Privacy notice

Who is responsible for your data?

Lorn eSport is the data controller for the account information described here. To ask a question or exercise your rights, use our contact form.

What we collect and why

• Name and email address: required to create and manage your account, contact you about account or order matters, and link orders to your account.
• Phone number: required to create and manage your account and keep your contact details in your profile.
• Password: used to authenticate you. We store a salted password hash, not your readable password.
• Date of birth: optional. If you provide it, it is saved as profile information; it is not required to create an account.
• Authentication session: a random session token is placed in a strictly necessary cookie to keep you signed in. The server stores a hash of that token.

Required fields are needed to create an account. If you do not provide them, you cannot register. The optional date of birth can be left blank.

Legal bases

We process account information, including a date of birth you choose to add to your profile, to provide the account service you request (performance of a contract, Article 6(1)(b) GDPR). We use the session cookie because it is necessary to provide the signed-in service you request.

Who receives the data?

Access is limited to people who need the information to operate the shop and provide support. Our service providers process data on our behalf:

• Supabase: stores account and session records.
• Cloudflare: hosts the site and processes requests to its server functions.
• Resend: receives your name and email address to send the account welcome email.

These providers may process data in locations outside the European Economic Area. Where applicable, transfers are made under a GDPR-recognised transfer mechanism, such as an adequacy decision or Standard Contractual Clauses.

How long we keep the data

We keep account information while your account remains open. You may request account deletion through our contact form. We will delete the account information unless we must retain specific information to comply with a legal obligation or establish, exercise or defend legal claims. Authentication tokens become invalid after 14 days; expired session records may remain in the database until they are removed.

Cookies and local storage

The authentication cookie is strictly necessary to keep you signed in. It is HttpOnly, uses SameSite=Strict, and is marked Secure over HTTPS. It expires after 14 days. No consent is requested for this cookie because it is required for the account service you request. This site also stores your theme and shopping cart in your browser's local storage; these are not cookies.

Your rights

Subject to the conditions in data-protection law, you can request access to, correction or deletion of your data, restriction of processing, or object to processing. You may also request data portability where applicable. To make a request, use our contact form. You can complain to your local data-protection authority; in France, this is the CNIL.

Automated decisions

We do not use account information for automated decisions or profiling that produce legal or similarly significant effects.