Last updated: October 15, 2026
This policy explains what personal data b3basketball.com ("B3 Basketball", "we", "us") collects, why, how long we keep it and the rights you have. We follow the EU General Data Protection Regulation (GDPR) and the Serbian Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti). We collect as little as possible: no advertising, no tracking cookies and no selling of data.
1. Who is responsible
The data controller is the operator of b3basketball.com. Contact for all privacy questions and requests: b3basketballnews@gmail.com.
2. What we collect
| Data | When | Why (legal basis) | How long |
|---|---|---|---|
| Display name, email address, password (stored only as a salted PBKDF2 hash, never in readable form), account creation and last sign-in dates, the date you accepted the Terms | You register | To provide your account (contract, GDPR Art. 6(1)(b)) | Until you delete your account |
| Your comments, and reports you file about other comments | You comment or report | To run the comment section (contract) and keep it safe (legitimate interest, Art. 6(1)(f)) | Until you or a moderator delete them, or you delete your account |
| Moderation records: hidden comments, account suspensions and their reason | A rule is broken | Enforcing the community guidelines and preventing repeat abuse (legitimate interest) | As long as needed to enforce a ban, at most 2 years after the account is closed |
Session cookie b3s (a random token; we store only its hash) | You sign in | Keeping you signed in (strictly necessary) | 30 days, or until you sign out |
| Password-reset token (stored as a hash) | You ask for a reset | Resetting your password (contract) | 1 hour, single use |
| IP address and email of failed sign-in, registration and reset attempts | An attempt fails or a reset is requested | Protecting accounts against password guessing and spam (legitimate interest) | 15 minutes |
| Technical request logs (IP address, browser, page, time) | Every visit | Security and keeping the site running (legitimate interest) | Kept by our host Cloudflare for a short period under its own policy |
We don't collect payment data, phone numbers, precise location or special categories of data. Please don't post personal information (yours or anyone else's) in comments.
3. Cookies and third-party content
We set one cookie, b3s, only when you sign in. It is strictly necessary for the account to work, so it
doesn't need consent. We use no analytics or advertising cookies.
- Videos are embedded from YouTube in privacy-enhanced mode (youtube-nocookie.com). YouTube (Google) receives your IP address when the player loads and may store data in your browser when you play a video.
- Social posts from X and Instagram are shown as text cards; nothing loads from X or Instagram until you click "Show post".
- Fonts are loaded from Google Fonts, which receives your IP address when a page loads.
- Share buttons are plain links: nothing is sent to X, Facebook, WhatsApp, Telegram or Viber unless you click one.
4. Who processes the data for us
- Cloudflare, Inc.: hosting, the account and comment database (Cloudflare D1), security. Data may be processed in the EU and the USA.
- Mailgun Technologies, Inc.: sends account emails (password reset). It receives your email address and name. Open and click tracking is turned off.
- Google (YouTube, Google Fonts), as described above.
Where data leaves the EU/EEA or Serbia, these providers rely on the EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework. We share data with authorities only when the law requires it. We never sell personal data.
5. What others can see
Your display name and your comments are public, next to the date. Your email address is never shown.
6. Your rights
You can ask to access, correct, delete or receive a copy (portability) of your data, to restrict its use, and you can object to processing based on legitimate interest. You can delete your account at any time on the Account page; this removes your account, comments and reports at once. For anything else, email b3basketballnews@gmail.com from the address on your account. We reply within one month.
You may also complain to a supervisory authority: in Serbia the Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs), or the data protection authority of your EU country.
7. Age
Accounts are for people aged 16 or older. Betting content on the site is for adults (18+) only. If we learn that a child under 16 has registered, we delete the account.
8. Security
All traffic is encrypted (HTTPS). Passwords are hashed with PBKDF2-SHA256 and a unique salt, session and reset tokens are stored only as hashes, sign-in attempts are rate-limited, and only the site itself can make account requests. No system is 100% secure; if a breach affecting your data happens, we will inform you and the authorities as the law requires.
9. Changes
If we change this policy we update the date above, and for important changes we tell signed-in members on the site.