PRIVACY POLICY

1. Our details as the data controller
2. What personal data is processed and the legal basis for processing
3. What we do with your personal data
4. How long personal data is stored for
5. Security measures used by Us
6. Categories of recipients and Data Processors
7. Transfer of your data abroad
8. Social Network Services
9. Your rights
10. Children’s privacy
11. Cookies and similar technologies
12. Notice to California Residents
13. Contact us

1. Our details as the data controller

The provision of our applications (hereinafter “App”), whether via websites or through various app stores, is brought to you by Kamagames Ltd. registered at 4th Floor, 110 Amiens Street, Dublin 1, Ireland (the “Data Controller” of your personal data). Consequently, “We”, “Us” and “Ours” refers to the Data Controller.

We have a designated data protection officer (DPO) to help us comply with the requirements of the General Data Protection Regulation (EU) 2016/679. You may contact the DPO directly by emailing dpo@kamagames.com

In the alternative, you may email Us with regards to queries of any nature (in particular, to exercise Your Rights) at support@kamagames.com

2. What personal data is processed and the legal basis for processing

There are different types of information we obtain, whether directly from you or automatically via your device when you use the App. Essentially, we only obtain what is strictly necessary to provide you with our services, no more, no less.

Information, relating to you or your device, is either identified automatically by Our systems, provided to Us by the operating system of your device or is input by you manually when filling out certain fields, authorizing certain actions in the Apps.

Information you provide Us with:	Legal basis for processing
1. Email address when you log in to use the App as a registered user.	Performance of the contract with you. Unless you sign up via other means (SNS, see below), We could not provide you with our services as a logged in user other than through some means of unique identification. You may still access Our App as a guest and link your account later. We may contact you for marketing purposes of similar products and/or services. It will be in Our legitimate interests to do so, but you will always have a chance to opt out of such marketing communications prior to any such communication and every time thereafter. We will store just enough information to honour your opt-out preference in the future.
2. Social Network information via the “OAuth” method for secure login (read more about OAuth by following the link https://oauth.net/) Essentially, this is information from your public profile (with, for instance, Facebook) that you can control at any stage.	Performance of the contract with you. Same as above, We could not otherwise provide you with our services as a registered user.
3. Your name and avatar (an image of your choice to be shown when playing the App)	Your consent at the time of provision of the same. You can always change or replace your name and avatar within the App settings.
4. Your date of birth when you provide it to our support team to get some freebies.	Your consent to receive freebies on that special day each year. We do not store the year of your birth, only the DD.MM. so to minimize the extent of personal data We hold about you.
5. Messages and communication with support	Performance of contract to respond to your queries and provide customer support. We do not use this information for anything else (for instance, we do not build your profile or target you based on your communication with us or with other users of the App).

Strange, but that is it. The rest is the technical stuff that must be processed in order to provide you with our services.

Information collected automatically or assigned by Us to you	Legal basis for processing
1. The server that hosts the App may record requests your device makes to the server, the details on device and browser you use, your IP address, date and time of access, city and country, operating system, browser type, mobile network information.	Performance of the contract. The App would not operate otherwise, you need this to connect to the Internet. This data is used only for technical purposes – that is, to ensure the proper functioning and security of the App and to investigate possible security incidents.
2. Advertising identifiers provided by the operating system of your handheld device (such as, for instance, IDFA, GAID)	Your consent to the provision of such identifiers given by default through the operating system of your device (Apple or Android, for instance). You are free to withdraw your consent by resetting those identifiers or opting out of interest based advertising. This may be done via the settings of your handset and/or your browser. We respect those choices you make through the settings of your device.
3. Various device identifiers, provided by the operating system (device ID or a vendor ID, for instance) or allocated by Us (your in-App ID, for instance)	Our legitimate interests in fraud prevention and potential unauthorized access from multiple devices/locations, ensuring the technical availability and security of the App.
4. App version, OS version information, browser type, language used, make/model of your device	Performance of the contract. We need to know this technical information so the App functions properly on your device.
5. All the events that naturally occur during your usage of the App (such as logs, events, hands played, purchase history, crashes of the App, system reports and so on). Statistical information with regards to App usage.	Partly, performance of the contract and partly our legitimate interests in fraud prevention and potential unauthorized access, ensuring the technical availability and security of the App. Analysis of statistical information helps us to optimize the App in future updates, such usage does not affect your rights and freedoms and does not disclose any personal data of yourself or your contacts.

3. What we do with your personal data

We protect your data and do not treat your personal data in any way that would surprise you (unless We told you about it and you made an informed decision to consent to such usage).

For instance, We encrypt the password created by you at the sign up stage and then store your personal data on secure servers that would prevent unauthorized access or destruction.

We use the advertising identifiers in strict compliance with the requirements of the operating systems (for otherwise We would be in breach of their usage terms). Thus, We only use those advertising identifiers to meet our contractual obligations towards the parties that brought you to Us and vice versa (whether by you clicking on an advertising banner in our partners’ apps, watching the ad or otherwise).

Unless you have asked us not to, We may rarely contact you by email about similar products and services to the App. Whenever We contact you, We would always give you the right to opt out prior to the first communication and at any time thereafter (see the section “Your Rights” below).

The purposes for processing the data provided by you include:

Providing you with Our services
Fraud prevention
Improving our services
Notifying you of any changes in our services

4. How long personal data is stored for

Depending on the type, your personal data is stored either until you delete the App or after six months of inactivity. Some data (such as IP addresses or blacklisted email addresses used for fraud) may be held for longer in our legitimate interests to protect our business from losses and also to respect your choice of opt-outs from marketing emails.

We are required by law to delete any information that is no longer necessary to provide Service to you. We assume that if you have not used our App for over six months (“Period of Inactivity”), you have left us indefinitely. We will delete any Personal Data that we have in our possession following the Period of Inactivity. But do not worry, you are always welcome to use our App again if you decide to come back by setting up a new account.

5. Security measures used by Us

Your data is stored on one of the secure servers that we rent and We use the recommended industry practices to keep your data secure. We use appropriate level of technical and organizational measures to prevent accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to personal data transmitted, stored or otherwise processed.

Hetzner and Amazon (the “Hosting providers”) are contracted to store your personal data. Those Hosting providers are in possession of various international security certificates that ensure safety of your data with them. You can read more on the security measures of Hosting providers by following the links:

https://www.hetzner.com/assets/downloads/FOX-Certificate.pdf ISO 27001 certificate

https://d1.awsstatic.com/certifications/iso_27001_global_certification.pdf ISO 27001 certificate

Thus, having the appropriate security with the Hosting providers when storing your data, We have to ensure that access to such data is provided on a need-to-know basis. Access to the Hosting providers is controlled via various technical and organizational measures that include:

Two-factor authentication to access the Hosting providers;
Following the principle of least privilege;
All servers and services are subject to continuous monitoring. This includes the logging of personal access in the user interface.
Each employee has access to the systems/services only via his/her own employee access. The access rights involved are limited to the responsibilities of the respective employee and/or team.

6. Categories of recipients

We do not share your personal data with any third parties, except for:

the data processors (service providers) that act solely upon our instructions and in the performance of our duties to you;
as stated in this privacy policy; or
where We have to comply with a legal obligation.

This does not mean that We blindly follow disclosure orders. We will check each request to ensure it satisfies the relevant safeguards, contains a court order or is issued under a legislative measure for the prevention, investigation, detection or prosecution of criminal offences.

Independent Controllers

Once you access the rewarded ads section, you may be able to obtain free in-game virtual currency (as defined in our terms and conditions) in return for certain actions. As with everything else in this world, if you are not paying for the product – you are the product. Hence, your personal data (non-invasive and general in most cases, as described in each controller’s privacy policy below) will be processed by an independent third party that gets some benefit for processing your personal data for further targeted advertising.

For Android users only: Tapjoy, Inc. is an independent controller and processes your personal data in accordance with their privacy policy available at https://www.tapjoy.com/legal/#privacy-policy. The type of information processed by Tapjoy is listed in their privacy policy and includes certain device information as well as app and ad information. Please, read through their privacy policy for further information. Your personal data is accessed by Tapjoy only after you have accessed the particular section of our app by clicking on it following a prompt (consent through affirmative action). Once you have agreed and proceed to access the rewarded ads section, we have no further control over the extent to which Tapjoy complies with its own privacy policy. Should you wish to exercise your rights in relation to such personal data passed to Tapjoy, you will need to contact them directly. You can find all the relevant information on their website with relevant links and advice.

For iOS and Android users: Unity Technologies Finland OY (“Unity”) is an independent controller that is used by and processes your personal data in accordance with their privacy policy available at https://unity3d.com/legal/privacy-policy. Most apps (including ours) was developed using Unity software. Unity automatically collects certain device information from the outset (as listed in their privacy policy). With regards to the Unity Ads section, Unity, among others, collects the following data: whether you click or tap an ad for a new game, whether you watch the ad or play a game frequently, whether others playing a game like the one you’re playing have downloaded a particular new game, and whether you download and install the new game you see advertised. All of this is for purposes of predicting the types of new games that you might like to download.

If you are in the EU and do not wish to be targeted in this manner, the first Unity ad you see in an app (as of May 25, 2018) explains how you can opt-out of data collection in that particular game. You can opt-out then or at any time by clicking or tapping the “i” button (or Data Privacy icon) on any ad you see (the “i” button or Data Privacy icon will also allow you to access the data that is collected about you in that particular app). For example, you might see a summary that includes information indicating that Unity see that you are using an iPhone 8 and you are playing from Germany. In the past week you were seen 5 times in this game and have been shown 27 ads. You have installed 0 games based on those ads.

Additionally, all users, regardless of their location, may opt-out of all personalized advertising by enabling privacy features on their devices such as Limit Ad Tracking (iOS) and Opt Out of Ads Personalization (Android). See your device’s Help system for more information.

7. Transfer of your data abroad

While your data may be accessed from different parts of the world on our behalf, We do not actually transfer your personal data outside the EEA. To any extent that data is accessed from abroad, We follow set contractual safeguards and protections to ensure that your data is as safe abroad as it is within the EEA.

Where a third party accesses your data on our behalf or upon our instructions (be it inside or outside the EEA), We use the relevant legal basis to comply with the data protection legislation. In cases where there is no finding of an adequacy decision by the European Commission, we use model contracts to safeguard your rights and data.

8. Social Network Services (SNS)

When you log in to use any of Our Apps via an SNS (such as Facebook) you provide Us with certain information from you profile for that site. The information provided via SNS varies and depends on a particular SNS (for instance, Facebook provides information on your name, age range, picture, gender, friends list and email address). You can untick the boxes for information you prefer not to share with us during the sign up process.

You can find out more about these settings at the SNS where you play Our App (for instance, you can edit the privacy and settings of your apps with Facebook by following the link https://www.facebook.com/help/218345114850283?helpref=about_content - last accessed on December 11, 2019).

Your activity when playing the App via an SNS will also be subject to the SNS’ privacy policy for their part of data processing.

9. Your rights

You are entitled to the full spectrum of the rights under the General Data Protection Regulation and We will go out of our way to accommodate any valid request. You can either exercise your rights by deleting certain features through your device or by emailing us at support@kamagames.com to exercise all the other rights.

You have a wide array of rights that we respect. Among those the right to:

Require access to your personal data;
Require rectification of your personal data;
Require erasure of your personal data;
Withdraw consent to processing of your personal data, where applicable;
Lodge a complaint with your national supervisory authority (in the EEA) if you believe that your privacy rights have been breached;
Not to be discriminated against for exercising any of your rights.

You may be required to prove through a certain procedure that the request emanates from the data subject (i.e. contact us from within the app itself and confirm a code that we would send to the registered email address). This is so that we do not disclose personal data to those that are not entitled to it.

If your personal data is erased at your request or in accordance with our data retention policy, We only retain such information that is necessary to protect our legitimate interests or to comply with a legal obligation.

Please note, all requests should be emailed to Us at support@kamagames.com, sent to us by post or via an App’s related internet website (where applicable).

10. Children’s privacy

The Apps are intended strictly for over 18 year old persons. We never knowingly collect or solicit any information from anyone of 13 years and younger. The App and its content are not directed at nor made look to appeal to such persons. Parents or guardians that believe that We hold information about their children aged 13 and under may contact Us at support@kamagames.com

11. Cookies and similar technologies

We use certain cookies when you visit Our Websites, but We give you an opportunity to choose which of those optional, non-essential cookies you would want to keep. Check the relevant cookie policy for the website you are visiting.

There is no consensus on how mobile application companies should interpret the DNT signals. For the purposes of the CalOPPA, We do not currently respond to DNT signals whether that signal has been received on a computer or a mobile device.

12. Notice to California Residents

For the purposes of the California Consumer Privacy Act of 2018 (the “CCPA”):

1) We do not sell nor share consumer personal information as per sections 1798.140(ad)(2) and 1798.140(ah)(2) respectively.

2) In accordance with section 1798.130(a)(5):

the list of your rights is specified in section 9 of this privacy policy;
the categories of personal information We collect and have collected about consumers in the preceding 12 months and the business purpose for collection are listed in section 2 of this privacy policy.

3) In accordance with section 1798.130(a)(1)(A) and (B), consumers can contact us via an email address provided herein. And where an internet website is separately accessible for a particular App, that internet website is also available to submit any requests consumers may have.

4) As per the last sentence of section 1798.130(a)(2)(A), We do not wish to collect more information than we already hold about consumers when dealing with verifiable requests, and, as such, We require the consumers to use the account they hold with us to submit a verifiable consumer request.

Put simply, We have an obligation to reduce the risk of processing unauthorized requests. Thus, if you contacted us from an email address asking for information relating to a user with a completely different email address and user ID, We would ask you to use the in-App chat to authenticate the request. And this has to be done to a reasonably high degree of certainty.

5) You may designate an authorized agent to make a request on your behalf. In order to do this, you should, firstly, provide the agent with written and signed permission to submit a request on your behalf. Secondly, you must verify your own identity directly with us and confirm the authority of the agent. Please, note that We retain the right to refuse a request from an allegedly authorized agent absent the legal proof of authority.

13. Contact us

Feel free to contact us at any time should you have any questions in relation to this privacy policy, either via email, by post or within App.

KamaGames Ltd
Attention: Data Protection
KamaGames Ltd, 4th Floor, 110 Amiens Street, Dublin 1, Ireland
Support Team: support@kamagames.com

v.230205