Sign in
CupsFree playHow it worksPrize rulesFAQResponsible playDiscord

Rules

Privacy notice

Last updated: 2026-10-27

Who is responsible for your data

The controller of your personal data is Loriam Holding Ltd, a private limited company registered in Cyprus (company number HE430761), Ammochostou 19, 3075 Limassol, Cyprus.

For any privacy question or request, write to [email protected] or use the #support channel on our Discord server.

This notice explains what data we collect when you use Corevill (corevill.com), why we use it, who we share it with, how long we keep it, and your rights under the EU General Data Protection Regulation (GDPR).

Data we collect

From Steam, when you sign in:

  • Your Steam ID.
  • Your public Steam profile name, avatar and profile link.
  • The results of our account checks: the age of your Steam account, your Counter-Strike 2 playtime, and whether the account has VAC, game or community bans.

From you, when you sign up and use your account:

  • Your confirmation that you are 18 or older and that you accepted our terms (the time and the terms version). Your age is self-declared: we do not ask for your date of birth or nationality when you sign up.
  • Your legal name, only if we ask you for an ID before paying a prize (we take it from the document).
  • For a paid cup, your confirmation that you live in a country where paid cups are open, with the country of your IP address at that moment.
  • Whether you chose to hide yourself from the lobby feed.
  • If you play on our free community servers (Deathmatch, Retakes, Surf, Arena), even without a Corevill account: your SteamID, Steam name and game stats there (play time, kills and deaths, Arena wins, Surf times). We use them to run the servers and their leaderboards, and we attach them to your account if you sign in with that Steam account. Leaderboards show your Steam name; with an account you can hide yourself, or ask us to remove you. Legal basis: our legitimate interest in running the servers (Article 6(1)(f)). Kept while the servers run, at most 2 years after your last game.
  • Your XP, level, badges and challenges in the player hub (computed from your activity; the top players by level are shown in the lobby unless you hide yourself).
  • Your teams and team roles.
  • Your payout wallet addresses, and the signed message you use to prove that a wallet is yours.
  • Messages you send to support on Discord or by email.
  • Your email address, if you ask us to tell you when registration for a cup opens (you do not need an account for this), with the consent text you agreed to, and the time and IP address of the request.
  • A photo of your identity document (passport, ID card or driving licence), only if we ask a winner to verify identity, age and country before paying a prize. From it we record your legal name, that you are 18 or older, and your nationality (for the sanctions check), not your date of birth.
  • For paid-cup matches, the country of the IP address your game connects from (looked up with DB-IP, db-ip.com), to check the paid-cup country rules. A mismatch is reviewed by our staff before a prize is paid; we never block you for it.

Created when you use Corevill:

  • Your IP address, the country of your IP address, and basic browser and device details in our server logs.
  • Payment data: the payment requests and payment addresses we create for your entry fees, the wallet address you paid from, and the transaction hashes, amounts, networks and times of your entry fee payments, refunds and prize payments.
  • Sanctions screening results: whether your name or your wallet addresses matched a sanctions list, and how we resolved it.
  • Cup and match data: rosters, check-ins, results, scores and in-game statistics.
  • Match recordings ("demos"). Demos may contain in-game actions, player names and in-game text chat. If voice is recorded on a server, a demo may also contain in-game voice.

From Discord, if you link your Discord account:

  • Your Discord user ID and username.

Why we use your data, and our legal bases

  • To run your account and cups, take entry fees, and pay prizes and refunds. Legal basis: performance of our contract with you (GDPR Article 6(1)(b)).
  • To check that only eligible people enter: your 18+ confirmation, the country of your IP address (and, for paid cups, your confirmation that you live in a country where they are open). Legal bases: legal obligation (Article 6(1)(c)) and our legitimate interest in following the law of the countries we serve (Article 6(1)(f)).
  • To screen names, countries, wallet addresses and, after an identity check, nationalities against sanctions lists before we accept payments or pay prizes and refunds. Legal basis: legal obligation under EU sanctions law (Article 6(1)(c)).
  • To block VPN, proxy and hosting networks from paid cups, by checking your IP address against public lists of hosting-provider networks. Legal basis: our legitimate interest in applying the country rules (Article 6(1)(f)).
  • To keep cups fair: Steam account checks, demo review, and detecting cheating, multiple accounts and other rule breaks. Legal basis: our legitimate interest, and yours, in fair competition (Article 6(1)(f)), and our contract with you.
  • To keep Corevill secure and prevent fraud and abuse. Legal basis: legitimate interest (Article 6(1)(f)).
  • To check a winner's identity, age and country when we ask for an ID before paying a prize, so that we pay the right person and follow sanctions rules. Legal bases: legal obligation (Article 6(1)(c)) and our legitimate interest in preventing fraud (Article 6(1)(f)). The photo is stored encrypted, only Corevill staff can open it, and each opening is logged.
  • To keep accounting and tax records. Legal basis: legal obligation (Article 6(1)(c)).
  • To show public cup information: brackets, results, team pages, player pages and the live lobby show your Steam name, avatar, country flag, team and match statistics. Your Steam name, avatar and country flag can appear on cup pages and in the lobby feed (for example "... joined Corevill Cup #1"); you can hide yourself from the feed in your account. We never show your legal name, nationality or wallet addresses publicly. Legal basis: our contract with you, because public results are part of a public competition, and our legitimate interest in publishing results (Article 6(1)(f)).
  • To give you the Player role and send cup reminders in our Discord server, if you link Discord. Legal basis: our contract with you.
  • To answer your support requests. Legal basis: our contract with you, and legitimate interest.
  • To email you once when registration for a cup opens, if you asked for it and confirmed your address. Legal basis: your consent (Article 6(1)(a)). You can withdraw it at any time with the unsubscribe link in our email; this does not affect what we did before.

We do not sell your data. We do not use it for advertising.

Automated decisions

Some decisions are made automatically: the Steam account checks that decide whether you can enter a cup, the country and sanctions checks, and whether a prize payment is sent at once or held for review. These are needed to run the cups under our contract with you. If an automatic decision blocks you, you can ask a person to review it, explain your view, and contest the decision by contacting support.

Who we share data with

  • Hetzner Online GmbH (Germany): hosts our servers, which are in Helsinki, Finland.
  • Cloudflare, Inc.: delivers and protects our website, and stores our backups and match demos.
  • Valve Corporation (Steam): we send your Steam ID to the Steam Web API to get your public profile, playtime and ban status. Valve handles that data under its own privacy policy.
  • Discord Inc.: if you link Discord, and when you use our Discord server. Discord handles that data under its own privacy policy.
  • Blockchain service providers that we use to read and send transactions.
  • Sanctions screening and blockchain analysis providers that check wallet addresses (and names, after an ID check) against sanctions lists.
  • Our email provider (Resend), for support emails and the registration emails you asked for.
  • Professional advisers, auditors, banks and public authorities, when the law requires it or to defend legal claims.

Other players and the public can see the public cup information described above.

Public blockchains: entry fee payments, refunds and prize payments are recorded on the Tron and BNB Smart Chain networks. These records are public and permanent. Anyone can see the addresses, amounts and times, and no one, including us, can change or delete them.

Transfers outside the EEA

Some of the companies above are based in the United States or work with staff and servers outside the European Economic Area. When your data leaves the EEA, we rely on an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework, for companies certified under it) or on the European Commission's Standard Contractual Clauses. You can ask us for more information about these safeguards.

How long we keep your data

  • Account data: while your account is open. When it is closed, we delete or anonymise it within 90 days, except for the data below.
  • Financial records (entry fee payments, refunds, prize payments, payout wallets and the identity data needed to support them): at least 6 years, as required by Cyprus tax and accounting rules, and longer if a tax audit or legal claim is open.
  • Sanctions screening records: at least 6 years after the payment they relate to.
  • Ban records (Steam ID and the reason): for as long as the ban applies.
  • Cup results: results stay in the public cup history. When an account is closed, we replace the player name with "Deleted player" where we can.
  • Demos: for up to 12 months, and longer if they are needed for an open dispute or ban.
  • Photos of identity documents: deleted 90 days after our check (whether we verified it or not). We keep the result of the check (verified or not, the date, and a fingerprint of the file) with your financial records.
  • Server logs with IP addresses: up to 90 days, unless needed to look into abuse.
  • Support messages: up to 2 years after the last message, unless needed for a dispute.
  • Registration alerts: unconfirmed email addresses are deleted after 7 days; confirmed ones 30 days after the cup ends or is cancelled. An unsubscribed address gets no more emails and is deleted on the same schedule.

Your rights

You have the right to:

  • Access the personal data we hold about you.
  • Correct data that is wrong.
  • Ask us to erase your data.
  • Restrict how we use your data.
  • Receive your data in a portable format.
  • Object to our use of your data based on legitimate interests.
  • Withdraw consent, where we rely on consent.

Some rights have limits. For example, we must keep financial records for the period the law requires, and we cannot change data recorded on a public blockchain.

To use your rights, contact [email protected]. We reply within one month.

You can also complain to a data protection authority. Our lead authority is:

  • Office of the Commissioner for Personal Data Protection
  • 15 Kypranoros Street, 1061 Nicosia, Cyprus (postal address: P.O. Box 23378, 1682 Nicosia, Cyprus)
  • Phone: +357 22 818 456
  • Email: [email protected]
  • Website: https://www.dataprotection.gov.cy

You can also complain to the data protection authority in the EU country where you live or work.

Cookies

When you first visit, we ask which cookies you allow. Rejecting is as easy as accepting, and you can change your choice at any time: Cookie settings (also at the bottom of every page).

Essential (always on, no consent needed):

  • A session cookie that keeps you signed in.
  • cv_consent: your cookie choice (6 months).
  • Cloudflare may set a security cookie that protects the site from bots and abuse.

Analytics (only if you allow it):

  • cv_src: where your first visit came from (for example an ad campaign name), so we can count which campaigns bring players (90 days).

Marketing (only if you allow it):

  • The Meta pixel (Meta Platforms Ireland Ltd): cookies such as _fbp and _fbc that measure which of our ads lead to sign-ups and cup registrations. With the same consent we also send these two events (account created, registered for a cup) from our server to Meta, with your email address and user id in hashed form. Without marketing consent nothing is sent to Meta.

We also keep anonymous counts of steps on the site (a visit, starting to sign in, joining a cup) in our own database, without cookies from third parties and without profiling.

Children

Corevill is for adults: you must be 18 or older to create an account and to enter any cup. Age is self-declared at sign-up; we may ask any winner for an ID before paying. If you think someone under 18 has an account, contact us and we will close it.

Changes to this notice

We may update this notice. The date at the top shows the last change. If a change matters to you, we will tell you on the site and in our Discord server.

Contact