1. General Provisions

1.1. This Privacy Policy defines the procedures and conditions for processing personal data when using the Loot Arena platform (hereinafter — the Platform), including the LootArena mobile application for iOS and Android (hereinafter — the Application).

1.2. This Policy is developed in accordance with applicable data protection legislation, including the General Data Protection Regulation (GDPR) for users in the European Union.

1.3. This Policy is an integral part of the Service Agreement.

2. Data Controller

Individual Entrepreneur Karpushev Nikita Sergeevich

OGRNIP: 318352500068775 • INN: 352201555447

Email: support@lootarena.ru

2.2. Depending on the nature of processing, the Data Controller may act:

as an independent data controller;
as a data processor acting on behalf of a Client.

3. Roles in Data Processing

3.1. With respect to Client representatives (legal entities and individual entrepreneurs), the Controller acts as an independent data controller.

3.2. With respect to User data (individuals — club visitors):

3.2.1. As a data processor on behalf of the Client — for data related to: mission execution and game mechanics; bonus accrual; visit and activity tracking; analytics provision to the Client; User interaction with a specific club. The Client in this case is the data controller and bears responsibility for lawful processing grounds.

3.2.2. As an independent data controller — for data related to: ensuring Platform functionality; information security; fraud prevention; aggregated analytics; feature development and testing; anonymized statistics; legal compliance.

4. Categories of Data Processed

4.1. Client Data (independent controller): representative's full name; organization/IE name; tax identification numbers; contact phone; email; electronic document management data; payment details; technical access data (IP, logs).

4.2. User Data: Telegram ID (user_id); name, nickname, username; phone number (if provided); visit, mission, bonus, and purchase data; technical data (IP, device, OS); age verification status (if provided by the Client or integrations).

4.2a. Linked Game Accounts (voluntary). If the User links a game account, the Platform additionally processes:

Steam: SteamID, display name and avatar, public game statistics (matches played, playtime, ranks, performance metrics such as K/D and KDA) and, where available, FACEIT and OpenDota identifiers and statistics;
Riot account for League of Legends and VALORANT (when this feature becomes available), linked only through Riot Sign-On: PUUID, Riot ID, game region, match history and the User's own match statistics needed to check venue challenges.

Game account data is used to show the User's game profile and to check the conditions of challenges the User takes part in; Steam data may also appear in game leaderboards according to the User's visibility settings. Riot account data is shown only to the User who linked it. Clubs receive only the result of a challenge, not match data. The User can unlink a game account at any time; associated game data is deleted within 30 days. Data received from the Riot Games API is also deleted at the request of Riot Games or if the Platform's access to the Riot Games API ends.

4.3. Mobile Application User Data (additionally):

email address — for account recovery and communication with the User;
date of birth — for loyalty program participation (club birthday bonuses and gifts);
geolocation — for automatic check-in (requested with User permission);
device push token — for sending push notifications (requested with User permission);
device fingerprint — for the anti-fraud system.

4.4. The Controller does not process special categories of data (biometric, medical, etc.).

4a. Mobile Application Authentication

Authentication in the mobile application is performed via phone number and password. The email address is used for account recovery (one-time OTP code) and communication with the User.

5. Purposes of Processing

5.1. Clients: contract execution; accounting and tax reporting; document management; technical support; information security.

5.2. Users (depending on the role): ensuring Platform operation; identification; mission execution and bonus accrual; activity analytics; fraud prevention; feature development; aggregated statistics.

6. Legal Basis for Processing

6.1. Client data processing is based on contract performance and applicable legal requirements.

6.2. User data processing: under a commission — based on grounds provided by the Client; for independent purposes — based on contract performance, applicable law, and the legitimate interests of the Controller.

6.3. For users in the European Union, processing is based on: consent (Article 6(1)(a) GDPR); contract performance (Article 6(1)(b) GDPR); legitimate interests (Article 6(1)(f) GDPR).

7. Processing Conditions and Security Measures

7.1. Processing is carried out using automated means.

7.2. The Controller implements appropriate legal, organizational, and technical security measures.

7.3. Access to data is restricted to authorized personnel only.

7.4. The Controller may engage technical subcontractors (including hosting providers) in compliance with applicable data protection laws.

8. Data Storage and Protection

Your Data is Protected

8.1. Personal data is processed and stored with modern organizational and technical security measures.

8.2. The Controller ensures an adequate level of data protection during storage and transfer, including when using cloud providers.

8.3. Data transfer to third parties is carried out only in cases provided by law or this Policy, with an adequate level of protection ensured.

9. Data Retention and Deletion

9.1. Client data is retained for the duration of the contract and for periods required by applicable law.

9.2. User data is processed for the duration of the Client's Subscription.

9.3. In case of suspension due to non-payment, data is stored for 30 calendar days, after which it may be deleted without recovery.

9.4. The Controller may store anonymized and aggregated data indefinitely for analytics and Platform development purposes.

10. Rights of Data Subjects

Data subjects have the right to: access information about processing; request correction, restriction, or deletion of data; withdraw consent (if applicable); lodge a complaint with the relevant data protection authority.

For EU residents, additional rights under GDPR include: the right to data portability; the right to object to processing; the right not to be subject to automated decision-making.

Requests should be sent to: support@lootarena.ru

10a. Account and Data Deletion

10a.1. Users can delete their account and all associated personal data directly in the mobile application via "Profile" → "Delete Account".

10a.2. Deletion is completed within 30 days of the request.

10a.3. Data that must be retained by law (accounting records, etc.) will be kept in anonymized form until the expiration of the required retention period.

10a.4. Users may also submit a data deletion request at: support@lootarena.ru

11. Analytics and Cookies

11.1. The web version of the Platform uses the Yandex.Metrica analytics service for anonymized statistics. The mobile application does not use any third-party analytics or advertising SDKs — only first-party anonymized server-side usage statistics are collected.

11.2. Cookies and similar technologies may be used for the proper functioning of the Platform.

11.3. Users can disable cookies in their browser settings, though this may affect certain Platform features.

12. Changes to This Policy

12.1. The Controller reserves the right to modify this Policy.

12.2. The current version is available at: https://lootarena.ru/legal/privacy-en

Publication date: March 14, 2026 · updated October 7, 2026 (section 4.2a)
Document version: 2.1