Arena Privacy Policy

1. Scope and data controller

This Policy applies when you visit Arena2Connect, create or receive an account, link a communication channel, play or watch a match, enter or create a tournament, buy Pitch Credits or Marketplace access, hire Arena Coach, participate in Arena Clubhouse, subscribe through a Telco/VAS provider, appear on a leaderboard, claim a reward, contact support, receive email or otherwise interact with Arena.

Arena2Connect determines why and how Arena personal data is processed and is the data controller, except where a Telco, messaging platform, payment gateway, tournament sponsor or other partner independently determines its own processing under its privacy notice.

2. Information we collect

Account and identity data

Name or nickname, Arena handle, player code, email address, international-format phone number, country or state where supplied, password hash, account role and status, referral code, verification timestamps, accepted legal-policy versions, login history and account preferences.

Channel and communication data

Linked channel, provider, external user or conversation identifier, username, phone number, verification and last-seen data, inbound and outbound message text, sender and recipient addresses, provider message IDs, delivery status, timestamps, webhook headers, payloads and technical metadata.

Gameplay and competition data

Commands, timing and reaction measurements, game moves and outcomes, match sessions, teams, formations, player attributes, scores, commentary, invitations, fixtures, tournament applications and entries, squads, group tables, qualification status, leaderboard statistics, reward qualification, anti-farming checks, spectator activity and comments, Tournament Talk comments, @mentions, comment reports and tournament-specific moderation records. When you opt into Quick Match, Arena also processes your temporary matchmaking availability, selected opponent preference, challenge/matching mode, queue time and any resulting casual-match link.

Media and public-profile data

Avatar, team logo, team image, tournament banner, public display name, tournament identity and any text, image or comment you upload or ask us to publish, including Tournament Talk posts and @mentions.

Subscription, wallet and payment data

Pitch Credit wallet balance and ledger, purchase amount and currency, transaction and provider references, payment status, authorisation URL, selected gateway, Arena Pass product and usage, Telco product, MSISDN, subscription ID, event type and status, renewal and expiry dates, allowances, reconciliation and billing metadata. Payment providers generally process full card or bank authentication details directly; Arena does not intentionally store full card details.

Marketplace and Coach data

Marketplace product and variant, purchase reference, Pitch Credit amount, entitlement scope and dates, tournament scope where applicable, and fulfilment metadata. When you request Arena Coach analysis, we may process your own historical match statistics, actions, moves and completed match records, the selected fixture or completed match, and opponent information only from matches you personally played against that opponent. We may store the prepared coaching context, your Coach question, report type, response, provider/model identifier and audit metadata so you can review reports and we can investigate quality, access and privacy issues. Where a persistent external Coach conversation provider is enabled, Arena may also maintain an opaque per-user conversation thread so coaching sessions can retain continuity. Arena does not use your email address, phone number or Arena handle as the remote thread identifier, and the external provider does not receive direct database access through Coach. Arena keeps its own Coach report history so the external thread is not the only record of your coaching activity.

Clubhouse community and moderation data

Community-rule acceptance, categories, topics, posts, replies, Arena Lounge live-chat messages, short-lived Lounge presence, personal Lounge mutes, reports, moderation reasons, hidden/locked/pinned status, forum/Lounge sanctions, sanction expiry and administrator moderation audit records. Lounge messages are web-only and are not automatically forwarded through SMS, WhatsApp or Telegram.

Reward and payout data

Leaderboard position, winner and claim status, account name, bank name, bank code, account number, currency, verification status and information reasonably needed to investigate eligibility, fraud or payment.

Support, newsletter and administration data

Contact-form messages, support correspondence, newsletter campaign and recipient status, whether an email was queued, sent, failed or skipped, administrator actions, moderation notes, financial-report delivery records, tournament notifications and complaint history.

Device, security and usage data

IP address, user agent, session identifiers, access tokens, cookie data, local browser preferences such as selected timezone display, requested URLs, error and activity logs, rate-limit information, security events and information used to diagnose outages, deadlocks, delivery failures or abuse.

3. How we obtain information

• Directly from you: registration, settings, gameplay, comments, uploads, purchases, tournament forms, payout forms and support.
• Automatically: website sessions, server logs, security controls, Web Chat polling, gameplay timing and device/browser data.
• From linked providers: Telegram, WhatsApp, SMS providers, Telcos, VAS aggregators, payment gateways, email providers and channel webhooks.
• From other users or organisers: match invitations, tournament applications, squad assignments, comments, Tournament Talk @mentions, reports and creator moderation.
• From administrators and partners: account-status changes, reward verification, tournament management, reconciliation, sponsorship and support records.

4. Why we use personal data and our lawful bases

Where we rely on consent, you may withdraw it. Withdrawal does not make earlier lawful processing invalid. Where we rely on legitimate interests, we assess the need, impact and safeguards and you may object as described below.

5. Information that may be public

Arena is partly a public competition and spectator service. The following may be visible to other users or the public: nickname, Arena handle, avatar, team name and images, tournament entry, squad, fixture, score, commands translated into commentary, match events, statistics, group standings, leaderboard position, winner status, spectator comments and Tournament Talk comments. If you deliberately opt into Quick Match and allow challenges, other Arena users may also see that you are currently available for a casual game, your selected matchmaking preference and a link to your public Arena profile. This availability is temporary and opt-in. When you enter Arena Lounge, authenticated Arena members in that live room can see the Lounge messages you send and your linked public player identity; Lounge presence is short-lived and used to show how many members are currently there.

Your password, verification code, private email, private phone number, full bank account number and private support correspondence are not intended for public display. Administrators and authorised service providers may access private data where needed for their duties.

Clearing Web Chat removes the visible conversation from your Web Chat history but does not delete completed match events, transaction ledgers, anti-abuse records, public commentary or provider-held messages. A messaging provider may keep messages according to its own policy.

6. Automated processing and human review

Arena uses automated rules to generate match outcomes, enforce turn timing, assign fixtures, calculate standings, determine qualifying games, rank leaderboards, consume allowances, detect duplicate or suspicious activity, and decide whether a command is accepted, charged or timed out.

Most of these decisions are necessary to deliver the game and do not produce legal effects. Decisions affecting account suspension, reward eligibility, payout, significant fraud findings or another similarly important interest may be reviewed by an authorised person. You may contact us to explain your position, request human intervention or contest an automated decision, subject to applicable law and the need to preserve anti-fraud controls.

Arena Coach may use deterministic software or a configured language-model service to turn a restricted Arena dataset into training guidance. The application, not the model, determines which records are permitted: your own play history and opponent information only from direct matches between you and that opponent. Coach is blocked during live gameplay. If an external model endpoint is enabled, only the prepared Arena coaching context and your Coach question are sent to that provider; the feature does not grant the provider direct access to Arena's database or unrestricted opponent records.

7. Newsletters, invitations and direct marketing

Arena administrators may send a newsletter or invitation to account holders selected by account status, such as active, pending or suspended, or to one or more specifically selected users. Campaign records may show the recipient address, name, account status and delivery result.

We will send marketing only where we have a lawful basis. You may object at any time and ask us to stop promotional emails or messages by using an unsubscribe method where provided or contacting us. We may still send non-marketing messages required for account security, transactions, subscriptions, tournaments, legal notices or services you requested.

Do not forward a personal verification, reset, onboarding or reward-claim link to another person. Such links may be time-limited, single-purpose and associated with your account.

8. When we share information

We do not sell personal data. We may disclose the minimum information reasonably necessary to:

• Messaging and delivery providers: SMS aggregators, mobile networks, Telegram, WhatsApp/Meta, email providers and notification services.
• Payment and financial providers: Paystack, Squad, Ogaranya, banks and payment processors used to initiate, verify, reverse or reconcile transactions and approved rewards.
• Hosting, security and technical providers: infrastructure, database, backup, monitoring, anti-abuse, captcha and software-support providers.
• AI/language-model providers where Arena Coach is configured to use one: the restricted coaching context and question needed to generate the requested report. Arena does not intentionally send unrelated Arena records or direct database credentials through the Coach request.
• Tournament creators, sponsors and partners: entrant, fixture, winner, moderation or settlement information reasonably needed to operate a specific tournament or fulfil a disclosed prize, without giving them unrestricted access to private account data.
• Professional advisers: lawyers, auditors, accountants, insurers and data-protection advisers under confidentiality duties.
• Authorities and claimants: regulators, courts, law enforcement or another person where legally required or reasonably necessary to protect rights, safety, users, the public or Arena.
• Business transfers: a buyer, investor or successor in a merger, financing, restructuring or sale, subject to appropriate confidentiality and continued protection.

Third-party advertisements or external links may take you to another service. Their privacy practices apply once you leave Arena. Advertisers do not receive private Arena messages merely because an advertisement is displayed.

9. International data transfers

Some communication, cloud, email, payment or support providers may process data outside Nigeria. Where personal data is transferred internationally, we will use a mechanism permitted by applicable law, such as an adequacy decision, contractual safeguards, approved certification or another lawful exception, and will consider the destination, recipient and security measures.

10. Cookies, sessions and browser storage

Arena uses necessary cookies or similar storage to maintain login sessions, protect forms, remember security state and keep Web Chat active. The browser may also store preferences such as whether dates should display in UTC or your local timezone.

Blocking necessary cookies may prevent login, gameplay, payments or account settings from working. Where optional analytics or advertising storage is introduced, we will provide any notice or choice required by law.

11. Retention, account deletion and backups

We keep personal data only for as long as reasonably necessary for the purpose collected, including:

• account and channel data while the account is active and for a reasonable period after closure to handle restoration, disputes, fraud and legal obligations;
• game, tournament, public result and leaderboard records needed to preserve competition history and integrity;
• wallet, payment, Telco, reward and payout records for accounting, reconciliation, consumer disputes, tax, audit and fraud-prevention periods required by law or legitimate operational need;
• security, webhook, activity and error logs for periods proportionate to investigation, reliability and abuse-prevention needs;
• newsletter delivery records and support correspondence for campaign accountability, opt-out handling, service improvement and dispute resolution;
• Marketplace purchase/entitlement records for fulfilment, wallet reconciliation, support and audit; Coach reports and restricted context snapshots for user history, quality investigation and access/privacy auditing; Clubhouse discussion posts, reports, moderation actions and sanctions for community operation and abuse handling;
• Arena Lounge live-chat messages for 30 days by default, Lounge reports for 180 days by default, and only short-lived Lounge presence needed to show who is currently in the room. These periods are configurable and eligible old records are deleted in controlled batches;
• Quick Match availability for only the short matchmaking window needed to find an opponent; Arena reuses one queue record per player and changes it to matched, cancelled or expired rather than keeping a new permanent presence record for every heartbeat;
• backups until they are overwritten under the normal backup cycle.

Where the operator enables the retention scheduler and sets a retention period, old Web Chat display messages and detailed gameplay conversation may be moved from the live message table into a verified archive and then expunged in controlled batches. These two categories default to permanent retention until a period is expressly configured. Transactional, subscription, payment, reward, security, newsletter and other service records are not included in this automated message cleanup.

Anti-automation event records use a separate security retention policy. Routine login and tournament-registration observations default to 30 days, human-verification and security-signal events to 180 days, and administrator review/clear audit events to 365 days. Eligible old records are deleted in controlled batches; active scoring signals are not deleted while they can still affect a player's current risk score. These periods may be adjusted by the operator for legitimate security, legal or operational needs.

When you request account deletion, we will delete, anonymise or restrict data that is no longer needed. We may preserve immutable transaction ledgers, completed competition records and evidence required for legal claims, fraud prevention or regulatory duties. Public records may be de-identified instead of removed where deletion would damage the integrity of a completed competition.

12. Security and personal-data breaches

We use reasonable technical and organisational measures, which may include password hashing, expiring verification tokens, signed callbacks, access controls, audit logs, rate limits, database transactions, encryption in transit, provider authentication, backups and restricted administrator access.

No internet service is completely secure. Protect your password, devices and verification links and notify us promptly of suspected misuse. Where a personal-data breach creates a risk requiring notification, we will take steps required by applicable law, including notifying affected people and the Nigeria Data Protection Commission where appropriate.

13. Your data-protection rights

Subject to the Nigeria Data Protection Act 2023 and applicable exceptions, you may have the right to:

• be informed about processing and obtain access to your personal data;
• correct inaccurate or incomplete data;
• request deletion or restriction where the legal conditions are met;
• object to processing based on legitimate interests and object at any time to direct marketing;
• withdraw consent without affecting earlier lawful processing;
• request data portability where applicable and technically available;
• not be subject to certain solely automated decisions with legal or similarly significant effects, and request human intervention;
• lodge a complaint with the Nigeria Data Protection Commission or seek another lawful remedy.

To protect users, we may verify identity before responding. Describe the account, requested right and relevant data. We may refuse or limit a request where permitted by law, including where disclosure would affect another person's rights, reveal protected anti-fraud information, undermine competition integrity, or conflict with a legal retention duty.

14. Children and young users

A person under 18 should use Arena only with the knowledge, consent and supervision of a parent or legal guardian. The guardian should control paid subscriptions, wallet purchases, creator funding and prize claims. We do not knowingly use a child's personal data for targeted marketing without a lawful basis and any required guardian authorisation.

If you believe a child has provided personal data without appropriate authority, contact us so we can investigate and take suitable action.

15. Changes, requests and complaints

We may update this Policy to reflect new features, providers, security practices or legal requirements. The version and effective date will be updated, and we may provide additional notice or request fresh consent where required.

Data controller: Arena2Connect

Privacy requests may be submitted through the Arena contact page.

You may also complain to the Nigeria Data Protection Commission. We encourage you to contact us first so we can attempt to resolve the matter promptly.