Privacy Policy in regard to Games

1. Data Privacy

We take the protection of your personal data very seriously. We treat your personal data as confidential and we handle it in line with the statutory data privacy regulations, as well as this Privacy Policy.

This Privacy Policy applies to the processing of personal data (“Data Processing”) by us when use is made of our online games (“Games”). The nature, purpose and scope of the Data Processing in the context of making use of the Games is explained in it.

2. Controller and Data Privacy Officer

The “Controller” is the legal person that decides, either alone or together with others, on the purpose and means of processing personal data.

The Controller for our Games is:

a. Flaregames GmbH

The Controller is Flaregames GmbH.

for the following Games:

b. Well Played Games Ltd

The Controller is Well Played Games Ltd.

for the following Game:

c. The Phoenix Lighthouse GmbH

The Controller is The Phoenix Lighthouse GmbH.

for the following Game:

d. SmileyGamer BV

The Controller is SmileyGamer BV.

for the following Games:

e. Sad Panda

The Controller is Sad Panda Studios Ltd.

for the following Games:

The external Data Privacy Officer of the Controllers (with the exception of Upright Games GmbH and Sad Panda Studios Ltd.) is

3. General Principles of Data Processing

Below we would like to inform you about the general principles of data processing.

a. Scope of the Data Processing

We essentially only process your personal data to the extent necessary for making our Games available, along with their content and services, and for using them.

b. Legal Basis for the Data Processing

In so far as we obtain consent from you for the data processing, Art. 6(1)(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis for the data processing.

In the case of any data processing that is necessary in order to fulfill a contract to which you are a contracting party, Art. 6(1)(1)(b) GDPR serves as the legal basis. This also applies to any processing procedures that are required for conducting pre-contractual measures.

Should any data processing be required in order to fulfill a legal obligation to which our company is subject, Art. 6(1)(1)(c) GDPR serves as the legal basis.

Should the data processing be required in order to preserve a legitimate interest of our company or a third party, and should your interests, basic rights and basic freedoms not outweigh the first-mentioned interest, Art. 6(1)(1)(f) GDPR serves as the legal basis for the processing.

c. Storage period and erasure of personal data

Your personal data will be erased or blocked once the purpose of the storage has lapsed. It may be saved beyond that point in time if the latter has been stipulated by the European or national legislative authorities in any European Union regulations, laws or other provisions to which we are subject. Any blocking or erasure of said personal data will also be carried out if a storage period prescribed by said norms expires, unless there is any necessity to continue to store said personal data in regard to the conclusion of a contract or the fulfillment of a contract.

4. Specific instances of data processing

The following instances of data processing are carried out with our Games:

a. Downloading of the Games

Our Games are provided via the platforms of Google, Apple, Microsoft, Nintendo, Epic and Steam. The platforms also offer an opportunity for in-app purchases and further proprietary services. We have no influence over the data processing in that respect, and the respective platform operator is the Controller under data privacy law. Said operator’s respective terms and conditions of use and privacy policies shall apply.

You can inspect the Google Play Store Privacy Policy here:

https://policies.google.com/privacy?hl=en

You can inspect the Apple AppStore Privacy Policy here:

https://support.apple.com/en-us/HT211970

You can inspect the Microsoft App Store Privacy Policy here:

https://privacy.microsoft.com/privacystatement

You can inspect the Steam Store Privacy Policy here:

https://store.steampowered.com/privacy_agreement

You can inspect the Nintendo Store Privacy Policy here:

https://accounts.nintendo.com/term_chooser/privacy_policy

You can inspect the Epic Store Privacy Policy here:

https://www.epicgames.com/site/privacypolicy

b. Hosting

All data that arises when the following Games are made use of is stored on servers. In the case of the various purposes of processing, said data stored on the servers is accessed.

The data processing in the form of storage of personal data is carried out based on the use agreement that you accepted from us when opening the Game for the first time, and thus in accordance with Art. 6(1)(1)(b) GDPR.

The personal data will be erased from the servers once no grounds for processing any longer exist. This is typically the case upon the contractual relationship being terminated, as long as the legal regulations do not require the data to be stored for a longer period of time.

(1) AWS

In regard to our Games:

we use the Processor:

You will find further information on the processing of personal data at AWS in AWS’ Privacy Policy:

https://aws.amazon.com/compliance/data-protection/

(2) NodeChef

In regard to our Games:

we use the Processor:

You will find further information on the processing of personal data at NodeChef in NodeChef’s Privacy Policy:

https://www.nodechef.com/privacy

(3) CloudFlare

In regard to our Games:

we use the Processor:

You will find further information on the processing of personal data at CloudFlare in CloudFlare’s Privacy Policy:

https://www.cloudflare.com/privacypolicy/

(4) InMotion

In regard to our Games:

we use the Processor:

You will find further information on the processing of personal data at InMotion in InMotion’s Privacy Policy:

https://www.inmotionhosting.com/privacy/

c. Setting up an Account

To use our Games, you need to set up an account. This in particular enables us to be able to allocate any scores to the respective player, and also enables the player to play the Game on various different terminals.

The following categories of personal data may be processed for this purpose:

The data is processed based on the use agreement, and thus in accordance with Art. 6(1)(1)(b) GDPR.

In the case of the following Games, setting up an account is optional:

If you choose to refrain from setting up an account, however, not all features of the Game can be used.

d. Running the Game

The use of our Games requires data processing, without which the Game cannot be run. Said instances of data processing are in particular necessary in order for the Game to first at all be made available and ready to play, to detect and fix any bugs, to access scores, or also to link in-app purchases with the player’s account.

The following categories of personal data may be processed for this purpose:

The data is processed based on the use agreement, and thus in accordance with Art. 6(1)(1)(b) GDPR.

d2. VIP Program

For our game:

for some users we offer the opportunity to take part in a VIP program. If the user consents to the Terms of Use for the VIP Program, the customer receives exclusive in-game content, as well exclusive content outside the scope of the game.

In regard to the application for admission to the VIP Program, we process the following personal data:

Said personal data is also used to offer the user the exclusive content (for example, on the user’s birthday). In order to provide the VIP Program, the user’s game conduct is, moreover, extensively observed. In that regard, the personal data is processed based on the contract concerning the VIP Program concluded by the user with us, and thus based on Art. 6(1)(1)(b) GDPR.

In order to process the personal data, in this respect we make use of the following processors, with which we have concluded the required contracts, and which process the data exclusively on our behalf:

e. Creation of Aggregate Information

We create aggregate statistical information from the personal data available to us. We use said statistical information for various purposes, such as for optimizing the Game, improving our marketing campaigns, etc. The aggregate information no longer concerns personal data.

When the data is aggregated, the following categories of personal data may be used:

Aggregate statistical information is created based on our legitimate interest in enabling various evaluations and ratings of our Games, Art. 6(1)(1)(f) GDPR. Your interests also do not outweigh this, as the personal reference is removed through the process of the data being aggregated, which enables us to process the data on efficiently.

(1) Tableau

In regard to our Games:

we sometimes use the Processor

(“Tableau”) to create the aggregate information. You will find further information on the processing of personal data at Tableau in Tableau’s Privacy Policy:

https://www.salesforce.com/de/company/privacy/

In regard to our Games:

we use the Processor:

which in turn uses Tableau as a subprocessor.

(2) Firebase

In regard to our Games:

we sometimes use the Processor

(“Firebase”), in so far as you downloaded the Game via the Google Play Store or the Apple Appstore. You will find further information on the processing of personal data at Firebase in the Firebase Privacy Policy:

https://firebase.google.com/support/privacy

f. Fixing individual bugs

In order to fix game bugs that occur with an individual user, it is sometimes not sufficient to only process aggregate information and data, but it is also necessary to inspect and evaluate personal data.

Depending upon any bugs, the following categories of personal data may be processed for this purpose:

The data is processed based on the use agreement that you accepted from us when opening the Game for the first time, and thus in accordance with Art. 6(1)(1)(b) GDPR.

(1) Firebase

In regard to our Games:

we use the Processor:

in so far as you downloaded the Game via the Google Play Store or Apple Appstore. You will find further information on the processing of personal data at Firebase in the Firebase Privacy Policy:

https://firebase.google.com/support/privacy

(2) Unity

In regard to our Games:

we use the Processor:

You will find further information on the processing of personal data at Unity in Unity’s Privacy Policy:

https://unity.com/legal/privacy-policy

g. Fraud Detection

We inspect and validate personal data in order to ascertain any misuse of our Games.

The following categories of personal data may be processed for this purpose:

In that respect, personal data is processed on the basis of our legitimate interest, Art. 6(1)(1)(f) GDPR. We also have an interest in ascertaining any misuse of our Games. This is also, inter alia, substantiated by the fact that any misuse of our Games may also constitute violations of legislative regulations.

h. Advertising

We use different types of analysis and promotional tools in order to successfully advertise in our Games, and show advertisements on other websites.

The following categories of personal data may be processed for this purpose:

The legal basis for the processing is your voluntary consent (Art. 6(1)(1)(a) GDPR). You can revoke your consent at any time. The lawfulness of the data processing procedures that have already been carried out will not be affected by the revocation.

The personal data is processed for the purposes of advertising until such time as you revoke your consent. Should the personal data not be required for any further purposes, it will be erased.

(1) Unity

In regard to our Games:

we use the Processor:

You will find further information on the processing of personal data at Unity in Unity’s Privacy Policy:

https://unity.com/legal/privacy-policy

(2) Appsflyer

In regard to our Games:

we use the Processor:

You will find further information on the processing of personal data at Appsflyer in Appsflyer’s Privacy Policy:

https://www.appsflyer.com/legal/privacy-policy/

In regard to our Games:

we use the Processor:

which in turn uses Appsflyer as a subprocessor.

(3) Adjust

In regard to our Games:

we use the Processor:

You will find further information on the processing of personal data at Adjust in Adjust’s Privacy Policy:

https://www.adjust.com/terms/privacy-policy/

In regard to our Games:

we use the Processor:

which in turn uses Adjust as a subprocessor.

(4) ironSource

In regard to our Games:

we use the Processor:

You will find further information on the processing of personal data at ironSource in ironSource’s Privacy Policy:

https://developers.is.com/ironsource-mobile/air/ironsource-mobile-privacy-policy/#step-1

(5) Google AdMob

In regard to our Games:

we use the Processor:

You will find further information on the processing of personal data at Google AdMob in Google AdMob’s Privacy Policy:

https://policies.google.com/privacy

(6) Vungle

In regard to our Games:

we use the Processor:

You will find further information on the processing of personal data at Vungle in Vungle’s Privacy Policy:

https://vungle.com/privacy/

(7) Pangle

In regard to our Games:

we use the Processor:

You will find further information on the processing of personal data at Pangle in Pangle’s Privacy Policy:

https://www.pangleglobal.com/privacy

(8) Facebook

In regard to our Games:

we use the Processor:

You will find further information on the processing of personal data at Facebook in Facebook’s Privacy Policy:

https://www.facebook.com/privacy/policy

(9) AppLovin

In regard to our Games:

we use the Processor:

You will find further information on the processing of personal data at AppLovin in AppLovin’s Privacy Policy:

https://www.applovin.com/privacy/

(10) Liftoff

In regard to our Games:

we use the Processor:

You will find further information on the processing of personal data at Liftoff’s Privacy Policy:

https://liftoff.io/privacy-policy/

(11) Phoenix Lighthouse, AWS (Redshift)

In regard to our Games:

we use the Processor:

which in turn utilizes the service Redshift of the subprocessor

You will find further information on the processing of personal data at AWS in AWS’ Privacy Policy:

https://aws.amazon.com/compliance/data-protection/.

i. Support requests

You can send us support requests. In this respect, your details are exclusively used for the purpose of handling the support request and for the eventuality of any follow-up questions that you may have.

The following categories of personal data may be processed for this purpose:

The legal basis for the processing of the data is Art. 6(1)(1)(f) GDPR. Our interest in answering your request corresponds to your interest. As you write to us, it is in your own interest that we answer, and you are aware that we need to process your data in order to answer your question. If you have accepted our terms and conditions of use, the processing is based on Art. 6(1)(1)(b) GDPR.

The data will be erased once it is no longer needed in order to achieve the purpose for which it was gathered. This is the case once the respective conversation with the user has been terminated. The conversation has been terminated once it can be inferred from the circumstances that the issue concerned has conclusively been clarified.

(1) Zendesk

In regard to our Games:

we use the Processor:

You will find further information on the processing of personal data at Zendesk in Zendesk’s Privacy Policy:

https://www.zendesk.com/company/privacy-and-data-protection/

(2) AWS

In regard to our Games:

we use the Processor AWS. You will find further information on the processing of personal data at AWS in AWS’ Privacy Policy:

https://aws.amazon.com/compliance/data-protection/

(3) Freshworks

In regard to our Games:

we use the Processor:

You will find further information on the processing of personal data at Freshworks in Freshworks’ Privacy Policy:

https://www.freshworks.com/privacy/

j. External links

Our games may contain links to external web pages or services of third parties, over the content, data privacy standards and security standards of which we have no control. Please therefore inform yourself about the privacy statements of the corresponding providers on their web pages or services.

The linked pages have been checked for any infringements of rights as at the date of linking. No unlawful content could be identified as at the date of linking. Should we become aware of any legal infringements, we will immediately remove the corresponding link.

Said external links solely serve the purpose of entertainment, and it is not absolutely necessary to visit corresponding web pages or services in order to play the game.

k. Loyalty Program

In the course of our loyalty program, the following data may be processed:

– email address

The processing is carried out for the purpose of offering loyalty gifts/bonuses. The legal basis for this is Art. 6(1)(f) GDPR. It is in your interest that you are offered loyalty gifts/bonuses.

In addition, besides the email address, your name and postal address are also processed, for the purpose of sending you the gifts/bonuses. The legal basis for this is the fulfillment of a contract; Art. 6(1)(b) GDPR. Once the gifts/bonuses have been successfully delivered, the data is erased.

l. Newsletter

If you register for a newsletter, this requires your email-address and/or your name and address. [In addition, we check in compliance with the relevant law whether you are the true holder of the email-address and agreed to receive the newsletter. For this purpose, we send you a validation email.] Our newsletter informs about products, services and content of our companies.

As receiving the newsletter is dependent on your consent (Art. 6 (1) lit. a) GDPR), you can revoke your consent at any time by sending us an email to privacy@thelighthousepublishing.com or by clicking on the unsubscribe button in our newsletter or by changing your settings (click “manage your preferences” in the confirmation e-mail).” The data processing until the revocation remains unaffected.

5. Data processing in external countries

To provide our content and services, we sometimes make use of processors. For technical reasons, some of these processors have servers in external countries, with which connections are produced in certain situations. Your personal data will also sometimes be processed in this respect.

With the following subprocessors, we have concluded EU Standard Contractual Clauses (https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32021D0914&from=EN) or those subprocessors have concluded EU Standard Contractual Clauses with their subprocessors processing data in third countries, and / or they themselves or their clients are subject to an adequacy decision (especially EU-US Privacy Framework):

6. Your rights

a. Your right to information

You may request from us a confirmation about whether any personal data concerning you is being processed by us.

Should such processing be done by us, you may request the following information from us:

You are entitled to request information on whether the personal data concerning you is transmitted to an external country or an international organization. In this context, you may request to be informed about the appropriate guarantees under Art. 46 GDPR in connection with the transmission.

b. Right to rectification

If the personal data processed relating to you is incorrect or incomplete, you are entitled to have your data rectified or completed by us. We will undertake the rectification without delay.

c. Right to restriction of the processing

You may, on the following prerequisites, request the restriction of the processing of personal data concerning you:

Should the processing of the personal data concerning you have been restricted, this data may – except for being stored – only be processed with your consent or in order to assert, exercise or defend any legal claims or to protect the rights of another natural or legal person, or for reasons relating to a significant public interest of the EU or a Member State.

Should the restriction of the processing have been carried out in line with the above prerequisites, you will be notified by us before the restriction is lifted.

d. The right to have your data erased

You may require us to erase the personal data concerning you without delay. We are obliged to erase said data immediately if one of the following reasons applies:

Information passed on to third parties

Should we have published the data concerning you, and should we be obliged, pursuant to Art. 17(1) GDPR, to erase it, we will, taking into account the available technology and the costs of implementation, take reasonable steps, also of a technical nature, to inform the Controllers responsible for the data processing, who processes the personal data, that you, as a data subject, have required all links to said personal data or copies or replications of said personal data to be erased.

Exceptions

The right of erasure does not exist if the processing is necessary

e. The right to notification

Should you have asserted the right to rectification, erasure or restriction towards us, we shall be obliged to inform all recipients to whom the personal data concerning you has been disclosed about said rectification or erasure of the data or restriction of the processing, unless this proves impossible or involves disproportionate effort.

You are entitled to assert against us the right to be notified about said recipients.

f. The right to data portability

You are entitled to be given the personal data concerning you, with which you have provided us, in a structured, well-established and machine-readable format. In addition, you have the right to transmit said data to another controller, without any impediment by the Controller to whom the personal data was provided, as long as

When exercising this right, you are, moreover, entitled to arrange for the personal data concerning you to be transmitted directly by us to another controller, in so far as this is technically feasible. No freedoms or rights of other persons may be compromised by this.

The right to data portability shall not apply to the processing of personal data that is required in order to take on a task that falls within the public interest or is carried out in exercise of public authority, which has been transferred to us.

g. The right to object

You are entitled, for reasons arising from your particular situation, to raise an objection at any time to the processing of the personal data concerning you based on Art. 6(1)(1)(e) or (f) GDPR. This also applies to any profiling activities conducted based on these provisions

We will then no longer process the personal data concerning you unless we can provide evidence of compelling reasons for the processing, worthy of protection, which outweigh your interests, rights and freedoms, or the processing serves the purpose of asserting, exercising or defending any legal claims.

Should the personal data concerning you be processed in order to engage in direct marketing, you are entitled to raise an objection to the processing of personal data concerning you for the purpose of such advertising at any time. This also applies to profiling, in so far as it is connected with such direct marketing.

Should you raise an objection to the processing for direct marketing purposes, the personal data concerning you will no longer be used for said purposes.

In connection with the use of services of the information society, you may, notwithstanding Directive 2002/58/EC, exercise your right of objection using automated procedures that make use of technical specifications.

h. Right to revocation of any consent under data privacy law

You are entitled to revoke your declaration of consent under data privacy law at any time. The legitimacy of the processing that has been carried out based on the consent prior to revocation is not affected by the consent being revoked.

i. Automated decisions in the individual case, including profiling

You have the right not to be made the subject of any decision based exclusively on automated processing – including profiling – insofar as this decision has legally valid consequences for you or significantly adversely affects you in a similar manner.

This does not apply if the decision

j. The right to appeal to a supervisory authority

Irrespective of any other legal remedy under administrative law or any judicial remedy, you are entitled to lodge a complaint with a supervisory authority, especially in the Member State of your place of residence, place of work or the place of the presumed infringement, if you are of the opinion that the processing of the personal data concerning you violates the GDPR.

The supervisory authority with which the complaint has been lodged will inform the Appellant (you) about the status and results of the complaint, including the option of a judicial remedy under Art. 78 GDPR.

January 2024