(information on processing of your personal data)
We are the data controller, which means that we determine the purposes and means of the processing of your personal data.
We take the protection of personal data very seriously, therefore you will find here all the information about the processing of your personal data by Us as well as the information on your rights. We implement high standards of data security (organisational and technical) so your data are not disclosed to unauthorised recipients or third parties.
If you will not find all the relevant information below or you will need more information on the processing of your personal data, please do not hesitate to contact us by email at: firstname.lastname@example.org or in writing at our address: Staromestská 3, 811 03 Bratislava, Slovak Republic. For more information on your rights please see the section 7 below.
- identification details (name, surname, unique identifier of the user/player – User ID);
- contact details (email address, country/habitual residence);
- economic data (payment method, payment transaction information, bank account, credit card number);
- message data (by using our services – e.g. chat logs, user/player support tickets);
- other personal data (all other personal data you provide us voluntarily by using/accessing our services, by communicating with Us).
We also collect your personal data from other sources or automatically, which include:
- digital data (IP address, MAC geo-location data, IMEI, MAC address, browser type and language, data about your device, GPS location with your consent);
- gameplay data (data you generate by playing games and by interacting with other users/players within the game, in game chats and messages, your game progress, levels, session length, preferred settings, game preferences);
- digital data provided from social networking sites like Facebook or Google+, if our services and/or products are connected to your social networking site account (e.g. Facebook friends and other traffic data);
- digital data provided from application platforms (distribution platforms) like Apple’s Appstore, Google Play (Android), Steam and Windows Phonestore when you buy, access, use and/or interact with our services and/or products via these platforms (e.g. your user name, profile picture, age range, gender, your friend playing the same game);
- economic/financial data (payment method, payment transaction information, bank account, credit card number) from the payment service providers to process the payments received from you under Our EULA and concluded agreements;
- publicly available data at public state databases or registers.
We do not process any special categories of personal data (sensitive data), unless it is required by applicable law or the law will specifically entitle Us to process such data for a specific (necessary) purpose in the future.
Our web servers by default temporarily protocol data of requesting computers that visit our websites, identification information concerning the web browser and operating system used at each visit and the duration date and duration of the visits. These data cannot be used to identify a specific natural person, therefore they are not personal data.
2. WHY DO WE HAVE YOUR PERSONAL DATA AND WHAT IS THE BASIS FOR YOUR PERSONAL DATA PROCESSING
We process your personal data for the following purposes and on a relevant legal basis:
- providing our services and products – We process your personal data to provide you all the services and/or products and to perform the agreement/contract concluded by and between you and Us pursuant to our EULA.
In order to improve and develop our services and products, we collect and analyse data generated within our services and products . These personal data are not provided to third parties and are intended for our internal analytical and statistical purposes only.
We will process your IP address or other geo-location data to prevent any abuse of our services. This will not lead to geo-blocking within the EU internal market prohibited under the applicable EU law.
We need to process your personal data for this purpose for the entire duration of the agreements and after the agreements expire or are terminated, we archive the personal data to the extent necessary to comply with Our legal obligations under the applicable law (accounting and tax regulations stipulate 10 years storage period).
The data we use for our internal analytical and statistical purposes are usually anonymised, so they do not meet the definition of a personal data. These data are processed for the duration of for up to five (5) years after the agreement was expired or terminated.
- to improve Our services and products – We will process your personal data to improve Our services and/or products and provide you with the support you will need in relation to our services and products. We have a legitimate interest to such processing of your personal data. This purpose includes updating and developing player profiles, developing and improving the service and user/player experience, customizing your service experience, responding to your comments and questions and providing the user/player support, sending you related information (updates, security alerts and other support messages), receiving error messages about any issues you/your device encounters with our services to enable us to fix bugs and interoperability issues, detecting and preventing illegal activities (e.g. hacking or cheating), conducting optional user/player feedback, conducting research.
You have a right to object to processing of your personal data for this purpose at any time and if you object to such processing, We will no longer process your personal data for this purpose unless We demonstrate compelling legitimate grounds for the establishment, exercise or defence of Our legal claims.
We will store your personal data for this purpose for the duration of the agreement concluded by and between you and Us and up to five (5) years after the agreement was expired or terminated.
- performance of the contractual obligations and keeping accounting/contractual records – for this purpose We process the personal data related to our business partners, contractors, subcontractors so We can perform the contracts concluded by and between Us and them. We need to process the personal data for this purpose for the entire duration of the contracts and after the contracts expire or are terminated, we archive the personal data to the extent necessary to comply with Our legal obligations under the applicable law (accounting and tax regulations stipulate 10 years storage period).
- establishment, exercise or defence of Our legal claims – We process the personal data for this purpose based on Our legitimate interest to establish, exercise or defend Our legal claims in courts, extrajudicial proceedings, arbitration, administrative proceedings, decision enforcement proceedings, bankruptcy and restructuring proceedings, in relation to users, clients, business partners and/or debtors. We have a legitimate interest to process the personal data for this purpose to effectively establish, exercise or defend Our legal claims. You have a right to object to processing of your personal data for this purpose at any time and if you object to such processing, We will no longer process your personal data for this purpose unless We demonstrate compelling legitimate grounds for the establishment, exercise or defence of Our legal claims.
- We store the personal data for this purpose for the duration necessary, to effectively establish, exercise or defend Our legal claims. The storage period mainly corresponds with the statutory periods/limits to effectively establish, exercise or defend Our legal claims at the court, whereas the storage period should not exceed four (4) years after the contractual/non-contractual relationship expired or was terminated.
- establishing contact, communication or providing information – We process the identification and contact details of natural persons and of the representatives of the legal persons collected from publicly available sources for this purpose or collected from these person, as well collected from other persons for this purpose, based on Our legitimate interest. We have a legitimate interest to establish contact with other natural and legal persons to properly establish contact and communicate with them for the proper/basic operation of Our company or to provide these persons with information they require (e.g. by using our contact forms or by emailing us). You have a right to object to processing of your personal data for this purpose at any time and if you object to such processing, We will no longer process your personal data for this purpose unless We demonstrate compelling legitimate grounds for the establishment, exercise or defence of Our legal claims.
We store personal data for this purpose for the duration necessary to establish contact, communication or provide the information required, whereas the storage does not exceed five (5) years.
3. THE RECIPIENTS OR CATEGORIES OF RECIPIENTS OF THE PERSONAL DATA
Your personal data may be disclosed to the following recipients however before we disclose any personal data we thoroughly assess whether We are entitled to disclose the personal data to the recipients:
- to other users/players of our services/products when you use or access Our services or products (e.g. by using the social features of our games, the other users/players can see you profile information, your interactions and messages you have posted);
- to IT companies (processors) which provide Us with our daily internal IT support and management;
- to our lawyers (law firms) who provide Us with complex legal services and represent Us in courts or at other state authorities to exercise or defend Our legal claims;
- to our auditors (processors) who perform audits within our company, for example, to audit Our financial statements;
- to interpreters and translators (processors) if We in relation with the provision of Our services or for some other purpose We need to translate documents or texts to or from a foreign language;
- to accountancy firms and tax advisers (processors) who provide Us complex accounting and tax services.
We have concluded contracts with our processors, so they are not entitled to do with your personal data anything, unless we instruct them to do so.
We may also provide or disclose your personal data to any competent law enforcement body, regulator, government agency or other third party where we believe disclosure is necessary:
- as a matter of applicable law or regulation; or
- to exercise, establish or defend Our legal rights; or
- to protect your vital interests or those of any other person.
4. DATA TRANSFER OUTSIDE EU / EEA COUNTRIES
It is possible that we may transfer your personal data to third parties outside EU / EEA countries where the European Commission did not decide that there is an adequate personal data protection (e.g. the USA). Before such a transfer we will ensure that the recipient meets the adequate personal data protection (e.g. by concluding the standard data protection clauses adopted by the European Commission, supervisory authority or the third party is actively certified by the EU-USA Privacy Shield)
5. MOMENT OF SERVICE DELIVERY
You acknowledge and agree that the respective Service is fully delivered to you if at least one of the three following conditions is met:
- at the moment the access to the respective Service is enabled to you via the online communication method; or
- at the moment you completed the download and/or install of the Service at you device; or
- at the moment you are able to use the Service.
6. YOUR DATA PROTECTION RIGHTS
You have the right to access, correct, update or to delete all of your personal data. We will consider your request in accordance with the applicable laws. If the EU General Data Protection Regulation (GDPR) is applicable, you have the following data protection rights:
- Right to a rectification: If you find out that the personal data that We process about you are inaccurate or incomplete, you have the right to have them rectified or completed, as the case may be, without undue delay.
- Right to erasure (‘right to be forgotten’): In the following situations, you have the right to request that We erase your personal data. We will erase your personal data without undue delay if any of the following conditions is fulfilled:
- we no longer need the personal data for the purposes for which we processed them;
- you withdraw your consent to the processing of personal data and we do not have another reason for any further processing of the personal data;
- the personal data must be erased for compliance with a legal obligation pursuant to applicable law.
Please note that if one of the conditions is met, it does not mean that we will erase all your personal data immediately. This right will not apply in the event that the processing of your personal data continues to be necessary to comply with Our legal obligations or to establish, exercise or defend our legal claims.
- Right to restriction of processing: In certain situations, in addition to the right of erasure, you can exercise the right of limitation on processing of your personal data. This right allows you to request in certain situations that your personal data are tagged and such data are not be subject to any further processing operations - however, not forever in this case (like in the event of the right to erasure), but instead for a limited period of time. We have to limit the processing of personal data when:
- you challenge the accuracy of personal data until We identify which data are correct;
- We process your personal data without a sufficient legal basis, but you prioritize their limitation over erasing such data (e.g. if you expect that you would provide such data to us in the future anyway);
- We no longer need your personal data for the aforementioned purposes of processing, but you require them for the establishment, exercise or defence of your legal claims; or
- you object to the processing; the right to object is described in more detail below – „Right to object”). For the duration of the investigation of the legitimacy of your objection, we are required to limit the processing of your personal data.
- Right to data portability: You have the right to receive all your personal data from Us that you provided to Us and we process your personal data on the basis of your consent or on a contract/agreement. We will provide your personal data to you in a structured, commonly used and machine-readable format. In order to be able to easily transfer data at your request, this can only include the data that we process in our electronic databases using automated means.
Right to object: You have the right to object to processing in the event We process the personal data based on the legitimate interest. If you object to processing your personal data based on the legitimate interest We will no longer process the personal data unless We demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of Our legal claims.
- Right to withdraw your consent: Giving a consent is voluntary. In the event you have given Us a consent to process your personal data, you have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
- How to exercise your rights (under GDPR): You can exercise your rights using Our contact details, by email at: email@example.com or in writing at Our address: Staromestská 3, 811 03 Bratislava, Slovak Republic. We will provide you with the information on the actions taken on your request without undue delay, no later than one (1) month from receipt of your request. If We have reasonable doubts about your identity, We may ask you to provide additional information to confirm your identity (for example, We may ask you to provide a copy of your ID card). The time limit for processing your application begins to run after We have verified your identity. Due to the complexity of the application or the greater number of requests, We may extend the period in question by a further two (2) months, whereas We will inform you about this period extension.
If We do not take action on your request, We will inform you without delay and at the latest within one (1) month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.
If your requests will be manifestly unfounded or excessive, in particular because of their repetitive character, We may refuse to act upon your request or request from you a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested. We will consider a request as an inadequately repeated request, a request which is identical or similar and filed within six (6) months of the submission of the previous request.
- The right to lodge a complaint with a supervisory authority: The exercise of rights in the manner described above does not affect your right to lodge a complaint with the relevant supervisory authority. You can exercise this right mainly if you believe that We process your personal data without authorization or in violation of generally binding legislation. You can lodge a complaint against the processing of personal data by Us with a data protection authority, in particular in the European Economic Area member state of your habitual residence.