1. Data Controller Information

The Data Controller responsible for your personal data across the NUGS Ecosystem, including Esports Arena, NUGS Ascent, Partner Portal, OBS Overlay Suite, and Official Merch Shop, is NUGSAU LIMITED, registered in the United Kingdom.

If you have questions regarding this policy or wish to exercise your data rights, please contact our Data Protection Office via email at info@nugsau.com.

2. Categories of Information We Collect

We collect and process the following categories of personal data:

• Account & Registration Data: Real Name, Username, Email Address, Password hashes, Date of Birth (for age restriction & KYC verification), and Country/Region of Residence.
• Identity & KYC Verification Data: Government Photo ID scans, address proof documents, and verification status badges for users requesting wallet withdrawals or competing in cash prize events.
• Hardware & Peripheral Credentials: Verified controller/mouse/keyboard specs, display refresh rates, and linked competitive gamertags (PlayStation Network ID, Xbox Gamertag, Steam ID, Epic Account ID).
• Financial & Transaction Data: Payment transaction IDs, wallet deposit/withdrawal history, prize payout distributions, and subscriber tier statuses. Sensitive card details are handled directly by certified payment processors (PayPal, Revolut, Stripe) and are never stored on our servers.
• Gaming & Performance Telemetry: Tournament match scores, bracket progression, Skill Score ratings, Manager Skill (MS) ratings, reputation points (REP), and community sport ratings.
• Third-Party & Bot Data: Discord User IDs and OAuth tokens used to automatically synchronise competitor roles across community Discord servers.

3. Lawful Bases for Data Processing (UK GDPR Article 6)

We process your personal data under the following lawful bases:

• Contractual Necessity (Art. 6(1)(b)): Processing necessary to deliver platform services, host skill competitions, process merchandise orders, and distribute prize pool earnings.
• Legal Obligation (Art. 6(1)(c)): Processing required to comply with statutory anti-money laundering (AML), tax reporting, and youth protection regulations.
• Legitimate Interests (Art. 6(1)(f)): Processing required for anti-cheat detection, platform security, preventing fraudulent multi-accounting, and maintaining fair-play community standards.
• Consent (Art. 6(1)(a)): Processing based on explicit user consent, such as non-essential cookie tracking or optional promotional newsletters.

4. How We Use Your Personal Data

Your data is processed strictly for legitimate operational purposes:

• Creating and managing your global player profile across the NUGS ecosystem.
• Verifying hardware peripherals and enforcing fair-play anti-cheat standards.
• Facilitating automated tournament bracketing, matchmaking, and leaderboard calculations.
• Processing membership pass billing, store orders, and partner store payouts.
• Transmitting real-time stream overlays to your OBS Studio or Streamlabs software.
• Providing customer service and resolving match score dispute tickets.

5. Data Sharing & Third-Party Processors

We do not sell, rent, or trade your personal data. Data is shared exclusively with vetted sub-processors required to operate our ecosystem:

• Payment Processors: PayPal, Revolut, and Stripe process payments and wallet payouts under strict PCI-DSS compliance.
• Merchandise Fulfillment: Printful receives delivery names and shipping addresses to manufacture and dispatch on-demand shop orders.
• Infrastructure & Cloud Storage: Firebase (Google Cloud Platform) securely hosts user databases and media files under encrypted server environments.
• Integrated Messaging Services: Discord API is used to synchronize supporter tier roles and send match notifications.
• Statutory & Law Enforcement Bodies: We may disclose data when legally required by court order, law enforcement investigation, or regulatory compliance mandates.

6. International Data Transfers

Where personal data is transferred outside the United Kingdom or European Economic Area (EEA), we ensure appropriate safeguards are implemented in accordance with UK GDPR. This includes utilizing International Data Transfer Agreements (IDTAs), UK Addendums to EU Standard Contractual Clauses (SCCs), and adequacy decisions.

7. Cookies, Tracking & Advertising Preferences

We use essential session cookies to maintain secure user logins and navigation state. We also utilize performance cookies to analyse ecosystem traffic and optimize server responsiveness.

Google AdSense & Third-Party Vendors: Third-party advertising partners, including Google, may set cookies to serve non-intrusive advertisements based on prior visits. Users can manage or opt out of personalised advertising settings at any time by visiting Google Ads Settings.

8. Data Retention Policies

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected. Financial transaction records, withdrawal logs, and KYC verification records are retained for a minimum of 6 years following account closure to satisfy UK tax and Anti-Money Laundering statutory requirements.

9. Your Rights Under UK GDPR

Under the UK General Data Protection Regulation, you possess the following legal rights:

• Right of Access (Subject Access Request): You have the right to request a copy of the personal data held about you.
• Right to Rectification: You can request the correction of inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your account and personal data, subject to statutory financial retention exemptions.
• Right to Restrict Processing: You can request that we suspend processing your personal data under specific conditions.
• Right to Data Portability: You have the right to receive your personal data in a structured, machine-readable format.

To exercise any of these rights, please email our Data Protection Desk at info@nugsau.com. We respond to all valid requests within 30 calendar days.

10. Children's Privacy & Youth Safeguards

The NUGS platform does not knowingly collect data from children under 13 years of age. Registration is strictly limited to individuals aged 13 and older. If we discover that personal data of a child under 13 has been collected without verified parental consent, we will take immediate steps to purge the account data.

11. Security Measures & Encryption Standards

We implement robust technical and organisational security controls to protect personal data against unauthorized access, loss, or alteration. These measures include TLS 1.3 in-transit encryption, AES-256 at-rest database encryption, strict role-based access controls, and continuous vulnerability monitoring.

12. Complaints & Information Commissioner's Office (ICO)

If you have concerns about how we handle your personal data, we encourage you to contact us first. You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO):