Privacy Policy

The data controller is XP Arena Ltd (RC 9164447), trading as XP Arena, of 9 Sani Zangon-Daura Street, Guzape, Abuja, FCT 900104, Nigeria.

For anything in this notice — a question, a request about your data, or a complaint — write to play@xparena.net. We answer within 30 days.

We have not appointed a Data Protection Officer. If XP Arena becomes a data controller of major importance under the NDPA we will designate one and name them here. Until then, requests go to the address above and are handled by XP Arena management.

When you sign in with Google

We receive your name, email address, profile picture and a Google account identifier. We never receive or store your Google password.

When you set up a player profile

• Your XP Arena name (display name) and your public @handle.
• Your city and state, and your country.
• Your WhatsApp number, and whether you have confirmed it by following a link we sent to it.
• For online tournaments: your console platform, your PSN online ID, Xbox gamertag or PC handle, and optionally your EA ID.

When you play or compete

• Tournaments and matches you entered, your results, placements and bracket position.
• Statistics derived from those results — wins, losses, ranks, badges and rivalries.
• For XP StrikeOut: per-match events needed to settle a result and to detect cheating, including who struck out whom and where on the map it happened.
• Recordings of your matches — gameplay footage, screen capture, streams, photographs and video, which at the venue will include your image and voice. Entering a tournament grants us the right to record and use this, and section 12 of our Terms sets out exactly what that covers.

When money moves

• Entry fee payments, the reference on your bank transfer, and its status.
• Prizes owed and paid, and the account details you give us for a payout.
• If we are required to verify your identity before paying a prize, the identity information needed for that check.

Automatically, for security and fraud prevention

When you reserve a seat in a match we record your IP address and browser or device information, and we keep the time you were last active. An IP address is personal data under the NDPA and we tell you about it here because we collect it, not because we are asked to.

We use it for one thing: detecting the two forms of cheating that cost other players money — the same person entering one match from several accounts, and two players arranging a result between them. Shared connections are ordinary in Nigeria — a household, a hotspot, an office — so this evidence causes a payout to be held for a human to review. It never decides anything by itself.

When you buy from the store or join a waiting list

• Your name, WhatsApp number and email address, and what you ordered or asked about.
• Where relevant, delivery details and proof of payment you send us.

When you play XP StrikeOut

Each time you enter a battle and each time you ask to withdraw winnings, we record the IP address the request came from, your browser's description of itself (user agent), a random identifier the game keeps on your device, and a fingerprint of your device made from things like its screen size, time zone, language and graphics hardware. We scramble the fingerprint again on our side, so it cannot be matched to anything outside XP Arena. We use these only to spot one person playing from several accounts, or two accounts passing prize money between them (see section 3).

Records we create about players at the venue

When you play a tournament at XP Arena, we record your name, your result and — if you gave it to us — your phone number, so we can run the bracket, pay the prizes and publish who played. This happens whether or not you have an XP Arena account. Section 5 explains what we then publish and how to have it taken down.

Cookies and analytics

On some pages of this site we use Google Analytics, and our hosting provider's own analytics, to count visits and understand which pages work. We also remember where you arrived from when you follow a campaign link.

We should be straight with you: these analytics load today without asking your permission first, and under the NDPA non-essential analytics should be consent-based. We are adding a cookie choice to this site. In the meantime you can block these through your browser settings or a tracker blocker, and it will not affect anything else on XP Arena.

The NDPA requires us to have a lawful basis for every use of your data. Here is ours, use by use.

Spotting fraud in prize play (device and network signals)

Our legitimate interest, and yours as a player, in prizes going to the people who won them. These signals can only cause a payout to be held for a person at XP Arena to review — they never refuse you a game or cancel a prize on their own.

Running your account and player page

Performance of our contract with you. You cannot have an XP Arena player page without us storing what is on it.

Entering you into tournaments and publishing your handle, brackets and results

Performance of our contract with you. A competition that cannot name its entrants cannot be run, so publishing your handle is part of what you are entering, not an extra we ask permission for.

Emailing you about a tournament you entered — your draw, your opponent, your results and the winner

Performance of our contract with you. These are the messages that tell you who you play and when; a knockout tournament you cannot be told about is one you cannot take part in, so they are part of entering rather than marketing we ask permission for. They stop when the tournament does. You can still tell us to stop — reply unsubscribe to any of them — but then you will have to follow the bracket yourself to find out who you play.

Recording tournaments, and using that footage to promote XP Arena

Performance of our contract with you for running and broadcasting the competition, and our legitimate interest in promoting it. You agree to this when you enter a tournament — see section 12 of our Terms. Photography of guests who are not competing is separate, and you can decline it.

Contacting you on WhatsApp about your slot, your match or your prize

Performance of our contract with you. This is why we ask for the number, and it is the only thing we use it for unless you separately agree to updates.

Taking entry fees and paying prizes

Performance of our contract with you, and compliance with our legal obligations for financial records and tax.

Detecting cheating, collusion and multiple accounts

Our legitimate interest, and the legitimate interests of every other player in the prize pool. Where money is at stake, unchecked cheating is a direct financial harm to honest players.

Publishing a player page for someone who played at the venue but has no account

Our legitimate interest in publishing a complete and accurate competition record, balanced against the privacy of someone who did not sign up. This is the narrowest basis we rely on, so section 5 gives those pages extra protections and an unconditional way out.

Analytics and understanding how the site is used

Consent — which, as section 2 admits, we are not currently collecting properly. We are fixing that.

Sending you marketing or event announcements

Consent. You can withdraw it at any time and we will stop; it will not affect your account, your entries or your prizes.

Keeping records of payments, prizes and disputes

Compliance with our legal obligations, and establishing or defending legal claims.

An XP Arena player page is a public web page. Anyone with the link can open it, and it is meant to be shared. Here is exactly what it does and does not contain.

On your public page

• Your XP Arena name and your @handle.
• Your city and country.
• Your tournament and match history, your win and loss counts, your rank, your badges and the players you have faced most.
• Your profile picture, if you have one.

Never on your public page, and never sent to anyone who asks for it

• Your phone number or email address.
• Your prize money. No earnings figure appears on any public page of XP Arena. You see your own money in your wallet; nobody else sees it at all. This is deliberate and it is enforced in our software, not just in our policy.
• Your state, your console ID, your EA ID, or any account identifier. One exception, and only one: in an online tournament we email your console ID and EA ID to the opponent you have been drawn against. That is the whole reason we ask for them — without them your opponent cannot add you and the match cannot be played. It goes to that one player, by email, and it is never on the public bracket or your public page.
• Your IP address or anything about your device.

Being findable

Our player directory at xparena.net/players lets anyone search for a player by name or @handle. A profile can be set to unlisted, which keeps the page working for anyone you give the link to while keeping it out of that directory.

There is no button for this yet — today, ask us at play@xparena.net or on WhatsApp and we will set it for you. We are building the control into the player profile screen. You do not have to give a reason.

You give us a phone number so we can confirm your slot and send you your winnings. That is the only thing it is for.

We have deliberately not built — and will not build — a public search that takes a phone number and returns a player. Our reasoning, so you can hold us to it:

• Your @handle is a name you chose to be known by. Your number is not. A lookup from one to the other would let anyone who has your number from any source find out where you play, what you have won and what city you are in.
• Your number is the key to being paid. Confirming to a stranger that a number belongs to an XP Arena account that receives prize money is a gift to anyone trying to take it.
• We do not think a list connecting names, numbers, cities and tournament winnings should exist on the public internet in this market.

XP Arena staff can look up a player by number — that is how we send you the link to claim your own page — but only from inside our admin system, which is restricted to authorised staff and access-controlled. If you cannot find your page, message us on WhatsApp and we will find it for you.

We publish player pages for people who competed at the venue, so that brackets can name them and results are complete. If that is you:

• The page shows your name, your handle, your city and your results — nothing more, and never your number.
• It is marked unclaimed, so nobody mistakes it for a page you made, and we tell search engines not to index it.
• You can claim it — we send a link to the number we hold for you, so only you can — and then it is yours.
• If you enter an online tournament and our staff sign you up on your behalf, we may also record an email address you give them, purely so the tournament emails — your draw, your opponent, your results — can reach you. It belongs to that tournament, it is not a login, and it never appears on your page.
• Or you can tell us to take it down, and we will. Email play@xparena.net or message us on WhatsApp. You do not have to give a reason and we will not ask for one. We keep the underlying competition record, because a tournament result cannot be un-played and we may need it for a payment dispute, but your page and your name come off the public site.

We do not sell your personal data, and we never will. We share it only with the service providers that make XP Arena work, and only with what each of them needs to do its job:

One other person sees something of yours: your opponent. In an online tournament we email each player their opponent’s XP Arena handle, console ID and EA ID when a round is drawn, so the two of you can add each other and play. Your phone number, your email address and your prize money are never included. Nothing is sent to anyone who is not drawn against you.

Google

Sign-in, when you choose to sign in with your Google account, and website analytics.

Hosting and infrastructure providers

Run this website, the XP Arena platform and our databases. They hold your data on our instructions and may not use it for anything of their own.

Payment providers

Take entry fees and other payments, and hold the payment records that go with them.

Messaging and email providers

Carry the messages we exchange with you, including slot confirmations, claim links and tournament emails telling you who you play next. They see your email address and the contents of those messages in order to deliver them.

Business tools

Record store orders and enquiries so our team can fulfil them, and report faults so we can fix them.

You can ask us at play@xparena.net exactly which providers hold which of your data, and we will tell you. We have described them by category here rather than by name because the list changes as our infrastructure does, and a stale list is worse than an accurate answer on request.

We also share data where the law requires it — with a regulator, a court, or law enforcement acting on proper authority — and with our professional advisers where needed to establish or defend a legal claim.

Several of the services in section 7 store or process data outside Nigeria, mainly in the European Union and the United States. Under Part VIII of the NDPA we may only transfer your data abroad where there is an adequate level of protection or another lawful ground.

We rely on:

• Contractual protections with each provider requiring them to protect your data to a standard equivalent to the NDPA and to act only on our instructions.
• Where no adequacy decision covers a provider, the transfer being necessary to perform our contract with you — we cannot run your account, your matches or your payments without these services.

You can ask us at play@xparena.net which providers hold which of your data and where.

Your account and profile

For as long as your account exists. If you close it, we delete or anonymise your profile, keeping only what sections below require us to hold.

Competition entries, results and brackets

Indefinitely, as the historical record of a competition. Where a page is removed or an account closed, the record is kept without your name attached to a public page.

Payments, entry fees and prize records

Seven years from the transaction, to meet Nigerian tax and financial record-keeping requirements and to resolve disputes.

IP addresses and device information

Held on the match record it was captured against, and deleted with it. It is not accumulated into a separate profile of you.

XP StrikeOut fraud signals (IP address, device fingerprint, device identifier)

12 months from when they were recorded, then deleted.

Claim and phone-verification links

72 hours, then they expire. We store only a one-way hash of the link, so a copy of our database does not hand anyone a working link.

Store orders and enquiries

Two years, for warranty, refund and dispute purposes.

Tournament recordings and footage

Indefinitely. The licence you grant by entering a tournament is perpetual, and published footage cannot be recalled from everywhere it has been shared.

Analytics

As configured with Google Analytics, currently 14 months.

Under the NDPA you have the right to:

• Know and access — be told what we hold about you and get a copy.
• Correct — have inaccurate or incomplete data fixed.
• Delete — have your data erased where we no longer have a good reason to keep it.
• Restrict — have us pause using your data while a dispute about it is resolved.
• Port — receive the data you gave us in a machine-readable form.
• Object — tell us to stop a use we base on our legitimate interests, including publishing a player page about you.
• Withdraw consent — at any time, for anything we do on the basis of consent, such as marketing. It does not affect what we did lawfully before you withdrew.
• Stop tournament emails — reply unsubscribe to any email we send you about a tournament, and we will take you off. There is no link to click on purpose: these emails are how you find out who you play, so we would rather you meant it than tapped it by accident. We will still need to reach you somehow, so tell us on WhatsApp how you would prefer to hear about your matches.
• Not be subject to a decision made purely by a machine that significantly affects you. Our anti-cheat system flags matches; a person decides.

Exercise any of these by emailing play@xparena.net. We answer within 30 days and it is free. We may need to confirm who you are first — usually by messaging the number or email already on your account — because handing your data to someone impersonating you would be the worse outcome.

Where we may have to say no: we cannot delete a payment record we are legally required to keep; we will not erase evidence relating to an open cheating investigation or an unresolved prize dispute; and we cannot withdraw tournament footage you agreed we could record and use when you entered. We will always tell you which applies and why.

• Traffic to and from XP Arena is encrypted in transit.
• Verification and claim links are stored only as one-way hashes, are single-use, and expire.
• Our admin system is restricted to authorised staff, and administrative actions are written to an audit log.
• Our public services are rate-limited, so your profile cannot be bulk-harvested at speed.
• Staff and systems get access to the data they need for their role and not more — your phone number, for instance, is reachable by staff who must contact you and by no public part of XP Arena at all.

No system is perfectly secure. If a breach occurs that is likely to put your rights at risk, we will report it to the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of it and tell you directly where the NDPA requires it.

XP Arena tournaments involve entry fees and cash prizes and are for people aged 18 and over. We do not knowingly collect data from anyone under 18 through paid entry, and if we learn that we have, we will delete it and return any entry fee.

Stated plainly: we do not currently verify age at sign-up. We check at the venue and we act on what we are told, but the website does not yet ask. We are adding an age confirmation step. Under-18s are welcome at the venue for ordinary play — this is about paid competition and prize money.

If you are unhappy with how we have handled your data or your request, tell us first at play@xparena.net — most things are quicker to fix directly.

You also have the right to complain to the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng. You do not need our permission and you do not need to come to us first.

We update this notice when what we do changes. The version and date at the top always tell you which one you are reading. If a change materially affects how we use data you have already given us, we will tell you directly rather than relying on you to re-read this page.