NLDiscord
Naar het Nederlands

Privacy & Cookie Policy (GDPR / AVG)

Last updated: March 2026

Tarragon VZW ("we", "us", or "our") respects your privacy and is committed to protecting your personal data in accordance with the European General Data Protection Regulation (EU 2016/679 - GDPR) and applicable Belgian privacy legislation.

This Privacy Policy explains what personal data we collect, why we collect it, how we safeguard it, and what your rights are.

1. Data Controller

The data controller responsible for the processing of your personal data is:

Tarragon VZW
Wijngaardstraat 15 bus 13
8500 Kortrijk, Belgium
Enterprise Number (KBO/BTW): BE 0799.673.542
E-mail: privacy@tarragon.be or contact@tarragon.be
Website: https://tarragon.be

2. What Personal Data We Collect and Why

We only collect data necessary to organize community gaming events, manage our non-profit association, and process memberships:

A. Event Registrations (e.g. D&D, Boardgame Nights)

  • Data collected: Name/nickname, email address, chosen game/group table.
  • Purpose: Managing table player counts, sending confirmation emails, and allowing you to cancel your spot.
  • Legal basis: Performance of a contract / legitimate interest (Art. 6.1(b) and (f) GDPR).
  • Retention: Event registration logs are retained for the season and periodically cleared.

B. User Accounts & Dragon Authentication (Clerk)

  • Data collected: Name, email address, profile picture (avatar), authentication tokens, user role (user, member, dragon).
  • Purpose: Authenticating into the website, accessing member benefits, and managing community council permissions.
  • Legal basis: Performance of a contract (Art. 6.1(b) GDPR).
  • Service provider: Clerk Inc. (Data processed under EU Standard Contractual Clauses).

C. Membership Subscriptions & Payments (Stripe)

  • Data collected: Name, email, billing address, VAT/tax ID (for businesses), subscription status, payment history. We do not store complete credit card or payment credentials on our servers.
  • Purpose: Administering your annual Kobold membership (€10/year) and complying with Belgian accounting, tax, and VAT regulations.
  • Legal basis: Performance of a contract and legal obligation under Belgian tax law (Art. 6.1(b) and (c) GDPR).
  • Service provider: Stripe Payments Europe, Ltd.

D. Community Communications (Resend / Discord)

  • Data collected: Email address for automated transaction/confirmation receipts via Resend.
  • Purpose: Sending necessary service notifications (event ticket confirmation, cancellation tokens). We do not send unsolicited marketing spam.

3. Cookies and Local Storage

Our website is built to be privacy-first and does not use third-party behavioral advertising or cross-site tracking cookies.

  • Essential / Strictly Necessary Cookies:
    • Authentication (Clerk): Session tokens (__session, __client_uat) necessary for keeping you logged in securely.
    • Security & Cloud Infrastructure: Load balancing and fraud prevention tokens.
    • Cookie Consent: A local storage item (tarragon_cookie_consent) recording your acceptance of the cookie notice.
  • Analytics: If minimal anonymous aggregated traffic analytics are enabled, they run in privacy-preserving mode without fingerprinting personal information.

4. Data Sharing & Processors

We never sell, rent, or trade your personal data to advertisers or third parties. We only share data with trusted data processors strictly necessary for providing our digital services:

  1. Convex (Backend database & real-time synchronization, hosted in EU regions).
  2. Clerk (Identity management and authentication).
  3. Stripe Payments Europe Ltd. (PCI-DSS compliant payment processing).
  4. Resend (Transactional notification emails).
  5. Vercel (Global web application hosting and CDN).

All service providers comply with GDPR and maintain appropriate data protection safeguards.

5. Data Security

We implement strict technical and organizational measures to safeguard your data, including TLS/HTTPS encryption in transit, strict database-level access controls, role-based authorization for our administration ("Dragons"), and API-level sanitization.

6. Your Rights Under GDPR

Under European data protection law, you have the following rights:

  1. Right of Access (Art. 15 GDPR): You can request a copy of the personal data we hold about you.
  2. Right to Rectification (Art. 16 GDPR): You can update incorrect or incomplete information via your user profile or by contacting us.
  3. Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR): You can request the deletion of your account and personal data, except where retention is required by Belgian law (e.g., financial/tax accounting).
  4. Right to Restriction of Processing (Art. 18 GDPR): You may request that we limit the processing of your data in certain circumstances.
  5. Right to Data Portability (Art. 20 GDPR): You can receive your data in a structured, commonly used, and machine-readable format.
  6. Right to Object (Art. 21 GDPR): You can object at any time to processing based on legitimate interests.

To exercise any of these rights, please send an email to privacy@tarragon.be or contact@tarragon.be. We will respond within 30 days without charge.

7. Supervisory Authority

If you believe your data protection rights have been infringed, you have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données):

Gegevensbeschermingsautoriteit (GBA)
Drukpersstraat 35, 1000 Brussel, Belgium
Website: https://www.gegevensbeschermingsautoriteit.be
E-mail: contact@apd-gba.be

Privacy Policy | D&D & Boardgames Kortrijk | Tarragon