Privacy at Cyber-Ball Manager
Effective
The short version
We use your information to run your account, keep your club going and deal with problems. The newsletter is optional. You can ask what we hold about you, request a copy, correct it, or ask us to permanently delete your account.
Our fictional sponsors have questionable ethics. Your personal data is not part of their business model.
For permanent deletion, sign in and open a Support ticket. Say that you want your account and personal data permanently deleted. If you cannot sign in, email support@cyber-ball.com.
Who is responsible
Fifth Season AS, Oslo, Norway, operates Cyber-Ball Manager and is the data controller. Contact us through in-game Support or at support@cyber-ball.com. This notice covers the public website, the game, Support and the CBM newsletter.
The game is for people aged 16 and over. We ask you to confirm that you meet that age requirement and record the confirmation date, rather than collecting your date of birth. We don't really want to know how old you are.
Your account and sign-in
Google verifies your sign-in. CBM stores your Google account identifier and verified email address. We do not store your Google display name or profile-picture address. Signing in gives us no access to your Google password, Gmail, contacts or files.
We store your account number, account dates, language, age confirmation, permissions and account status. We initially estimate your country from your IP address. Sign-in records include your IP address, browser details and session dates. Account recovery records include the email addresses and IPs used, and whether recovery succeeded.
We use this information to run and protect your account, remember your choices and help when something goes wrong. You need a Google account and these necessary account details to play. You can browse the public site without signing in.
Your club and the community
We store your club name, description, uploaded images, preferences, game decisions, activity times, matches, transfers and game history. We also store your credit balance, transactions and Friends list.
Posts, reactions, chat, in-game mail and attachments contain what you choose to share. Support stores your tickets, images and our replies. Staff keep reports, warnings, cases and notes when dealing with problems and enforcing the rules. Please leave sensitive real-world information out of public posts and screenshots.
You can choose to use a referral link when creating your account. This links the accounts for referral credits. Following a link alone does not set a referral cookie. Ask Support if you want the connection removed.
Checkout currently uses FakePal. It charges no real money. We store test purchases and credit records, but no payment-card details. We will update this notice before taking real payments.
Why we are allowed to use it
Running your account, the game, requested community features and Support is part of our agreement with you. That is the legal basis for using the information these services need, GDPR Article 6(1)(b).
Security, moderation and fault reports help us keep the game working, protect accounts and deal with abuse or disputes. We rely on legitimate interests, Article 6(1)(f). We weigh those needs against your rights and limit the information used.
The optional newsletter and referral choice rely on your consent, Article 6(1)(a). You can withdraw it at any time without affecting earlier lawful use. We keep records needed to handle your privacy rights or meet a specific legal duty under Article 6(1)(c).
Reading this notice or agreeing to the game rules does not give us blanket consent to use your information for other purposes.
Storage and service providers
Fifth Season operates the CBM server and stores game data and our backups in Oslo, Norway, within the European Economic Area. GlobalConnect provides the physical hosting facilities and internet connection. It has no access to our data.
Google may process information outside the EEA, including in the United States. Its own privacy policy covers Google sign-in. For Workspace customer data, Google acts as our processor under its standard business agreement and Cloud Data Processing Addendum.
Google's transfer safeguards include adequacy decisions such as the EU-US Data Privacy Framework, and standard contractual clauses where required. The linked Google documents explain which apply. Ask Support for details about the safeguards for your data or a copy of the applicable clauses.
Cookies and browser storage
The sign-in cookie normally keeps you signed in for 30 days. Security cookies protect your requests and last for the browser session. Logging out ends your current sign-in session.
Temporary browser storage helps with account recovery, prevents duplicate checkout requests and remembers statistics-view choices. We remember your chat channel only while the page is open.
The front page connects to Google when you choose sign-in. Account recovery also uses Google. Google may use its own cookies, as explained in its privacy notice.
We use no advertising trackers. Blocking necessary browser storage can prevent sign-in or other requested features from working.
How long we keep it
We keep account information until you delete the account. Closing an account for inactivity or rule-breaking does not delete it. We remove expired or revoked sign-in records and expired recovery records within 30 further days. We keep operational logs for up to 90 days.
We remove ordinary in-game mail after 60 days. Mail marked important is excluded, but that does not override a valid privacy request. Community content stays while we provide the feature, subject to your rights and removal requests.
We review resolved Support tickets, completed privacy requests and moderation records after 12 months. We delete or anonymize what we no longer need. Anything kept for an ongoing dispute or legal duty has a recorded reason and review date. We do not keep every case forever by default.
Copies prepared for staff to review a privacy request are deleted within seven days. Newsletter addresses stay while you subscribe. We keep opt-out records only while needed to keep you off old mailing lists, and remove working copies we no longer need.
After we remove data from Google Workspace, Google can take up to 180 days to complete its own deletion process under its processing terms.
We keep restricted backups to recover the whole system after technical problems. They expire no later than 90 days after creation. After a restore, we reapply completed deletions before reopening the game. We keep a separate deletion record for 91 days, and longer only if needed to finish backup cleanup or reapply a deletion. Backups do not provide individual account recovery or postpone deletion from the live game.
Your rights and permanent deletion
Ask Support what we hold about you and request a copy. You can ask us to correct, delete or restrict use of your data, object to uses based on legitimate interests, or withdraw consent for optional uses. Where portability applies, you can request a reusable electronic copy, such as JSON or CSV.
For deletion, open a Support ticket and say you want your account and personal data permanently deleted. This also covers the newsletter subscription on that address. No special wording required.
Deletion permanently ends account access and your management of the club. We remove your account, sign-in link, associated personal records and uploaded files, and review related cases and shared content. Some shared game results can remain with identifying links removed. Your Google account is unaffected.
When a staff account is deleted, retained Support replies, internal comments and moderation notes move to the continuing administrator's account, with their name shown as author. We remove the departing staff member's author details and review the content for personal information. We still delete their own personal Support tickets.
If a legal duty or legal claim requires us to keep limited information, we explain what stays, why and for how long. We also protect other people's privacy when preparing copies or reviewing shared conversations.
If you cannot sign in, email support@cyber-ball.com. We may ask for evidence that the account is yours. Never send your Google password. Requests are normally free. We respond without undue delay and within one calendar month of receipt. For complex requests, we may need up to two further months; we explain any extension within the first month. If we cannot grant your request fully, we explain why and how to challenge it, including through Datatilsynet or the courts.
Automatic decisions and complaints
CBM automatically runs matches, training and game balances. Inactivity and warning rules can also restrict account access. You can ask Support for human review of an account decision, or email us if you cannot sign in.
You can complain directly to Datatilsynet, Norway's data protection authority, or the supervisory authority where you live or work in the EEA. You do not have to contact us first.
We update this notice when our use of your data changes. We tell affected managers about material changes before they take effect, and ask for fresh consent when required.