Cryptopolis - Privacypolicy

Privacypolicy

PRIVACY STATEMENT – CRYPTOPOLIS

Version 1.0 – July 2022

  1. Cryptopolis

Cryptopolis is developed, published and hosted by CFX Gaming B.V. We are a Dutch company that is globally active. We store our data on servers in the European Economic Area, unless stated otherwise below.

We process your personal data when you use our services. In this privacy statement we summarize when and how we collect, use and secure your personal data.

  1. General

We may change provisions of this privacy statement from time to time. If we do that, we will inform you of the changes. However, we also advise you to check for yourself from time to time whether the privacy statement has been changed.

  1. Which personal data do we collect and for which purposes?

If you visit our website www.cryptopolisgame.com or if you play our game Cryptopolis, there are a number of ways in which we collect your personal data. Below we explain which personal data we may collect from you. The personal data is processed for different processing purposes. The data retention period also differs depending on the processing purpose. Note that should there be any legal changes to the required data retention periods, these legal changes will take precedence over the periods mentioned in this privacy statement.

The www.cryptopolis.com website

If you visit our website, we may process your personal data. Below we will explain the personal data processed per processing ground.

Contact, correspondence and complaints

  1. To be able to communicate with you, we process your e-mail address, telephone number or your social media username (depending on the method you use to contact us), as well as the content of the correspondence or complaint. Our processing ground is our legitimate interest to be able to communicate with you and deal with complaints and your legitimate interest to be able to communicate with us and being able to file complaints. The data is processed up to 6 months after the correspondence has ended or the complaint has been dealt with. If you do not wish for us to process this personal data, you should not contact us. 
  1. Exchange crypto -> external party (Apeswap)
  1. Booster packs -> external party (Binance)
  1. Staking

Newsletter

  1. If you give us permission by opting in for the newsletter, we process your e-mail address and player-ID to be able to send you the newsletter. Our processing ground is the permission you have given us. The data is processed for the duration that your account exists, or until you unsubscribe for the newsletter. If you do not wish for us to process this personal data, you should not sign up for the newsletter. 

Cookies

  1. We place cookies on our website. With these cookies we can process your personal data. The personal data is generated or collected by us or by the cookies. The types of cookies, the personal data to be processed, the purposes, the principles and the retention periods are described in our cookie statement: www.cryptopolisgame.com/cookiestatement/

Playing the Cryptopolis game

To be able to provide you with our game, we process your personal data as you sign up for and play our game. Below we will explain the personal data processed per processing ground.

Identification and authentication

  1. We process personal data to identify and authenticate you. Our processing ground is that the processing is necessary for the performance of a contract. We need to be able to identify and authenticate you if we want to be able to provide you the game per our terms of service. If you do not wish for us to process the information mentioned below, you cannot play game our game. The data is processed for the duration that your account exists. You can delete your account at any time. We do not delete player accounts because they might contain monetary value, but we will send inactive players reminders that they have the option to empty and remove their account.  
  • The information we process, depends on your login method. If you don’t login via your crypto wallet, we process your e-mail address and an encrypted version of your password. The e-mail address will also be processed if you request a new password. If you login via your crypto wallet, we only process the public key of your wallet. 
  • If you wish to use two factor authentication, we will process the telephone number provided by you to us. 
  • We will also process a player-ID to identify you in our servers and databases, that we will assign to you.  

In-game nicknames

  1. To be able to play our game, you must use a nickname for your character. This may be a pseudonym. Our processing ground is our legitimate interest to provide you and other players the game the way we intended to and the legitimate interest of you and other players to be able to communicate with characters via a nickname. If you do not wish for us to process your nickname, you cannot play game our game. Although you are able to pick a randomized nickname. The data is processed for the duration that your account exists. You can delete your account at any time. We do not delete player accounts because they might contain monetary value, but we will send inactive players reminders that they have the option to empty and remove their account.  

Matchmaking

  1. To be able to provide the online parts of the game, we must provide matchmaking services. For this purpose we process your player-ID, IP-address, skill level, number of games played and your win/lose ratio. Our processing ground is that the processing is necessary for the performance of a contract. Our game is an online social game, which means that for the provision of the game matchmaking services are required. We also process this data based on our legitimate interest to be able to create a more enjoyable experience by providing fair matchmaking based on skill levels and your legitimate interest to be matched against people of an equal skill level. If you do not wish for us to process this information, you cannot play game our game. The data is processed for the duration that your account exists. You can delete your account at any time. We do not delete player accounts because they might contain monetary value, but we will send inactive players reminders that they have the option to empty and remove their account.  

Progression and achievements

  1. To be able to provide you with progression mechanics, we must track your in-game progression and your achievements. We process your possessions, time spent in-game, login dates, friends, chats, visited rooms, traded items, bought boosters, the number of crypto withdrawals, experience points, quest information, daily activities, prestige level, achievements and your player-ID. Our processing ground is our legitimate interest to provide you and other players the game the way we intended to and the legitimate interest of you to be able to enjoy a more enjoyable game. If you do not wish for us to process this information, you cannot play game our game. The data is processed for the duration that your account exists. You can delete your account at any time. We do not delete player accounts because they might contain monetary value, but we will send inactive players reminders that they have the option to empty and remove their account.  

Chat functionality

  1. To be able to provide you with chat functionality, we must process your player-ID and the chat itself. Our processing ground is that the processing is necessary for the performance of a contract. Our game is an online social game, which means that for the provision of the game chat is an essential part of the game. We also process this data based on our legitimate interest to be able to monitor the chat to create a more enjoyable experience by filtering unwanted chat and spam and your legitimate interest to be able to report unwanted chat and spam. If you do not wish for us to process this information, you cannot use the chat function in the game. The data is processed for up to 6 months after the chat has been conducted. 

Account value, return on marketing spend and affiliates

  1. To be able to determine the lifetime value of your account, the return on marketing spend, to pay affiliates and to be able to allocate revenue to the correct month, we process your first login moment, your player-ID and the financial value of your account since creation and per month. Our processing ground is our legitimate interest to be able to analyse the use of our game, to measure the effectiveness of our marketing campaigns and to be able to pay our affiliates. The data is processed for the duration that your account exists. You can delete your account at any time. We do not delete player accounts because they might contain monetary value, but we will send inactive players reminders that they have the option to empty and remove their account.  

Inactive players

  1. To be able to approach inactive players, we process your last login moment, your e-mail address and player-ID if you have shared your e-mail address with us. Our processing ground is our legitimate interest to increase user retention and to be able to inform users of the option to remove their account. The data is processed for the duration that your account exists. You can delete your account at any time. We do not delete player accounts because they might contain monetary value, but we will send inactive players reminders that they have the option to empty and remove their account.  

Daily rewards

  1. To be able to provide you with daily rewards, we process your last login moment and your player-ID. Our processing ground is our legitimate interest to provide you and other players the game the way we intended to, to increase player retention and your legitimate interest to be able to claim daily rewards. The data is processed until you claim your next daily reward, because we need to know when you last claimed your reward to determine if you are eligible for a new reward. 

Targeted ads

  1. To be able to provide you with targeted ads, we process the lifetime value of your account, your player-ID, your purchases and the NFT-series you possess. Our processing ground is your permission. The data is processed for the duration that your account exists or until you withdraw your permission. You can delete your account at any time. We do not delete player accounts because they might contain monetary value, but we will send inactive players reminders that they have the option to empty and remove their account.  

Purchases, trades, sales, collections and allocations of boosters, NFT’s and in-game items

  1. To allow you to purchase, trade, sell, collect and allocate boosters, NFT’s and in-game items, we process your player-ID, the Item-ID, the series to which the NFT belongs and the purchases made by you. Our processing ground is that the processing is necessary for the performance of a contract. We need to be able to process this information if we want to be able to allocate boosters, NFT’s and in-game items and to be able to allow you to purchase, trade and sell them. If you do not wish for us to process this information, you must refrain from purchasing, trading, selling and collecting boosters and in-game items. The data is processed for the duration that your account exists. You can delete your account at any time. We do not delete player accounts because they might contain monetary value, but we will send inactive players reminders that they have the option to empty and remove their account.  

Determining the success of boosters

  1. To determine the success of a booster, we process your player-ID and the series of the NFT’s you possess. Our processing ground is our legitimate interest to be able to determine the success of a NFT series in order to improve them. The data is processed for the duration that your account exists. You can delete your account at any time. We do not delete player accounts because they might contain monetary value, but we will send inactive players reminders that they have the option to empty and remove their account.  

Payments, transactions and withdrawals

  1. To be able to make payments and perform transactions and to allow you to withdraw cryptocurrency, we process the public key of your crypto wallet, your player-ID and the amount that must be paid. Our processing ground is that the processing is necessary for the performance of a contract. We need to be able to process this information if we want to be able make the necessary payments to you. If you do not wish for us to process this information, you should not use the option to be paid by us. The data is processed for the duration that your account exists. You can delete your account at any time. We do not delete player accounts because they might contain monetary value, but we will send inactive players reminders that they have the option to empty and remove their account.  

Tax and administrations

  1. We are obliged to maintain a decent administration for tax purposes. For this purpose we process your name, address, possessions, the public key of your crypto wallet and your trading activity. Our processing ground is our legal obligation to maintain a decent administration for tax purposes. The data is processed for up 7 years after collecting the data. We may share this personal data with our accountant and with the relevant tax authorities. 

Security, the prevention of DDOS and anticheat

  1. For security purposes, to prevent DDOS and to prevent cheating in-game we process your IP-address if you play our game or connect to our game. For security purposes we also process your general location (based on your IP-address), login attempts, language, first login, last login and your device type. For anticheat purposes we also process your play behavior, scores and player-ID. Our processing ground is our legitimate interest to secure our game, services and assets and to create a fair gaming environment for all players. Your legitimate interest is to be able to play the game in a fair gaming environment and to have your assets protected. The data is processed up to 6 months after collection of the personal data, unless an incident has occurred in which case the data will be processed up to 6 months after resolving of the incident. 

Improvement of the game

  1. To be able to improve our game, we process your player-ID, in-game movements and acts, data related to your progression, device type, device specs, network type, IP-address and your general location based on your IP-address. Our processing ground is our legitimate interest to improve our game. The data is processed up to 6 months after collection of the personal data. This data is shared with Unity and you have the option to opt-out of this processing by changing your settings in the in-game menu if you do not wish for us to process this personal data.

Newsletter

  1. If you give us permission by opting in for the newsletter, we process your e-mail address and player-ID to be able to send you the newsletter. Our processing ground is the permission you have given us. The data is processed for the duration that your account exists, or until you unsubscribe for the newsletter. If you do not wish for us to process this personal data, you should not sign up for the newsletter. 

Correspondence and complaints

  1. To be able to communicate with you, we process your player-ID, e-mail address and the content of the correspondence or complaint if you contact us. Our processing ground is our legitimate interest to be able to communicate with you and deal with complaints and your legitimate interest to be able to communicate with us and being able to file complaints. The data is processed up to 6 months after the correspondence has ended or the complaint has been dealt with.  If you do not wish for us to process this personal data, you should not contact us. 

Business relations

If you are our business relation, such as a business customer, supplier or journalist, we process your personal information. Below we will explain the personal data processed per processing ground. 

Correspondence

  1. To be able to communicate with you, we process your contact information. Our processing ground is our legitimate interest to be able to communicate with you and your legitimate interest to be able to communicate with us. The data is processed up to 6 months after the correspondence has ended or the complaint has been dealt with.  If you do not wish for us to process this personal data, you should not contact us. 

Concluding and performing contracts

  1. To be able to conclude and perform contracts with you or the party you work for and the sending or payment of invoices, we process your contact information, the information included in the contract and invoice information if necessary for the performance of the contract. Our processing ground is that the processing is necessary for the performance of a contract or the concluding of such contract. Our processing ground is also our legal obligation to maintain a decent administration of invoices and payments. The data is processed for the duration of the contract and up to 7 years after the contract has come to an end. 

4. Sharing personal data

We may use so-called data processors to process your personal data on our behalf. We conclude data processing agreements with these processors, to assure they only process your personal data on our instruction. 

We use the following types of processors:

  • companies that provide storage of (personal) data and database management and maintenance;
  • software providers (such as providers of chat software, matchmaking services, game engines etc.);
  • research firms and providers of analytical software to improve our services;
  • hosting provider(s);

If you provide additional information to these processors yourself, we are not responsible for this. It is wise to inform yourself properly about the processor and his company before you provide your personal data. 

Sharing data with your consent

We may also share personal data with others if you give us permission to do so. For example we can cooperate with other parties to offer you specific services or offers. If you register for these services or marketing offers, we may provide your name or contact details if they are necessary to provide that service or contact you. Before we do this, you will always be expressly asked for your consent.

Sharing based on our legal responsibility

We may also share personal data with third parties if this is:

1. necessary to comply with our legal obligations; 
2. necessary to comply with legal requests from authorities; 
3. is required to respond to any legal claims; 
4. necessary to protect the rights, property or safety of us, our users, our employees or the public; 
5. is required to protect ourselves or our users against fraudulent, abusive, inappropriate or unlawful use of our services.

We will immediately notify you if a government agency makes a request that relates to your personal data, unless we are not allowed to do so on the grounds of the law.

Merger or sale (part) of the company

It may happen that we disclose, share or transfer your personal data when we transfer part of our business. Examples include (negotiations about) a merger, sale of parts of the company or obtaining loans. We will of course try to limit the impact for you as far as possible by transferring personal data only when necessary and anonymizing where possible. 

5 . Protection of personal data

Protecting your personal data is of the utmost importance for us. We have therefore taken appropriate technical and organizational security measures in order to protect your personal data. These measures include, but are not limited to:

–     We only engage trusted providers of databases to store data, which have taken adequate physical and electronic measures to minimize the risk of unauthorized access, loss or misuse of personal data.

–     We use TLS (Transport Layer Security) technology to encrypt sensitive information or personal data, such as account passwords.

–     We make backups of personal data.

–     Sensitive information is stored encrypted.

–     Vulnerabilities in the software are dealt with as quickly as reasonably possible.

We would like to point out that we cannot guarantee absolute security when sending personal data via the internet or storing personal data. We advise you to take this into account before sharing personal data. 

6 . Links to third party sites

Our service and websites may contain links to other websites and services. These third party websites and services can collect and retain information about you. If you provide your personal data to third parties, then we are not involved. We have no control over these sites or the activities of the third parties. In that case, the privacy policy of the third party applies. We are not responsible for the content of the privacy policy of these parties and the way in which these parties deal with personal data. We encourage you to review their privacy and security practices and policies before you provide personal information to them.

7. Your rights

Privacy legislation gives you certain rights with regard to your own personal data. The rights that we describe below are not absolute rights. We will always consider whether we can reasonably meet your request. If we cannot meet your request, or if it would be at the expense of the privacy of others, we can refuse your request. If we refuse a request, we will let you know and explain our reasons.

Right of access

You have the right to request which personal data we process about you. You can also ask us to provide insight into the processing grounds, relevant categories of personal data, the (categories of) recipients of personal data, the retention period, the source of the data and whether or not we use automated decision making.

You may also request a copy of your personal data that we process. Do you want additional copies? Then we can charge a reasonable fee for this.

Right to rectification

If the personal data processed by us about you is incorrect or incomplete, you can request us to adjust or supplement the personal data.

If we grant your request, we will, to the extent reasonably possible, inform the parties to whom we provide information.

Right to erasure

Do you no longer want us to process certain personal data about you? Then you can request us to delete certain (or all) personal data about you. Whether we will delete data depends on the processing ground. We only delete data that we process on the basis of a legal obligation or for the performance of the agreement if the personal data is no longer necessary. If we process data based on our legitimate interest, we will only delete data if your interest outweighs ours. We will make this assessment. If we process the data on the basis of consent, we will only delete the data if you withdraw your consent. Have we accidentally processed data or does a specific law require that we delete data? Then we will delete the data. If the data is necessary for the settlement of a legal proceeding or a (legal) dispute, we will only delete the personal data after the end of the proceedings or the dispute.

If we grant your request, we will, to the extent reasonably possible, inform the parties to whom we provide information.

Restriction of processing

If you dispute the accuracy of personal data processed by us, if you believe that we have processed your personal data unlawfully, if we no longer need the data or if you have objected to the processing, you can also request us to restrict the processing of that personal data. For example, during the time that we need to assess your dispute or objection, or if it is already clear that there is no longer any legal ground for further processing of those personal data, but you still have an interest in us not deleting the personal data. If we limit the processing of your personal data at your request, we may still use that data for the settlement of legal proceedings or a (legal) dispute.

Right to data portability

At your request, we may transfer the data that we automatically process to execute the agreement or based on your consent, to you or another party designated by you. You can make such a request at reasonable intervals.

Automated individual decision making

We do not take decisions based solely on automated processing.

Right to object

If we process data on the basis of a legitimate interest, you may object to the processing by sending us an e-mail. We will then once again weigh your objections and your interests against the legitimate interests for data processing. If we conclude that your interests and objections prevail, we will cease the processing activity for you if we have no other basis for processing. If we conclude that the legitimate interests for the data processing prevail, the data processing will continue. We will inform you of the outcome of this assessment.

Right of restriction of processing and withdrawal of permission

If we process data on the grounds of a legitimate interest, you may object to the processing. If we process data on the basis of your consent, you may withdraw that consent. For more information, please refer to the relevant processing purposes above.

Exercising your rights

You can send a request for access, correction, deletion, data transfer of your personal data or request for withdrawal of your consent or objection to the processing of your personal data to [email protected]

To prevent abuse, we may ask you to identify yourself adequately in the case of a written request for access, rectification or erasure. 

We strive to process your request, complaint or objection within a month. If it is not possible to make a decision within a month, we will inform you of the reasons for the delay and the time when the decision is expected to be made (no longer than 3 months after receipt).

Dutch Data Protection Authority

Do you have a complaint about our processing of your personal data? Please contact us. We are naturally happy to assist you. If we cannot come to a solution, you are also entitled to submit a complaint to the national privacy authority, in this case the Dutch Data Protection Authority. For this you can contact the Dutch Data Protection Authority via https://autoriteitpersoonsgegevens.nl

9. Contact

If you have questions, concerns or comments about this privacy statement or our data processing, please contact us via e-mail on [email protected].