GSC GAME WORLD PRIVACY POLICY

This policy explains what data is or may be collected when using our services, such as playing our games (subject to this policy being included in the respective game’s EULA), visiting websites, etc. and how such data is used, stored and protected.

You need to agree (provide your free consent) to this Privacy Policy before you will be able to use our services.

1. Who Are We

1.1. We are GSC GAME WORLD GLOBAL LTD, company number HE 413188, address: Kolokotroni, 59, 3032, Limassol, Cyprus (hereinafter “GSC”, “we”, “us”, “our”).

You may contact us via email at [email protected] or by physical mail: GSC GAME WORLD GLOBAL LTD, Kolokotroni, 59, 3032, Limassol, Cyprus.

You can contact a person responsible for the data protection via email [email protected] in case you have additional questions about this policy.

2. Scope of This Privacy Policy

This Privacy Policy governs personal data and non-personal data, which is collected by us during your use of our services.

This Privacy Policy applies to: all our websites (unless specific website states otherwise), games in case respective End User License Agreement incorporates it, social media channels (alongside respective social media privacy policies), forums, technical and customer support and any other services that we provide to you, except where different privacy policy applies to a product or a service (eg. Stalker2.com website privacy policy).

Please note that not all of our services and websites actually have a respective functionality to collect data, e.g., in a case where specific website does not have a forum functionality - it does not collect relevant data and so on. Moreover, in most cases our websites do not have a registration function and will only collect basic technical data about the device you are using to access them, unless you utilize “Contact us” or similar communication functionality.

3. Data That We May Collect

3.1. When you use our services, we may collect the following data if relevant:

• Your name and surname;
• Your email address;
• Any username used to identify yourself in any of our services;
• Technical information about any device you utilize to access our services, such as: your internet or network connection (including IP address), any mobile device identifier, your operating system, browser type, or other software, as well as hardware or other technical specifications;
• Data regarding your usage of our services, including but not limited to: metrics regarding when and how you utilize the services, traffic data, and geographical location data. This constitutes technical information about our users' behaviors and patterns, devoid of personal data.
• Data that is provided by social media linking between your social media account and our services. This is only applicable if you used the relevant functionality.
• Any additional data that you provide us via our services.

3.2. When you contact our technical support (either directly or via crash reports in our games when applicable), we may process other data that is relevant to help you with your problem. This includes data in crash logs which is gathered by your device or the technical parameters of the device you use to utilize our services.

3.3. In case you participate in competitions organized by GSC, we may process additional data such as correspondence address, social media information, photos, bank account numbers for the purpose related to such competitions (prize collecting, coverage of the event, etc.).

3.4. We may also collect some non-personal data about you in order to improve our games and services based on such data.

3.5. In order to provide you with our services, we need to process data provided above.

4. Children Data

4.1. GSC does not and will not knowingly collect personal data from any child under 16 years of age, without additional explicit consent from their parent or guardian.

If you are a parent or guardian and became aware that a child improperly registered on our website or used fake information to use our services or if you are simply concerned about the transfer of personal data about your child, please let us know.

5. How Do We Collect Such Data

5.1. Directly from you in the following cases:

• if you provide us your data;
• when you contact us;
• when you report a problem with our services;
• when you participate in our competitions;
• via surveys that we may use from time to time.

5.2. Indirectly (due to your activity or from third parties) in the following cases:

• during your activity as a user of our services (such data includes IP address, country of origin, purchases) - collected automatically;
• data we receive about you from social media platforms if you use them to authorize yourself or data from distribution platforms.

5.3. We will not receive or store any of your payment details in case you buy out products from our websites, this part is covered by the relevant payment service provider. We do not receive any of your actual payment details, but only about the fact that transaction exists.

6. Legal Basis

6.1. We process your data to provide you with our services that you use and to perform our obligations arising from agreements between you and us, including:

• to provide services that you request from us;
• to allow you to use interactive features of our products where applicable;
• to host competitions and distribute prizes.

We also process your data subject to our obligations under applicable law:

• for legal and accounting purposes;
• as defined by EU legislation (GDPR).

We additionally may process your data for legitimate interests of GSC or sometimes third parties:

• for communication with you as our customer;
• to provide notices regarding the changes to our services;
• to develop, improve our services;
• to defend ourselves in court or other institutions, etc..

We rely on your consent to process your data in specific cases. If you grant it (such consent may be withdrawn at your own discretion, however previously processed data shall not be affected):

• to provide you with marketing information (such as targeted marketing emails) about our services or products;
• to focus on and customize our marketing communications, promotions, and ads presented on both our websites and third-party websites, along with services tailored using the aggregated data we've gathered about you.

6.2. We may profile your data to personalize our marketing communications, offers and advertisements. However, in such cases, no algorithms are utilized to make decisions that could affect your legal situation.

If you no longer want to receive personalized offers, product recommendations from us, or marketing information, you can object to this service at any time, by unsubscribing from the marketing materials.

6.3. We may process and provide our partners that are involved in the process of provision of our services (like payment providers or game data analytics) with some aggregated and general non-personal data. Such data, if applicable at all, corresponds to general statistics and is anonymized.

7. Data Storage Periods

7.1. We'll retain your personal information solely for the duration required to accomplish the objectives laid out in this Privacy Policy. Once your personal data is no longer necessary, we may delete it or render it anonymous.

7.2. Specific storage periods:

• We store personal data during the performance of the contract and 24 months after completion.
• After the expiration of the specified period, we anonymize the data and store it for statistics and analytics purposes.
• We store payment data during 36 months. The data is stored to provide support, for verification of the ownership and for activation of a copy of the game or until you withdraw your consent.
• We process data based on your consent during the performance of the contract/ while your interaction with our service and 24 months after or until you withdraw your consent.

8. Data Sharing and Transfer

8.1. We may share your personal data with our contractors in order to perform a contract and within our group of companies where necessary. Generally, we may share the data (personal or otherwise) based on:

• Consent. Your explicit consent is required for us to share personal data.
• Compliance with the law. We will disclose your personal data to third parties to the extent that it is necessary:
  • to comply with a government request, court order, or applicable law;
  • to prevent unlawful use of our website or violation of the Terms of use of our website and our policies;
  • to protect against claims of third parties;
  • to help prevent or investigate fraud.
• We transfer your personal data to third parties on the basis of a public offer for processing on our behalf, subject to technical and organizational measures to protect your personal data. We may transfer your data to certain companies, consultants, and contractors hired to provide certain services on our behalf.
• We transfer your personal data for storage to:
  • OVHCloud - you can read more in their Privacy Notice
  • CloudFlare - you can read more in their Privacy Notice
• Also keep in mind that communications you have with us (via chat messages, forums, contact us forms, etc.) may provide information about you. In case you share some data publicly when using our services, it may become available to our staff and others persons.
• By default, the data is stored on the servers located in Poland but we may need to process your personal data in another country.
• We use adopted Standard Contractual Clauses for data protection while transfer and storage.
• However, if a data transfer is required to perform a contract or to provide you services, we have the right to do so without your consent.

We want to draw your special attention that we do not sell, rent, or trade your personal data to anyone.

9. Third Party Information Collection and External Services

9.1. Our services may have links to third-party websites that may be of interest to you. This Privacy Policy does not cover such third-party websites, meaning that different rules will most likely apply if you decide to visit those. Please, in case you open such websites via the links in our services, familiarize yourself with their rules.

10. Do We Use Cookies?

We use cookies to provide information such as: IP address, geolocation, device type and browser type, personal ID to monitor your session on the site.

If you want to disable cookies, you can find instructions for managing your browser settings at these links:

• Internet Explorer
• Chrome
• Firefox
• Opera
• Safari
• Vivaldi
• Microsoft Edge

11. Your Rights

You, as a subject of personal data, have the following rights:

• The right to access information. You can request an explanation of the processing of your personal data.
• The right to withdraw consent. You can withdraw your consent at any time.
• The right to portability. You can request all the data that you provided to us, as well as request to transfer data to another controller.
• The right to restrict processing. You may partially or completely prohibit us from processing your personal data (this, however, will result in your inability to continue to use our services).
• The right to file complaints. If your request was not satisfied, you can file a complaint to the regulatory body.
• The right to be forgotten. You can send us a request to delete your personal data from our systems.

To exercise your rights, write us an email at [email protected].

If your request was not satisfied, you can file a complaint to the regulatory body, the Office of the Commissioner for Personal Data Protection at P.O.Box 23378, 1682 Nicosia, Cyprus or via email at [email protected].

12. California Privacy Rights

We make these disclosures to those visiting our websites who reside in California which supersede and replace any conflicting disclosures found elsewhere on our websites as well as reflect your privacy rights granted by the California Consumer Privacy Act (CCPA).

Opt-out of disclosure for direct marketing purposes.

The California laws allow its residents to learn the identities of entities that received their personal data for marketing purposes and the categories of information disclosed. You may request such information by contacting us by e-mail [email protected].

Please be aware that this opt-out does not prohibit our disclosure of personal data for any purpose other than direct marketing. The data we process and share may include your name, address, email address, and telephone number.

Automatic gathering of information.

We collect data that you provide to us online, and through websites of unaffiliated third parties.

Automatic gathering of information by third parties.

When you visit our websites, third parties can collect personal data about your online activities over time and across different websites pertaining to your visit to or use of our and other websites.

13. Do-Not-Track Requests

California's residents visiting our websites may request that we do not automatically gather and track information pertaining to their online browsing movements across the Internet. Such requests are typically made through web browser settings that control signals or other mechanisms that provide consumers the ability to exercise choice regarding the collection of personal data about an individual consumer's online activities over time and across third-party websites or online services. We currently do not have the ability to honor these requests. We may modify this Notice as our abilities change.

14. California Residents’ Data Protection Rights

The CCPA has extended California residents’ data protection rights. However, we have already guaranteed all these rights and described them precisely in this Notice as well as a means of rights exercising. Please refer below to investigate.

Right to be informed.

Please find a list of personal data we collect about you and your activity, sources and business purposes of personal data collection, and third parties we may share your personal data with in Section 3 - 6 of the Notice.

Your Right of access, Data portability, and Right to delete are prescribed by Section 7 of the Notice.

You can exercise these rights any time by contacting us via email at [email protected].

Notice, the CCPA envisages some specific requirements related to the exercising of these data protection rights. Considering them we may:

• respond to your request within forty-five (45) days of receiving the request;
• provide you with personal data we collected about you no more than twice in a 12-months period (categories and specific pieces of collected personal data, business purpose and sources of collection, categories of third parties personal data is shared with);
• NOT provide you with personal data if we cannot verify your identity. You shall provide us with sufficient information allowing us to verify you as the person about whom we collected personal data. However, we do consider requests made through your Account sufficiently verified;
• NOT transmit your personal data to another entity.

Also, please be aware that we are allowed to maintain personal data after a deletion request is received, as permitted by the CCPA (for instance, for the purposes of detection of security incidents, repair errors, compliance with legal obligations, transaction completion).

15. How Do We Update Privacy Notice?

This Privacy Notice and the relationships falling under its effect are regulated by the GDPR.

Note: GDPR is General Data Protection Regulation that is European law protecting personal data and privacy related questions.

Existing laws and requirements for the processing of personal data are subject to change. In this case, we will publish a new version of the Privacy Notice on our website. If significant material changes are made that affect your privacy and confidentiality, we will notify you by email or display information on the website and ask for your consent if necessary.