Privacy Policy

Last updated: May 2026

L33t Pro Services, S.L. («L33t Pro»), based in Segovia, Spain, is the data controller for personal data collected through games.l33tpro.com (the «Portal»).

This policy complies with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD), and the privacy requirements of Steam (Valve), Google Play (Google LLC), and the App Store (Apple Inc.).

1. Data Controller

Name: L33t Pro Services, S.L.
Address: Segovia, Spain
Contact: legal@l33tpro.com

We are not required to appoint a Data Protection Officer (DPO). For any privacy questions, contact us at the address above.

2. Data We Collect

Registration: username, email, password (bcrypt hash; never plain text).
Activity: games played, scores, achievements, in-game events.
Technical: IP address, browser, OS, pages visited.
Payment: processed by Stripe or Merso. We only receive confirmation and transaction ID. No card data stored.
Platform: via Steam, Google Play or App Store we may receive your platform ID and public username per their APIs and your privacy settings.

3. Purpose and Legal Basis

Account management — contract performance (Art. 6(1)(b) GDPR).
Scores, achievements, stats — contract performance.
Security and fraud prevention — legitimate interests (Art. 6(1)(f)).
Aggregate anonymous analytics — legitimate interests.
Service communications — legitimate interests.
Marketing — consent (Art. 6(1)(a)), only if opted in.
Legal obligations — legal obligation (Art. 6(1)(c)).

4. Retention

Data kept while your account is active. On deletion request, erased within 30 days except where legally required.

Technical logs: max 90 days.

5. Recipients

We do not sell your data. Shared only with:

Infrastructure (hosting, CDN) under GDPR DPAs.
Stripe — Stripe Privacy Policy.
Merso — Merso Privacy Policy.
Umami Analytics (self-hosted, stats.l33tpro.com).
Competent authorities when required by law.

6. International Transfers

Data processed on EU servers (Spain). Transfers outside the EEA covered by Adequacy Decisions, SCCs, or other GDPR safeguards.

7. Your Rights

Under GDPR and LOPDGDD you have the right to:

Access your data.
Rectification of inaccurate data.
Erasure (right to be forgotten).
Restriction of processing.
Objection to legitimate-interest processing.
Portability in structured format.
Not be subject to automated decisions.
Withdraw consent at any time.

Email legal@l33tpro.com.

8. Supervisory Authority

You may lodge a complaint with the AEPD: www.aepd.es or your EU/EEA supervisory authority.

9. Children

Not for children under 14 in Spain (Art. 7 LOPDGDD) or under 13 elsewhere. Contact legal@l33tpro.com for deletion.

10. Distribution Platforms

Third-party privacy policies also apply:

Each platform is an independent data controller.

11. Security

HTTPS/TLS, bcrypt, firewalls, fail2ban, restricted production access, regular backups. Breach notification per Art. 34 GDPR.

12. Policy Changes

Changes published here with a new date. Significant changes notified via Portal or email.

13. Account Deletion (Android / Google Play)

If you use Google Play Games sign-in in the Hexagon Imperium Android app, you can request deletion of your game account and all associated data (username, ELO, progress, match history) by:

In-app: Settings - Delete Account - Confirm.
By email: support@l33tpro.com subject: DELETE ACCOUNT - Hexagon Imperium, include your Google Play Player ID.

All data erased within 30 days. Anonymous stats may be retained.

Data Controller: L33t Pro Services, S.L. · Segovia, Spain · legal@l33tpro.com