Privacy

The data controller is the Site's operator, operator of the Cazio site (see the legal notice). For any question about your data, contact support from the help center or at [email protected].

Only the data useful to the service is collected. Nothing is sold, rented or used for advertising. The table summarizes, for each purpose, what is processed and for how long.

The site only uses cookies that are strictly necessary for it to work, which don't require consent:

• cz_session: keeps you signed in (inaccessible to JavaScript, sent only over https, 30 days);
• cz_csrf: protects your operations against requests forged from another site;
• cz_lang: remembers the language you chose in the footer (1 year), only if you choose one.

If you don't choose, the page language is inferred from the country of your IP address (provided by our network service) or, failing that, from your browser's language; nothing is stored for this.

The browser also keeps a few display preferences locally (sidebar open or collapsed, reduced animations) and, for a visitor who isn't signed in, their list of favorites. These values don't leave your device and are deleted along with the site's data in your browser.

No audience measurement tool, no ad network, no tracking pixel, no embedded social network. Fonts and images are served by Cazio itself: no request is sent to a third-party service to display them.

Your data is only accessible to the operator's authorized staff, and to strictly necessary providers:

• OxaPay, cryptocurrency payment provider: for a deposit, it receives the amount and an internal invoice reference; for a withdrawal, the destination address, the network, the amount and an internal reference. It receives neither your username nor your email address. When you pay on its page, its own policy applies to you.
• The server host (see the legal notice) and, where applicable, a network and protection service (CDN, firewall) through which the site's traffic passes.
• Discord, if the support relay is enabled there: the username, subject and messages of your tickets are then forwarded to a private space reserved for the team, to be handled there.
• An email provider, if sending emails is ever enabled: it would then deliver the service emails (your address and the message).
• The competent authorities, when required by law (anti-money laundering, court order).

Transactions you make on a blockchain are public by nature: a withdrawal's destination address and amount are visible to everyone there, without your identity.

Some providers (payment, network, email) may process data outside the European Economic Area. Such a transfer then relies on the safeguards provided by the applicable regulations (adequacy decision, standard contractual clauses).

The following measures protect your data:

• encrypted connection (https) across the whole site;
• passwords stored as salted hashes, never in plain text; two-factor authentication available;
• encrypted two-factor authentication secrets; parameterized database queries;
• administrative access restricted to accounts protected by two-factor authentication, and logged;
• regular database backups, with access restricted to authorized people.

No system is infallible: in the event of a data breach likely to expose you to a risk, the operator informs you and notifies the competent data protection authority within the legal deadlines.

Account, gaming, wallet and identity verification data must be kept after the account is closed for the period required by accounting and anti-money laundering obligations, which is generally 5 to 10 years depending on the nature of the data and the applicable law. They are then deleted or anonymized.

During this period, they are only used to meet these obligations and to defend rights in court, and are no longer visible from your account.

You can request access to your data, its rectification, its erasure, the restriction of or objection to its processing, and its portability. Erasure cannot cover data that the law requires to be kept (section 8).

To exercise a right, open a ticket from the help center or write to [email protected]. Proof of identity may be requested to protect your account. You can also lodge a complaint with the data protection authority of your country (in France: the CNIL).

The site is prohibited for people under 18. If you think a minor has created an account, report it to support: the account will be closed.

This policy may change with the site or the law: the date of the last revision appears at the top of the page, and significant changes are announced on the site. It should be read together with the terms and conditions.