1. Data Controller
Komáromi Társasjáték Klub (hereinafter "KTK" or "we") Website: ktklub.com Email: info@ktklub.com
2. What Data We Collect
2.1 REGISTRATION & PROFILE
When you register, we collect: your nickname, email address, and password (stored only in hashed form using bcrypt). Optionally, you may provide: favorite games, a short profile bio, and a profile picture.
2.2 TABLE RESERVATION
When making a table reservation, we collect: your name, email address, reservation date and time, table type, and number of players.
2.3 Finding opponents and D&D sessions
When you create or join a player search or a D&D session we collect: the name of the game or campaign, the date, the time, the maximum number of players, and the chat messages between participants. Chat messages are deleted automatically once the date of the game or session has passed.
2.4 KTK NEXUS APP
When using the NEXUS mobile application, we collect and store the following data:
Data stored on device: authentication token, user ID, nickname, email address, avatar URL, language preference, VP counter game data, Nexus Bird score, and user preferences (notifications, intro tips state). This data is stored exclusively on your device (SharedPreferences) and is automatically deleted when you uninstall the app.
Push notifications: We use Firebase Cloud Messaging (Google) to send push notifications. We store a device identifier (FCM token) on our server. The FCM token contains no personal data — it is used solely to deliver notifications.
Bug reports: If you submit a bug report from the app, we collect: your email address, the bug description, device type, Android version, and app version.
Club chat & private messages: Club chat messages between registered members and private messages between friends are stored on our server.
2.5 TECHNICAL DATA
We use only essential functional cookies (a login session cookie and one that remembers your chosen language). We do not use tracking cookies, third-party analytics, or advertisements. The app contains no advertisements and uses no analytics SDKs.
2.6 NEWSLETTER
We send a newsletter about club events, tournaments and news. Registering on the website or in the KTK Nexus app automatically subscribes you to our newsletter. If you do not want it, you can unsubscribe at any time: every e-mail has an unsubscribe link at the bottom, you can switch it off in your account (My account → My details), or write to us at info@ktklub.com. You can also subscribe on the website without registering; in that case we send a confirmation e-mail and add you to the list only after you confirm.
For this we process your e-mail address, your chosen language, and when and how you subscribed. Legal basis: for registered members, our legitimate interest in keeping them informed about club life (Art. 6(1)(f) GDPR) — you can object at any time by unsubscribing; for people who subscribe on the website, their consent (Art. 6(1)(a) GDPR). The newsletter is sent by Brevo (Sendinblue SAS, France) as our processor; it stores the data within the EU. Brevo measures e-mail opens and link clicks so we can see what interests you. After you unsubscribe we send no further newsletters; on request we permanently delete your address from the list.
2.7 SERVER LOG AND CONTACT FORM
The server that runs the website — like almost every website’s — writes a short log entry for every request: the IP address, the time, the page opened and the browser type. We keep it only for security and troubleshooting (for example to recognise attack attempts), and it is deleted automatically after 14 days. IP addresses sending repeated suspicious attempts (for example mass password guessing) are blocked temporarily; those entries are deleted after at most 4 weeks. Legal basis: our legitimate interest in running the service securely (Art. 6(1)(f) GDPR).
If you write to us through the contact form, besides your name, e-mail address and message we also record your IP address, so that we can filter out unwanted (spam) messages. The message reaches us by e-mail at info@ktklub.com; the copy stored on the server is deleted automatically after at most 2 years. Legal basis: our legitimate interest in answering your enquiry and filtering out abuse (Art. 6(1)(f) GDPR).
2.8 GAME RATINGS IN THE BOXES (NFC STICKER)
Anyone can rate a game with the sticker in its box, without signing up. We store the star rating and, if you give it, your name. If you report that something is missing or damaged in the box, we keep your short note too, and if you suggest a game for the club to buy, that suggestion as well. Only the club organisers see these: we use them to keep the game library in order and to decide what to buy. So that the same game can only be rated once a day from one phone, your browser gets a random identifier (the ktk_rv cookie); the server keeps only an irreversible fingerprint of it and of your IP address, and deletes that after 30 days. Giving your name is optional. Legal basis: our legitimate interest in running the club's game library (Article 6(1)(f) GDPR).
3. Purpose of Data Processing
We process your data solely for the following purposes: managing your account and profile, providing table booking, enabling opponent and D&D session finding, chat communication (club chat, player-search chat, D&D session chat, private messages), sending push and e-mail notifications (confirmation, joining, chat messages, reminders, opening-hours notice), displaying the Nexus Bird and 2048 leaderboards, managing votes and announcements, and protecting the service (brute-force protection, rate limiting).
Sending the newsletter too (see 2.6): club events, tournaments and news by e-mail — until you unsubscribe.
4. Legal Basis
We process data based on your consent (Art. 6(1)(a) GDPR) — given at registration by accepting the privacy checkbox. You may withdraw your consent at any time by contacting us or deleting your account.
The newsletter is the exception: registered members receive it on the basis of our legitimate interest (Art. 6(1)(f) GDPR), which you can object to at any time by unsubscribing; people who subscribe on the website without registering receive it on the basis of their consent (see 2.6).
5. Data Sharing
We do not sell, rent or share your personal data with third parties. For push notifications we use Firebase Cloud Messaging (Google) — the only thing sent to Google is a device identifier (FCM token). Your nickname is visible to other members in player searches, D&D sessions, the club chat and the Nexus Bird leaderboard. Your e-mail address is never shown to other users.
Exception: to send the newsletter we pass your e-mail address and chosen language to Brevo (Sendinblue SAS, France), which processes them as our processor, only on our instructions, and stores them within the EU.
5.1 THIRD-PARTY SERVICES (SDKS)
The app and website use the following third-party services:
- Firebase Cloud Messaging (Google LLC): For sending push notifications. The only thing we send is a device identifier (FCM token). Google privacy policy: policies.google.com/privacy
- Glide (Bumptech): For loading and caching images. Glide collects no personal data — it operates exclusively in device memory and cache.
- Retrofit / OkHttp (Square): For network communication with our server. These libraries do not collect or forward data to third parties.
- Brevo (Sendinblue SAS, France): For sending the newsletter. It receives your e-mail address and chosen language; the data is stored within the EU. Privacy policy: brevo.com/legal/privacypolicy
Beyond these, we use no analytics, advertising, tracking or social media SDKs.
5.2 DATA TRANSFERS OUTSIDE THE EEA
Firebase Cloud Messaging operates on Google LLC servers, which may be located in the United States or other countries outside the European Economic Area (EEA). Google ensures an adequate level of data protection under the EU–US Data Privacy Framework. All other personal data is stored exclusively on servers within the EEA.
6. Data Retention
- Account data: as long as your account is active.
- Table reservations: automatically deleted 7 days after the reservation date.
- Game requests and chat messages: automatically deleted 1 day after the game date.
- D&D sessions and chat messages: deleted automatically after the date of the session.
- Push notification tokens: as long as your account is active; the token becomes inactive after the app is uninstalled.
- Data stored on device: automatically deleted when the app is uninstalled.
- Newsletter: for as long as you are subscribed. After you unsubscribe we send nothing more; we keep the fact that you unsubscribed so you are not added back to the list. On request we delete your address permanently.
- Server log (IP address): 14 days; security blocks: at most 4 weeks.
- Contact form and chatbot messages: on the server for at most 6 months.
- Visit statistics: 24 months. Anonymous, aggregated figures — no IP address and no identifier.
- Game ratings: while the game is in the library (the phone and IP fingerprint is deleted after 30 days); missing-part reports: 90 days after they are resolved; buying suggestions: 12 months.
You may request deletion of your account and all associated data at any time (see section 12).
7. Data Security
Passwords are hashed using bcrypt (never stored in readable form). Sessions are authenticated using tokens. Forms are protected with rate limiting (max 10 login attempts / 5 registrations per 15 minutes per IP address). CAPTCHA and nonce tokens are used for form validation. Data transfer is encrypted via HTTPS/SSL on both the website and the app.
8. Your Rights
Under the GDPR, you have the right to: access your data, rectify inaccurate data, erase your data, restrict processing, data portability, and object to processing. To exercise these rights, contact us at info@ktklub.com, or use the deletion options available in the app and on the website.
If you feel we have violated your rights, you can also lodge a complaint with the Slovak data protection authority: Úrad na ochranu osobných údajov Slovenskej republiky (dataprotection.gov.sk).
9. Cookies
We use only essential cookies: a session cookie (PHPSESSID, for login sessions) and one that remembers your chosen language (ktk_lang). Neither tracks you nor builds a profile. We do not use any marketing, analytics, or tracking cookies. The app does not use cookies — data stored on the device is managed via the SharedPreferences mechanism.
We measure site traffic without cookies, anonymously (Umami, running on our own server). It uses no cookies, builds no profile and stores no personal data — only aggregate, anonymous statistics (pages viewed, referring source, country, browser). No third party has access to it.
10. Children's Policy
The app and website are not intended for children and are not directed at users under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that we have stored data from a person under 13, we will delete it without delay. If you believe we are storing your child's data, please contact us at info@ktklub.com.
11. Changes to This Policy
We may update this privacy policy from time to time. We will notify you of any material changes via email, a notice on the website, or an in-app notification.
12. Account & Data Deletion
You may request deletion of your account and all associated personal data in the following ways:
- By email: info@ktklub.com
- Via the web form: Delete account
Within 30 days of receiving the request we permanently delete all of your personal data. Deletion covers: account information, profile data, avatar, table bookings, player searches, D&D sessions, chat messages (club chat, private messages, player-search chat), Nexus Bird and 2048 scores, voting history and push notification tokens. Deletion is permanent and cannot be undone.
Deleting your account also removes you from the newsletter list, including the address stored with Brevo.
13. Contact
If you have questions about this privacy policy or your data, contact us at: info@ktklub.com
Effective from 19 September 2026
The KTK Community rules have moved to the House rules page — you will find them there together with the rules that apply in the club.
Go to the house rules →