StepBridge respects the privacy of its online visitors and customers of its products and services and complies with applicable laws for the protection of your privacy, including, without limitation, the European Union General Data Protection Regulation (“GDPR”) .

1. Definitions

Wherever we talk about personal data below, we mean any information that can either itself identify you as an individual (“Personally Identifying Information”) or that can be connected to you indirectly by linking it to Personally Identifying Information. StepBridge also processes anonymous data, aggregated or not, to analyze and produce statistics related to the habits, usage patterns, and demographics of customers as a group or as individuals. Such anonymous data does not allow the identification of the customers to which it relates. StepBridge may share anonymous data, aggregated or not, with third parties.

2. Why StepBridge Collects and Processes Data

StepBridge is a bridge community where people play bridge using the same identity as they use in the physical bridge world. The bridge experience we deliver is meant to be as close as possible to playing at a physical club. This means we want members to experience they play with fellow bridge payers not hiding behind anonymous or fake identities. 

StepBridge collects and processes personal data for the following reasons:

a) where it is necessary for the performance of our agreement with you to provide an online bridge service and deliver associated content and services;
b) where it is necessary for compliance with legal obligations that we are subject to (e.g. our obligations to keep certain information under tax laws);
c) where it is necessary for the purposes of the legitimate and legal interests of StepBridge or a third party (e.g. the interests of our other customers), except where such interests are overridden by your prevailing legitimate interests and rights; or
d) where you have given consent to it.

These reasons for collecting and processing personal data determine and limit what personal data we collect and how we use it (section 3. below), how long we store it (section 4. below), who has access to it (section 5. below) and what rights and other control mechanisms are available to you as a user (section 6. below).

3. What Data We Collect and Process

3.1 Basic Account Data

When setting up an account, StepBridge will collect your name, address, date of birth, email address, phone number and National Bridge Organisation (NBO) membership. The provision of this information is necessary to register a StepBridge account. During setup of your account, the account is manually assigned a username that is later used to reference you. You also get assigned a password which, in combination with your username, allows you to login to StepBridge.

3.2 Transaction and Payment Data

In order to make a transaction on StepBridge, you may need to provide payment data to StepBridge to enable the transaction. If you pay by credit card, you need to provide typical credit card information (name, address, credit card number, expiration date and security code) to StepBridge, which StepBridge will process and transmit to the payment service provider of your choice to enable the transaction and perform anti-fraud checks. Likewise, StepBridge will receive data from your payment service provider for the same reasons.

3.3 Other Data You Explicitly Submit

We will collect and process personal data whenever you explicitly provide it to us or send it as part of communication with others on StepBridge. This data includes:
a) information that you post in any of our content and services;
b) information sent through chat; and
c) information you provide when you request information or support from us or purchase services from us, including information necessary to process your orders.

3.4 Your Use of the StepBridge Websites

We collect a variety of information through your general interaction with the websites, content and services offered by StepBridge. Personal data we collect may include, but is not limited to, browser and device information, data collected through automated electronic interactions and application usage data. Likewise, we will track your process across our websites and applications to verify that you are not a bot and to optimise our services.

3.5 Your Use of the StepBridge App

In order to provide you with services, we need to collect, store and use various information about your activity when you use the StepBridge App. This includes your username, as well as what is usually referred to as “game data”. By game data we mean information about your games’ preferences, progress in the games, playtime, as well as information about the device you are using, including what operating system you are using, device settings, unique device identifiers, and crash data.

3.6 Tracking Data and Cookies

We use “Cookies”, which are text files placed on your computer, to help us analyze how users use our services, and similar technologies (e.g. web beacons, pixels, ad tags and device identifiers) to recognize you and/or your device(s) on, off and across different devices and our services, as well as to improve the services we are offering, to improve marketing, analytics or website functionality. The use of Cookies is standard on the internet. Although most web browsers automatically accept cookies, the decision of whether to accept or not is yours. You may adjust your browser settings to prevent the reception of cookies, or to provide notification whenever a cookie is sent to you. You may refuse the use of cookies by selecting the appropriate settings on your browser.
When you visit any of our services, our servers log your global IP address, which is a number that is automatically assigned to the network your computer is part of.

3.7 Google Analytics [currently not activated, but it could be activated without prior notice]

This website uses Google Analytics, a web analytics service provided by Google, Inc. (“Google”). Google Analytics uses “cookies”, which are text files placed on visitors’ computers, to help the website operators analyse how visitors use the site. The information generated by the cookie about the visitors’ use of the website will generally be transmitted to and stored by Google on servers in the United States.

On this website, IP anonymisation has been activated. The IP addresses of users visiting StepBridge will be shortened. Only in exceptional cases will a complete IP address be transferred to a Google server in the United States and shortened there. On behalf of the website operator, Google will use this information for the purpose of evaluating the website for its users, in order to compile reports on website activity, and to provide other services relating to website activity and internet usage for website operators.

Google will not associate the IP address transferred in the context of Google Analytics with any other data held by Google. You may refuse the use of cookies by selecting the appropriate settings on your browser. However, please note that in this case you may not be able to use the full functionality of this website. Furthermore, users can prevent the collection of data about their use of the website (including their IP address) generated by the cookie, and the processing of data by Google, by downloading and installing the browser plug-in through the following link: https://tools.google.com/dlpage/gaoptout?hl=en.

3.8 Information Required to Detect Violations

We collect certain data that is required for our detection, investigation and prevention of fraud, cheating and other violations of our terms, bridge laws and other applicable laws (“Violations”). This data is used only for the purposes of detection, investigation, prevention and, where applicable, acting on of such Violations and stored only for the minimum amount of time needed for this purpose. If the data indicates that a Violation has occurred, we will further store the data for the establishment, exercise or defense of legal claims during the applicable statute of limitations or until a legal case related to it has been resolved. Please note that the specific data stored for this purpose may not be disclosed to you if the disclosure will compromise the mechanism through which we detect, investigate and prevent such Violations.

4. How Long We Store Data

We will only store your information as long as necessary to fulfil the purposes for which the information is collected and processed or — where the applicable law provides for longer storage and retention period — for the storage and retention period required by law. After that your personal data will be deleted, blocked or anonymised, as provided by applicable law.

In particular:
If you terminate your StepBridge account, your personal data will be marked for deletion except to the degree legal requirements or other prevailing legitimate purposes dictate a longer storage. In certain cases personal data cannot be completely deleted in order to ensure the consistency of the gameplay experience. For instance, tournaments you have participated in will keep your username and/or full name listed in the results for an unlimited time. 

Please note that StepBridge is required to retain certain transactional data under statutory commercial and tax law for a period of up to ten (10) years.

If you withdraw your consent on which a processing of your personal data is based, we will delete your personal data without undue delay to the extent that the collection and processing of the personal data was based on the withdrawn consent. If you exercise a right to object to the processing of your personal data, we will review your objection and delete your personal data that we processed for the purpose to which you objected without undue delay, unless another legal basis for processing and retaining this data exists or unless applicable law requires us to retain the data.

5. Who Has Access to Data

5.1 If you play on StepBridge, your results are considered public data. Your results may be published on the website of StepBridge including your full name. 

5.2 StepBridge and its subsidiaries may share your personal data with each other and use it to the degree necessary to achieve the purposes listed in section 2. above. In the event of a reorganisation, sale or merger we may transfer personal data to the relevant third party subject to applicable laws.

5.3 We may also share your personal data with the NBO you are a member of. Your personal data will be used in accordance with this Privacy Policy and only as far as this is necessary for services the NBO provides (eg. master points).

5.4 StepBridge may release personal data to comply with court orders or laws and regulations that require us to disclose such information.

6. Your Rights and Control Mechanisms

The data protection laws of the European Economic Area and other territories grant their citizens certain rights in relation to their personal data. While other jurisdictions may provide fewer statutory rights to their citizens, we make the tools designed to exercise such rights available to our customers worldwide.

To allow you to exercise your data protection rights in a simple way we are providing a dedicated section on the StepBridge Portal. This gives you access to your personal data, allows you to rectify and delete it where necessary and to object to its use where you feel necessary. To access it, log into the StepBridge Portal at https://portal.stepbridge.co.uk/ and choose the menu item Profile.

As a resident of the European Economic Area you have the following rights in relation to your personal data:

6.1 Right of Access.

You have the right to access your personal data that we hold about you, i.e. the right to require free of charge (i) information whether your personal data is retained, (ii) access to and/or (iii) duplicates of the personal data retained. You can use the right to access to your personal data through the StepBridge Portal. If the request affects the rights and freedoms of others or is manifestly unfounded or excessive, we reserve the right to charge a reasonable fee (taking into account the administrative costs of providing the information or communication or taking the action requested) or refuse to act on the request.

6.2 Right to Rectification.

If we process your personal data, we shall endeavor to ensure by implementing suitable measures that your personal data is accurate and up-to-date for the purposes for which it was collected. If your personal data is inaccurate or incomplete, you can request StepBridge Support to correct the data.

6.3. Right to Erasure.

You have the right to obtain deletion of personal data concerning you if the reason why we could collect it (see section 2. above) does not exist anymore or if there is another legal ground for its deletion. As a result of deleting your StepBridge account, you will lose access to all StepBridge services.

In some cases, deletion of your StepBridge account, and therefore personal data deletion, is complicated. In some cases, considering the complexity and number of the requests, the period for personal data erasure may be extended, but for no longer than two further months.

6.4 Right to Object.

When our processing of your personal data is based on legitimate interests according to Article 6(1)(f) of the GDPR / section 2.c) of this Privacy Policy, you have the right to object to this processing. If you object we will no longer process your personal data unless there are compelling and prevailing legitimate grounds for the processing as described in Article 21 of the GDPR; in particular if the data is necessary for the establishment, exercise or defense of legal claims.

You also have the right to lodge a complaint at a supervisory authority.

6.5 Right to restriction of processing of your personal data

You have the right to obtain restriction of processing of your personal data under the conditions set out in article 18 of the GDPR.

7. Children

The minimum age to create a StepBridge account is 13. StepBridge will not knowingly collect personal data from children under this age. Insofar as certain countries apply a higher age of consent for the collection of personal data, StepBridge requires parental consent before a StepBridge account can be created and personal data associated with it collected. StepBridge encourages parents to instruct their children to never give out personal information when online.

8. Contact Info

You can contact StepBridge’s data protection officer by sending an e-mail to StepBridge Support, or at the address below.

StepBridge International
Kennedylaan 9
3533KH Utrecht
The Netherlands

Revision: September 2021