The information in this policy applies to the processing of personal data on or through our website and is intended to inform you, in particular, about the scope of processing, the purposes of processing, recipients, legal bases, retention periods and your rights. Personal data means any information relating to an identified or identifiable natural person, i.e. a human being (hereinafter also referred to as a "data subject"); this includes, for example, your name, your address or your email address. The "processing" of personal data includes, in particular, the collection, storage, use and transmission of such data.

1 Name and Address of the Controller

The controller within the meaning of the General Data Protection Regulation (GDPR), other national data protection laws of the Member States and other data protection provisions is:

KING Art GmbH
Kleine Waagestraße 1
D-28195 Bremen

Tel. +49 (421) 322 76 - 00
Email: impressum@kingart-games.com
Website: http://www.kingart-games.com

2 Contact Details of the Data Protection Officer

You can contact our Data Protection Officer as follows:

KING Art GmbH
Data Protection Officer
Kleine Waagestraße 1
D-28195 Bremen

Email: datenschutz@kingart-games.com

3 General Information on Data Processing

3.1 Legal Bases for the Processing of Personal Data

Where we obtain the data subject's consent to processing operations involving personal data, Article 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.

Where the processing of personal data is necessary for the performance of a contract to which the data subject is a party, Article 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations necessary to take steps prior to entering into a contract.

Where the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Article 6(1)(c) GDPR serves as the legal basis.

Where processing is necessary for the purposes of a legitimate interest pursued by our company or a third party, and the interests, fundamental rights and freedoms of the data subject do not override that interest, Article 6(1)(f) GDPR serves as the legal basis for processing.

3.2 Data Erasure and Retention Period

The data subject's personal data will be erased or its processing restricted as soon as the purpose for storing it no longer applies. Data may also be stored beyond this point where this has been provided for by the European or national legislature in EU regulations, laws or other provisions to which the controller is subject.

IV. Provision of the Website and Creation of Log Files

3.3 Description and Scope of Data Processing

The following data is collected in this context:

The IP address of the requesting device, which is truncated so that it can no longer be linked to an individual.
Browser type/browser version
Operating system used
Referrer URL
Host name of the accessing computer
Time of the server request

This data is also stored in our system's log files. This data is not stored together with other personal data of the user.

3.4 Legal Basis for Data Processing

The legal basis for the temporary storage of the data and log files is Article 6(1)(f) GDPR.

3.5 Purpose of Data Processing

The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user's device. For this purpose, the user's IP address must remain stored for the duration of the session. Data is stored in log files to ensure and improve the functioning of the website and for statistical analyses.

These purposes also constitute our legitimate interest in processing the data.

3.6 Retention Period

The data will be erased as soon as it is no longer necessary to achieve the purpose for which it was collected. Where data is collected to provide the website, this is the case when the respective session has ended.

Where data is stored in log files, this is the case after no more than 7 days. Storage beyond this period is possible. In this case, users' IP addresses are erased or altered so that they can no longer be attributed to the requesting client.

4 Cookies

4.1 Description and Scope of Data Processing

Cookies are small text files that are assigned to the browser you use and stored on your hard drive, and through which certain information is provided to the party that sets the cookie.

We use the following cookies that are necessary for the provision of our websites (necessary cookies):

We use so-called session cookies on our websites. The purpose of these cookies is to identify your device during a visit to our websites and to determine when your visit has ended. These cookies store a so-called session ID, which allows various requests from your browser to be assigned to the same session. This enables your computer to be recognised if you return to our website during a browser session.

When you visit our website, you can consent to the use of so-called tracking cookies via a so-called cookie banner (see section 6). If you click "Accept" on the cookie banner, a cookie containing this information will be stored on your device ("consent cookie") so that the cookie banner will no longer be displayed on subsequent visits to our website. Non-essential cookies are only set after you have given your explicit consent. You can withdraw or adjust your consent at any time via the cookie settings.

If you have a user account and log in, you have the option of enabling the "Remember login" function. If you do so, a cookie will be set on your device that identifies you to us as logged in, so that you do not have to log in again each time ("login cookie").

For security reasons, we also use a so-called "XSRF token cookie", which serves to prevent cross-site request forgery attacks on our website.

In addition, cookies are set as part of web analytics by Google Analytics (see section 7).

4.2 Legal Basis for the Processing of Personal Data

The legal basis for setting the necessary cookies is Article 6(1)(f) GDPR.

4.3 Purpose of Data Processing

The necessary cookies enable the provision of our websites and help ensure the secure operation of our website. These purposes also constitute our legitimate interest in processing the data.

4.4 Retention Period and Options for Objection and Removal

The session cookies and the XSRF token cookie are deleted two hours after you leave our website. The consent cookie and the login cookie are automatically deleted from your device after 24 months, unless you delete these cookies manually before then.

Cookies are stored on your device and transmitted from it to our website. You can therefore disable or restrict the transmission of cookies or delete them by changing the settings in your browser. If cookies are disabled for our website, it may no longer be possible to use all of the website's functions in full.

Click here to manage your cookie settings

5 Web Analytics Using Google Analytics

5.1 Scope of Data Processing

To tailor our website to users' needs, we use the web analytics service Google Analytics provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

Google Analytics collects and processes, among other things, the following categories of data:

Usage data: pages and URLs accessed, time spent, scroll depth, clicks, events
Device information: browser type and version, operating system, screen resolution, language setting
Location data: country and region (based on the IP address; the IP address itself is truncated/discarded by Google before any storage and is not stored)
Source information: referring website (referrer), marketing channel
Technical identifiers: cookie ID, client ID (pseudonymous user identifier)

Google Analytics uses cookies and comparable tracking technologies on your device for this purpose. The data collected in this way is generally transferred to Google servers in the USA and stored there.

5.2 Legal Basis for the Processing of Personal Data

The processing of your personal data in connection with Google Analytics is based exclusively on your consent under Article 6(1), first sentence, point (a) GDPR, which you can give via our cookie banner. Without your consent, Google Analytics will not be activated.

5.3 Purpose of Data Processing

The processing of users' data by Google Analytics enables us to analyse our users' browsing behaviour. By evaluating the data obtained, we are able to compile information about the use of the individual components of our website. This helps us to continuously improve our website and its user-friendliness. Anonymising the IP address takes sufficient account of users' interest in the protection of their personal data.

5.4 Retention Period

Cookies are stored on the user's device and transmitted from it to our website. As a user, you therefore also have full control over the use of cookies. You can disable or restrict the transmission of cookies by changing the settings in your internet browser. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are disabled for our website, it may no longer be possible to use all of the website's functions in full. User data stored by Google is automatically erased after 2 months. The retention period can be configured in the GA4 property settings.

5.5 Options for Withdrawing Consent

You can withdraw your consent at any time with effect for the future, without affecting the lawfulness of the processing carried out up to that point. The following options are available to you:

Cookie banner / consent management: You can adjust or withdraw your consent at any time via our privacy settings (accessible via the "Cookie settings" link in the footer of our website).
Browser add-on: You can install Google's official opt-out add-on for commonly used browsers: https://tools.google.com/dlpage/gaoptout
Browser settings: You can delete cookies in your browser at any time or disable the storage of cookies completely. Please note that in this case it may not be possible to use all of our website's functions in full.

5.6 Recipients and Transfers to Third Countries

In connection with Google Analytics, Google Ireland Limited and Google LLC. (USA) support us as processors under Article 28 GDPR. Data processing may therefore also take place outside the EU or the EEA. Personal data is transferred to the USA:

- primarily on the basis of an adequacy decision under Article 45 GDPR within the framework of the EU-US Data Privacy Framework (DPF), provided that Google LLC is certified under the DPF at the relevant time (this can be checked at: https://www.dataprivacyframework.gov), and

- additionally on the basis of appropriate safeguards in the form of Standard Contractual Clauses (SCCs) under Article 46(2)(c) GDPR.

Please note that the adequacy decision concerning the DPF is currently legally and politically controversial. If the decision is suspended or repealed in the future, we will base the transfer exclusively on the agreed SCCs.

6 Google reCaptcha

We use Google's reCaptcha service to determine whether a particular entry in our contact form is made by a human or a computer. Google uses the following data to check whether you are a human or a computer: the IP address of the device used, the page you visit on our website on which the Captcha is embedded, the date and duration of the visit, identification data for the browser and operating system type used, your Google account if you are logged in to Google, mouse movements on the reCaptcha areas, and tasks in which you must identify images. The legal basis for the data processing described is Article 6(1)(f) of the General Data Protection Regulation (balancing of interests, based on our interest in ensuring the security of our website). Depending on its technical implementation, the use of this service may require consent under Article 6(1)(a) GDPR.

7 Embedded YouTube Videos

7.1 Scope of Data Processing

We embed videos from the YouTube service on our website. YouTube is operated by YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA, a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter jointly referred to as "YouTube").

To prevent a connection to YouTube's servers from being established automatically when you access our website, we use a so-called two-click solution: when you first access the page, only a locally stored preview image of the video is displayed. No data is transferred to YouTube at this stage.

The video is only loaded from YouTube's servers when you actively click on the preview image and thereby give your consent. At that moment, for technical reasons, your browser transmits the following categories of data to YouTube:

- Technical connection data: IP address, time of access

- Device information: browser type and version, operating system

- Usage data: page accessed (referrer URL), interactions with the video (e.g. play, pause, playback duration)

- Cookie and tracking data: when the video is played, YouTube uses cookies and comparable technologies (e.g. local storage) through which usage data may be collected and, where applicable, linked to an existing Google account

We have no influence over further data processing by YouTube. For more information, please refer to Google's/YouTube's privacy policy at: https://policies.google.com/privacy

7.2 Legal Basis

The embedding of the videos and the associated data processing are based exclusively on your consent under Article 6(1), first sentence, point (a) GDPR, which you give by clicking on the preview image. Without your consent, no content is loaded from YouTube and no data is transferred to YouTube.

7.3 Purpose of Data Processing

YouTube processes the transmitted data for the following purposes:

- Provision and delivery of the requested video content

- Analysis of usage behaviour and improvement of the services

- Personalisation of content and advertisements (if you are signed in to a Google account or YouTube recognises you through cookies)

7.4 Retention Period

The retention period for data processed by YouTube is governed by Google's/YouTube's privacy policies, over which we have no influence. Information on this can be found at: https://policies.google.com/privacy

7.5 Withdrawal of Consent

You can withdraw your consent at any time with effect for the future, without affecting the lawfulness of the processing carried out up to that point. For videos that have already been played, subsequent withdrawal is technically impossible; you can prevent future video retrievals as follows:

- Do not click on preview images: as long as you do not click on the preview image, no data is transferred to YouTube.

- Cookie settings: you can adjust or withdraw your consent at any time via our privacy settings (accessible via the "Cookie settings" link in the footer of our website).

- Browser settings: you can delete cookies stored in your browser at any time or restrict cookie storage.

7.6 Recipients and Transfers to Third Countries

When YouTube videos are embedded, data is transferred to YouTube LLC and Google LLC in the USA. The USA is considered a third country within the meaning of the GDPR.

Personal data is transferred to the USA:

- additionally on the basis of appropriate safeguards in the form of Standard Contractual Clauses (SCCs) under Article 46(2)(c) GDPR.

Please note that the adequacy decision concerning the EU-US Data Privacy Framework is currently legally and politically controversial. If the decision is suspended or repealed in the future, we will base the transfer exclusively on the agreed SCCs.

8 Contact by Email, Contact Form or Telephone

8.1 Description and Scope of Data Processing

You can contact us using the email addresses provided on our website. In this case, the user's personal data transmitted with the email is collected.

Our website also provides a contact form that you can use to send us support enquiries about our products.

We collect the following data, among other things, via this form:

Email address
Product
Platform
Preferred language

This also includes any data that you may send us in your individual message.

You can also contact us using the telephone numbers provided. If you contact us by telephone, we generally collect, in the form of call notes, the data that you provide to us or that is automatically transmitted with your call. This includes, among other things, your name, your enquiry and your telephone number.

8.2 Legal Basis for Data Processing

The legal basis for processing data transmitted when you contact us by email, contact form or telephone is Article 6(1)(f) GDPR. If the contact is aimed at entering into a contract or takes place within an existing contractual relationship, Article 6(1)(b) GDPR is an additional legal basis for processing.

8.3 Purpose of Data Processing

We process the personal data solely to handle your contact with us. This also constitutes the necessary legitimate interest in processing the data.

8.4 Retention Period

The data will be erased as soon as it is no longer necessary to achieve the purpose for which it was collected. For personal data sent by email or contact form, or transmitted during telephone contact, this is the case when the respective conversation with you has ended. The conversation is deemed to have ended when it can be inferred from the circumstances that the matter in question has been conclusively resolved.

If communication generates data that we are required to retain or store under tax, commercial or other provisions, it will only be erased after the respective statutory retention or storage periods have expired. The legal basis for this storage is Article 6(1)(c) GDPR.

9 Registration/Customer Account

9.1 Description and Scope of Data Processing

On our website, we offer customers the opportunity to create a customer account by providing personal data. The data is entered into an input form, transmitted to us and stored. The following data is collected during the registration process:

First and last name
Email address
Country
Password

The following data is also stored at the time of registration:

Date and time of registration

Further customer data is stored in the customer account, e.g. their games, player tag and order history. Customers also have the option of storing shipping addresses there. Customers can view the data stored in their customer account via the "Settings" menu item in their customer account and can also add, delete or change the data there.

9.2 Legal Basis for Data Processing

The legal basis for processing the data is Article 6(1)(b) GDPR.

9.3 Purpose of Data Processing

Personal data is processed when opening and continuing to provide the user account in order to make the relevant user account functions available to the user and thus to perform the corresponding agreement with the user.

9.4 Retention Period

The data will be erased as soon as it is no longer necessary to achieve the purpose for which it was collected. For data stored in the customer account, this is generally the case when the customer account is deleted. We also delete a customer account if it is inactive for a period of 12 months, i.e. if no login has taken place during that period.

If the customer account generates data that we are required to retain or store under tax, commercial or other provisions, it will only be erased after the respective statutory retention or storage periods have expired. The legal basis for this storage is Article 6(1)(c) GDPR.

10 Newsletter

10.1 Description, Scope and Purpose of Data Processing

When registering for a customer account, you also have the option of subscribing to our newsletter. We will then also use your email address and your name to send you information and advertising about our games, promotions and events by email.

10.2 Legal Basis for Data Processing

The legal basis for processing the data is your consent under Article 6(1)(a) GDPR.

10.3 Retention Period and Withdrawal of Consent

You can unsubscribe from our newsletter at any time and thereby withdraw your consent, e.g. via the relevant settings in your customer account or via the relevant links at the end of each newsletter.

If you withdraw your consent, we will no longer use your data to send our newsletter. However, we will continue to store your email address and proof of your consent for a period of three years, starting at the end of the year in which we last sent you our newsletter before your withdrawal, so that we can demonstrate your consent in the event of a dispute. After that, we will erase the data unless we need it for other purposes listed in this policy, e.g. because you still have a customer account with us.

11 Orders in Our Online Shop

11.1 Description and Scope of Data Processing

When you place orders in our online shop, we collect the data evident from the requested form fields and the order itself, including:

Salutation
Name of the contact person
Address
Email address
Subject matter and price of the order

11.2 Legal Basis for the Processing of Personal Data

The legal bases for processing this data are Article 6(1)(b) and (f) GDPR.

11.3 Purpose of Data Processing

We use the data for each order to fulfil it and issue an invoice. If you have a customer account, we also use the data to make your games and order history available to you. This purpose also constitutes our legitimate interest in processing the data.

11.4 Disclosure of Data and Collection by Payment Service Providers

To perform the contract, we disclose your data to the shipping company commissioned to deliver the goods, to the extent necessary for delivery of the goods ordered.

As part of payment processing, the selected payment service providers collect the necessary payment data themselves. In this respect, the privacy policy of the respective payment service provider applies. The external payment services have been integrated into our offering in such a way that a connection to the servers of the respective service provider is only established when you select that service as your payment method during the ordering process.

11.5 Retention Period and Options for Objection and Removal

We store the data relating to your customer account, including the order history, until your customer account is deleted.

Outside your customer account, we use the data relating to your respective orders to fulfil them and issue invoices. After an order has been fulfilled, invoiced and paid for, we continue to store the data for as long as we are required to do so under tax, commercial or other provisions. It will only be erased after that. The legal basis for this storage is Article 6(1)(c) GDPR.

12 Recipients of Personal Data

To provide our website and the available means of contact, we use various service providers, including hosting providers and email providers, which process the data stored with them exclusively on our behalf as processors under Article 28 GDPR within the European Union.

13 Special Processing Situation: Job Applications

If you send us an application for an advertised position, your application documents will be processed on the basis of Article 88 GDPR in conjunction with section 26(1), first sentence, first half-sentence, of the German Federal Data Protection Act (BDSG). If you also send an application photo, you do so voluntarily and thereby give your consent to the collection and storage of your application photo (Article 88 in conjunction with section 26(2) BDSG). We have a very strong interest in conducting and completing a proper application procedure. This also includes refuting any allegations of discrimination to the contrary in connection with the conclusion of the application procedure, which is why your application documents will only be erased 6 months after rejection. Your application documents will only be stored for longer with your explicit consent. In the case of unsolicited applications, the documents will be erased within a maximum of 12 months of receipt, even if no rejection has been issued.

14 Rights of the Data Subject

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights against the controller (where applicable, subject to further conditions set out in the relevant provisions):

The right of access under Article 15 GDPR
The right to rectification under Article 16 GDPR
The right to erasure ("right to be forgotten") under Article 17 GDPR
The right to restriction of processing under Article 18 GDPR
The right to be informed under Article 19 GDPR
The right to data portability under Article 20 GDPR
The right to object under Article 21 GDPR
The right not to be subject to an automated decision under Article 22 GDPR
The right to withdraw consent to the processing of personal data under Article 7(3) GDPR

To exercise these rights, please use the contact details provided at the beginning of this policy.

Without prejudice to other administrative or judicial remedies, you also have the right to lodge a complaint with the competent supervisory authority if you consider that the processing of your personal data infringes the GDPR.

Privacy Policy for the Website of KING Art GmbH