Personal Data Processing Policy

1. Who processes your data

The personal data controller is FAIRPLAY APPS DOO (ul. Železnička 20, Novi Sad, 21102, Serbia; registration number 22125290, tax ID (PIB) 115190571); support@fairplayapps.rs.

The controller runs the VOG board game club: the websites vogclub.com and vogclub.games, the Windows client and the mobile apps (the "Service").

The Windows client and the mobile apps are shared by all zones of the VOG federation (section 7). Account data in them is processed by the operator of the zone where the account was created: for vogclub.com and vogclub.games accounts — the controller under this policy, for accounts of other zones — that zone's operator under its own documents. This policy covers only these resources: websites and apps of other operators work under their own documents.

Personal data questions: privacy@vogclub.com or support@fairplayapps.rs.

This policy is based on the Law on Personal Data Protection of the Republic of Serbia ("Official Gazette of RS", No. 87/2018; the "Law"). The Russian version of this policy prevails.

2. Who this policy applies to

It applies to everyone whose data the Service processes: registered players, guests playing without an account, website visitors, and people who contact us through the feedback form.

The Service is intended for persons aged 16 and over (clause 2.1 of the Terms of Use). By registering you confirm that you are at least 16. If we learn that an account was created by someone under 16, we close it and delete the data.

Citizens of the Russian Federation, including those living abroad, should register in the ru zone: when registering in the com zone you confirm with a checkbox that you are not a Russian citizen, and if Russia is stated at registration, the account is created in the ru zone, under the documents of its operator. The country and the checkbox are your statements, not proof of citizenship, and they do not change the applicable law. Owners of earlier accounts are asked this question after signing in if there are signs of a link with Russia — Russia as the stated country, connecting from Russia now or within the last 12 months, signing in with Yandex or VK, an email address in a Russian domain, or the Russian interface language . The signs are only a reason to offer to clarify the information: they do not prove citizenship, and their absence does not mean the person is not a Russian citizen; without them we do not ask — we do not collect information about citizenship without a reason. While there is no answer and a sign remains, we repeat the question every three months; "no answer" is kept separately from the answer "not a Russian citizen", and a wrong answer is corrected through support; those who answer "Russian citizen" are offered a move to the ru zone or archive mode (clause 2.3 of the Terms of Use). The move means a separate account with the Russian operator; the historical com account is kept separately, and you can still play with com players from ru, through the VOG federation (section 7).

3. Accounts created before 1 November 2026

The VOG club has been running since 1997. The controller of the club's data is the company named in section 1. Accounts, game history and ratings accumulated by the club earlier continue to be processed for the purposes and in the manner described in this policy. All club accounts created before 1 November 2026 remain managed by the controller and are not transferred to operators of other zones — including if you create an account in another zone. If you do not want your earlier data to be processed, delete your account in the profile settings ("Account" section, "Delete account") or write to privacy@vogclub.com.

4. What data, why, and on what basis

We collect only what a specific purpose requires. We do not ask for passport data or special categories of data (health, beliefs, etc.) for registration or play, and ask you not to include them in your profile, messages or requests. If in an exceptional case age or a representative's authority has to be confirmed, we will tell you in advance what is needed, why, how and for how long it is kept.

Service emails — sign-in codes, access recovery, sign-in alerts — are sent regardless of the news email consent: the account cannot be used without them.

5. What other players see

Other players see your nickname, game avatar from the Service's set, ratings, games played and messages in public chat. Your profile is visible within the visibility settings you choose in the profile settings, "Profile visibility" section. Your email address, IP address and sign-in log are never shown to other players.

6. Cookies and browser storage

The websites use cookies for signing in (vog_at — 15 minutes, vog_rt — until you sign out or the sign-in expires), registration (vog_reg — 2 hours) and entering a room of another zone (vog_fed_state — 10 minutes) — the websites do not work without them — and for remembering your settings: interface language (vog_lang), marks of news you have read or closed (news_seen, news_urgent_x), the game catalog view (games_view — one year). There is no third-party analytics or advertising. Game settings, unfinished guest games and marks of prompts already shown (for example, about confirming your age) are kept in browser storage on your device. Sign-in pages and the feedback form use bot protection by Cloudflare Turnstile: it loads from Cloudflare servers and receives technical signals — the IP address, browser and connection data (including the User-Agent and the TLS fingerprint), the site key and the address of the check page. To protect our websites Cloudflare processes them on our behalf, and to improve Turnstile — as an independent controller under its own terms.

7. Who receives the data

The data, including backups, is hosted on servers in the Netherlands at the hosting provider Friendhosting LTD (Bulgaria), in the infrastructure of the Serverius data centre (Dronten and Meppel). The entry point for the main traffic to the websites and the protection of the websites from attacks are located there as well. Cloudflare is used separately — only for Turnstile bot protection (Section 6).

Only the following receive data:

• sign-in services you choose yourself: Google, GitHub, Telegram;
• bot protection service on sign-in pages and the feedback form: Cloudflare Turnstile (Cloudflare, Inc., USA);
• Apple and Google notification services — in mobile apps, if you allowed notifications;
• operators of other zones of the VOG federation — when you play in their rooms and tournaments (below);
• other players — to the extent described in section 5;
• public authorities — where required by law.

Processing on the controller's behalf is carried out by processors under contracts with confidentiality and data protection obligations (Art. 45 of the Law): Friendhosting LTD (Bulgaria) — servers, backups and the traffic entry point in the Serverius data centre (the Netherlands); Cloudflare, Inc. (USA) — Cloudflare Turnstile bot protection, to the extent Cloudflare processes on our behalf (Section 6).

Transfers outside Serbia: storage, processing and receipt of traffic in the Netherlands, and the hosting contract with a company from Bulgaria — parties to Council of Europe Convention 108 and members of the European Union, with an adequate level of data protection (Art. 64 of the Law); notification services (USA) — at your choice; Cloudflare Turnstile (USA) — bot protection, under a data processing agreement with the European Commission's standard contractual clauses; sign-in services — at your choice; operators of other zones of the VOG federation — to the country of the zone's operator, when you yourself enter its room or tournament, with your consent to that zone; currently the Russian Federation, a party to Council of Europe Convention 108 (Art. 64 of the Law). We do not sell data and do not share it for advertising.

Other zones of the VOG federation

The VOG club is a federation of zones. Each zone has its own operator, its own websites and its own documents; an account belongs to one zone — the one where it was created (the home zone). A room or tournament may belong to another zone. Which zone runs a room and who its operator is is shown before your first entry; you can enter only after you consent to that zone.

When you play in a room or tournament of another zone, the controller passes to its operator only:

• your player number with the zone code, nickname and account flags (whether the email is verified, whether you are 16 or older, the end date of membership, whether the account is banned; payments and their history are not passed) — in a signed one-time ticket on entry;
• presence at the table, moves, move times, the game result and the change in the federation rating;
• preset phrases and emoji of the table chat, if the room owner enabled it;
• a restriction for rule violations — only its term, without details, and only to zones you entered in the last 30 days;
• complaints from our players about a player of that zone: their number and nickname, what happened and when — without details of who complains, which are also removed from quotes and attachments;
• a notice of account deletion — the recipient deletes or anonymises this data within 24 hours.

Your profile details, email address, IP address, device details, sessions and sign-in log, payments, support requests and statistics are not passed to other zones: you enter another zone's room through your own zone, and its operator does not see your address.

Leaderboards and ratings of players in the controller's rooms are shown to players of other zones through their zone and are not stored there. The controller receives the same data about players of other zones who play in its rooms from their operators and processes it under this policy.

Consent to a zone can be withdrawn in the profile settings — "Profile visibility" section, "Federation zone consents" block: after that new exchange with that zone stops; only service notices needed to delete data already passed or to comply with the law are sent. The data already passed is kept by the receiving zone's operator under its own documents: games and ratings as its game archive, the nickname — for 30 days after the player last entered.

8. How long we keep data

9. Deleting your account

You can delete your account in the profile settings ("Account" section, "Delete account") without contacting us. 30 days after the request the account data is anonymised: email, nickname, profile, connections and sign-in methods are deleted, the account's IP addresses are erased, your messages in room and table chats and your private messages are deleted; the people you talked to keep their own messages in those conversations — without your messages and nickname. You can cancel the deletion within 30 days. Games played and ratings remain with an anonymous nickname (section 8). Data leaves backups as they are replaced. Deletion does not affect what section 8 keeps for a separate period by law or to protect rights: records of consents, messages the law requires us to keep, materials of a complaint under review; access to them is restricted and they are not used for other purposes. Requests for which the law sets a shorter period are fulfilled within it, without waiting for the 30 days.

10. Your rights

You have the right to:

• learn what data of yours we process, why and how, and get a copy of it;
• have inaccurate data corrected or completed;
• have data erased or its processing restricted where there is no basis for it;
• receive the data you provided to us in a machine-readable format;
• object to processing based on legitimate interest;
• withdraw consent — for emails ("Emails" section) and transfers to other federation zones ("Profile visibility" section, "Federation zone consents" block) this is done in the profile settings; withdrawal does not affect what was done before it;
• lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia (poverenik.rs) or go to court.

Send requests to privacy@vogclub.com from the email address of your account (if you no longer have access to it, from another address: we will offer a proportionate way to confirm the account is yours). If you have no account (a guest, a website visitor, the author of a request), describe in your email which data it is about, and we will offer a proportionate way to confirm it is yours. We reply within 30 days; for complex or numerous requests it may be extended by no more than another 60 days — we will tell you about the extension and its reasons within the first 30 days.

11. How we protect data

Data travels between your device and our servers in encrypted form; only those who need data for their work have access to it, and a second factor is provided for signing in to the admin area; sign-in secrets are stored encrypted and codes as hashes; databases are not reachable from the Internet; sign-ins and security events are logged; backups are made. We notify the Commissioner and you of security breaches affecting your data in the cases and within the time limits set by the Law. Report vulnerabilities and possible leaks to security@vogclub.com.

12. Changes to this policy

A new version is published on this page with its date; previous versions are listed below. If changes affect the purposes of processing or require new consent, we will tell you when you sign in.