Privacy Policy

Where we store information on, or access information from, your device (for example through cookies or similar technologies), we do so only with your consent under § 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) and regulation 6 of the UK Privacy and Electronic Communications Regulations (PECR), unless this is strictly necessary to provide the Service you have asked for.

4.1 What we use your data for

We do not make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects for you.

4.2 Our newsletter

To send you our newsletter, we need your email address and information that lets us check you own that address and agree to receive the newsletter. We use a double opt-in process: after signing up, you receive an email asking you to confirm your subscription. Any other information is optional. We use this data only to send you the newsletter and do not share it with third parties other than our newsletter provider.

You can withdraw your consent at any time, for example through the "unsubscribe" link in every newsletter. We keep your data until you unsubscribe, then delete it from our mailing list. We may delete or block email addresses from our list at our discretion, based on our legitimate interests.

After you unsubscribe, we may keep your email address on a blocklist so that we do not email you again. We use the blocklist only for this purpose, based on our legitimate interest in complying with the law on sending newsletters. The blocklist is not limited in time. You can object to this storage if your interests outweigh our legitimate interest.

Our newsletter provider is MailerLite, which processes your data on our behalf under a data processing agreement.

5. Hosting, cookies and analytics

5.1 Hosting

Our Website is hosted by Squarespace, Inc. and/or its affiliates (together, "Squarespace" or the "Hosting Provider"). The Hosting Provider stores the Website and processes the server log data described in section 3.2, and any data you submit through forms on the Website, on our behalf. We have entered into a data processing agreement with the Hosting Provider under Article 28 GDPR / UK GDPR, which requires it to process your data only on our instructions and to keep it secure.  Squarespace stores Website data in Tier III data centres in the United States and delivers images and other content through content delivery networks in several countries. We protect these transfers as described in section 8. You can find more information in Squarespace's privacy policy: squarespace.com/privacy. For details of where Squarespace stores data, see Squarespace's help centre.

Our other websites, and the servers our Games connect to for features such as the Twitch integration (see section 3.4), are hosted by Hetzner Online GmbH ("Hetzner"), in data centres in Germany. Hetzner processes this data on our behalf under a data processing agreement. More information: Hetzner's privacy policy.

We use the Hosting Provider based on our legitimate interest in presenting our Website reliably and securely. Where we ask for your consent, for example in a cookie banner, the processing is based solely on your consent and § 25(1) TDDDG / regulation 6 PECR. You can withdraw your consent at any time.

5.2 Cookies and similar technologies

We do not have a separate cookie policy. This section explains how our Services use cookies and similar technologies.

What cookies are. Cookies are small text files that your browser stores on your device when you visit a website. Similar technologies, such as local storage, pixels and software development kits (SDKs) in apps and games, also store or read information on your device. In this policy, we call all of these "cookies". Session cookies are deleted when you close your browser. Persistent cookies stay on your device until they expire or you delete them. First-party cookies are set by us; third-party cookies are set by another company, such as a provider whose content is embedded on our Website.

Cookies on our Website. Our Website uses the categories of cookies described below, which are set by our Hosting Provider, Squarespace, or by providers of content embedded on the Website. We only use cookies that are not strictly necessary if you have agreed to them through our cookie banner.

We do not use cookies for advertising or to track you across other websites.

Cookies we use. Squarespace keeps an up-to-date list of the cookies it may set on the websites it hosts, including their names, purposes and how long they last, in its help centre. Which of these cookies are set on our Website depends on the features we use and the choices you make in our cookie banner.

Managing your choices. When you first visit the Website, a cookie banner lets you accept or reject all non-essential cookies, or choose by category. You can change your mind at any time through the "Cookie preferences" link at the bottom of every page. Withdrawing consent is as easy as giving it and does not affect use before you withdrew it. We store your choice for up to 12 months and then ask you again. You can also delete or block cookies in your browser settings. If you block all cookies, some parts of the Website may not work.

Cookies and similar technologies in our Games. We do not use cookies, advertising identifiers or tracking technologies in our Games on any platform, other than the login cookies for the Twitch integration described below. Our Games store save files, settings and configuration files on your device, and platform software (such as Steamworks, Nintendo's system software, PlayStation and Xbox system software or the iOS and Android operating systems) reads limited device and account information so that platform features like achievements and cloud saves work. When a Game crashes or an error affects gameplay, our error analytics system reads technical information about the error and your device to create an error report that does not identify you (see section 3.3). We consider this strictly necessary to provide a working Game.

If you use the Twitch integration, our login process uses cookies to log you in with your Twitch account, and your login details are stored on your device for up to 30 days so that you stay logged in. This is strictly necessary to provide the feature you have chosen to use. 

5.3 Website analytics

Our Website uses the analytics built into Squarespace, our Hosting Provider. Squarespace gives us statistics about visits to the Website, such as the number of visits, the pages viewed, how visitors arrived at the Website (for example from a search engine or another website), their approximate location (country or region) and the type of device and browser used. We only see this information in aggregated form and do not use it to identify you. Squarespace sets analytics cookies only if you agree to them in our cookie banner (see section 5.2). We do not pass this information to, or sell it to, any other third parties.

We use this information based on our legitimate interest in understanding how the Website is used, so that we can improve it, or on your consent where analytics cookies are used.

5.4 Fonts

The Website uses fonts provided through Squarespace, which may include Google Fonts or Adobe Fonts, to display text consistently.  You can find more information in the Google Fonts FAQ and Google's privacy policy.

6. Game platforms, community channels and other third-party services

6.1 Game platforms and storefronts

Our Games are available on PC through Steam, on Nintendo Switch, on PlayStation and Xbox consoles and on mobile devices through the Apple App Store and Google Play. On some platforms, such as PlayStation and Xbox, our Games are published by our publishing partners, who manage the store listings. When you buy, download or play a Game there, the platform provider processes your personal data, such as your account, purchase and payment details, as a separate controller. Its own privacy policy applies to that processing. Our Games use platform features such as achievements and cloud saves, which the platform provider runs.

Other than as described in this policy, we do not access or process your platform account data.

6.2 Error analytics

Our Games may use Sentry, provided by Functional Software, Inc. d/b/a Sentry ("Sentry"), to send us crash reports when a Game crashes on Nintendo Switch or a mobile device, and error reports when an error affects gameplay without the Game crashing. On Nintendo Switch, crash reports reach Sentry through a service provided by Nintendo. These reports do not contain your IP address or other information that identifies you (see section 3.3). Sentry processes these reports on our behalf. More information: Sentry's privacy policy.

6.3 Social media and community channels

We run pages and channels on Discord, Instagram, TikTok, the Steam community and other platforms. When you visit or interact with them, the platform operator processes your data under its own privacy policy. For some platforms, such as Instagram, we and the operator are joint controllers of the page statistics the operator provides to us. Where that is the case, the operator has agreed to take primary responsibility for providing you with information and handling your rights requests, but you may also contact us. We use these channels based on our legitimate interest in communicating with our community.

7. Who we share your personal data with

We do not sell your personal data. We share it only as follows:

• Within our group. We share personal data with our subsidiary Spellgarden Games UK where needed to help us provide, manage and support the Services, for example for customer support, community management and business administration, including for Games whose rights are held by Spellgarden Games UK, such as Thrifty Business. We do this based on our legitimate interest in running our business efficiently across our group (Art. 6(1)(f) GDPR). Spellgarden Games UK is based in the United Kingdom, which the European Commission recognises as providing adequate protection for personal data (see section 8).

• Service providers. We use trusted providers who process data on our behalf and under our instructions, including our Hosting Provider (Squarespace), Hetzner, our newsletter provider (MailerLite), email and IT providers, our error analytics provider (Sentry) and customer support tools. 

• Game platforms and storefronts, where needed for a Game to work on that platform or to investigate or prevent fraud (section 6.1).

• Publishing, porting and development partners. We work with publishers, who manage some of the storefronts our Games are sold on, and with porting partners and other studios who help us bring our Games to new platforms, fix bugs and make changes. Where needed for these purposes, we share bug reports, error data, save files and related communications with them. 

• Professional advisers, such as lawyers, accountants and auditors, who are bound by confidentiality duties.

• Authorities and courts, where we are legally required to, or where needed to enforce our terms, protect our rights or protect the safety of others.

• A buyer or successor, if we sell, merge or restructure all or part of our business or assets, subject to appropriate confidentiality protections.

• Anyone else with your consent.

8. International transfers

We are based in Germany and the United Kingdom, so your personal data is shared between the European Economic Area ("EEA") and the UK. Both the European Commission and the UK Government recognise each other's data protection standards as adequate, so no further safeguards are needed for these transfers.

Some of our service providers and platform partners process personal data in other countries, including the United States. In particular, our Hosting Provider, Squarespace, stores Website data in the United States, and our error analytics provider, Sentry, stores crash and error reports there. Where a country has not been recognised as providing adequate protection, we protect your data by:

• relying on an adequacy decision where one exists, including the EU-US Data Privacy Framework and its UK Extension where the recipient is certified;

• using the European Commission's standard contractual clauses, together with the UK International Data Transfer Addendum or International Data Transfer Agreement where UK law applies; or

• relying on other safeguards permitted by data protection law, such as binding corporate rules.

Squarespace and Sentry are both certified under the EU-US Data Privacy Framework and its UK Extension, and their data processing agreements, which form part of their terms of service, also include the standard contractual clauses as an additional safeguard. You can check a company's certification on the Data Privacy Framework website.

You can ask us for more information about these safeguards using the contact details in section 15.

9. How long we keep your personal data

We keep personal data only for as long as we need it for the purpose we collected it for. After that, we delete or anonymise it, unless the law requires or allows us to keep it longer (for example to meet retention periods under tax or commercial law, or to establish, exercise or defend legal claims). In that case, we delete it once those reasons no longer apply.

10. Children

Our Games are designed to be enjoyed by a wide audience, which may include younger players. We do not knowingly collect personal data directly from children under 16 in the EEA, or under 13 in the UK, without the consent of a parent or guardian. Game platforms provide their own parental controls and handle account creation for children.

If you are a parent or guardian and believe your child has given us personal data without your consent, please contact us at support@spellgardengames.com. We will delete it within a reasonable time.

11. How we keep your data secure

We use appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access. For example, the Website uses SSL/TLS encryption to protect data you send us, such as enquiries. You can recognise an encrypted connection because your browser's address bar shows "https://" and a padlock icon. When encryption is active, third parties cannot read the data you send us.

Please note that data sent over the internet, for example by email, can have security gaps. We cannot fully guarantee that data will be protected against access by third parties.

12. Your rights

You have the following rights over your personal data, free of charge, subject to the conditions and exceptions in applicable law:

• Access (Art. 15): to find out whether we process your personal data and to receive a copy of it, together with information about where it came from, who receives it and why we use it.

• Rectification (Art. 16): to have inaccurate or incomplete data corrected.

• Erasure (Art. 17): to have your data deleted, for example where we no longer need it or you withdraw your consent.

• Restriction (Art. 18): to ask us to limit our use of your data, for example to storage only. You have this right where you dispute the accuracy of your data (while we check it), where our processing is unlawful but you prefer restriction to deletion, where we no longer need the data but you need it for legal claims, or where you have objected under Art. 21(1) and we have not yet decided whose interests prevail.

• Data portability (Art. 20): to receive data you gave us, which we process by automated means based on your consent or a contract, in a commonly used, machine-readable format, or to have it sent directly to another controller where technically possible.

• Withdrawal of consent (Art. 7(3)): to withdraw your consent at any time. This does not affect the lawfulness of processing carried out before you withdraw it.

Right to object (Art. 21 GDPR / UK GDPR)

Where we process your personal data based on legitimate interests (Art. 6(1)(f)), you have the right to object at any time, on grounds relating to your particular situation, including to profiling based on that provision. If you object, we will stop processing your data unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims.

Where we process your personal data for direct marketing, including our newsletter, you have the right to object at any time, including to profiling related to that marketing. If you object, we will no longer use your data for direct marketing.

How to exercise your rights

To exercise any of these rights, email us at support@spellgardengames.com or write to us at the address in section 15. If you are in the UK, you can also contact our UK representative, Spellgarden Games UK. We may need to confirm your identity before acting on your request. We will respond within one month, or explain why we need more time where the law allows it. We will not treat you less favourably for exercising your rights.

Sometimes we cannot do everything you ask, for example because of the legal basis we rely on, because the law requires us to keep certain data, or because it would affect another person's rights. If so, we will explain why.

13. Complaints

If you are unhappy with how we use your personal data, please contact us first so we can try to put it right. You also have the right to complain to a data protection supervisory authority, in particular in the country where you live or work or where the alleged breach took place:

• Germany: our lead supervisory authority is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg.

• Other EEA countries: you can find your local authority in the European Data Protection Board's list of members.

• United Kingdom: the Information Commissioner's Office.

• Switzerland: the Federal Data Protection and Information Commissioner.

This right applies without prejudice to any other administrative or judicial remedy.

Additional information for residents of certain US states

Residents of certain US states, such as California, Virginia, Colorado, Connecticut and Utah, have additional rights, including to know, access, correct and delete their personal data and to opt out of its sale, sharing for targeted advertising, or profiling. We do not sell your personal data or share it for targeted advertising. You can exercise your rights as described in section 12. If we refuse your request, you may appeal by replying to our decision. If you are not satisfied, you may contact your State Attorney General or, for California residents, visit the California Attorney General's website.

14. Changes to this policy

We may update this policy from time to time, for example when we change our Services, add a new Game or feature, or when the law changes. We will publish the updated version on this page and change the "Last updated" date at the top. Where a change is significant, we will let you know in an appropriate way, such as through the Website, our newsletter or the relevant Game.

15. Contact us

If you have questions about this policy or how we use your personal data, please contact us:

Spellgarden Games UG (haftungsbeschränkt)

Beskidenstraße 7 71640 Ludwigsburg
support@spellgardengames.com

Spellgarden Games UK Limited (our UK representative)

C/O Johnston Carmichael Birchin Court, Birchin Lane, London, Greater London, England, EC3V 9DU
+44 735 607 3652
support@spellgardengames.com

You can also contact us using our contact form. The form is provided by Google, which may process what you submit on our behalf.

Our legal notice (Impressum) is available at spellgardengames.com/imprint.