Privacy and cookie policy

1. Controllers and allocation of roles

Melanny Quirama Valladares controls processing connected with orders, confirmed payments, delivery, commercial records, refunds, fraud prevention and customer support.

Luis Adriano Martínez Naval controls processing where he determines the purposes and means of the information website, tools, online game, creative communications and consented analytics. He may also act as the seller’s technical processor when operating the store under her instructions. Technical or creative cooperation does not by itself make both people joint controllers of every processing activity.

Both use the privacy and support contact shown at the end of this page. This allocation reflects operational roles and does not restrict a data subject’s rights against the relevant controller.

2. Data that may be processed

• Purchase and delivery: email, country, language, product, price, order number, dates, status, PayPal identifiers and receipt information.
• Technical and security: IP address, user agent, access logs, attempts, security events, encrypted or hashed tokens, and download history and status.
• Support: optional name, email, order number, category, message, replies, ticket reference, dates and request status.
• Preferences: language, cookie choices and campaign parameters where the relevant legal basis exists.
• Online game: alias, room or match identifiers, game actions, session state, chat messages and optional email where a feature requests it.
• Analytics and advertising: viewed pages, interactions, device, referrals, measurement identifiers and conversion events, only where required consent or another valid basis exists.

BALL does not seek sensitive categories or the full payment-card number. Do not place sensitive information, secrets, children’s data or third-party data in chat or free-text forms.

3. Sources

Data comes from the user, device and browser, use of the site and game, PayPal’s transaction confirmation, and hosting, security or measurement providers. Personal-data lists are not purchased for unsolicited advertising.

4. Purposes and legal bases

5. Recipients and providers

Data may be processed by service providers needed for the operation, including:

• PayPal: payments, fraud prevention and transaction confirmation.
• Hosting, database, email, CDN and security providers: infrastructure, delivery, backups, protection and local anti-abuse controls.
• Cloudflare Turnstile: anti-abuse verification on the contact form and administrative sign-in. It may process technical browser and network signals to distinguish human from automated traffic.
• Microsoft Clarity: usage analytics only when enabled and consented.
• Meta: Pixel or Conversions API advertising measurement only when enabled and the relevant choice has been made.
• OpenAI: chat text may be sent for automatic translation when the feature is enabled and used.
• Advisers, authorities and professional providers: only where needed to comply with law, defend rights or investigate fraud.

Each provider processes data according to its role, agreement and policy. Personal data is not sold to advertisers.

6. International transfers

The store is operated from Colombia and some providers may process data in other countries. Where a law requires safeguards for international transfers, recognised mechanisms — such as adequacy decisions, contractual clauses, transmission or transfer agreements and supplementary measures — will be used according to the provider and activity.

The global nature of the Internet means a request from the European Union, United Kingdom or another territory may be handled from Colombia and through international infrastructure.

7. Cookies and similar technologies

Necessary cookies or storage remember language, maintain security, session, consent, the purchase process and private access. They are not optional where strictly necessary.

Analytics and Advertising are optional where consent is required. The panel allows separate acceptance or rejection and later changes through “Cookie settings” in the footer. Refusal does not prevent purchase or download.

Withdrawal stops future loads controlled by BALL; it cannot automatically erase information already lawfully processed by a provider, so browser and provider controls may also apply.

8. Retention

• Orders, receipts, contractual consents and associated records are kept for the periods required by accounting, tax, consumer and claims laws.
• Download tokens and logs are kept while access is active and for a reasonable security and support period.
• Support tickets are kept while handled and afterwards as needed to prove service and resolve disputes.
• Security logs are kept for limited periods proportionate to risk.
• Data based only on consent is kept until withdrawal or until no longer necessary, without affecting prior lawful processing.
• Online-game data is kept for the operational, moderation, security or incident-resolution period reasonably required.

When no purpose or retention duty remains, data is deleted, anonymised or restricted according to technical capability and applicable law.

9. Data-subject rights and Colombian periods

Depending on jurisdiction, users may request information and access; update or correction; a copy or portability; erasure; withdrawal of consent; objection; restriction; human review of solely automated decisions with significant effects; and evidence of authorisation where relevant.

In Colombia, a consultation is answered within ten (10) business days of receipt, extendable by no more than five (5) additional business days after prior notice. A complete claim is answered within fifteen (15) business days from the following day, extendable by no more than eight (8) additional business days after a reasoned notice. An incomplete claim may be supplemented after a request made within five days and is deemed withdrawn after two months without correction.

Erasure or withdrawal may be limited where retention is required by law or contract, to perform the order, for security, fraud prevention or defence of claims. Proportionate identity verification may be required.

10. Children

The store is not intended for independent purchases by children. BALL Online may be used by children only with authorisation and supervision from their legal guardian. Access requires confirmation and the chat blocks links and contact details, but no measure replaces adult supervision.

If information about a child is detected without a valid basis, its deletion will be assessed. The child or guardian may request access, correction or deletion of aliases, chat and matches through support where applicable.

11. Security and automated decisions

Reasonable measures include HTTPS, access restrictions, protected passwords, tokens, encrypted secrets, download controls, logs and backups. No system is invulnerable; users should protect their email and private link and report suspicious access.

Automated rules may be used for fraud, download limits, security and ad delivery. BALL does not intend to make solely automated decisions producing significant legal effects without the safeguards required by law.

12. Requests, claims and authorities

Privacy requests may be submitted through support under the “Privacy” category. The system provides a reference number, date, time and tracking link and preserves evidence of the request.

In Colombia, a complaint may be filed with the Superintendencia de Industria y Comercio after the prior consultation or claim procedure where required. Users may also approach a competent local authority in the European Union, United Kingdom or another territory where entitled.

13. Policy changes

The date and version are displayed in the header. Material changes will be communicated proportionately. The policy version in force at purchase is recorded with the order for evidential purposes.