Privacy notice draft for review · 1 October 2026. This describes the current playtest and website. Withdrawal of test consent, provider transfers and backup deletion must be verified before final adoption. Descriptions of future online services do not mean that processing has already started.
1. Controller
EXSports Oy, Finnish Business ID 2719500-4, Korkeavuorenkatu 25, 48100 Kotka, Finland. Privacy and other enquiries: info@exsports.fi. Company details and telephone. This notice covers the EXS World Tour Android game (fi.exsports.exsworldtour), its playtest and worldtour.exsports.fi.
2. Data in the current playtest
- On your device: settings, language, tutorial and career progress, personal results and replays, and technical logs. Local logs may be created before you accept participation.
- Test data sent to the server: a random installation identifier and session identifier, timestamps and game version; jump results and tricks, attempts and progress, settings and language, performance measurements, warnings and crash logs.
- Device information: manufacturer, model, operating system, processor architecture, memory and core count, graphics hardware, refresh rate, screen resolution and density. Network infrastructure also processes the connection's IP address.
- Test invitations: if you register with us for testing, the contact details you provide and the Google account email needed to manage test access. That address is not added to the game's automatic telemetry uploads.
- Support requests: the email address and message you provide, and additional information needed to handle the issue.
The installation identifier is not your name, but sessions with the same identifier can be linked. This is pseudonymous rather than fully anonymous data. The current game does not request location, contacts, camera or microphone access and contains no advertising-network tracking. No player account is created in the current test.
3. Purposes and legal bases
Local game data enables play and stores progress. Identifiable test logs help fix faults, assess performance and controls, and balance the game. They are not used for targeted advertising or sold to advertisers.
The intended legal basis for test analytics is separate consent (GDPR Article 6(1)(a)). The current test build only permits starting through an acceptance screen; it does not yet offer play without uploads or withdrawal in settings. Correcting this flow and ensuring freely given consent are prerequisites for adopting this notice. Acceptance of game terms does not replace that consent.
Support uses information necessary for contractual matters to perform the contract (6(1)(b)); other enquiries and necessary security rely on legitimate interests in handling communications and protecting the service (6(1)(f)). Information required by law is processed to comply with that obligation (6(1)(c)). The basis and necessity are assessed by data category; wanting to improve a game does not justify unlimited collection.
Sending your requested test invitation and managing test access rely on our legitimate interest in organising a closed test (6(1)(f)). Google Play processes the tester group in its service. You can end participation and request removal from the group by email; without the address needed for test access, an individual invitation cannot be provided.
4. Providers and transfers
The current test sends technical logs to Supabase, which processes them on EXSports' behalf. Project documentation places the database in Ireland, but the cloud configuration, agreement and backup location must be confirmed before this draft is adopted. The website is distributed through GitHub Pages; GitHub processes visitors' IP addresses, among other information, for service security.
Providers may process information outside the EU/EEA even when the primary database is in the EU. We therefore do not promise exclusively EU-based processing. The final notice must confirm the applicable transfer mechanism, such as an adequacy decision or EU Standard Contractual Clauses with any necessary additional safeguards. You may request information about safeguards by email.
Provider details: Supabase Data Processing Addendum and GitHub Privacy Statement. For any future purchase, Google Play handles payment and account information under its own terms; EXSports does not receive your full payment card number.
5. Retention and deletion
The company has approved a maximum retention of 90 days after the relevant test period ends for identifiable test data. Testers will be informed when testing ends. Unnecessary data is deleted earlier. Where an earlier acceptance screen promised retention only during testing, that shorter promise applies; the new maximum does not retrospectively extend it.
Deletion covers identifiable test datasets and copies controlled by EXSports. Backup expiry still needs verification; this notice does not claim automated deletion is already implemented. Truly anonymised statistics may be retained if they can no longer be linked to a person or installation.
Test invitation contacts are retained for test access and necessary test communications, no longer than the test-data limit above. Support correspondence is retained as needed to resolve the issue and necessary legal claims. Any legally required transaction records are retained for the applicable statutory period. If data must remain following a deletion request, we explain the scope and reason. Device saves remain until you remove them or the app; this does not delete information already sent to the server.
6. Your rights and requests
Subject to applicable conditions, you may request access, correction, erasure, restriction and portability of your data. You may object to processing based on legitimate interests and withdraw consent for future processing. Withdrawal does not affect the lawfulness of earlier processing.
Email info@exsports.fi. See the practical deletion instructions, including if you do not have an account. We respond without undue delay, generally within one month. If a legally permitted extension of up to two additional months is necessary, we explain the reason within the first month.
You may complain to the Finnish Data Protection Ombudsman or another competent supervisory authority. The current test does not make solely automated decisions with legal or similarly significant effects within the meaning of the GDPR.
7. Children and the future full release
The current test is for ages 13 and over. If a child participated contrary to this limit, a guardian can contact us to investigate and request deletion. The full release's PEGI 3 target concerns content. Children's analytics, accounts and any parental consent process will be designed separately before launch; consent ages and other requirements may vary by country.
8. Website and future online services
The current website has no analytics or advertising tracking, sign-in, or cookies set by EXSports. See cookies and technical information. An email link opens your own email application.
Firebase, Google sign-in and World Rank are future features. An updated notice will specify account identifiers, public nicknames, runs, any replays/videos, security information, recipients and retention periods. Current scores on the website are examples. New processing purposes will be explained before launch, with separate consent where required.