Privacy policy

1. Who we are

TheChessSuperApp is operated by Lessader, which is responsible (the controller) for the personal data described in this policy. Clubs, federations, schools and coaches that enter data about their players answer for that data being correct, as the terms of service explain. You can reach us at privacy@lessader.com.

2. Data we collect

• Account: your email address, when you sign in, and which version of the terms of service and of this policy you accepted, and when.
• Last seen: one date and time, the last day you used the site signed in. It is written at most once a day and overwritten each time: no history, no address of your device, no browser details.
• Player profile: name, birth year, sex, federation and FIDE ID, and what the FIDE rating list says about that ID (title, ratings).
• Tournaments: entries, pairings, results, standings and the tournament files organizers upload.
• Organizations: clubs, federations and organizers, their members and their roles.
• Reports: when you report a page to our staff, which page, why and the words you add. Nobody behind the page is told who reported it.
• Technical: the cookies the site needs (see "Cookies") and server logs (address of your device, time, page) kept for security.
• Minors: only what the section "Minors" says.

We do not collect identity documents and we do not buy data about you.

3. Purposes and legal basis

• Running the service you signed up for (your account, entering events, your results): the agreement between you and us.
• Publishing pairings, results, standings and ratings: the legitimate interest of the players, organizers and the chess community in a public and verifiable sports record, and the FIDE rules for rated events.
• Security, preventing abuse and handling fraud reports: our legitimate interest.
• Activity statistics (how many accounts used the site in the last 30 days), from the last-seen time: our legitimate interest in knowing how much the service is used.
• Data about minors: the consent of the parent or guardian.
• Obligations the law sets on us, such as keeping accounting records of paid entries.
• Sponsors: we count how many times ads are seen and clicked, without knowing who saw or clicked them.

We do not sell personal data and we do not use it for profiling or targeted advertising.

4. Minors

• A parent or guardian creates and manages the profile of a child, gives and records consent, and receives all notifications. Children under 13 have a profile but no account.
• A child's profile holds only a FIDE ID, or a real name and birth date entered by the parent with consent. No nicknames, photos, contact details or addresses.
• To enter events a child needs a club, federation, school or coach that vouches for them. The age comes from FIDE or the federation's registry, otherwise from that voucher.
• Arbiters check age in person when a prize depends on it; nothing is stored. A confirmed age fraud is a strike against the club or federation, never the child, who is shown as "Minor, name hidden".
• Share buttons on a child's page are shown only to the parent, and share images show name and result only.

5. Public data

Players' names, federation, title, rating and tournament results are public, like on any chess results site, and may appear in reports to FIDE and to national federations. The birth year of a minor and your email address are never public.

6. Processors and sharing

We use service providers (processors) that handle data for us. They are listed at the end of this policy, with what they do for us and where. Data processing agreements with them are being put in place. We give data to authorities only when the law requires it.

7. International transfers

The list at the end of this policy shows the region of each processor, so you can see where your data is handled. Where data leaves the Dominican Republic, we are putting agreements in place so that it keeps an equivalent level of protection.

8. How long we keep data

• Account and profile: while the account exists. When you close it we delete them within 30 days, except what follows.
• Tournament results: kept as a public sports record.
• Sign-in codes: valid for 10 minutes and for one use only.
• Strikes: 2 years.
• Last seen: overwritten the next day you use the site signed in, and deleted with the account.
• What you accepted (versions and dates): as long as the account exists, so we can show your consent.
• Reports you made: as long as the account exists; deleting the account deletes them.
• Server logs: at most 90 days.
• Accounting records of paid entries: as long as the law requires.

9. Your rights

Under the Dominican Law 172-13 on the protection of personal data and, where it applies, the European General Data Protection Regulation (GDPR), you have the right to:

• access the data we hold about you;
• correct it when it is wrong or incomplete;
• delete it (cancellation), except accurate results in the public record and data the law obliges us to keep;
• object to the use of your data based on our legitimate interest;
• withdraw your consent at any time, for example a parent for their child's profile, without affecting what was done before;
• receive a copy of your data in a common format.

To exercise them, write to privacy@lessader.com from the email address of your account, or the parent's account for a child. We answer without undue delay and within the time the law sets. If you are not satisfied, you can bring a habeas data action before the courts of the Dominican Republic, or complain to the data protection authority of your country where the GDPR applies.

10. Security

The site is only served over encrypted connections. Sign-in codes are stored as hashes, staff use a second sign-in step, and only the staff who need it can reach personal data. If a breach puts your data at risk, we tell you and the authorities without undue delay, and within 72 hours where the law requires it.

11. Cookies

We use only the cookies the site needs to work: your sign-in session, your language and the protection of forms against forgery. No tracking or advertising cookies, and no analytics from third parties.

12. Changes to this policy

Each version of this policy has a number and an effective date, shown at the top of this page. When a new version is published, signed-in users are asked to accept it before they continue.

13. Contact

Questions about this policy or your data: privacy@lessader.com.