, may process data in the EU/EEA and third countries outside this area. If personal data is transferred outside the EU/EEA, the operator ensures that appropriate legal transfer mechanisms and valid data processing terms required by applicable privacy laws are in place.
9. Retention, deletion and anonymisation
*Service Data Retention: Account, competition, and trading records are retained in accordance with the service retention rules specified in this policy. *GA4 Cookies & Data Retention: Optional GA4 cookies are set to remain for up to 13 months. The event and user data retention period in the GA4 property must be set to 14 months, while aggregated reports may be kept longer. *Effect of Withdrawal: Withdrawal of consent applies to future data collection and does not automatically delete data that was lawfully processed prior to the withdrawal.
10. User rights
In accordance with applicable laws, users may request to access, correct, delete, restrict processing, transfer, object to processing, or withdraw consent for their personal data. You can submit your request via "Contact Us" on the site info page.
11. Right to complain
Users have the right to lodge a complaint with a competent data protection supervisory authority.
12. Children and guardian permission
League of Markets is designed for a general audience. Users who cannot legally consent to online services on their own may only use League of Markets with the permission of a parent or legal guardian. Please note that League of Markets does not collect date of birth during the standard registration process.
13. Changes to this policy
League of Markets may update this policy to reflect changes in features, service providers, or legal requirements. The version date displayed on this page indicates the currently effective draft.
14. Research metrics and operational review
To assess service stability and market demand, the operator may analyze data including account counts, feature usage, competition activities, technical load, API call volumes, provider errors, and interest in Pro account features. Where feasible, aggregated or pseudonymized data will be used. If there are material changes to processing purposes, data categories, or provider configurations, privacy notices and legal bases will be re-evaluated prior to implementation, and consent will be requested if legally required.
15. Google Analytics 4
Google Analytics 4 (GA4) Notice When GA4 is active, League of Markets uses it only after obtaining your consent pursuant to Art. 6(1)(a) GDPR and Sec. 25(1) TDDDG. *Purpose: To improve our services by measuring page views, sessions, browser/device categories, approximate location, and basic technical usage. *Privacy Protection: Instead of full page URLs, non-personal virtual pathnames are transmitted. We intentionally exclude email addresses, nicknames, account IDs, invite/reset tokens, competition titles, tickers, and order/trade details. *Ad Features Disabled: Google Signals, ad storage, ad user data usage, remarketing, and personalized advertising are all disabled. *Consent Management: Your preferences are saved locally in your browser and can be changed at any time via the "Cookie Settings" link in the footer. The operator maintains GA4 property settings consistent with this notice.
Optional marketing and advertising emails
Marketing consent is optional and recorded separately from required account consent. If you opt in, the service stores the consent state, time, notice version, source, a one-way IP hash, and a shortened user-agent record. You may withdraw consent in Account settings or through the unsubscribe link in each marketing email. Withdrawal does not affect required service, security, legal, or league-operation messages.
Professional-account promotion applications
The application stores the registered email address, provisional league title, purpose, expected participant count, expected duration, optional comments, request IP address and hash, consent time, review result, and granted period. Email and IP are used to review eligibility, prevent repeated requests by the same person or organization, communicate the result, and administer expiry. No payment method or automatic renewal is required.