Privacy Policy

The data controller is XP Arena Ltd (RC 9164447), trading as XP Arena, of 9 Sani Zangon-Daura Street, Guzape, Abuja, FCT 900104, Nigeria.

For anything in this notice — a question, a request about your data, or a complaint — write to play@xparena.net. We answer within 30 days.

We have not appointed a Data Protection Officer. If XP Arena becomes a data controller of major importance under the NDPA we will designate one and name them here. Until then, requests go to the address above and are handled by XP Arena management.

When you sign in with Google

We receive your name, email address, profile picture and a Google account identifier. We never receive or store your Google password.

When you set up a player profile

• Your XP Arena name (display name) and your public @handle.
• Your city and state, and your country.
• Your WhatsApp number, and whether you have confirmed it by following a link we sent to it.
• For online tournaments: your console platform, your PSN online ID, Xbox gamertag or PC handle, and optionally your EA ID.

When you play or compete

• Tournaments and matches you entered, your results, placements and bracket position.
• Statistics derived from those results — wins, losses, ranks, badges and rivalries.
• For XP StrikeOut: per-match events needed to settle a result and to detect cheating, including who struck out whom and where on the map it happened.
• Recordings of your matches — gameplay footage, screen capture, streams, photographs and video, which at the venue will include your image and voice. Entering a tournament grants us the right to record and use this, and section 12 of our Terms sets out exactly what that covers.

When money moves

• Entry fee payments, the reference on your bank transfer, and its status.
• Prizes owed and paid, and the account details you give us for a payout.
• If we are required to verify your identity before paying a prize, the identity information needed for that check.

Automatically, for security and fraud prevention

When you reserve a seat in a match we record your IP address and browser or device information, and we keep the time you were last active. An IP address is personal data under the NDPA and we tell you about it here because we collect it, not because we are asked to.

We use it for one thing: detecting the two forms of cheating that cost other players money — the same person entering one match from several accounts, and two players arranging a result between them. Shared connections are ordinary in Nigeria — a household, a hotspot, an office — so this evidence causes a payout to be held for a human to review. It never decides anything by itself.

When you buy from the store or join a waiting list

• Your name, WhatsApp number and email address, and what you ordered or asked about.
• Where relevant, delivery details and proof of payment you send us.

Records we create about players at the venue

When you play a tournament at XP Arena, we record your name, your result and — if you gave it to us — your phone number, so we can run the bracket, pay the prizes and publish who played. This happens whether or not you have an XP Arena account. Section 5 explains what we then publish and how to have it taken down.

Cookies and analytics

On some pages of this site we use Google Analytics, and our hosting provider's own analytics, to count visits and understand which pages work. We also remember where you arrived from when you follow a campaign link.

We should be straight with you: these analytics load today without asking your permission first, and under the NDPA non-essential analytics should be consent-based. We are adding a cookie choice to this site. In the meantime you can block these through your browser settings or a tracker blocker, and it will not affect anything else on XP Arena.

The NDPA requires us to have a lawful basis for every use of your data. Here is ours, use by use.

Running your account and player page

Performance of our contract with you. You cannot have an XP Arena player page without us storing what is on it.

Entering you into tournaments and publishing your handle, brackets and results

Performance of our contract with you. A competition that cannot name its entrants cannot be run, so publishing your handle is part of what you are entering, not an extra we ask permission for.

Recording tournaments, and using that footage to promote XP Arena

Performance of our contract with you for running and broadcasting the competition, and our legitimate interest in promoting it. You agree to this when you enter a tournament — see section 12 of our Terms. Photography of guests who are not competing is separate, and you can decline it.

Contacting you on WhatsApp about your slot, your match or your prize

Performance of our contract with you. This is why we ask for the number, and it is the only thing we use it for unless you separately agree to updates.

Taking entry fees and paying prizes

Performance of our contract with you, and compliance with our legal obligations for financial records and tax.

Detecting cheating, collusion and multiple accounts

Our legitimate interest, and the legitimate interests of every other player in the prize pool. Where money is at stake, unchecked cheating is a direct financial harm to honest players.

Publishing a player page for someone who played at the venue but has no account

Our legitimate interest in publishing a complete and accurate competition record, balanced against the privacy of someone who did not sign up. This is the narrowest basis we rely on, so section 5 gives those pages extra protections and an unconditional way out.

Analytics and understanding how the site is used

Consent — which, as section 2 admits, we are not currently collecting properly. We are fixing that.

Sending you marketing or event announcements

Consent. You can withdraw it at any time and we will stop; it will not affect your account, your entries or your prizes.

Keeping records of payments, prizes and disputes

Compliance with our legal obligations, and establishing or defending legal claims.

An XP Arena player page is a public web page. Anyone with the link can open it, and it is meant to be shared. Here is exactly what it does and does not contain.

On your public page

• Your XP Arena name and your @handle.
• Your city and country.
• Your tournament and match history, your win and loss counts, your rank, your badges and the players you have faced most.
• Your profile picture, if you have one.

Never on your public page, and never sent to anyone who asks for it

• Your phone number or email address.
• Your prize money. No earnings figure appears on any public page of XP Arena. You see your own money in your wallet; nobody else sees it at all. This is deliberate and it is enforced in our software, not just in our policy.
• Your state, your console ID, your EA ID, or any account identifier.
• Your IP address or anything about your device.

Being findable

Our player directory at xparena.net/players lets anyone search for a player by name or @handle. A profile can be set to unlisted, which keeps the page working for anyone you give the link to while keeping it out of that directory.

There is no button for this yet — today, ask us at play@xparena.net or on WhatsApp and we will set it for you. We are building the control into the player profile screen. You do not have to give a reason.

You give us a phone number so we can confirm your slot and send you your winnings. That is the only thing it is for.

We have deliberately not built — and will not build — a public search that takes a phone number and returns a player. Our reasoning, so you can hold us to it:

• Your @handle is a name you chose to be known by. Your number is not. A lookup from one to the other would let anyone who has your number from any source find out where you play, what you have won and what city you are in.
• Your number is the key to being paid. Confirming to a stranger that a number belongs to an XP Arena account that receives prize money is a gift to anyone trying to take it.
• We do not think a list connecting names, numbers, cities and tournament winnings should exist on the public internet in this market.

XP Arena staff can look up a player by number — that is how we send you the link to claim your own page — but only from inside our admin system, which is restricted to authorised staff and access-controlled. If you cannot find your page, message us on WhatsApp and we will find it for you.

We publish player pages for people who competed at the venue, so that brackets can name them and results are complete. If that is you:

• The page shows your name, your handle, your city and your results — nothing more, and never your number.
• It is marked unclaimed, so nobody mistakes it for a page you made, and we tell search engines not to index it.
• You can claim it — we send a link to the number we hold for you, so only you can — and then it is yours.
• Or you can tell us to take it down, and we will. Email play@xparena.net or message us on WhatsApp. You do not have to give a reason and we will not ask for one. We keep the underlying competition record, because a tournament result cannot be un-played and we may need it for a payment dispute, but your page and your name come off the public site.

We do not sell your personal data, and we never will. We share it only with the service providers that make XP Arena work, and only with what each of them needs to do its job:

Google

Sign-in, when you choose to sign in with your Google account, and website analytics.

Hosting and infrastructure providers

Run this website, the XP Arena platform and our databases. They hold your data on our instructions and may not use it for anything of their own.

Payment providers

Take entry fees and other payments, and hold the payment records that go with them.

Messaging providers

Carry the messages we exchange with you, including slot confirmations and claim links.

Business tools

Record store orders and enquiries so our team can fulfil them, and report faults so we can fix them.

You can ask us at play@xparena.net exactly which providers hold which of your data, and we will tell you. We have described them by category here rather than by name because the list changes as our infrastructure does, and a stale list is worse than an accurate answer on request.

We also share data where the law requires it — with a regulator, a court, or law enforcement acting on proper authority — and with our professional advisers where needed to establish or defend a legal claim.

Several of the services in section 7 store or process data outside Nigeria, mainly in the European Union and the United States. Under Part VIII of the NDPA we may only transfer your data abroad where there is an adequate level of protection or another lawful ground.

We rely on:

• Contractual protections with each provider requiring them to protect your data to a standard equivalent to the NDPA and to act only on our instructions.
• Where no adequacy decision covers a provider, the transfer being necessary to perform our contract with you — we cannot run your account, your matches or your payments without these services.

You can ask us at play@xparena.net which providers hold which of your data and where.

Your account and profile

For as long as your account exists. If you close it, we delete or anonymise your profile, keeping only what sections below require us to hold.

Competition entries, results and brackets

Indefinitely, as the historical record of a competition. Where a page is removed or an account closed, the record is kept without your name attached to a public page.

Payments, entry fees and prize records

Seven years from the transaction, to meet Nigerian tax and financial record-keeping requirements and to resolve disputes.

IP addresses and device information

Held on the match record it was captured against, and deleted with it. It is not accumulated into a separate profile of you.

Claim and phone-verification links

72 hours, then they expire. We store only a one-way hash of the link, so a copy of our database does not hand anyone a working link.

Store orders and enquiries

Two years, for warranty, refund and dispute purposes.

Tournament recordings and footage

Indefinitely. The licence you grant by entering a tournament is perpetual, and published footage cannot be recalled from everywhere it has been shared.

Analytics

As configured with Google Analytics, currently 14 months.

Under the NDPA you have the right to:

• Know and access — be told what we hold about you and get a copy.
• Correct — have inaccurate or incomplete data fixed.
• Delete — have your data erased where we no longer have a good reason to keep it.
• Restrict — have us pause using your data while a dispute about it is resolved.
• Port — receive the data you gave us in a machine-readable form.
• Object — tell us to stop a use we base on our legitimate interests, including publishing a player page about you.
• Withdraw consent — at any time, for anything we do on the basis of consent, such as marketing. It does not affect what we did lawfully before you withdrew.
• Not be subject to a decision made purely by a machine that significantly affects you. Our anti-cheat system flags matches; a person decides.

Exercise any of these by emailing play@xparena.net. We answer within 30 days and it is free. We may need to confirm who you are first — usually by messaging the number or email already on your account — because handing your data to someone impersonating you would be the worse outcome.

Where we may have to say no: we cannot delete a payment record we are legally required to keep; we will not erase evidence relating to an open cheating investigation or an unresolved prize dispute; and we cannot withdraw tournament footage you agreed we could record and use when you entered. We will always tell you which applies and why.

• Traffic to and from XP Arena is encrypted in transit.
• Verification and claim links are stored only as one-way hashes, are single-use, and expire.
• Our admin system is restricted to authorised staff, and administrative actions are written to an audit log.
• Our public services are rate-limited, so your profile cannot be bulk-harvested at speed.
• Staff and systems get access to the data they need for their role and not more — your phone number, for instance, is reachable by staff who must contact you and by no public part of XP Arena at all.

No system is perfectly secure. If a breach occurs that is likely to put your rights at risk, we will report it to the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of it and tell you directly where the NDPA requires it.

XP Arena tournaments involve entry fees and cash prizes and are for people aged 18 and over. We do not knowingly collect data from anyone under 18 through paid entry, and if we learn that we have, we will delete it and return any entry fee.

Stated plainly: we do not currently verify age at sign-up. We check at the venue and we act on what we are told, but the website does not yet ask. We are adding an age confirmation step. Under-18s are welcome at the venue for ordinary play — this is about paid competition and prize money.

If you are unhappy with how we have handled your data or your request, tell us first at play@xparena.net — most things are quicker to fix directly.

You also have the right to complain to the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng. You do not need our permission and you do not need to come to us first.

We update this notice when what we do changes. The version and date at the top always tell you which one you are reading. If a change materially affects how we use data you have already given us, we will tell you directly rather than relying on you to re-read this page.