This register is the release-gate source for section 94. Each feature row must be updated before content lock when a launch surface changes collected data, lawful basis, retention, DSR impact, or transfer mechanism.
Gate Rules#
- Every feature must document data collected, lawful basis, retention, subject rights impact, and cross-border transfer mechanism.
- Features touching identifiable data require privacy review before release candidate signoff.
- Features touching sensitive data, minor data, profiling, AI inference, moderation evidence, biometric-adjacent media, or cross-region transfers require a DPIA before the release gate.
- The release gate blocks when the DPIA status is
required-missing,legal-review-open, orprocessor-contract-open.
Feature Register#
| Feature | Data collected | Lawful basis | Retention | Subject rights impact | Cross-border transfer mechanism | DPIA |
|---|---|---|---|---|---|---|
| Account identity and 2FA | Account id, platform id, email hash, age band, 2FA state | Contract, legal obligation for minors and security | Account life plus fraud/legal retention | Access, rectification, erasure, portability, restriction, objection | Subject home zone; SCCs/BCRs for approved support transfer | Required |
| Profile and privacy settings | Handle, avatar choice, locale, accessibility settings, consent receipts | Contract; consent for optional processing | Account life; consent receipts retained for audit | Access, rectification, erasure, portability | Subject home zone only unless support transfer approved | Required |
| Match records and replay metadata | Match id, fighters, ruleset, result, replay metadata, opponent ids | Contract, legitimate interest | Match history window; public esports records after review | Access, erasure by anonymization, portability | Subject home zone; public exports privacy-reviewed | Required |
| Ghost and replay sharing | Ghost files, replay ids, sharing scope, friend/global visibility | Consent and contract | Until consent revocation or content expiry | Access, erasure/anonymization, portability | Subject home zone; cross-region discovery only after consent | Required |
| Optional telemetry and balance analytics | Feature use, performance, crashes, move frequency, aggregate heatmaps | Consent where required; legitimate interest where permitted | Aggregated after identifier purge; raw windows limited by ops need | Access, erasure purge, restriction, objection | Regional telemetry ingest; SCCs/BCRs for approved analysis | Required |
| Commerce and cosmetic ledger | Purchases, receipts, entitlements, cosmetic inventory, refund state | Contract, legal obligation | Platform/legal tax retention; account ledger while active | Access, erasure where not legally retained, portability | Platform owner DPA plus regional commerce records | Required |
| Social, chat, and UGC | Friend links, party ids, lobby chat, decals, CAW outfits, reports | Contract, legitimate interest, legal obligation | Moderation/legal retention by case | Access, erasure/redaction, objection, appeal rights | Moderation region with restricted reviewer access | Required |
| Moderation and safety appeals | Report evidence, decision, Statement of Reasons, appeal record | Legal obligation, legitimate interest | Case retention plus DSA/regional audit period | Access to own decisions, rectification where appropriate, appeal | Restricted transfer under SCCs/BCRs when reviewer is outside home zone | Required |
| AI and anti-cheat systems | Classifier outputs, model cards, opt-out status, anti-cheat risk facts | Legal obligation, legitimate interest | Audit record life; sanctions by policy | Access, objection, appeal, AI transparency | EU AI record store and security region, no model training on minor profiles | Required |
| Minor account protections | Age band, parental settings, consent status, jurisdiction detection | Legal obligation, contract, parental consent where required | Account life plus audit evidence | Guardian access, erasure, privacy defaults, profiling objection | Subject home zone; no behavioral ad transfer | Required |
| Esports public results | Display name, event, fighter, bracket, result, replay link | Contract, legitimate interest | Public archive after privacy review | Access, correction, removal review for private identifiers | Public only after minimization review | Review required |
| Web legal and sub-processor pages | Public page analytics only if strictly necessary; no account data | Legitimate interest or disabled | Aggregate-only web telemetry | Cookie/consent rights where tracking exists | No personal-data transfer for page view beyond necessary hosting logs | Review required |
DPIA Completion Evidence#
A completed DPIA must include:
- feature owner and release owner
- data-flow diagram
- risk to minors and vulnerable players
- profiling or automated decision analysis
- sensitive-data and special-category assessment
- cross-border transfer assessment
- sub-processor and DPA status
- security controls and audit events
- mitigation owner and due date
- legal signoff and DPO signoff
Release-Gate Packet#
Each release gate must attach the latest version of this register, the extended
privacy compliance contract, the sub-processor delta, DSR routing validation,
and privacy ops on-call contact. The release manager records the gate result as
privacy-approved, privacy-approved-with-conditions, or privacy-blocked.