Privacy

The data controller is eDAST Gaming, s.r.o. (the Cyber Empire club), company ID (IČO) 17851882, Na Florenci 1332/23, Nové Město, 110 00 Praha 1, Czech Republic. Questions about your data: info@cyberempire.cz, +420 775 146 366.

Battle Pass is a programme for the club's customers: you earn XP for paid play time at the club, climb the season's levels and get rewards. The site cyberpass.cz shows your progress. You collect game time and coins on the site yourself; staff hand out the other rewards at reception.

• Account. Your username in the club's ggLeap system and your ID there, so that progress and rewards go to you and nobody else. Your account on the site is created when you first sign in to the site, when you first open Battle Pass in the club's app, or automatically when you sign in to ggLeap at a club PC where automatic sign-in is switched on. The link to your ggLeap profile photo is shown only to staff at reception, so they can recognise you; the member pages do not display it, and the site keeps no copy of the photo.
• Sign-in. Your ggLeap username and password are passed to ggLeap once to be checked; the site does not store the password. After you sign in, the site starts its own session, which lasts up to 7 days but ends if you do not use the site for 24 hours. A session opened automatically at a club PC lasts up to 12 hours and ends 1–⁠2 minutes after you leave the PC.
• The club's app. When you open Battle Pass in the club's app, the app passes your ggLeap sign-in token to the site. The site checks it with ggLeap once and does not store it, then gives the app its own session, with the same time limits as on the site; the app keeps it in the phone's secure storage. The app loads reward pictures directly from ggLeap.
• Sign-in at a club PC. The site records every automatic sign-in attempt: the time, the PC, the result and the ggLeap session, and for a successful sign-in also your account. If the sign-in fails, the ggLeap ID is kept only as a one-way code (a hash). These records let us investigate a sign-in under someone else's name.
• Purchases. From the moment your account exists, the site keeps a record of all your purchases in the club's ggLeap system: product, quantity, time, and whether you paid with money or coins. From these the site learns that you bought the pass and works out which play time earns XP.
• Play. After you buy the pass: the start, length and PC of each of your sessions, the XP credited and your levels. The PC matters because the XP rate depends on its zone. While you play, the site sees which PC you are at right now, so your progress updates faster; this is cleared when you leave.
• Rewards. What was given, when, and by whom (you on the site, or a member of staff), and whether it arrived.
• Changes made by staff. Reward hand-outs, XP corrections and a pass recorded as bought at reception are saved with the employee's name and the reason. Only staff see the reason; your XP history shows the correction without it.
• A pass bought before your first sign-in. If the pass was bought before you first signed in to the site, the site keeps your ggLeap ID and the details of that purchase until your first sign-in or until the season is finally closed, so that the XP is credited correctly.
• Sign-in protection. When someone tries to sign in, the site remembers the username typed and the IP address, to slow down password guessing.
• Request log. The server records every request to the site: the time, the IP address, the page address without parameters and the server's response, to investigate faults and abuse.
• Service records. The site keeps the times of your sign-ins and of requests to update your data. The server's service logs sometimes contain an IP address or your internal number.

Apart from what you type on the site yourself, the site gets everything from the club's ggLeap system.

There is no legal obligation. But without a ggLeap account and the data about your play at the club you cannot take part in the programme: the site would not be able to credit XP or give you rewards.

• You bought the pass: the data is needed to carry out the programme's terms (performance of a contract, GDPR Art. 6(1)⁠(b)).
• You have no pass but signed in to the site, or your account was opened at a club PC: the club's legitimate interest in showing a customer their progress without a separate registration (GDPR Art. 6(1)⁠(f)).
• Sign-in protection, the request log, club-PC sign-in records, the record of hand-outs, protection against double credits, and the records that remain after an account is deleted: the club's legitimate interest in running the programme fairly and securely and in protecting its rights in case of a dispute (GDPR Art. 6(1)⁠(f)).

The site calculates XP and levels automatically under the season's rules. We make no decisions with legal effects for you based solely on automated processing: refunds, corrections and disputed cases are decided by a member of the club's staff.

• ggLeap, the system in which the club keeps customer accounts and sales. It is provided by ggCircuit, LLC (USA), which stores the data on its servers in the USA. The site gets your data from ggLeap and sends it your username and password when you sign in, the sign-in token from the club's app, and your ID when it gives you game time or coins. There is no European Commission adequacy decision covering ggCircuit: the company is not on the list of EU-⁠U.S. Data Privacy Framework participants.
• Hosting. The site's server is in the Czech Republic (provider: Forpsi).
• Backups. A copy of the database is kept on our server for 30 days. Another copy is encrypted on our server and kept for 30 days in Google Cloud Storage (US region); its key is stored separately, in the club's secrets store, Google Secret Manager (EU region), and only the club can access it. Google LLC is certified under the EU-⁠U.S. Data Privacy Framework.
• Site status alerts go to the club's owners via Telegram and contain no customer data.

The site uses no advertising, trackers or third-party analytics. Fonts and reward pictures load from our own server.

• Account, purchases, sessions, XP and rewards: for as long as the account exists. An account nobody has signed in to for 24 months, and that has had no pass in that time, is deleted; if you come back, it is created again when you sign in.
• Records that remain after your account is deleted at your request (see “Your rights”): 3 years after the end of the season they belong to, in case of a dispute; then they are deleted.
• Sign-in session: up to 7 days, or 24 hours without use; up to 12 hours at a club PC.
• Sign-in attempt records: about a day after the last attempt.
• Club-PC sign-in records: 30 days.
• Request log: 14 days.
• Times of sign-ins and of update requests: 12 months.
• The server's service logs are overwritten as they fill.
• Backups: 30 days.

The site sets only necessary cookies: your sign-in session and the language. Details are on the “Cookies” page.

You can:

• find out what data we hold about you: your progress and XP history are visible on the site, and we will send a full copy on request;
• ask us to correct inaccurate data, such as XP or a hand-out record. Your username can be changed in ggLeap or at reception, and the site updates it the next time you sign in;
• ask us to delete your account;
• ask us to restrict processing;
• get your data in a machine-readable form.

Ask at reception or write to info@cyberempire.cz. We answer free of charge and within one month at the latest; we may ask you to confirm that the account is yours.

After deletion at your request, your profile on the site is erased (username, photo link) and the account can no longer be used to sign in. What remains, without your name and under an internal number, are the records of credited XP, sessions, purchases and rewards given, and notes that staff typed in manually: these cannot be changed and may contain your name. The club can link these records to you only through its ggLeap system. Backups keep the earlier data for up to 30 more days.

You can object at any time to processing based on the club's legitimate interest: an account without a pass, sign-in protection, the record of hand-outs. We will stop unless the club has compelling legitimate grounds that override your interests, or needs the data to protect its rights in a dispute, such as one about a reward. If you object to an account without a pass, we will delete it as on a deletion request: the account can then no longer be used to sign in.

If you believe your data is being processed wrongly, you have the right to lodge a complaint with the Czech data protection authority, Úřad pro ochranu osobních údajů (Pplk. Sochora 27, 170 00 Praha 7, posta@uoou.gov.cz, uoou.gov.cz).

The site is also used by club customers who are minors. We do not ask for consent to process data, so the age limit for such consent (15 in the Czech Republic) does not apply here. A child can ask about their data, or ask for it to be deleted, on their own; a parent or guardian can do so on the child's behalf.

The connection to the site is encrypted (HTTPS). Passwords are not stored. Only club staff can access the data, and only as far as their duties require; the changes they make are saved with the employee's name. Backups kept off the server are encrypted.

If this text changes, a new date will appear here. Version dated 28 October 2026.