Privacy notice
This notice explains what personal data the Pro Pilkki 2 Results Service processes, where the data comes from, why it is processed and for how long it is kept, and what rights you have. It has been prepared in accordance with the EU General Data Protection Regulation (GDPR) and the Finnish Data Protection Act. The Finnish version of this notice is the authoritative one.
1. Controller and contact details
Controllers (joint controllers): Jesse Hytönen and Lassi Nousiainen. The service is a hobby service maintained by them, not a company. You can exercise your rights in respect of either controller, and requests are forwarded to both. For data protection matters: info@propilkkitulospalvelu.fi.
Shared responsibility. The controllers are jointly and equally responsible for the processing of personal data in the service. Each of them is responsible for the lawfulness of the processing, for handling requests from data subjects and for personal data breaches. The contact point is info@propilkkitulospalvelu.fi, and you can turn to either controller. The one who receives a request handles it and informs the other.
The service is not an official service of Procyon Products. Pro Pilkki 2 and its marks belong to Procyon Products.
2. What data we process and where it comes from
Site visitors
- No tracking. The public site uses no analytics or advertising and loads nothing from third parties (fonts and images come from our own server). The site's security policy blocks loading from anywhere other than our own server.
- Cookies. The public pages do not set cookies. When you sign in and in the administration views, the server sets a temporary session cookie (
__Host-pp2sid) that is removed when the browser is closed and expires on the server after 2 hours of inactivity or at most 12 hours. The cookie is necessary for signing in. It can also appear when you submit the feedback form, because the server then opens a session. The cookie contains no personal data. - Server log. Our web host (Domainhotelli, Planeetta Internet Oy) keeps a technical log (IP address, time, requested page, browser) for security and troubleshooting. This log is maintained by the web host, not by the service administrators. The web host does not publish a retention period for the log, so it is determined by the web host's own practices and we cannot influence it.
- Feedback. You can send a message to the administrators with the Feedback form. The message is mandatory. Name and email are optional. Together with the message we store the page and season you were on, and, to limit the number of submissions, a salted hash calculated from your IP address, which is not shown to the administrators either. The first 80 characters of the message are also written to the administration event log.
- Your own IP address in the Host it yourself guide. The Host it yourself guide asks the server which IP address your request comes from and shows it to you. The server does not store the address. The address may remain in your own browser's memory (section 3).
Results and players
We publish competition results: the player's in-game name or nickname, team tag, points, catches and competition details. A real name is not needed for the results and is not published.
Source. The data comes from the game log (playlog) of the game server that ran the competition, which a service administrator imports into the administration by hand. You do not have to provide any data yourself: a result arises from taking part in the competition.
Minor players. We do not ask for or store players' age, and we publish only the nickname used in the game. If a player is a minor, the player or their guardian can ask for the nickname to be replaced or the result to be removed from the public site. We do this without needing a reason, without delay and at the latest within one week. A guardian can make the request on behalf of a child under 15.
IP addresses. The join lines of the game log contain players' IP addresses. When a log is imported into a season's results, the lines that contain an IP address and the ban list identifiers are removed, so they do not end up in the season data or on the public site. The service does not store players' IP addresses.
Competition organiser's server. The administrators enter for a competition the organiser (the organiser's player name) and the game server address and port so that players can join. The public site shows them in the "Join the game" card. The address is the organiser's own IP address or hostname, so it is the organiser's personal data. The address is kept in the season data and shown again for each round: from 30 minutes before the start of the round until 30 minutes after the start. At other times the address is not even in the page's source code. The address is published only when the organiser has given permission. You can withdraw the permission at any time by contacting us, and we remove the address without delay. Most games are organised by Lassi Nousiainen, but other organisers are possible on the same terms.
Administrators
- Account. The main administrator invites administrators by email. We store the email, the name (if given), a hash of the password (not the password), the secret of two-factor authentication and hashes of recovery codes, and the permissions. An administrator does not need to provide any other data.
- Security log. Sign-ins and failed attempts and permission changes: time, event, IP address, email, a short note and the browser string.
- Event log. The event list in the administration, covering the last 200 events (for example deleting an account or receiving feedback), contains the administrator's email and the email or name of the person concerned.
- Emails. Invitation and password reset messages are sent through the web host's email service. The server records the time and recipient of every message. The content of the message, including links, is stored in the log only if sending failed, so that the link can be passed on by hand.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Publishing results and history | Legitimate interests: the community's competition activity (1 f). You can object, see section 7. |
| Managing administrator accounts | Legitimate interests: running the service and access control (1 f) |
| Security, preventing abuse, security log and event log | Legitimate interests (1 f) |
| Server log (the web host's technical log) | Legitimate interests: security of the service and troubleshooting (1 f) |
| Receiving and handling feedback | Legitimate interests: developing the service and fixing errors (1 f) |
| Showing the competition organiser's server address to players | The organiser's consent (1 a). Consent can be withdrawn at any time. |
Data stored in your browser
Your browser's storage (localStorage) holds data that stays on your device and is not sent to the server: search history (key pp2_haut_v1, up to the 5 search results you most recently picked, saved when you pick a result), language choice (pp2_kieli, saved when you change the language yourself) and the own settings of the Host it yourself and Autoscript tools (pp2-hostaus, pp2-autoscript:nyt, pp2-autoscript:tallennetut). The Host it yourself tool also remembers your own IP address, whether you typed it or the page detected it, and its Clear button removes the data. The administration view of signed-in users also stores interface settings and a local working copy. The site has no separate button for clearing the search history: you can delete it in your browser settings (site data). This storage is strictly necessary for the operation of the service and falls under section 205 of the Finnish Act on Electronic Communications Services, so no consent is needed.
4. Whether providing data is mandatory
Using the site and viewing results does not require you to provide personal data. In the Feedback form only the message is mandatory. An administrator account needs an email address so that the invitation and password reset can be sent. Publishing results is based on game logs, so players do not provide data to the service themselves.
5. Retention periods
- Administrator account: until it is deleted (you can ask for deletion at any time).
- Security log (sign-ins, IP addresses, permission changes): 12 months. Older lines are deleted automatically the next time something is written to the log (at most once a day). The file is also rotated when it fills up.
- Event log: the last 200 events.
- Sessions: 2 hours of inactivity, at most 12 hours.
- Rate-limit and sign-in attempt counters (as hashes): short-lived, removed about one hour after the limiting window ends.
- Feedback: until the administrators delete it; the service keeps at most 500 messages, and unhandled ones are always kept.
- Email sending log (time and recipient, and for failed sends also the content): 30 days. Older entries are deleted automatically the next time a message is sent (at most once a day).
- Backups: the main administrator makes a zip copy of the site and its data by hand (users, seasons; not sessions or the configuration file). The last 5 copies are kept in the service's data directory. In addition, a copy of the previous public page is stored on every publication, the last 5. The web host may also take its own backups of the server. Whether they exist and how long they are kept is determined by the web host's practices, and we cannot influence it.
- Server log: according to the web host's practices (the web host does not publish a period).
- Organiser's server address: in the season data until the organiser withdraws permission or the season is deleted. On the public site it is visible only in the round's time window.
- Published results: part of the competition history until you ask for them to be removed or changed (section 7).
6. Who receives the data
Data is not sold and is not disclosed for marketing.
- Web host (processor). Domainhotelli, Planeetta Internet Oy. According to the provider the data centres are in Helsinki. The web host processes data on our behalf under a data processing agreement. Under the agreement the web host may use sub-processors, and transfers outside the EU/EEA require standard contractual clauses.
- Email service. Messages are sent from the web host's server with the server's own mail function (PHP mail). The domain's sender policy record (SPF) allows only this server's addresses, and no external email service is used.
- We ourselves do not transfer data outside the EU/EEA and do not disclose it to anyone else.
7. Your rights
You have the right to access your data, have it rectified, ask for its erasure, restrict the processing and object to processing based on legitimate interests. You can also ask for your data to be transferred. A machine-readable export is not available as a ready-made function: we hand over the data on request by hand. Make these requests at the contact address above; we reply within one month. If you want your name or player name removed from the results, we can replace it with a nickname.
Identification. For requests about results we may ask you to show that the player name is yours. We accept account requests from the email address of the account.
We do not use automated decision-making or profiling.
If you believe we are processing your data unlawfully, you can lodge a complaint with the supervisory authority: the Office of the Data Protection Ombudsman.
8. Security
Accounts are protected with a password of at least 12 characters, and passwords are stored only as hashes. Two-factor authentication (a time-based code and recovery codes) is available to administrators and recommended, not mandatory: the administration reminds users of it until it is turned on. Sessions expire automatically. The number of requests is limited to prevent abuse. If a personal data breach is detected, we will notify those concerned and, where necessary, the authority within the time required by law.
9. Changes
We update this notice when the processing changes. The current version is always on this page.