Effective date: 28 July 2026 · Last updated: 28 July 2026

1. Controller and contact

The controller for this community hub is the Phoenix Romania community administration. Privacy enquiries and data-rights requests may be sent to scp@pxn.ro or submitted through the official support/Discord ticket channel. Please do not send passwords or authentication tokens.

2. Data we process

• Account data: display name, email address, password hash, avatar, roles, account dates and preferences.
• Linked identities: SteamID64 and Steam profile information; Google account identifier and matching email when Google sign-in is enabled.
• Technical and security data: IP address, session identifiers, timestamps, browser/device information, login attempts and audit logs.
• Community and gameplay data: online status, server activity, playtime, XP, coins, leaderboard records, sanctions and linked game statistics.
• Transactions and submissions: shop orders, payment references supplied by payment providers, staff applications, clips, posts, votes, reports and support communications.

We do not need your Steam password, Google password or full payment-card details and you should never provide them to community staff.

3. Purposes and legal bases

We process data to create and authenticate accounts, link the correct Steam identity, operate servers and community features, deliver purchases, review applications, calculate rankings, prevent fraud and abuse, secure infrastructure, answer requests and comply with law. Depending on the activity, the legal basis is performance of our agreement with you, legitimate interests in operating and protecting the community, compliance with legal obligations, or consent for genuinely optional processing.

4. Recipients and third-party services

Data is available only to authorised staff and service providers where necessary. Integrations may involve Steam/Valve, Google, Discord, YouTube, TikTok, payment providers, hosting providers and SCPList. Embedded content can allow its platform to receive your IP address and browser data under that platform’s own policy. Some providers may process data outside the EEA using an adequacy decision or other lawful safeguards.

5. Retention

Account data is normally retained while the account is active. Security and access logs are generally retained for up to 12 months unless an incident requires longer preservation. Unsuccessful or completed staff applications are normally reviewed for deletion or anonymisation after 12 months. Transaction records are retained for the period required by accounting, tax and dispute rules. Gameplay statistics may be aggregated or anonymised for historical rankings. Data may be retained longer where necessary to establish, exercise or defend legal claims.

6. Cookies and local storage

The hub uses essential cookies or local storage for sessions, security, preferences and consent. Authentication cannot function without essential storage. Third-party embeds may set their own cookies only when loaded and are governed by the relevant provider.

7. Your rights

Subject to the GDPR and Romanian law, you may request access, rectification, erasure, restriction, portability or objection; withdraw consent for future processing; and complain to the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP). Rights are not absolute—for example, some records must be retained for security, legal or financial obligations. We may request reasonable identity verification before acting on a request.

8. Security and automated decisions

We use access controls, password hashing, encrypted transport where deployed, audit logging, backups and restricted administrative permissions. No internet service can guarantee absolute security. Rankings and automated anti-abuse signals may assist staff, but Phoenix Romania does not intend to make decisions producing legal or similarly significant effects solely by automated means.

9. Children and policy changes

The account service is intended for users aged 16 or over unless valid parental authorisation and applicable law permit otherwise. We may update this Policy when functionality, providers or legal requirements change and will publish the revision date.