Privacy Policy
What Legendcy Survival collects, why we use it, who may process it, how long we keep it, and what you can ask us to do about it.
1. Who we are
Legendcy Survival is operated by Gwenhwyar. The person or legal entity legally responsible for the processing of personal data must be identified clearly in the site records and, where required, in this notice.
Controller identity: Before publishing this policy, replace the operator name above with the controller's full legal name and, if applicable, registered business name/address. An online username alone may not be sufficient to identify the controller.
Questions about privacy or personal information can be sent to legendcysurvivalofficial@gmail.com.
Our online store is provided through Tebex. Tebex may process information directly during checkout and payment. Tebex's own privacy notice also applies to processing it performs as its own controller.
2. What we collect and why
Website accounts
If you create an account, we may process your username, email address, password hash, account settings and information needed to keep your account secure. Passwords must not be stored in plain text.
Purpose: account creation, authentication, requested website functionality, account security and account-related support.
Minecraft information
When you connect or link a Minecraft account to a website account or use Minecraft-related features, we may process your Minecraft username, UUID and information required for the linked feature.
Purpose: linking accounts, delivering Minecraft-related features and preventing abuse.
Applications, appeals and support
If you submit a staff application, ban appeal, support ticket or other form, we process the information you provide for the specific purpose of reviewing, answering and administering that request.
Only information that is relevant and necessary for the particular request should be requested. Do not submit unnecessary sensitive personal information.
Date of birth / age information
If a form asks for your date of birth (DOB), it is collected specifically to determine whether you meet an applicable minimum-age requirement, such as a 15+ requirement for a particular application or service.
The DOB is required only when the relevant form or service uses age verification. If you do not provide a required DOB, the age-restricted application or service cannot be submitted or provided because the minimum-age check cannot be completed.
Where technically possible, we should retain only the result of the age check (for example, “15+ verified”) rather than the full date of birth. If the system currently stores the full DOB, that storage must be changed or a documented retention reason must exist before this statement is relied upon.
Technical and security information
Our hosting and server infrastructure may generate technical information such as IP addresses, timestamps, browser information, request information and security logs.
Purpose: operating the website, troubleshooting, preventing abuse, detecting security incidents and protecting the service.
Purchases
Purchases are handled through our Tebex webstore. We may receive information needed to identify a purchase, deliver the purchased product or reward, handle support and maintain transaction records.
We have removed customer email addresses from our Tebex-to-Discord purchase notification. The Discord notification does not need the customer's email address to function.
3. Legal reasons for processing
For each processing activity, Legendcy Survival must identify a specific GDPR legal basis. The following describes the intended basis for the main activities:
| Processing | Legal basis | Why |
|---|---|---|
| Creating and operating a requested website account | GDPR Article 6(1)(b), where necessary for the requested service/contract | Necessary to create the account and provide the requested account functionality. |
| Staff applications | GDPR Article 6(1)(f) — legitimate interests | Administering and assessing applications for roles in the community. |
| Ban appeals and support requests | GDPR Article 6(1)(f) — legitimate interests | Administering moderation, resolving requests and protecting the community/service. |
| Age verification / DOB used for a 15+ requirement | GDPR Article 6(1)(f) — legitimate interests | Enforcing the stated minimum-age rule and preventing access where the age requirement is not met. The necessity and balancing of this interest should be documented. |
| Security logs and abuse prevention | GDPR Article 6(1)(f) — legitimate interests | Protecting the website, server and users against abuse, fraud and security incidents. |
| Purchases and delivery of purchased rewards | GDPR Article 6(1)(b) and/or another applicable legal basis depending on the specific processing | Processing required to complete the requested purchase and related administration. |
| Legally required records | GDPR Article 6(1)(c) — legal obligation, where applicable | Required only where a specific legal obligation applies. |
| Optional non-essential analytics | Consent where consent is legally required | Optional analytics should not be treated as necessary merely because it is useful. |
We do not rely on “consent” as a generic legal basis for all applications or DOB collection. The basis must match the actual processing and be documented before the processing starts.
4. Age verification and DOB
Where an application or service has a 15+ minimum-age requirement, the form may ask for a date of birth solely to determine whether the applicant meets that requirement.
- The DOB must not be used for unrelated purposes.
- The DOB field should be clearly marked as required or optional.
- If the age check is mandatory, the form should explain that refusing to provide the required information means the age-restricted application or service cannot be submitted.
- After the age check, the preferred design is to retain only a minimal verification result, such as “15+ verified”, if that is sufficient for the purpose.
- If the full DOB is retained, the controller should document why retaining the complete date is necessary and specify a defined retention period.
This approach reflects the GDPR principles of data minimisation and storage limitation: personal data should be limited to what is necessary and not kept longer than necessary.
6. Transfers outside the European Economic Area
Some providers used by Legendcy Survival may process personal information outside the EEA.
Tebex: Tebex states in its current creator terms that it uses a server located in the United States and that transfers to non-adequate third countries may use Standard Contractual Clauses. urlTebex Creator Agreementhttps://www.tebex.io/terms-creator-agreement
Discord: Discord states that information is processed and stored in the United States and other countries and describes the use of Standard Contractual Clauses, adequacy decisions and the EU-U.S./UK/Swiss Data Privacy Frameworks as applicable. urlDiscord Privacy Policyhttps://discord.com/privacy
Other providers: The actual hosting location and transfer mechanism must be verified against the provider's current documentation and the service configuration before publishing a definitive statement. We will not claim that a specific provider uses an EEA-only environment or a particular transfer safeguard unless that has been verified.
Where a restricted transfer occurs, the controller must use a lawful transfer mechanism and appropriate safeguards required by applicable data-protection law.
7. How long we keep personal information
Personal information is not kept indefinitely merely because it is technically possible to keep it. Retention must be tied to a defined purpose and period, with deletion or anonymisation when the information is no longer necessary.
| Information | Retention rule |
|---|---|
| Website account information | Until the account is deleted, subject to any specific lawful reason to retain particular records. The backend must actually delete the data when the stated deletion event occurs. |
| Age-verification DOB | Preferred: delete the full DOB after the age check and retain only the minimum verification result needed. If the full DOB is retained, a defined maximum retention period must be documented here before publication: [INSERT ACTUAL DOB RETENTION PERIOD]. |
| Applications | Retain only for the documented period necessary to administer the application and any directly related disputes or records: [INSERT ACTUAL APPLICATION RETENTION PERIOD]. |
| Ban appeals and support requests | Retain only for the documented period necessary to handle the request, moderation record or directly related dispute: [INSERT ACTUAL SUPPORT/APPEAL RETENTION PERIOD]. |
| Security and technical logs | Retain for a defined period appropriate to the security purpose: [INSERT ACTUAL LOG RETENTION PERIOD]. |
| Purchase/transaction records | Retain for the period necessary for fulfilment, fraud prevention and any applicable legal/accounting obligations. |
| Deletion requests | Retain only as long as reasonably necessary to demonstrate that the request was handled and to meet any applicable legal obligation. |
Important: The retention periods above must match the database, backups and administrative systems. A privacy policy cannot make indefinite backend storage compliant simply by saying that data will be deleted later.
8. Cookies
Legendcy Survival may use strictly necessary cookies for authentication, sessions and requested website functionality.
We do not intentionally use advertising cookies or sell browsing information to advertisers. If non-essential analytics or tracking is enabled, the applicable consent requirements will be respected.
9. Your rights
Depending on the circumstances, you may have rights under the GDPR/AVG including:
- Access to the personal information we hold about you.
- Correction of inaccurate or incomplete information.
- Deletion of personal information where the legal requirements are met.
- Restriction of certain processing.
- Objection to processing based on legitimate interests.
- Data portability where applicable.
- Withdrawal of consent where processing is based on consent.
To request access, correction or deletion, email legendcysurvivalofficial@gmail.com. We may ask for reasonable information to verify that the request belongs to you.
We aim to respond within the time period required by applicable data-protection law.
10. Children and young users
Legendcy Survival is a Minecraft community that may be used by younger players. We aim to collect only information that is necessary for the stated purpose.
Where a particular application or service has a minimum age, that requirement will be stated on the relevant form. Where consent is legally required because of a user's age, the applicable requirements will be followed.
11. Security and HTTPS
We use appropriate technical and organisational measures intended to protect personal information against unauthorised access, loss, misuse and unlawful processing.
HTTPS requirement: Personal information, including account credentials, applications, appeals, support forms and DOBs, should be transmitted only over HTTPS with a valid TLS certificate. If any page that collects or transmits such information is still accessible over plain HTTP, the site configuration must be corrected before this policy's security statement is relied upon.
Administrative access should be restricted to authorised people who need it for their role. No online service can guarantee absolute security.
12. Changes to this policy
We may update this Privacy Policy when our website, Minecraft server, webstore or data-processing activities change. The date at the top of this page will be updated when the policy changes.
13. Contact us
If you have a question about this Privacy Policy, your personal information or a deletion request, contact:
Legendcy Survival — [INSERT CONTROLLER'S FULL LEGAL NAME / REGISTERED ENTITY]
legendcysurvivalofficial@gmail.com