Privacy and cookie policy

1. Controllers and allocation of roles

Melanny Quirama Valladares controls processing connected with orders, confirmed payments, delivery, commercial records, refunds, fraud prevention and customer support.

Luis Adriano Martínez Naval controls processing where he determines the purposes and means of the information website, tools, online game, creative communications and consented analytics. He may also act as the seller’s technical processor when operating the store under her instructions. Technical or creative cooperation does not by itself make both people joint controllers of every processing activity.

Both use the privacy and support contact shown at the end of this page. This allocation reflects operational roles and does not restrict a data subject’s rights against the relevant controller.

2. Data that may be processed

• Purchase and delivery: email, country, language, product, price, order, dates, status, PayPal identifiers, contractual acceptance and download history.
• Optional marketing: email, language, country, originating order, date, version and consent status.
• Technical and security: IP address, user agent, access logs, attempts, events, encrypted or hashed tokens and incidents.
• Support: optional name, email, order, category, message, replies, ticket reference, dates and status.
• BALL Online: alias, match, actions, sessions, messages, language, acceptance of responsible access and optional email where a feature requests it.
• Analytics and advertising: pages, interactions, device, referral, measurement identifiers and conversions where consent or another valid basis exists.

The full card number and sensitive categories are not requested. Do not enter personal data, links, telephone numbers, email addresses, secrets or third-party information in the chat.

3. Sources

Data comes from the user, device and browser, use of the site and game, PayPal’s transaction confirmation, and hosting, security or measurement providers. Personal-data lists are not purchased for unsolicited advertising.

4. Purposes and legal bases

5. Recipients and providers

Data may be processed by service providers needed for the operation, including:

• PayPal: payments, fraud prevention and transaction confirmation.
• Hosting, database, email, CDN and security providers: infrastructure, delivery, backups, protection and local anti-abuse controls.
• Cloudflare Turnstile: anti-abuse verification on the contact form and administrative sign-in. It may process technical browser and network signals to distinguish human from automated traffic.
• Microsoft Clarity: usage analytics only when enabled and consented.
• Meta: Pixel or Conversions API advertising measurement only when enabled and the relevant choice has been made.
• OpenAI: chat text may be sent for automatic translation when the feature is enabled and used.
• Advisers, authorities and professional providers: only where needed to comply with law, defend rights or investigate fraud.

Each provider processes data according to its role, agreement and policy. Personal data is not sold to advertisers.

6. International transfers

The store is operated from Colombia and some providers may process data in other countries. Where a law requires safeguards for international transfers, recognised mechanisms — such as adequacy decisions, contractual clauses, transmission or transfer agreements and supplementary measures — will be used according to the provider and activity.

The global nature of the Internet means a request from the European Union, United Kingdom or another territory may be handled from Colombia and through international infrastructure.

7. Cookies and similar technologies

Cookies or storage classified as necessary remember language and maintain security, session, consent, the cart or purchase process, and private access. Optional acceptance is not required when they are strictly necessary.

The Analytics and Advertising categories are optional where consent is required. The panel allows them to be accepted or rejected separately and the choice to be changed later through “Cookie settings” in the footer. Refusal does not prevent purchase or download.

Withdrawal stops future loads controlled by BALL; it cannot automatically erase information already lawfully processed by a provider, so browser and provider controls may also apply.

8. Retention

• Orders, receipts, contractual consents and accounting or tax records: for the statutory periods and the periods needed to defend claims.
• News subscriptions: until consent is withdrawn, the user unsubscribes or the address is found to be permanently invalid.
• BALL Online messages: up to 30 days.
• Completed or cancelled matches: up to 90 days.
• Technical attempt-limiting records: up to 180 days.
• Tickets and incidents: while they are handled and for the proportionate period needed to evidence their handling.

A claim, fraud, security incident or legal duty may justify limited longer retention. Where no purpose or duty remains, data is deleted, anonymised or blocked.

9. Data-subject rights and Colombian periods

Depending on jurisdiction, users may request information and access; update or correction; a copy or portability; erasure; withdrawal of consent; objection; restriction; human review of solely automated decisions with significant effects; and evidence of authorisation where relevant.

In Colombia, a consultation is answered within ten (10) business days of receipt, extendable by no more than five (5) additional business days after prior notice. A complete claim is answered within fifteen (15) business days from the following day, extendable by no more than eight (8) additional business days after a reasoned notice. An incomplete claim may be supplemented after a request made within five days and is deemed withdrawn after two months without correction.

Erasure or withdrawal may be limited where retention is required by law or contract, to perform the order, for security, fraud prevention or defence of claims. Proportionate identity verification may be required.

10. Children

The store is not intended for independent purchases by children. BALL Online may be used by children only with authorisation and supervision from their legal guardian. Access requires confirmation and the chat blocks links and contact details, but no measure replaces adult supervision.

If information about a child is detected without a valid basis, its deletion will be assessed. The child or guardian may request access, correction or deletion of aliases, chat and matches through support where applicable.

11. Security and automated decisions

Reasonable measures include HTTPS, access restrictions, protected passwords, tokens, encrypted secrets, download controls, logs and backups. No system is invulnerable; users should protect their email and private link and report suspicious access.

Automated rules may be used for fraud, download limits, security and ad delivery. BALL does not intend to make solely automated decisions producing significant legal effects without the safeguards required by law.

12. Requests, claims and authorities

Privacy requests may be submitted through support under the “Privacy” category. The system provides a reference number, date, time and tracking link and preserves evidence of the request.

In Colombia, a complaint may be filed with the Superintendencia de Industria y Comercio after the prior consultation or claim procedure where required. Users may also approach a competent local authority in the European Union, United Kingdom or another territory where entitled.

13. Policy changes

The date and version are displayed in the header. Material changes will be communicated proportionately. The policy version in force at purchase is recorded with the order for evidential purposes.