Data privacy statement of astragon Entertainment GmbH

1. General information

Welcome! Thank you for your interest in our game. We are astragon Entertainment GmbH, Am Wehrhahn. 33, D-40211 Düsseldorf. You can contact us at: info@astragon.de

Our commitment

Protecting your privacy is of utmost importance to us. Therefore, complying with the statutory data privacy regulations forms a natural foundation of our day-to-day work. It is, however, moreover paramount to us that you at all times know which personal data we gather, why we gather it, and how we process it. We will be happy to explain to you what rights you have and how to exercise them, as well.

What is personal data?

To put it briefly, anything whereby you, as an individual, can be identified, whether due to the information itself or in connection with other information. Examples of this include your name, e-mail address, or also a customer ID, but even the point in time at which you visit our website if that is saved together with your IP address. We constantly endeavour to gather as little personal data as possible. Simultaneously, we are informing you in this document, in depth, on your personal data, if we gather any.

Why is this document so long?

The legislative authority requires us to describe the following to you in regard to all personal data individually:

• which personal data we gather (= the nature of the data gathered)
• which law or ordinance or regulation permits us to do so (= the legal basis)
• why we gather said data (= the intended use)
• what exactly happens to your data (= the nature of the processing)
• how long we save your personal data
• what rights you have in regard to your personal data (= the rights of data subjects)

We need to list all the steps individually. This is why this document is very extensive.

1. Controller and Corporate Data Protection Officer

Responsible within the meaning of the EU General Data Protection Regulation (GDPR) are we, the company

astragon Entertainment GmbH

Am Wehrhahn. 33, D-40211 Düsseldorf 

info@astragon.de 

If you have any questions regarding data protection please contact our Corporate Data Protection Officer. Our Corporate Data Protection Officer is

Helena Kühn

datenschutz@astragon.de

2. Legal basis

We gather and process personal data based on the most up-to-date European law. You will find the entire legal basis specified below in the General Data Protection Regulation (GDPR). Depending upon the purpose for gathering the data, one or more of the legal bases below will apply:

• Consent pursuant to Art. 6(1)(a) General Data Protection Regulation (GDPR).

Consent is a declaration of intent. This can be given in writing in the form of a statement, or also by way of any other clearly affirmative action. In whatever way the consent is given, it needs to be given voluntarily, apply to a specific case, and unmistakably express that the data subject is in agreement with the processing of the personal data concerned. For that purpose, the data subject needs to be adequately informed and understand the consent.

• The necessity of fulfilling the contract or taking preparatory measures pursuant to Art. 6(1)(b) GDPR

This means: The data is necessary so that we can fulfil the contractual obligations towards you or we need the data to prepare for concluding an agreement with you.

• Processing to fulfil legal obligations pursuant to Art. 6(1)(c) GDPR

This means: The processing of the data is, for example, mandatory for us based on a law or other regulation.

• Processing in order to preserve legitimate interests pursuant to Art. 6(1)(f) GDPR

This means: The processing of the data is necessary in order to, on the one hand, preserve legitimate interests on our part or on the part of a third party, as long as your interests or basic rights and basic freedoms, which make the protection of personal data necessary, do not outweigh the latter.

3. Rights of data subjects

As far as your personal data is concerned, you are the data subject. You have the following rights in regard to the processing of data by us in the scope in accordance with the respective article of the General Data Protection Regulation cited:

• Information Right pursuant to Article 15 GDPR, i.e. the right to be informed about how your personal data is processed and which personal data is processed by us,  
• Right of rectification pursuant to Article 16 GDPR - i.e. the right to request the rectification of inaccurate personal data relating to you without undue delay, including the completion of incomplete data,  
• Right to erasure ("right to be forgotten") pursuant to Article 17 GDPR - i.e. the right to request the erasure of your personal data, provided that certain conditions are met, 
• Right to restriction of processing pursuant to Article 18 GDPR - i.e. the right to request the restriction of the processing of your personal data, provided that certain conditions are met, 
• Right to data portability pursuant to Article 20 GDPR - i.e. the right to demand that you receive your personal data that you have provided in a structured, common and machine-readable format and the right to transfer it to a third party, provided that certain conditions are met, 
• Right to object in accordance with Article 21 GDPR - i.e. the right to object to the processing of your personal data where the processing is based on our legitimate interests, provided that certain conditions are met.  

Notwithstanding any other legal remedy under administrative or judicial law, you are entitled to file an appeal with a supervisory authority, in particular in the EU Member State that is your place of residence, your place of work or the place of the presumed infringement if you are of the opinion that the processing of the personal data concerned infringes the GDPR.

4. Deletion of data and duration of storage

The personal data of the data subject is deleted or blocked once the purpose of the storage lapses. It may, moreover, be stored beyond that time if this has been stipulated by the European or national legislative authority in EU ordinances, laws or other regulations to which the Controller is subject. The data may also be blocked or deleted if a storage period stipulated by said standards expires, unless the necessity for further storage of the data for concluding an agreement or fulfilling an agreement exists.

2. Specific data processing

1. Do we gather personal data if you play our games on a mobile phone or tablet?

When you use our games on a mobile phone or tablet with the Google Android or Apple iOS operating systems, we do not gather any additional personal data. Please infer whether, and to what extent, personal data is gathered and processed by Apple or Google in the context of using the games from the respective data privacy policies of the relevant provider. This may in particular be the case if you use the convenience functions of Apple or Google that are integrated into the game, e.g. logging in to the Game Center, saving game statuses, etc. We have no access to such data that is gathered by Apple or Google.

2. Unity Analytics

a. Scope of data processing

When using our game we will collect general data subject to your prior consent which include: 

· actions taken in the game

· play time and length and numbers of playing sessions

· game settings

· userID (anonymized) 

· digital content purchased

· country of residence 

· hardware information 

· operating system 

· newspage engagement 

· IP adress

The IP address is only processed for the transfer of data and the analysis of the location and then deleted. Such data is processed by our analytics software hosted and operated by Unity Software Inc. based in the United States of America.  

All game related data is also processed by weltenbauer. Software Entwicklung GmbH based in Germany, who is the developer of the Game. 

b. Legal basis

Legal basis is Art. 6 para. 1 (a) and (f) GDPR for the analytics services used. The legitimate interest is to enable us to improve our game based on the playing experience of our players. The legal basis for the transfer of data to our service providers is Article 28 para. 3, 6 and 7, Article 46 para. 2 (c) GDPR GDPR in conjunction with the use of the standard clauses of the EU Commission. The legal basis for the processing of the data by weltenbauer. Software Entwicklung GmbH is Art. 28 para. 3 GDPR. 

c. Purpose of the data processing

The purpose is to use such aggregated data to analyze what parts of our game our players prefer, if parts of our games are not accessible or should be improved. Furthermore the action taken in the game are required to provide a consistent game experience. Processing the developer is required for additional development and maintenance.  

d. Duration of storage

The IP address is anonymized upon after using the IP address to analyze the user’s country of origin. The game play data is stored permanently as long as you do not delete your game account.  

e. Possibility of objection and deletion

You may at any time deactivate the analytics functions in the option menu of our games.  

3. AdMob (Lite Version)

a. Scope of the data processing

This game uses AdMob a marketing service of Google Ireland Limited. (“Google”). This Software plays ads in our free Lite Version. Those ads can be personalized. The IP address transmitted by your browser within the context of AdMob is not merged with other data of Google.

We have activated the so-called IP anonymisation in this game, i.e. the IP address is first truncated by Google within Member States of the European Union or in other contracting states of the Agreement on the European Economic Area, prior to being transmitted on to the USA.

Only in exceptional cases is the full IP address transmitted to a server of Google in the USA and truncated there. Google itself describes its data processing activity here: https://www.google.com/policies/privacy/. For more information on how Google uses the collected information, please visit the “How Google uses data when you use our partners’ sites or app” page: https://www.google.com/policies/privacy/partners/.

b. Legal basis

The legal basis for the processing of the data when using the game is Art. 6(1)(1)(f) GDPR. 

The legitimate interest within the meaning of Art. 6(1)(f) GDPR lies in a monetarisation of the game which does justice to the user’s requirements and takes the user’s usage preferences into consideration.

The legal basis for the passing on of the data to Google is Art. 28(3) and Art. 45(3) GDPR. The service provider is certified under the Privacy Shield Framework and is therefore subject to the adequacy decision (Implementing Decision 2016/1250) of the European Commission, i.e. the level of data protection with the service provider is recognised as being equivalent to that stipulated by the GDPR, even though the service provider has its registered office in the USA.

c. Purpose of the data processing

The processing serves the purpose monetarizing a free game.

d. Duration of the storage

The data is already anonymised directly after being gathered. Personal data is therefore only gathered in the course of the transmission, and not permanently.

e. The possibility of objection and deletion

You can opt-out from AdMob by Google service by following the instructions described by Google Inc.: https://support.google.com/ads/answer/2662922?hl=en.