Ukraine (Україна) - International privacy rights
If the law where you live provides additional rights, identify them in your request.
Ukrainian Parliament Commissioner for Human RightsPersonal Data Protection Law No. 2297-VISpecial-risk processing notification procedureState-language requirements for software and mobile appsData and content requestsLegal noticeУкраїнаUkraine (Україна)PrivacyTermsDelete dataSupportInternational privacy rightsLegal noticeOpen app
Controller, data and purposes in Ukraine
Alexander Goytom, established in Italy, is the personal data controller and can be contacted at ertalex@hotmail.it. When Ukraine is selected as the legal market, the Ukrainian Personal Data Protection Law applies alongside the GDPR. Before protected use, the Privacy Policy identifies the controller, profile, group, game, match, optional-media and security data, purposes, necessity, consequences of refusal, recipients, retention and rights.
Core data is used to provide the requested Free service and limited technical data is used to protect it. Photos, notes and taunts are optional. NerdScore does not sell data, show advertising, request sensitive data or make decisions with legal or similarly significant effects. Firebase Analytics is not available for the Ukraine market and cannot be enabled by an old consent record.
Special-risk processing and ordinary photos
Ukraine abolished general personal-database registration on January 1, 2014. Notification to the Ombudsman within 30 working days applies only when processing falls within the officially listed special-risk categories. The current Free service does not intentionally process those categories, precise location or movement data and does not use an ordinary uploaded photo for biometric identification or authentication.
NerdScore does not create a facial template, compare faces, perform liveness checks or infer identity from photos. Reports do not ask for sensitive data and incidental unlawful material is minimized, encrypted and retained only where necessary. Biometric recognition, identity or age verification, GPS, movement tracking or intentional sensitive-data processing would suspend the Ukraine release until classification, any required special-risk notification and every applicable Article 24 organizational step were completed. Under the current scope, Alexander Goytom directly organizes data protection; this is not presented as a Ukrainian appointment or registration.
Hosting and transfers outside Ukraine
Core profile, group, game, match, media, security-log and backup data is sent over encrypted connections to OVHcloud in Frankfurt, Germany for hosting, security, support and recovery. Germany is in the EEA and is a Convention 108 party, which Article 29 recognizes as providing adequate protection. Google Play handles limited distribution, installation, account and device data but NerdScore does not export profile, group, user-content or score data to Play. Play Integrity receives limited request and app, device and account-integrity signals; Firebase App Check receives attestation material, tokens and technical app or device data; Firebase Hosting receives an IP address and ordinary HTTP technical data only when a public static legal page is requested.
The transfer register records each service separately, including recipient, destination, data category, purpose, retention, applicable terms and security measures. Google and its subprocessors may process technical data in more than one country. An EEA or Convention 108 destination uses the recognition in Article 29; any other destination requires a documented Article 29(4) basis or guarantee and the flow stops if that protection cannot be maintained. Firebase Analytics receives no Analytics data for the Ukraine market.
Ukrainian data rights and the 10/30-day timetable
A person may request information about processing, access and a copy, correction, deletion, restriction or objection through Support, the in-app export and deletion tools, or ertalex@hotmail.it. For a complete access request, NerdScore records within 10 working days whether access will be granted and satisfies a person's request for their own data within 30 calendar days; access to one's own data is not deferred. The statutory overall limit of 45 calendar days applies only to a legally permitted deferral of a qualifying third-party request.
Identity is verified only to the proportionate extent necessary. Any lawful restriction or refusal is recorded with its reason and review route. Corrections and deletions are propagated to active records, backups expire through the documented rotation, and legal holds remain limited, protected and auditable. A person may also contact the Ukrainian Parliament Commissioner for Human Rights through the official links below.
Personal-data incident procedure
A suspected loss, destruction, unauthorized disclosure, alteration or access is recorded, contained and assessed immediately. The current Ukrainian law does not create a general 72-hour authority deadline that NerdScore presents as universal. Because the controller is established in Italy, the separate GDPR assessment still requires authority notification within 72 hours where its threshold is met.
A person in Ukraine is informed immediately where the residual risk may affect their rights. The incident record preserves categories, affected people, timing, cause, consequences, containment, mitigation, communications and the reasons for notifying or not notifying. A valid Ukrainian authority order is handled through the documented, minimized and auditable authority-order workflow.
Minimum age and guardian permission
NerdScore is not directed to children under 16 and does not accept them into the service. Ukrainian civil law provides ordinary full capacity at 18 and partial capacity before that age. A 16- or 17-year-old must declare that a parent or legal guardian has read the Terms and permitted use of the current Free service and the limited user-content licence.
The versioned declaration is stored with the explicitly selected legal market but is not described as identity or age verification. The assessment reopens before lowering the minimum age, introducing Billing, Plus, advertising, prizes, public groups or processing specifically directed at children.
Ukrainian language, private groups and consumer scope
NerdScore provides a complete Ukrainian interface, Ukrainian legal pages and a Ukrainian Play listing. Language does not select the legal market: a person who selects Ukraine may read the Ukrainian notice or the English fallback without receiving another country's rules. User content remains inside invited private groups, with report, legal notice, removal, reasoned decision, review and encrypted evidence-preservation routes.
The current release is provided by a private natural person, free of charge, with no Billing, Plus, advertising, sponsorship, sale of data, wager, prize or transaction. The documented assessment therefore does not classify the controller as a provider acting within entrepreneurial activity under Law No. 3321-IX. Law No. 3153-IX and the e-pokupets portal are monitored because the official register still shows the law entering into force later. Monetization or professional activity reopens both assessments before release.
Your rights
You may request access, a machine-readable export, correction, deletion, restriction or portability, and may object where processing relies on legitimate interests. Write to ertalex@hotmail.it; identity checks may be required to protect other users.
You may withdraw analytics consent in the app at any time. You may also complain to your local supervisory authority; in Italy this is the Garante per la protezione dei dati personali.
International privacy rights
We provide every user, regardless of country, a way to request access, a copy, correction, and deletion of their data. We do not discriminate against anyone who exercises a privacy right, and we do not sell or share personal data for money or targeted behavioral advertising.
Changing NerdScore's language changes only the translation you read. It does not change your country, the law that applies, the competent authority, or any mandatory rights you have where you live.
Data controller
The data controller is Alexander Goytom. For privacy, access, export, correction, deletion or removal requests, write to ertalex@hotmail.it.
NerdScore is a scorekeeping service for private board game groups. It does not require an email account and does not sell personal data.