Privacy Policy

1. Introduction

This Privacy Policy describes how Tabula Belli collects, uses, stores, and protects personal data when you access or use our platform.

We are committed to handling your information in a lawful, fair, and transparent way, in line with applicable data protection regulations, including the General Data Protection Regulation (GDPR).

By using Tabula Belli, creating an account, or participating in events through the platform, you acknowledge that you have read this Privacy Policy and understand how your personal data is processed.

2. Data Controller

The data controller responsible for your personal data in connection with Tabula Belli is the operator of the platform.

If you have any questions about this Privacy Policy or about how we process your data, you can contact us via the Contact page available on the website.

3. Personal Data We Collect

The type of information we collect depends on how you interact with the platform.

3.1 Account Information

When you create and use an account on Tabula Belli, we may process:

• Username – your chosen display name on the platform
• Email address – used to identify your account, to help you recover access if needed, and to contact you regarding important issues related to your account or events. This email address is not automatically made public
• Password – stored only in hashed or encrypted form; we never store or see your password in plain text
• First and last name (optional) – if you choose to add them to your profile
• Location information (optional) – such as country, region, or city, if you decide to provide it to help discover local events
• Favorite games (optional) – a list of games or systems you are interested in, if you choose to add this information to your profile

3.2 Event Data

When you create, manage, or participate in events on Tabula Belli, we may process:

• Event details – including title, description, dates, location, capacity, game or system type, and any other information you choose to include in the event listing
• Registration information – records of which events you register for, when you register, and changes to your registration status (for example, confirmation or cancellation)
• Organizer contact email for the event – an email address that an organizer is required to provide as a contact point for that specific event. This email is shown on the event page so interested users can reach the organizer. It can be the same as or different from the email used for the organizer's account

3.3 Technical and Usage Data

To operate and secure the platform, we automatically collect certain technical data, such as:

• Session cookies – small files that enable basic functions such as staying logged in while you move between pages
• Security tokens (for example, CSRF tokens) – used to help prevent malicious actions and protect your account
• Timestamps and logs – records of key actions (for example, account creation, logins, event creation or updates) to help maintain security, diagnose issues, and improve the service

4. How We Use Your Data

We use your personal data for the following purposes:

• Account management – to create, maintain, and manage your user account
• Authentication – to verify your identity when you log in and to help protect your account from unauthorized access
• Event functionality – to allow you to create events, display event information, manage registrations, and let other users discover and join events
• Registration management – to keep track of which users have registered for which events, and to allow organizers to manage attendance and capacity
• Service-related communication – to send essential information related to your account or events in which you are involved (for example, confirmations, important changes, or security notifications). We do not use your data to send marketing newsletters or advertising campaigns
• Location-based features (optional) – to suggest or display events that are geographically relevant to you, if you have provided location data
• Platform maintenance and improvement – to understand how the platform is used, to fix bugs, enhance performance, and plan new features
• Security and misuse prevention – to monitor, detect, and prevent fraudulent or abusive activity, and to protect the rights, property, and safety of users and the platform

5. Legal Bases for Processing (Under GDPR)

Under the GDPR, we rely on several legal bases to process your personal data:

• Performance of a contract – when processing is necessary to provide the services you request (for example, managing your account, enabling you to create or join events)
• Consent – when you voluntarily provide optional data (such as location or favorite games) or choose to use specific features that require additional information. You can withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal
• Legitimate interests – when we have a legitimate interest in operating, improving, and securing the platform (for example, preventing abuse or analyzing how features are used), provided that these interests do not override your rights and freedoms
• Compliance with legal obligations – when we need to retain or disclose certain information to comply with laws or regulatory requirements

6. Cookies and Similar Technologies

Tabula Belli uses only cookies and similar technologies that are strictly necessary for the core functionality of the platform. These are required to provide the service you request and therefore do not require your prior consent under GDPR.

Examples of cookies we may use include:

• Session cookies (such as a session identifier) that keep you logged in as you navigate the site and that are typically deleted when you close your browser
• CSRF or security cookies that store tokens used to protect forms and actions from cross-site request forgery and similar attacks

We do not use:

• Advertising or profiling cookies
• Analytics cookies (such as Google Analytics)
• Social media tracking pixels
• Third-party cookies that track your behavior across different websites

You can configure your browser to block or delete cookies, but doing so may affect the basic functionality of the platform (for example, you might not be able to stay logged in or use certain features).

7. Who We Share Your Data With

We do not sell, rent, or trade your personal data to third parties. However, certain information is visible to other users as part of the platform's functionality:

7.1 Public Information

• Your username – Visible to all users when you create events or register for them
• Event details – If you organize an event, its details (title, description, location, date) are publicly visible
• Organizer contact email – The contact email that event organizers are required to provide appears on the event page for anyone viewing the event
• Location – Only if you've chosen to display it in your profile

7.2 What Stays Private

• Your password (encrypted and never visible to anyone, including us)
• Your registration history (only you and event organizers can see who registered for an event)

8. Data Storage and Security

Your data is stored in secure systems operated by us or by carefully selected service providers.

We implement appropriate technical and organizational measures to protect your personal data, including:

• Password hashing – passwords are transformed using industry-standard hashing algorithms before storage
• Access controls – restricting access to databases and systems to those who need it for operational purposes
• Security protections – such as CSRF protection, secure session handling, and regular updates to the platform's software components
• Monitoring and maintenance – using logs and technical data to detect unusual behavior, troubleshoot issues, and keep the service stable and secure

Despite our efforts, no method of storage or transmission over the internet is completely secure. We cannot guarantee absolute security, but we strive to protect your data to a reasonable and appropriate degree. You are responsible for choosing a strong password and for keeping your login credentials confidential.

Where possible, we aim to store and process data within the European Union or the European Economic Area (EEA). If data is ever transferred outside the EEA, we will take measures to ensure an adequate level of protection, for example by relying on standard contractual clauses or equivalent safeguards.

9. Data Retention

We retain personal data only for as long as it is reasonably necessary for the purposes described in this Privacy Policy or as required by law.

In particular:

• Active accounts – we keep account-related data for as long as your account remains active
• Events and registrations – information about events and registrations may be retained as part of the platform's history and for organizers to manage their records
• Cancelled registrations – we may keep records of cancelled registrations for administrative, security, or audit purposes

If you request deletion of your account, we will remove or anonymize personal data that is no longer needed. Some limited information may remain in backups or logs for a period of time, or may be retained where necessary to comply with legal obligations or to protect our legitimate interests (for example, in case of disputes or misuse).

10. Your Rights Under GDPR

If you are located in the European Union or in another jurisdiction with similar data protection rules, you have several rights regarding your personal data. These include:

• Right of access – to request confirmation of whether we process your data and to obtain a copy of the personal data we hold about you
• Right to rectification – to request correction of inaccurate or incomplete data. Many details can also be updated directly from your account settings
• Right to erasure ("right to be forgotten") – to request deletion of your personal data in certain circumstances, for example when it is no longer needed for the purposes for which it was collected
• Right to restriction of processing – to ask us to limit the use of your data while a complaint or request is being examined, or in other specific situations
• Right to data portability – to receive your personal data in a structured, commonly used, machine-readable format and to have it transmitted to another controller where technically feasible
• Right to object – to object to certain types of processing based on our legitimate interests, in which case we will stop processing unless we have compelling legitimate grounds
• Right to withdraw consent – where the processing is based on your consent, you can withdraw that consent at any time without affecting the lawfulness of processing based on consent before its withdrawal

To exercise any of these rights, please contact us through the Contact page of the platform. We may ask you to provide information to verify your identity before acting on your request. We will respond as soon as reasonably possible and, in any case, within the time limits established by applicable law (generally within one month).

11. Children's Privacy

Tabula Belli is intended for use by adults and older teenagers who are legally permitted to use online services in their jurisdiction.

We do not knowingly collect personal data from children under 13 years of age (or the minimum age required by local law if higher).

If you believe that a child has provided personal data to us without the appropriate consent, please contact us so that we can investigate the situation and, if necessary, delete the data.

12. Changes to This Privacy Policy

We may revise this Privacy Policy from time to time, for example when we introduce new features, update how the platform works, or when legal requirements change.

When we make significant changes:

• We will update the "Last updated" date at the top of this page
• Where appropriate, we may also provide additional notice within the platform

We encourage you to review this page periodically. By continuing to use Tabula Belli after changes become effective, you will be deemed to have accepted the updated Privacy Policy.

13. Third-Party Services

At this time, Tabula Belli does not use third-party analytics services, advertising networks, or social media plugins that track you across different websites.

If in the future we integrate such third-party services:

• We will update this Privacy Policy to describe the new processing activities
• Where required by law, we will ask for your consent before enabling those services or storing any non-essential cookies

14. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or the way we process your personal data, you can reach us using the Contact page available on the platform.

If you are not satisfied with our reply, you also have the right to lodge a complaint with your local data protection authority or with the competent authority in the EU Member State where you live, work, or where you believe your rights have been infringed.