Privacy Policy

Last updated: 2026-07-22

Računarsko programiranje "EREBUS" s.p. ("we", "us", "our") operates the Chesspoint platform at chesspoint.io. This Privacy Policy explains what personal data we process, on what legal basis, with whom we share it, and what rights you have as a data subject under the EU General Data Protection Regulation (GDPR).

1. Data Controller

The data controller responsible for the processing of your personal data is:

2. Categories of Personal Data We Process

a) Account data

Email address, username, hashed password, date of registration, and preferences. Provided directly by you during signup.

b) Subscription and billing data

Subscription status, start and renewal dates, invoice records, and an opaque transaction identifier returned by our payment processor. We do not store your full card number, CVV, or expiry date - these are handled entirely by Paddle.

c) Usage data

Lessons accessed, puzzles attempted, training sessions completed, and feature interactions. Used to provide the service and to enforce subscription-gated content limits.

d) Technical and log data

IP address, user agent string, request metadata, and error traces. Used for security, fraud prevention, debugging, and operational stability.

e) Usage statistics (cookieless, anonymized)

We measure aggregated page views, referrers, approximate location (country/region), and device type using Umami, a privacy-friendly analytics tool. This measurement is cookieless, does not create visitor profiles, and does not identify you personally, so no consent banner is required.

3. Legal Basis for Processing (Art. 6 GDPR)

We process your personal data on the following lawful bases:

• Art. 6(1)(b) - Contractual necessity: Account, subscription, and billing data are processed to perform the contract for provision of the Chesspoint service.

• Art. 6(1)(c) - Legal obligation: Invoices and accounting records are retained for tax and bookkeeping obligations under applicable BiH and EU law.

• Art. 6(1)(f) - Legitimate interests: Security logging, fraud prevention, diagnostic error reporting, and cookieless, anonymized usage statistics are carried out on the basis of our legitimate interest in operating a secure, stable, and continuously improving service, balanced against your rights and freedoms.

4. Processors and Subprocessors

To operate Chesspoint we rely on the following third parties, all of which act as processors under a data processing agreement (Art. 28 GDPR):

Where transfers to third countries outside the EEA are involved, we rely on the Standard Contractual Clauses adopted by the European Commission (Commission Implementing Decision (EU) 2021/914) and, where applicable, the EU-U.S. Data Privacy Framework.

5. Retention Periods

• Account data: retained while your account is active; deleted within 30 days of account deletion, except where retention is legally required.

• Invoice and billing records: retained for up to 11 years to comply with tax and accounting obligations in BiH and the EU.

• Server and security logs: retained for a maximum of 90 days.

• Error monitoring data (Sentry): retained for a maximum of 90 days.

• Usage statistics: collected only in aggregated, anonymized form; no personally identifiable analytics data is stored.

6. Your Rights as a Data Subject

Under the GDPR, you have the following rights:

• Right of access (Art. 15)

• Right to rectification (Art. 16)

• Right to erasure / "right to be forgotten" (Art. 17)

• Right to restriction of processing (Art. 18)

• Right to data portability (Art. 20)

• Right to object (Art. 21)

• Right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal (Art. 7(3))

To exercise any of these rights, please contact us at chesspoint.io@gmail.com. We will respond within one month of receipt of the request, in accordance with Art. 12(3) GDPR.

7. Right to Lodge a Complaint (Art. 77 GDPR)

If you believe that our processing of your personal data infringes the GDPR or other applicable data protection law, you have the right to lodge a complaint with a supervisory authority. In Bosnia and Herzegovina, the competent authority is the Personal Data Protection Agency of Bosnia and Herzegovina (Agencija za zaštitu ličnih podataka u Bosni i Hercegovini). EU residents may also lodge a complaint with the supervisory authority of their habitual residence, place of work, or place of the alleged infringement.

8. Cookies and Similar Technologies

We use the following categories of cookies and similar browser storage:

• Strictly necessary: required for login sessions and CSRF protection. These are set without consent as they are necessary to deliver the service you requested.

• Analytics: we use Umami, a cookieless analytics tool that sets no cookies and stores no identifiers in your browser. Because it processes no personal data and creates no profiles, no consent banner is required.

We do not use advertising, profiling, or cross-site tracking cookies.

9. Automated Decision-Making

We do not carry out any automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The most recent version will always be available on this page, together with the date of the last update. For material changes we will notify registered users by email.

11. Contact

If you have any questions about this Privacy Policy or how your personal data is processed, please contact us at: