Privacy Policy

1. Which law we apply, and an honest caveat

Paraguay’s personal data protection law is Law 7593/2025, enacted on 27 November 2025 and modelled on the European General Data Protection Regulation. Full entry into force is set for twenty-four months after enactment, that is around November 2027.

In other words: that law is not yet enforceable today. We nonetheless apply its criteria from now, voluntarily and ahead of time, because we would rather reach that date with the practice already running than with a policy written at the last minute. This page describes what we actually do, not what we plan to do.

Do not confuse this law with Law 6534/2020, often mistakenly cited as Paraguay’s data protection law: that one governs credit data specifically and does not apply to our processing.

2. Who is the controller

The controller is the owner of Albirroja.com, who can be reached through the site’s contact form. Every query, complaint or exercise of data rights goes through that channel and is logged.

The formal appointment of a data protection officer, with published contact details, is in progress. Until their identity is published here, the contact point is the one above. We do not claim to have appointed someone we have not yet appointed.

3. What data we process and on what basis

To create and maintain an account we process: name or nickname, email address, date of birth, password in hashed and irreversible form, and optionally a phone number. The basis is performance of the relationship the person starts on registering; the date of birth is additionally the age control.

From use of the site we record: date and time of access, IP address, device and browser type, and the detail of plays made with their play-money balances. The basis is our legitimate interest in platform security, fraud prevention and game integrity, and in the case of plays, the provision of the service itself.

We do not process card or bank account data, because the site takes no money. We do not process sensitive data and do not build profiles with legal effects on individuals.

4. Who we share it with

We do not sell personal data and do not disclose it for third-party advertising. It is shared only with the providers needed for the service to work: hosting and infrastructure, transactional email delivery, and verification messaging where applicable. Each receives only the minimum data needed and may not use it for its own purposes.

Our servers are hosted outside Paraguay. This means an international transfer of data, and we say so expressly rather than omitting it: the infrastructure sits in data centres with industry-standard security controls, and we are assessing the formal transfer instrument that Law 7593/2025 will require once in force.

We may also hand over data when required by a competent judicial or administrative authority, within its powers and for the specific request it makes.

5. How long we keep it

Account data is kept while the account is active. After closure it is kept for as long as needed to handle claims, meet legal obligations and preserve the integrity of game records, and is then deleted or anonymised so that it no longer identifies the person.

Technical access logs are kept for a limited period, aimed at detecting security incidents, and are not used for any other purpose.

6. Your rights

The data subject may request access to their data, rectification where inaccurate, erasure, restriction of or objection to certain processing, and a copy of the data they gave us, in machine-readable format.

Requests go through the site’s contact form, from the registered email address or by otherwise reasonably proving identity. We reply within a reasonable time and, where we cannot meet the request, we explain why rather than leaving it unanswered.

Once Law 7593/2025 is in force and Paraguay’s supervisory authority is constituted, the data subject may also lodge a complaint with it.

7. Cookies and similar technologies

We use local storage and strictly necessary cookies to keep the session open, remember the language and interface preferences, and protect forms against automated submissions. Without them the site cannot keep a person signed in.

We do not use third-party advertising cookies or cross-site tracking networks. The usage measurements we take are aggregate and are not linked to a person’s identity.

8. Minors

The site is not directed at people under eighteen and we do not knowingly collect data from minors. Registration requires a date of birth and the server checks it. If we detect an account belonging to a minor, we close it and delete their data.

9. Changes to this policy

Amendments are published on this page with their version date. Where a change substantially affects the processing, it is also notified within the site before taking effect.