Max Recovery Christmas 2026Privacy notice
Who is responsible: the volunteer organisers of Max Recovery Christmas 2026, based in Belgium, are responsible for your data (the "data controller" under the EU General Data Protection Regulation, GDPR). You can reach us at [email protected] about anything in this notice.
What we collect:
- Account: your email address, a securely hashed password (we cannot read it), your role, when you registered and when you agreed to this notice, and when you last logged in.
- Profile: the details you enter (display name, bio, platform, stream link, profile picture, banner and links).
- Discord username: so our Discord bot can give participants of the current event a role on our Discord server.
- Events: the events you sign up for and whether you were approved.
- Avatar requests: what you asked for, any reference link, the price, the payment status and any PayPal reference you give us. Payments happen on PayPal; we never see your card or bank details.
- Contact messages: your name, email address and message.
- Security: when you register, log in, reset a password, use two-factor authentication or send a contact message, we record your IP address to block abuse and brute-force attacks.
Why we use it, and our legal basis (Art. 6 GDPR):
- To provide your account, publish your profile and run the charity event: necessary to provide the service you signed up for (Art. 6(1)(b)).
- To keep the site secure, prevent abuse and keep a log of organiser actions: our legitimate interest in a safe service (Art. 6(1)(f)).
- To answer contact messages: our legitimate interest in replying to you (Art. 6(1)(f)).
- News emails: you can turn these off at any time on your Account page. Service emails (for example email confirmation and password resets) are always sent because the site cannot work without them.
We make no automated decisions about you; an organiser approves accounts and event places by hand.
What is public: once an organiser approves your account, your profile (display name, bio, images, links, platform, stream link and the events you take part in) is visible to everyone and can be read by our Discord bot and announcements. Your email address and Discord username are never public: only organisers and our role bot can see your Discord username. While you are an approved participant of the current event, the bot gives your Discord account a participant role on our server, which other server members can see; the bot removes the role when you are no longer a participant.
How long we keep it:
- Accounts whose email address is never confirmed are deleted after 14 days.
- Registrations that are not approved are deleted after 60 days.
- Accounts that have not logged in for 730 days get a warning email and are deleted 30 days later unless you log in.
- Contact messages are deleted after 90 days.
- IP addresses kept for security are deleted after 24 hours.
- The organiser action log is kept for 365 days.
- Email confirmation and password reset links expire within 48 hours and are then deleted.
When an account is deleted we also delete its profile, images, links, event sign-ups, schedule, avatar requests, delivered avatar files and the contact messages sent from its email address.
Who else processes it: we only share data with providers we need to run the site: our web host, Microsoft (sending email), Cloudflare (network security and spam protection on forms), and Google Fonts (your browser loads our fonts from Google, which sees your IP address). Our server is in the United Kingdom, which the EU recognises as protecting personal data to the same standard (an "adequacy decision"). Microsoft, Cloudflare and Google may also process data in the United States under the EU-US Data Privacy Framework. Discord handles the roles on our Discord server under its own privacy policy. If you pay for an avatar, PayPal processes that payment under its own privacy policy. We do not sell your data or use it for advertising.
Cookies: this site sets one cookie, PHPSESSID, which keeps you logged in and protects forms against forgery. It contains only a random ID, is never used for tracking, and is deleted when you close your browser. Because it is strictly necessary for the site to work, the law does not require your consent for it, so we do not show a cookie banner. Cloudflare, which protects the site, may set its own strictly necessary security cookies to tell people from bots. We use no analytics, tracking or advertising cookies. You can block cookies in your browser, but you will then not be able to log in.
Security: passwords are stored as one-way hashes, the site runs over HTTPS, and organiser accounts use two-factor authentication.
Your rights: under the GDPR you have the right to access your data, correct it, delete it, restrict or object to how we use it, and get a copy to take elsewhere (data portability).
- Download your data: Account page, "Download my data" (a JSON file).
- Correct your data: edit your profile on your dashboard, or ask an organiser.
- Delete your data: Account page, "Delete account". This takes effect immediately.
- For anything else, email us at [email protected]. We answer within one month.
You also have the right to complain to a data protection authority. Ours is the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données, www.dataprotectionauthority.be), or you can contact the authority in the country where you live.
Changes: if we change this notice in a way that affects you, we will tell you by email or on the site.
What we collect:
- Account: your email address, a securely hashed password (we cannot read it), your role, when you registered and when you agreed to this notice, and when you last logged in.
- Profile: the details you enter (display name, bio, platform, stream link, profile picture, banner and links).
- Discord username: so our Discord bot can give participants of the current event a role on our Discord server.
- Events: the events you sign up for and whether you were approved.
- Avatar requests: what you asked for, any reference link, the price, the payment status and any PayPal reference you give us. Payments happen on PayPal; we never see your card or bank details.
- Contact messages: your name, email address and message.
- Security: when you register, log in, reset a password, use two-factor authentication or send a contact message, we record your IP address to block abuse and brute-force attacks.
Why we use it, and our legal basis (Art. 6 GDPR):
- To provide your account, publish your profile and run the charity event: necessary to provide the service you signed up for (Art. 6(1)(b)).
- To keep the site secure, prevent abuse and keep a log of organiser actions: our legitimate interest in a safe service (Art. 6(1)(f)).
- To answer contact messages: our legitimate interest in replying to you (Art. 6(1)(f)).
- News emails: you can turn these off at any time on your Account page. Service emails (for example email confirmation and password resets) are always sent because the site cannot work without them.
We make no automated decisions about you; an organiser approves accounts and event places by hand.
What is public: once an organiser approves your account, your profile (display name, bio, images, links, platform, stream link and the events you take part in) is visible to everyone and can be read by our Discord bot and announcements. Your email address and Discord username are never public: only organisers and our role bot can see your Discord username. While you are an approved participant of the current event, the bot gives your Discord account a participant role on our server, which other server members can see; the bot removes the role when you are no longer a participant.
How long we keep it:
- Accounts whose email address is never confirmed are deleted after 14 days.
- Registrations that are not approved are deleted after 60 days.
- Accounts that have not logged in for 730 days get a warning email and are deleted 30 days later unless you log in.
- Contact messages are deleted after 90 days.
- IP addresses kept for security are deleted after 24 hours.
- The organiser action log is kept for 365 days.
- Email confirmation and password reset links expire within 48 hours and are then deleted.
When an account is deleted we also delete its profile, images, links, event sign-ups, schedule, avatar requests, delivered avatar files and the contact messages sent from its email address.
Who else processes it: we only share data with providers we need to run the site: our web host, Microsoft (sending email), Cloudflare (network security and spam protection on forms), and Google Fonts (your browser loads our fonts from Google, which sees your IP address). Our server is in the United Kingdom, which the EU recognises as protecting personal data to the same standard (an "adequacy decision"). Microsoft, Cloudflare and Google may also process data in the United States under the EU-US Data Privacy Framework. Discord handles the roles on our Discord server under its own privacy policy. If you pay for an avatar, PayPal processes that payment under its own privacy policy. We do not sell your data or use it for advertising.
Cookies: this site sets one cookie, PHPSESSID, which keeps you logged in and protects forms against forgery. It contains only a random ID, is never used for tracking, and is deleted when you close your browser. Because it is strictly necessary for the site to work, the law does not require your consent for it, so we do not show a cookie banner. Cloudflare, which protects the site, may set its own strictly necessary security cookies to tell people from bots. We use no analytics, tracking or advertising cookies. You can block cookies in your browser, but you will then not be able to log in.
Security: passwords are stored as one-way hashes, the site runs over HTTPS, and organiser accounts use two-factor authentication.
Your rights: under the GDPR you have the right to access your data, correct it, delete it, restrict or object to how we use it, and get a copy to take elsewhere (data portability).
- Download your data: Account page, "Download my data" (a JSON file).
- Correct your data: edit your profile on your dashboard, or ask an organiser.
- Delete your data: Account page, "Delete account". This takes effect immediately.
- For anything else, email us at [email protected]. We answer within one month.
You also have the right to complain to a data protection authority. Ours is the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données, www.dataprotectionauthority.be), or you can contact the authority in the country where you live.
Changes: if we change this notice in a way that affects you, we will tell you by email or on the site.