Pobierz wersję polską (PDF)

KEL5 Privacy Policy

Version: 2026-10-07 · Effective date: 7 October 2026

This Privacy Policy explains how personal data is processed in connection with KEL5 ticket sales, merchandise pre-orders, osu! account verification, payment confirmation, ticket delivery, event-only merchandise pickup, event entry, event safety, support, refunds, disputes and related event operations.

KEL5 is an international LAN tournament held in Poland. Personal data is processed in accordance with the GDPR and applicable Polish data-protection, consumer, accounting and tax rules.

1. Data controller

The data controller is KEL Tournaments, trading as KEL Tournaments, with registered address at Gdańsk, NIP 1234567890.

Privacy questions and requests concerning personal data may be sent by email to [email protected] or by post to the address above.

We have not appointed a data protection officer.

2. Who this policy applies to

This policy applies to:

• people who buy or attempt to buy a KEL5 ticket;
• people who buy or attempt to buy a KEL5 merchandise pre-order;
• people whose osu! account is used for ticket verification;
• attendees using a KEL5 ticket or pass;
• attendees aged 16 or 17 where guardian approval or age-related information is required;
• parents or legal guardians who provide approval or contact information for a minor attendee;
• people who contact KEL5 for support, refunds, complaints or privacy requests;
• staff members whose staff account is recorded in ticketing, check-in, support, safety or security logs.

3. Data we collect

3.1 osu! login data

When you sign in with osu!, we receive the account information supplied through osu! OAuth, including:

• verified osu! user ID;
• osu! username;
• authentication/session information needed to complete the login process.

We use this to link the ticket to a verified osu! account and to enforce ticketing and event-safety rules.

3.2 Ticket and merchandise order data

For ticket purchases, merchandise pre-orders and attempted purchases, we may process:

• first and last name;
• email address;
• date of birth, the resulting age group (16–17 or 18+) and whether parent or legal guardian consent is required;
• verified osu! user ID and username;
• selected ticket type;
• merchandise product, size, quantity and pickup status, and the osu! username and event role printed on personalised merchandise, where merchandise is ordered;
• ticket status;
• order timestamp;
• acceptance timestamp;
• version of the Terms of Sale, Event Rules and Privacy Policy accepted at checkout;
• your choice whether to appear on the public attendees page;
• checkout/session identifiers needed to complete or secure the order.

3.3 Minor attendee and guardian data

KEL5 is a 16+ event. If an attendee is aged 16 or 17, we may process limited information needed to verify guardian approval and event eligibility, such as:

• attendee name;
• attendee age confirmation or proof of age, where reasonably required;
• parent or legal guardian name;
• parent or legal guardian contact details;
• guardian approval statement;
• approval timestamp or submitted approval form;
• staff notes needed to verify or handle the approval.

We use this data only where needed for event entry, safety, venue compliance, dispute handling or legal protection.

3.4 Payment data

Payments are processed by Stripe. KEL5 does not receive or store full card details.

We may store:

• Stripe order/payment identifiers;
• Stripe refund ID, where applicable;
• payment status;
• payment currency;
• payment amount;
• payment timestamps;
• limited payment information needed to confirm, refund, investigate or reconcile an order.

Stripe processes payment data under its own privacy policy and security rules.

3.5 Ticket and event-entry data

For ticket delivery and event entry, we may process:

• ticket/pass identifier;
• QR/pass status;
• check-in status;
• check-in time;
• staff account responsible for check-in;
• information needed to prevent duplicate, invalid, refunded, unpaid or blocked ticket use.

3.6 Event safety and enforcement data

Where necessary for event safety, rule enforcement, fraud prevention, harassment prevention, abuse prevention, ban handling or legal protection, we may process:

• reports submitted to staff;
• complaint or incident details;
• evidence provided by attendees, staff, venue staff or online platform users;
• screenshots, links or messages relating to event-connected misconduct;
• internal notes;
• staff account responsible for handling the case;
• decision history, such as warning, refusal of entry, removal or ban.

This may include conduct connected to KEL5 even where the conduct happens outside the physical event, for example on social media, Discord, osu!, livestream chats, private messages or other event-related spaces.

3.7 Security and website data

To keep the ticketing system secure, we may process:

• IP address;
• browser and request information;
• device/session information;
• website security logs;
• rate-limit logs;
• OAuth state and CSRF protection data;
• security alerts and abuse-prevention logs;
• timestamps connected with the above.

3.8 Support and correspondence

If you contact us, we may process:

• your email address;
• your name or osu! username, if included;
• message content;
• attachments or screenshots you send;
• correspondence history;
• internal notes needed to resolve the request.

3.9 Data we do not request during standard checkout

During standard KEL5 ticket or merchandise checkout, we do not ask for:

• postal address;
• telephone number, except where needed for guardian approval or specific support handling;
• Discord account;
• Twitch account;
• full payment-card details.

3.10 Public attendee visibility

The public attendees page is optional. It is off by default for each ticket owner.

If you choose to appear on that page, we may display only your osu! username, osu! avatar and a link to your public osu! profile. We do not publish your real name, email address, ticket reference, payment information, QR code or check-in status there.

The attendee list is limited to eligible paid KEL5 tickets while the optional setting remains enabled. You can turn the setting off again from the ticket or attendees page. When an avatar is displayed, the visitor's browser requests it from osu!, which may receive the visitor's IP address under osu!'s own privacy policy.

4. Where the data comes from

We receive personal data from:

• you, when you enter checkout details, contact us or submit a request;
• a parent or legal guardian, where guardian approval is required;
• osu!, when you authenticate through osu! OAuth;
• Stripe, when Stripe confirms payment, refund or order-status information;
• our own ticketing, check-in, server, security and support systems;
• authorised event staff, where they record check-in, support, safety or enforcement actions;
• attendees, staff, venue staff, platform moderators or other people who submit event-safety reports or evidence.

5. Why we use personal data

We process personal data to:

• authenticate attendees through osu!;
• create and perform the ticket contract;
• issue, display, deliver and verify tickets or passes;
• create and confirm personalised merchandise pre-orders, have them printed and record their pickup at the event;
• verify age-related eligibility and guardian approval where required;
• confirm payment;
• process refunds, chargebacks, disputes and support requests;
• prevent duplicate purchases where duplicate active tickets are disabled;
• prevent fraudulent, unpaid, refunded, invalid, transferred or blocked ticket use;
• enforce organiser-maintained event bans;
• enforce the 16+ event restriction;
• operate one-time event entry;
• protect attendees, staff, players, partners, the venue and event integrity;
• investigate harassment, threats, abuse, fraud, security incidents, chargebacks, disputes or legal claims;
• keep necessary accounting, tax and legal records;
• comply with legal obligations.

6. Legal bases for processing

We process personal data under the following legal bases.

6.1 Contract (Article 6(1)(b) GDPR)

Ticket and merchandise order fulfilment, ticket delivery, payment confirmation, event-only merchandise pickup, support, refunds and admission checks are processed because they are necessary to take requested pre-contractual steps or perform the relevant contract.

This includes linking a ticket to a verified osu! account where this is part of the ticketing model, and checking your date of birth to confirm that you meet the 16+ age requirement and whether guardian consent is needed.

6.2 Legal obligation (Article 6(1)(c) GDPR)

Accounting, tax, payment, complaint-handling and other legally required records are processed where necessary to comply with legal obligations, in particular under the Polish Accounting Act, the Tax Ordinance, VAT rules and the Consumer Rights Act.

6.3 Legitimate interests (Article 6(1)(f) GDPR)

We process some data on the basis of KEL5’s legitimate interests, including:

• service security;
• fraud prevention;
• event safety;
• harassment prevention;
• abuse prevention;
• ticket enforcement;
• chargeback and dispute handling;
• audit logs;
• prevention of duplicate, invalid, refunded or unpaid ticket use;
• organiser-maintained event bans;
• age-related event safety checks;
• protection of legal claims;
• limited event documentation and public event coverage.

Before relying on legitimate interests, we consider whether the processing is necessary, proportionate and expected in the context of an online ticketing system and LAN event.

6.4 Consent (Article 6(1)(a) GDPR)

Where processing legally requires consent, we will request consent separately. Consent may be withdrawn at any time without affecting processing that was lawful before withdrawal.

The optional public attendee setting is used only when you turn it on and can be switched off again from your ticket or the attendees page.

Consent may also be used, for example, for optional analytics, marketing cookies, newsletter-style communication, or specific promotional media use if such features are introduced.

6.5 Do you have to provide your data?

Providing personal data is voluntary. However, signing in with osu! and the details marked as required in the order form (name, email address and date of birth) are necessary to buy and issue a ticket or merchandise order. Without them, we cannot sell you a ticket or merchandise.

For attendees aged 16 or 17, a signed parent or legal guardian consent form is necessary for entry.

Information in support requests is voluntary, but we may be unable to help if we cannot identify your order or issue.

7. Automated ticketing and eligibility rules

Checkout or ticket use may be automatically blocked where:

• the verified osu! ID appears on the organiser’s event-ban list;
• duplicate active tickets are disabled and an active ticket already exists for the same verified osu! account;
• ticket capacity is exhausted;
• payment is not confirmed;
• the ticket is refunded, cancelled, invalidated or already checked in;
• the request is blocked by security, abuse-prevention or rate-limit systems;
• the attendee does not meet the 16+ event requirement or required guardian-approval rules.

These rules are used to operate ticket sales, prevent fraud and protect event safety. They do not involve credit scoring, behavioural advertising, financial profiling or automated prediction of personal characteristics.

If you believe a block was applied incorrectly, contact [email protected]. A staff member will review the case manually.

8. Event-ban list

KEL5 may maintain a limited event-ban list for event safety, fraud prevention, rule enforcement, harassment prevention, abuse prevention, chargeback handling and protection of attendees, staff, players, partners and the venue.

The event-ban list may contain:

• osu! user ID;
• osu! username;
• internal reason or category;
• date added;
• staff account responsible;
• review notes;
• expiry or review date, where applicable;
• limited supporting information where necessary to justify the ban.

The ban list is not public. It is not used for marketing. Access is limited to authorised staff who need it for ticketing, support, entry control, event safety or legal handling.

A person who believes they were incorrectly blocked may contact [email protected] and request manual review.

9. Staff access

Access to personal data is limited to authorised staff and service providers who need the data for their role.

Depending on role, authorised staff may access data for:

• ticket support;
• payment/refund support;
• event check-in;
• event safety;
• website maintenance;
• fraud or abuse investigation;
• legal or accounting handling.

Staff access may be logged where appropriate. Staff should not access, copy, export or share personal data unless needed for authorised event operations.

10. Service providers and recipients

Personal data may be shared with or processed by the recipients below. Hosting, infrastructure, Cloudflare, Resend and other service providers process data on our behalf under data processing agreements. Stripe, osu! and Twitch also process some data as independent controllers under their own privacy policies.

• osu!, for verified account authentication;
• Stripe, for checkout, payment and refund processing;
• Cloudflare, for website delivery, security and media hosting;
• Resend, where configured, for ticket and order email delivery;
• the merchandise print company, which receives only the order number, osu! username, event role, product, size and quantity needed to print personalised merchandise;
• Discord, where configured, for internal operational ticket and refund notifications containing only limited operational information such as osu! username, ticket/pass type and status, not buyer contact details;
• hosting and infrastructure providers;
• Twitch, when the organisers enable the stream player on the website (see section 13);
• email providers where a provider other than Resend is configured;
• security and anti-abuse providers;
• accounting, legal or professional advisers;
• authorised KEL5 event staff;
• venue or security personnel where necessary for event safety, entry enforcement or incident handling.

Information may also be disclosed where required by law, public authorities, courts, payment disputes, fraud investigations, chargebacks or legal claims.

11. International transfers

Some recipients process personal data outside the European Economic Area (EEA):

• Stripe, Cloudflare, Resend, Discord and Twitch may process data in the United States;
• osu! is operated by ppy Pty Ltd from Australia.

Transfers to the United States rely on the EU–US Data Privacy Framework (the European Commission's adequacy decision of 10 July 2023) where the recipient is certified under it, and otherwise on Standard Contractual Clauses adopted by the European Commission (Article 46(2)(c) GDPR). Where osu!, Stripe or Twitch act as independent controllers, they are responsible for their own transfer safeguards.

You can ask for information about the safeguards we use, or a copy of them, at [email protected].

Please also read the Stripe and osu! privacy policies for information about their own processing.

12. Retention periods

We keep personal data only for as long as necessary for the purpose for which it was collected. The periods below apply unless the law requires a longer period or the data is needed for a pending complaint, dispute, chargeback, safety incident or legal claim. In those cases we keep the relevant data until the matter is closed and any related claims are time-barred.

12.1 Session and security data

OAuth state, CSRF and other temporary session data are deleted when the browser session ends or expires.

Security, rate-limit and website logs are kept for 90 days.

12.2 Ticket, merchandise order and check-in records

Ticket and merchandise order records are kept for 24 months after the Event and are then deleted or anonymised. This includes name, email address, date of birth, osu! account details, accepted document versions, pickup status, check-in records and abandoned or unpaid checkout attempts.

Aggregated attendance statistics that do not identify individual attendees may be kept longer.

12.3 Accounting and payment records

Accounting and tax records, such as payment amounts, Stripe payment and refund identifiers and invoices, are kept for the period required by Polish accounting and tax law, normally five years from the end of the calendar year in which the related tax payment deadline expired.

12.4 Guardian consent records

Guardian consent forms and related notes for attendees aged 16 or 17 are kept no longer than the period in section 12.2, and are deleted earlier when no longer needed.

12.5 Support, complaints and incident correspondence

Support, complaint and incident correspondence is kept for the period in section 12.2, counted from the Event or from the closing of the matter, whichever is later.

12.6 Event-ban records

Event-ban records are kept until the ban expires or is lifted. Ban records are reviewed periodically and deleted, anonymised or reduced when there is no longer a valid reason to keep them.

12.7 Backups

Deleted data may remain in backups until those backups are overwritten in the normal backup cycle.

12.8 Provider-held data

Data held by Stripe, osu! or other providers acting as independent controllers follows each provider's own retention policy.

13. Cookies and similar technologies

KEL5 uses the `kel5_session` cookie when you use ticket purchase, protected staff pages or other features that need a server session. It is an essential, session-only cookie used for:

• osu! OAuth state;
• authentication;
• checkout security;
• session management;
• CSRF protection;
• staff panel security.

This cookie is necessary for the website and ticketing system to work securely. It is not used for advertising, profiling or cross-site tracking.

KEL5 does not load optional analytics, advertising or remarketing cookies on public pages. When enabled by the organisers, the Twitch player loads in the stream section and Twitch may process cookies or similar technologies under its own notice. Stripe Checkout and osu! authentication are opened only when you request a payment or login; those providers process their own cookies and similar technologies under their own notices.

If optional analytics, advertising, remarketing or other non-essential technologies are introduced later, this policy will be updated and consent will be requested where required before they are used.

14. Event photography, recording and livestreaming

KEL5 may be photographed, recorded and livestreamed.

Because KEL5 is a public LAN event, attendees may appear incidentally in:

• crowd shots;
• venue photos;
• livestream footage;
• stage or match coverage;
• background footage;
• event recap materials.

This type of limited event coverage may be processed on the basis of the organiser’s legitimate interests in documenting, streaming and promoting the event.

Where practical, KEL5 will consider reasonable media-related requests. However, because the event may be livestreamed and recorded in public areas, KEL5 cannot guarantee removal from all live, crowd or background footage.

Specific media concerns may be sent to [email protected] or raised with staff during the event.

For posed photos, interviews or clearly promotional close-up media use, KEL5 may ask for separate permission where appropriate.

15. Minors

KEL5 is a 16+ event.

Attendees aged 16 or 17 may attend only with permission from a parent or legal guardian. Personal data connected with guardian approval may be processed where necessary for event eligibility, safety, venue compliance or legal protection.

A parent or legal guardian may contact [email protected] regarding privacy requests for a minor where they are legally authorised to act on the minor’s behalf.

Ticket purchase and attendance rules for minors are described in the Terms of Sale and Event Rules.

16. Data security

KEL5 uses organisational and technical measures intended to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

These measures may include:

• access controls;
• role-based staff access;
• protected staff pages;
• secure authentication;
• CSRF protection;
• rate limiting;
• server logging;
• payment processing through Stripe;
• limited access to ticketing and check-in tools.

No online system can be guaranteed to be completely secure, but KEL5 aims to keep personal data access limited, purposeful and proportionate.

17. Your rights

Depending on the circumstances, you may have the right to request:

• access to your personal data;
• correction of inaccurate data;
• deletion of data;
• restriction of processing;
• portability of data;
• objection to processing based on legitimate interests;
• withdrawal of consent, where processing is based on consent.

These rights are not absolute. KEL5 may need to continue processing or retaining certain data where required for:

• ticket performance;
• event safety;
• fraud prevention;
• accounting or tax obligations;
• refunds;
• chargebacks;
• complaints;
• disputes;
• legal obligations;
• legal claims.

We may ask for information reasonably needed to verify the requester before acting on a privacy request.

We respond to requests within one month of receiving them. In complex cases this period may be extended by up to two further months; if so, we will tell you why within the first month.

18. Right to object

Where we process data on the basis of legitimate interests, you may object to that processing.

If you object, we will review the request. We may continue processing where we have compelling legitimate grounds, including event safety, fraud prevention, abuse prevention, legal obligations, disputes, chargebacks or legal claims.

19. Complaints to a supervisory authority

You may complain to the Polish supervisory authority:

President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl.

You may also contact another competent data-protection authority if applicable.

20. Contact

Privacy requests may be sent to:

[email protected]

We respond without undue delay and within one month of receiving a request, as described in section 17.

21. Changes to this policy

This Privacy Policy may be updated when the ticketing process, providers, legal details, event operations, cookies, analytics, media use or legal requirements change.

Each ticket record stores the version of the Terms of Sale, Event Rules and Privacy Policy accepted when the order was submitted.

This Privacy Policy is available in Polish and English. If the versions differ, the Polish version prevails.