Privacy policy

This policy explains which personal data DocTeam processes when you visit docteam.be, create an account, link your Minecraft account or use the Whoniverse SMP features of the website. For each use, it gives the reason, the legal basis under the General Data Protection Regulation (GDPR), how long the data is kept and who receives it.

In short: we only collect what the website needs to work, we never sell your data, there is no advertising and no audience measurement, and content from YouTube and X only loads if you accept it.

Who is responsible for your data

The controller is DocTeam, the non-commercial fan project that publishes this website. DocTeam has no legal personality: it is represented by the person responsible for publication named below.

Name: DocTeam

We have not appointed a data protection officer, as the law does not require one for a project like ours. For any question about your data, write to us. Our other contact details are in the legal notice.

What we process and why

Visiting the website

Data: Your IP address, the date and time, the page requested and the details of your browser and device, which your browser sends with every request.
Why: To deliver the pages, keep the website secure and fix errors.
Legal basis: Our legitimate interest in running a working and secure website (GDPR, art. 6(1)(f)).
How long: The website does not store these details in its database. The web server of our host may keep technical logs for security reasons, for a limited time set by the host. When the website hits an error, the technical error message is kept for at most 30 days.

Session and preferences

Data: A session cookie and, on the server, the session linked to it: your account number once you are logged in, a security token for forms, short messages shown after an action, the language you picked, the fields of a form the website refused so you do not have to type them again (never your password), the page to return to after logging in, and the forum threads you opened, so that a view is counted only once. The language and consent cookies are described in the cookie policy.
Why: To keep you logged in, protect forms against forged requests and remember your choices.
Legal basis: Necessary to provide the service you ask for (art. 6(1)(b)) and our legitimate interest in a secure website (art. 6(1)(f)).
How long: The session cookie is deleted when you close your browser. The server deletes session data automatically after a short period of inactivity.

Your account

Data: Username, e-mail address, password (stored only as a one-way hash, never in readable form), role, whether your account is suspended, registration date, the date you accepted the terms of use, and the time of your last activity.
Why: To create and protect your account, let you log in with your username or e-mail address, and let administrators manage accounts. The website does not send newsletters. We only use your e-mail address to let you log in and, if needed, to write to you about your account. Your username, e-mail address and password are required to create an account: without them we cannot create it. Everything else (bio, pictures, Minecraft link, profile posts) is optional.
Legal basis: The contract formed by the terms of use you accept when you register (art. 6(1)(b)). For the time of your last activity, our legitimate interest in keeping the community safe (art. 6(1)(f)).
How long: Until you delete your account. Your username and e-mail address are then immediately replaced by an anonymous placeholder.

Public profile, forums and profile posts

Data: Username, profile picture, background picture (only administrators can set one), bio, role, the date you joined, forum threads and posts, the posts you write on profiles or receive on yours, your inventory, rank badges and active theme, and, if you linked your Minecraft account, your in-game name, your Minecraft UUID (it appears in the address of your head picture) and the date you first joined the Whoniverse SMP.
Who sees it: Everyone, including visitors without an account. Administrators and moderators are also listed on the home page. Your e-mail address is never shown publicly, and your in-game money is only shown to you and to administrators.
Why: To run the forums and member profiles.
Legal basis: The contract formed by the terms of use (art. 6(1)(b)).
How long: Profile details stay until you change them or delete your account. A profile post stays until its author, the owner of the profile or a moderator deletes it, or until one of those two accounts is deleted. Forum threads and posts stay after you delete your account so that discussions still make sense: they are then shown as written by “Deleted user”, without a link or picture. This is based on our legitimate interest in keeping discussions readable (art. 6(1)(f)). You can edit your posts before deleting your account, or ask us to delete specific posts.

Pictures are published as you send them. Photos can contain hidden information, such as the place where they were taken: remove it before uploading. Pictures added to a message with the forum editor are public at their own address and are not linked to your account in our database, so they are not deleted with your account. Ask us if you want one removed.

Online members list

Data: The time of your last request to the website, including the automatic refresh of the server status while the home or Whoniverse SMP page stays open (updated at most once a minute), and your choice to appear in the list or not.
Why: To show on the home page which members have been active in the last 5 minutes.
Legal basis: Our legitimate interest in making the community feel alive (art. 6(1)(f)). You can object at any time by unticking “Show me in the online members list” in your settings: you are then neither shown nor counted.
How long: The time is overwritten at each visit and deleted with your account.

Linking your Minecraft account (optional)

Data: Your personal link code, Minecraft UUID, in-game name, the date you first joined the Whoniverse SMP, your in-game money balance and the time of the last update.
How it works: You type the command shown in your settings on the Whoniverse SMP. The game server records your Minecraft UUID with your code. The website finds your code on the game server, saves your UUID and replaces the code with a new one. It then reads your name, first join date and balance from the game server, at most every 10 minutes when your profile is displayed, or when you ask it to check. If the game server does not know your name, our server asks Mojang's public profile service (api.minecraftservices.com) for the name that belongs to your UUID.
Why: To show your Minecraft identity on your profile and deliver your inventory items in the game.
Legal basis: The contract formed by the terms of use, for a feature you choose to use (art. 6(1)(b)).
How long: Until you unlink your Minecraft account in your settings, an administrator unlinks it, or you delete your account. Our server may also keep a temporary copy of your name and balance: it is deleted when your Minecraft account is unlinked, or automatically after one day. The game server keeps the code you used next to your UUID, but that code no longer matches any account.

Inventory items, ranks and themes

Data: The items you received, when and from which administrator, when you activated them, and a log of every activation: the item name, the command sent to the Whoniverse SMP (which contains your Minecraft UUID or name), whether it worked, the server's reply and the date.
Who sees it: Your inventory, with the date you received each item and when you activated it, is public on your profile. Which administrator gave an item and the activation log are only visible to administrators.
Why: To deliver ranks and perks on the Whoniverse SMP, apply themes on the website, answer support requests and prevent abuse.
Legal basis: The contract formed by the terms of use (art. 6(1)(b)). For the activation log, our legitimate interest in checking that items were delivered and preventing abuse (art. 6(1)(f)).
How long: An item stays until an administrator removes it or you delete your account. The activation log is kept until you delete your account.

The Whoniverse SMP

On the website: The home and Whoniverse SMP pages show the in-game names and Minecraft heads of the players connected to the server at that moment. The website only keeps a temporary copy of this list, renewed when it is more than 20 seconds old and deleted automatically after one day.
In the game: When you play, the game server processes your Minecraft UUID and name, your IP address, your chat messages and commands, and what you do in the game, such as your builds, land claims, money and first join date.
Why: To run the server, show who is playing, protect builds, prevent cheating and griefing, and enforce the rules.
Legal basis: Our legitimate interest in running a fair and safe server (art. 6(1)(f)) and the rules you accept when you play (art. 6(1)(b)).
How long: Game data stays as long as the server and its world exist, or until you ask us to delete it. Server logs are only kept as long as they are needed to investigate incidents and enforce the rules.

Data: The IP address and time of each failed login attempt, without any link to an account.
Why: After 8 failed attempts from the same IP address, logging in from that address is blocked for up to 15 minutes.
Legal basis: Our legitimate interest in protecting accounts (art. 6(1)(f)).
How long: Deleted automatically once they are 15 minutes old, during the cleanup that runs every hour while the website is visited, and at every login attempt. A successful login immediately deletes the failed attempts of its IP address.

Videos from YouTube and posts from X

Data: Only if you accept: your browser connects to YouTube (Google) or X to show our latest videos or posts on the home page. These services receive your IP address, browser details and the page you are visiting, and can set cookies.
Legal basis: Your consent (art. 6(1)(a)), which you can withdraw at any time with the “Cookie settings” link at the bottom of every page. Your choice itself is kept in a cookie so that we can respect it (art. 6(1)(c) and (f)).
How long: Your choice is kept for 6 months. Google and X keep the data they receive according to their own privacy policies.

Minecraft player heads

Data: The Minecraft heads shown next to members and players are downloaded by our server from mc-heads.net and then served by docteam.be: your browser never contacts mc-heads.net. That service only receives from our server the Minecraft name or UUID of the heads we display, never anything about you as a visitor.
Legal basis: Our legitimate interest in showing players' Minecraft heads (art. 6(1)(f)).
How long: Our server keeps a copy of each head, deleted automatically after 2 days. The copy of a member's head is also deleted when they unlink their Minecraft account or delete their account.

When you contact us

Data: Your e-mail address, your message and anything you choose to tell us.
Why: To answer you and handle your requests, reports and objections to moderation decisions.
Legal basis: Our legitimate interest in answering you (art. 6(1)(f)) and, for requests about your rights, our legal obligation (art. 6(1)(c)).
How long: As long as needed to handle your request and, for requests about your rights, to show that we answered them.

Who receives your data

We never sell or rent your data, and we do not use it for advertising.

The DocTeam team. Administrators can see members' e-mail addresses, registration and last activity dates, inventories, the activation log and in-game money. Moderators can edit and delete forum content and delete profile posts.
o2switch, our host, stores the website, its database and uploaded files in France. It acts only on our instructions, as a processor.
The Whoniverse SMP game server is run by DocTeam itself on a machine in Belgium. The exchanges between the website and the server are described above.
Mojang and Microsoft receive a Minecraft UUID from our server, not from your browser, when the website looks up a player name.
mc-heads.net receives from our server, never from your browser, the Minecraft name or UUID of the heads we display.
Google Ireland Limited (YouTube) and X Internet Unlimited Company, only if you accept their content. When their content loads on our pages, DocTeam and each of these companies are joint controllers for collecting your data and sending it to them. For everything they do with it afterwards, they alone are responsible: see the Google privacy policy and the X privacy policy.
Other websites. Pictures hosted on other websites are not loaded in messages: they are shown as links. Links to Discord, CurseForge, Modrinth, YouTube, X or other websites only contact those services when you click them.
Authorities, only when the law requires us to hand over data.

Transfers outside the European Union

The website and its database are stored in France, and the game server is in Belgium. Some services mentioned above can process data outside the European Union:

Google may transfer data to the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, which the European Commission recognises as offering an adequate level of protection, and Google also uses the standard contractual clauses approved by the Commission.
X transfers data to the United States and other countries and relies on the standard contractual clauses approved by the European Commission.
Mojang's profile service is part of Microsoft, which may process data in the United States and states that it follows the EU-U.S. Data Privacy Framework.
mc-heads.net is served through Cloudflare's worldwide network. It only receives from our server the Minecraft name or UUID of the heads we display, which Mojang already makes public, and nothing about the visitors of the website.

How we protect your data

The website is only served over an encrypted HTTPS connection.
Passwords are stored as one-way hashes, and nobody at DocTeam can read them.
The session and consent cookies cannot be read by scripts, are only sent over HTTPS and are withheld from forms and embedded content on other websites. A new session starts when you log in.
Every form is protected by a security token against forged requests.
Repeated failed login attempts are blocked.
Uploaded pictures are checked and renamed at random. Mod files are stored outside the public part of the website.
Only administrators can open the administration area. Commands and detailed player information on the game server require a secret key, but the connection between our host and the game server is not yet encrypted.
Our host commits to security measures in line with the recommendations of the French authorities on data protection and cybersecurity.

If a data breach is likely to put your rights at risk, we will tell the Belgian Data Protection Authority and, when the risk is high, the members concerned, as the GDPR requires.

Children

You can create an account yourself from the age of 13. If you are under 13, one of your parents or your legal guardian must agree before you create an account. If we find out that a child under 13 created an account without that consent, we will delete it. Parents can contact us at any time about their child's account. Under 13, only a parent or legal guardian can accept content from YouTube and X (GDPR, art. 8, and Belgian law of 30 July 2018, art. 7).

Whatever your age, never publish your address, phone number, school or other private details on the forums or your profile.

Automated decisions

We do not make decisions based solely on automated processing, including profiling, that have legal effects on you or affect you in a similarly significant way. The only automatic measure is the temporary login block described above, which ends within 15 minutes.

Your rights

You have the right to access, correct and delete your data, to restrict or object to its processing, to receive it in a portable format and to withdraw your consent. Most of this can be done directly from your account settings. Everything is explained on the page about your GDPR rights, including how to complain to the Belgian Data Protection Authority.

Changes to this policy

When this policy changes, we update the date at the top of the page. We announce important changes on the website before they apply.