PRIVACY POLICY

LAST UPDATED: APRIL 13, 2026

Vanguard Global B.V. ("Vanguard", "we", "us") is committed to protecting your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Dutch Uitvoeringswet AVG (UAVG). This policy explains how we collect, process, store, and protect your data when you use the Vanguard Airsoft platform at vanguardglobal.io.

1. DATA CONTROLLER

The data controller is Vanguard Global B.V., registered in the Netherlands. For any privacy-related enquiries, contact us at: privacy@vanguardglobal.io

2. DATA WE COLLECT

We collect the following categories of personal data:

• Account data: name, email address, username, password (hashed), profile photo, country, date of birth
• Player profile data: callsign, team affiliation, tier/rank, V-Points balance, playstyle, gear inventory, loadouts
• Event data: event registrations, attendance, check-in timestamps
• Communication data: messages sent through the community system, forum posts
• Waitlist data: first name, last name, email, country, username, referral code, referred-by username
• Technical data: IP address, browser type, device type, cookies, session tokens
• Social data: follower/following counts, linked social media handles (if voluntarily provided)

3. LEGAL BASIS FOR PROCESSING

We process your personal data based on the following legal grounds under Article 6 GDPR:

• Contract performance (Art. 6(1)(b)): processing necessary to provide the Vanguard platform services you signed up for
• Legitimate interest (Art. 6(1)(f)): platform security, fraud prevention, analytics to improve the platform
• Consent (Art. 6(1)(a)): marketing emails, cookie tracking, optional profile data
• Legal obligation (Art. 6(1)(c)): tax records, regulatory compliance

4. HOW WE USE YOUR DATA

• Provide and operate the Vanguard Airsoft platform
• Manage your account, player profile, and progression
• Process event registrations and manage team memberships
• Deliver V-Points rewards and track referral bonuses
• Send transactional emails (registration confirmations, referral notifications)
• Send marketing emails (only with your explicit consent)
• Improve platform performance and user experience
• Prevent fraud and ensure platform security

5. DATA SHARING

We do not sell your personal data. We may share data with:

• Base44: our backend infrastructure provider, which processes data on our behalf
• SendGrid (Twilio): email delivery service for transactional and marketing emails
• Vercel: hosting and CDN provider
• Law enforcement: when required by Dutch or EU law

All third-party processors are bound by Data Processing Agreements (DPAs) compliant with Article 28 GDPR.

6. INTERNATIONAL TRANSFERS

Some of our processors operate outside the EEA. Where this occurs, we ensure adequate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, or adequacy decisions per Article 45 GDPR.

7. DATA RETENTION

• Active accounts: data is retained for the duration of your account
• Deleted accounts: personal data is erased within 30 days of account deletion request, except where retention is legally required
• Waitlist data: retained until platform launch or until you request removal
• Server logs: retained for a maximum of 90 days

8. YOUR RIGHTS

Under the GDPR, you have the following rights:

• Access (Art. 15): request a copy of your personal data
• Rectification (Art. 16): correct inaccurate data via Settings or by contacting us
• Erasure (Art. 17): request deletion of your personal data ("right to be forgotten")
• Restriction (Art. 18): restrict processing in certain circumstances
• Portability (Art. 20): receive your data in a structured, machine-readable format
• Objection (Art. 21): object to processing based on legitimate interest
• Withdraw consent: withdraw consent at any time for consent-based processing

To exercise any of these rights, email privacy@vanguardglobal.io. We will respond within 30 days as required by GDPR Article 12.

9. COOKIES

We use essential cookies for authentication and session management. Optional analytics cookies are only placed after you consent via our cookie banner. You can withdraw cookie consent at any time by clearing your browser cookies or using the cookie settings in the banner.

10. CHILDREN

The Vanguard platform is not intended for children under the age of 16. We do not knowingly collect personal data from anyone under 16. If we become aware that data has been collected from a child under 16, we will delete it promptly. In the Netherlands, parental consent is required for users under 16 in accordance with Article 8 GDPR and the UAVG.

11. DATA SECURITY

We implement appropriate technical and organisational measures to protect your data, including encrypted transmission (TLS/HTTPS), hashed passwords, access controls, and regular security reviews.

12. DATA BREACH NOTIFICATION

In the event of a personal data breach, we will notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours as required by Article 33 GDPR. If the breach poses a high risk to your rights, we will also notify you directly.

13. COMPLAINTS

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Dutch Data Protection Authority: Autoriteit Persoonsgegevens

14. CHANGES TO THIS POLICY

We may update this policy from time to time. Material changes will be communicated via email or an in-platform notification. The "Last Updated" date at the top reflects the most recent revision.