Privacy notice

Onespire Zrt. (Onespire Zártkörűen Működő Részvénytársaság), registered at 1123 Budapest, Alkotás utca 53., Hungary (company registration number 01-10-049612), is the data controller for RPSA Arena. We process personal data in line with the EU General Data Protection Regulation (Regulation 2016/679, the “GDPR”), and this notice is the information we give you under Article 13.

For any question about this notice, or to exercise the rights described below, contact info@onespire.hu or call +36 1 791 8331.

We collect only what the platform needs to run a competition. Each item below is a field that actually exists in our database.

Using the platform itself does not require a phone number or a postal address, and we do not ask for your date of birth. Organised competition events are different — see the next section.

Alongside the platform, Onespire Zrt. (Onespire Zártkörűen Működő Részvénytársaság) runs developer competitions as organised events, with their own sign-up, an award ceremony and, in some cases, prizes. Taking part is entirely optional and separate from having an RPSA Arena account. If you do take part, the following additional processing applies.

All of the above rests on your consent, and you can withdraw it at any time — for the newsletter, from the unsubscribe link in any message or by writing to us. Withdrawing consent does not make the processing that happened before it unlawful. Withdrawing consent for event registration before the event means you cannot take part in it; it has no effect on your RPSA Arena account.

If you would rather not appear in photos or video, tell the organisers before the event, or write to info@onespire.hu afterwards identifying the recording concerned and we will remove it. Please note that once a photo has been published on social media, other people may have re-shared it under that platform’s own terms, which is outside our control.

Where a prize creates an invoicing or tax obligation for us, the related accounting records are kept for as long as accounting law requires, which is longer than the periods above.

To measure the signup funnel we store a random identifier in your browser (rpsa_anonymous_id in local storage and rpsa_session_id for the current tab). These are random values, not derived from anything about you.

Analytics records never contain your password, session tokens, raw email address, raw IP address, or your strategy source code. Your IP address and user-agent are stored only as salted one-way hashes, which we use to spot abuse and de-duplicate traffic. Nothing described in this section is shared with anyone outside Onespire Zrt. (Onespire Zártkörűen Működő Részvénytársaság), which is why it runs without asking you first. Advertising measurement is a separate thing, it involves a third party, and it never runs unless you agree to it — see the next section.

We also set one strictly necessary cookie to keep you signed in (rpsa_refresh).

We advertise the competition on Facebook and Instagram. To find out which of those ads actually bring people to the signup list, we can load the Meta pixel, a small piece of code provided by Meta Platforms Ireland Limited. If it is active it tells Meta that this browser opened a page on our site, and whether it reached one of two points in the signup funnel: you started registering, and you finished registering. It receives your IP address, the address of the page you are on, and stores identifiers in cookies and local storage on your device. It is never sent your name, your email address, your answers to the optional onboarding questions, or anything you type into the site.

This only happens if you say yes. We ask on your first visit, and until you accept, the Meta code is not downloaded at all — not loaded-but-silent, simply not requested. Declining costs you nothing: every part of the site works the same either way. The legal basis is your consent (GDPR Article 6(1)(a) and Section 155(4) of the Hungarian Electronic Communications Act).

You can change your mind at any time using the Cookie settings link in the footer of every page. Withdrawing stops us sending anything further; it does not undo what was already measured before you withdrew. Clearing your browser storage also erases the record of your choice, and we will ask again.

Your decision is stored on your own device only (rpsa_marketing_consent in local storage) and is never sent to our servers. If you accept, Meta Platforms Ireland Limited acts as an independent controller for what it does with the data, under its own privacy policy, and may transfer it to the United States under the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses.

We do not sell your data. The only advertising-related sharing we do is the Meta pixel described above, and only for visitors who have agreed to it. Inside Onespire Zrt. (Onespire Zártkörűen Működő Részvénytársaság), access is limited to the people who need it for their role — our administrative, finance and accounting staff, our management, and our legal counsel — and all of them are under a duty of confidentiality.

We use service providers who process data only on our instructions: our cloud hosting provider, an email delivery service used to send verification and account emails, and, for the event newsletter, an automated newsletter platform. Only the data needed for each specific purpose is passed to each of them.

We may also have to disclose data to courts, the police, tax authorities and other public bodies where they request it under a legal power. Public bodies acting on a specific legal enquiry are not treated as recipients under the GDPR.

Leaderboards, match replays and public strategy listings are visible to other users — but only your display name and competition results appear there, never your email address or any of the optional demographics.

Account data and competition history are kept while your account exists. If you delete your account, we delete your account data and the optional demographics; anonymised match results may remain in season records for the integrity of past competitions. Product analytics records are retained for up to 24 months. Retention for organised competition events is set out in the table above.

Personal data is stored on our servers and, where records exist on paper, at our registered office.

We design our processing around data protection by design and by default, and we aim to keep the amount of personal data we handle to the minimum the platform needs.

In practice that means technical and organisational measures covering access control, password protection of stored data, physical protection of the devices and of any paper records, regular backups, and staff training — chosen so that data stays available to those entitled to it, verifiably unaltered, and protected against unauthorised access, disclosure, alteration, loss or destruction. Where more than one approach is workable, we take the one that protects your data better.

A personal data breach is a security failure that leads to personal data being destroyed, lost, altered, disclosed or accessed without authorisation. We keep a record of any breach and of what we did about it.

We report breaches to the Hungarian National Authority for Data Protection and Freedom of Information without delay, unless the breach is unlikely to pose a risk to your rights and freedoms. Where a breach is likely to pose a high risk to you, we will tell you about it without undue delay.

You can request access to your data, correction or completion of it, deletion, a portable copy, or restriction of processing. Where we rely on consent — the optional demographics, marketing emails, and everything connected with organised competition events — you can withdraw it at any time, and withdrawing it does not affect your account or your ability to compete. You can also object to processing based on legitimate interest.

You also have the right not to be subject to a decision based solely on automated processing that produces legal effects for you or similarly significantly affects you. Match scoring and leaderboard placement follow the published competition rules and do not produce that kind of effect.

Write to info@onespire.hu to exercise any of these — email is the quickest route, and we will normally reply the same way. We decide on a written request within 30 days. If a request is unusually complex, or several are in progress, we may extend that by a further two months and will tell you in advance that we are doing so, and why. If we refuse a request we will say so in writing, explain the reasoning, and set out the remedies open to you. The first request in a given year about the same data is free; for repeated, excessive or manifestly unfounded requests we may charge a reasonable fee based on our administrative costs.

RPSA Arena is not directed at children under 16. If you tell us you are under 18 we will not use your data for marketing, and your parent or legal guardian is entitled to act on your behalf in exercising the rights above. If you believe a child has given us personal data without the consent of a parent or guardian, contact info@onespire.hu and we will delete it.

If you have a concern, the quickest route is usually to raise it with us first at info@onespire.hu. You do not have to, and you can complain to a supervisory authority at any time.

In Hungary that is the National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság):

• Website: naih.hu
• Address: 1055 Budapest, Falk Miksa utca 9–11.
• Postal address: 1363 Budapest, Pf. 9.
• Phone: +36 1 391 1400 — Fax: +36 1 391 1410
• Email: ugyfelszolgalat@naih.hu

You may also complain to the supervisory authority in the EU member state where you usually live or work, or where you believe the breach happened.

Independently of complaining, you can go to court. Proceedings against Onespire Zrt. (Onespire Zártkörűen Működő Részvénytársaság) as a Hungarian controller can be brought before a Hungarian court — you may choose the county court for where you live or are staying (birosag.hu/torvenyszekek). If you usually live in another EU member state, you may instead sue in the competent court there. Proceedings against one of our processors must be brought in the member state where that processor operates.

This notice applies until further notice or withdrawal, and we may amend it. If we change it materially we will publish a new version and record which version you accepted. See also our terms of service and competition rules.

The Hungarian-language notice covering Onespire Zrt. (Onespire Zártkörűen Működő Részvénytársaság)’s organised developer competition is published separately at Adatkezelési tájékoztató. It is the original document rather than a translation of this page, so where the two describe the same event processing, the Hungarian text governs.