This Privacy Policy explains what data Kordon Labs (“Kordon”, “we”, “us”) processes when you use the Service, why, for how long and what rights you have. Terms with capital letters have the meaning given in the Terms of Service.
We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and other data protection laws that apply to us.
We collect the minimum. Kordon does not ask customers or players for real names, home addresses, phone numbers or identity documents, and does not determine their precise location. Players are known to us only by their nickname, game UUID and IP address, and we do not try to find out who is behind them.
Who is responsible for the data
- Customers' data
- Kordon is the controller: accounts, payments, support and the security of the Service.
- Players' data
- The owner of the Resource (our customer) is the controller; Kordon processes the data on the customer's behalf, as a processor.
- The Kordon database
- Kordon is the controller: the shared list of addresses and networks found to be VPNs, proxies, hosting, bots or attack sources, used to protect all connected Resources.
Data of customers
When you create and use a Kordon account, we process:
- account data: username, email address, display name, language;
- security data: sign-in details, two-factor authentication settings, sign-in sessions with the IP address and browser, technical features of the browser and device (graphics card, screen, time zone, fonts) that keep a blocked account from being replaced with a new one, the account's security log;
- your Resources and their settings, lists, kick messages, API keys and team members;
- billing data: plan, period, amounts, payment method and the payment's identifiers. We do not receive card numbers or wallet keys;
- support tickets: your messages and the files you attach;
- emails we send you (codes and notices).
Data of players
When a player connects to a Resource with the Kordon plugin, we receive and store for that Resource:
- the player's IP address and the server address they connected to;
- nickname, game UUID and whether the account is licensed;
- game client details: version, language, Java or Bedrock;
- the time of the connection, the play session and play time;
- the result of the check: allowed or blocked, and the reasons;
- the player's skin, to show it in the client area.
From the IP address we determine the country, the network and the internet provider, and whether the address belongs to a VPN, proxy, hosting, Tor or another anonymiser; for this we use IP reputation data from third-party sources and the Kordon database. The country is determined approximately; we do not determine a player's precise location.
An address that a customer looks up in the client area is processed in the same way.
Visitors of the website
When you open the website or the client area, your browser sends us your IP address and technical request data. We use them only to deliver the pages and to protect the site from attacks and abuse.
Purposes and legal grounds
- Providing the Service under the contract with the customer: the account, client area, checks, billing and support (GDPR Art. 6(1)(b)).
- Protecting Resources from VPNs, proxies, bots, ban evasion and attacks, based on the legitimate interest of our customers and our own (Art. 6(1)(f)).
- Maintaining the Kordon database, so that a threat found on one Resource is blocked on all of them, based on our legitimate interest and that of all customers (Art. 6(1)(f)).
- Security of the Service, preventing abuse and fraud (Art. 6(1)(f)).
- Legal obligations, such as accounting for payments and answering lawful requests of authorities (Art. 6(1)(c)).
We do not sell data, do not use it for advertising and do not build profiles of players for any purpose other than protection.
Automated decisions
Whether a player is let into a Resource is decided automatically, by the rules its owner has set and by the Kordon database. Such a decision concerns access to that Resource only.
A player who disagrees with a decision can contact the Resource's administration: they see the reason and can let the player in with the whitelist. You can also ask us at contact@matix.gg to review a Kordon database entry; a member of our team will look into it.
How long we keep data
- Account data
- while the account exists. After it is deleted, we keep only the records the law requires us to keep.
- Player data of a Resource
- while the Resource is connected to Kordon; it is deleted together with the Resource.
- Technical records
- up to one year (check results, security logs, usage statistics).
- Kordon database
- as long as the entry is needed for protection; automatic entries are removed at the latest 2 years after the address was last detected.
Backups are kept for a limited time and then overwritten.
International transfers
Data is stored in the EU. Some providers, such as IP reputation services, may process data in other countries. In such cases we rely on the safeguards provided by law, such as standard contractual clauses.
Security
We take reasonable technical and organisational measures to protect data from unauthorised access, loss and misuse, and we give access to it only to those who need it for their work. If a breach affects personal data, we take measures to limit its consequences and inform those affected where the law requires it.
Your rights
Depending on the law that applies to you, you have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable form, and to complain to the data protection authority of the country where you live. We ask you to contact us first, so that we can settle the matter quickly.
12.1Customers
Write to contact@matix.gg from the email address of your account. Much can be done in the client area yourself: change your data, delete Resources together with their player data, export the connection journal.
12.2Players
The controller of your data is the owner of the Resource you connect to, so contact that Resource's administration first: they see your records and can, for example, add you to the whitelist. You can also write to us at contact@matix.gg; we will forward the request to the owner and help them answer it.
12.3Entries in the Kordon database
Entries about addresses and networks used by VPNs, proxies, hosting, bots or for attacks are kept on the basis of the legitimate interest of all protected Resources. We review requests to remove them, but may refuse if removal would weaken the protection, for example if the address is still used to anonymise traffic or for attacks. If you think your home address was flagged by mistake, write to contact@matix.gg and we will check it.
12.4How we answer
We answer requests within the time limits set by law. To protect your data, we may ask you to confirm that the request comes from you, for example by writing from the email address of your account.
Children
Kordon accounts are for persons aged 16 and over. Players of any age may connect to protected Resources; we process only the connection data listed above and do not knowingly collect other data about children.
Changes to this Policy
We may update this Privacy Policy. The current version is published on this page with the date of the last update; we notify customers of material changes by email or in the client area. If the language versions differ, the English version prevails.
Contact
Questions about privacy and requests about your data: contact@matix.gg.