Personal data processing policy
Last updated: 18 October 2026
1. Data controller
This policy describes how the operator of lpu.ru processes personal data. Legal name, address and contact information must be supplied by the operator.
2. Purposes and categories of personal data
Registration and account management: email address, user ID, password hashes, assigned roles, security events. Tournament administration: names, organizations, birth year/date where provided, gender where necessary for the tournament regulations, chess IDs, ratings by time control, team/club, pairings and results. The ratings directory may process publicly available federation data received from FIDE, CFR, and ChessResults.ru. Technical operation and security: IP addresses, session cookies, request timestamps, error and audit logs. Details about children require particular care.
3. Legal grounds and use
Data is processed according to applicable Russian law (including Federal Law No. 152-FZ), based on the legal ground appropriate to the specific purpose: an agreement, a legal obligation, or a valid consent where required. Publishing this policy is not a substitute for a separate consent when the law requires it. The operator does not treat a public chess rating as consent to publish unrelated personal data.
4. Operations and recipients
Data may be collected, recorded, structured, stored, updated, used, transmitted to authorized service providers where required, blocked and deleted. Access is limited by the user’s role and organization. Public tournament results and player profiles, if enabled, require a separate assessment of disclosure rights and consent. Source federation records remain identifiable.
5. Storage, location, retention
Personal data is stored for the period required to meet the relevant purpose or applicable statutory duty, then erased or anonymized unless other lawful grounds apply. The operator must verify whether and how the legal requirements for localization of Russian citizens’ data are met and document hosting and backup locations. A fixed retention period must be specified in internal records for each processing purpose.
6. Security and cookies
The site uses protected sessions and technically necessary cookies for login, interface language and security. Server-side controls include role checks, access logs, password hashing and restricted database access. Security measures and any third-party analytics, email services, and hosting processors must be verified in the operator’s final inventory.
7. Rights of individuals
Data subjects may request access, clarification, blocking or deletion of their personal data, withdraw applicable consent, and contact the competent supervisory authority, subject to statutory exceptions. Requests should be sent to the verified operator contact below. The operator may need to verify the requester’s identity before acting.
8. Changes and contact
The operator may update this policy when processing practices or legal requirements change. The currently applicable version is published at this address.
1. Data controller
- Operator
- Not yet configured by the site owner
- Legal / postal address
- Not yet configured by the site owner
- Personal data contact
- Not yet configured by the site owner