Privacy policy

1. Controller and scope

The controller is Exiria Games spółka z ograniczoną odpowiedzialnością. KRS 0001255280 · NIP 9512652549. Sąd Rejonowy dla m.st. Warszawy w Warszawie, XIII Wydział Gospodarczy Krajowego Rejestru Sądowego. Contact us about privacy at admin@exiriagames.com. This notice covers this website and correspondence with the company. The game has a separate privacy notice.

2. Website visits and correspondence

When a browser requests a page, the hosting infrastructure handles the IP address, request time, requested address, response status and technical browser information. These data allow delivery of the site, diagnosis and protection against abuse. The legal basis is our legitimate interest in operating a reliable and secure information service (Article 6(1)(f) GDPR).

If you contact us, we process your email address, the name or identifier you provide, the message and the reply history. The basis is our legitimate interest in handling correspondence, or steps at your request before a contract and performance of that contract where applicable (Article 6(1)(b)/(f)). For statutory requests and obligations we use Article 6(1)(c). Please avoid sending unnecessary sensitive data.

3. Cookies and browser storage

These informational pages do not set cookies, run analytics scripts, use browser storage or load third-party fonts or embeds. Following a link to a separate game, sign-in provider or email service takes you to a service with its own data processing. Technical network requests and server logs still exist; a static website does not mean that no personal data is processed.

4. Recipients and service providers

Access is limited to authorised company personnel and service providers supporting hosting, infrastructure, email and, for game accounts, authentication and game operation. Professional advisers and public authorities may receive data where necessary and lawful. Service providers acting on our behalf must be subject to appropriate data-processing arrangements. We do not sell personal data.

Our website hosting provider is OVHcloud, and our email provider is home.pl. The servers used for both services are located in Poland. Exiria account authentication uses Amazon Web Services through Amazon Cognito in the eu-central-1 region in Frankfurt.

5. Retention

Logs and backup copies are retained for three months. Test account data is retained during authorised participation. After account closure we remove data that is no longer needed, subject to applicable legal obligations and the establishment, exercise or defence of claims.

Correspondence is retained while a request is handled and afterwards only for as long as required by a legal obligation or a justified claim. Records of accepted documents are retained according to the same necessity-based criteria.

6. Your rights and requests

Depending on the applicable legal basis and conditions, you may request access, rectification, erasure, restriction and portability, and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing. Contact admin@exiriagames.com. Requests are normally free; any GDPR exception must be explained.

We respond without undue delay and normally within one month of receiving a rights request. Where the GDPR permits an extension for complexity or number of requests, we tell you within that first month, explain why and may extend by up to two further months. If we refuse all or part of a request, we explain the grounds and available remedies. We may request additional information where reasonably necessary to verify your identity.

You may complain to the President of the Personal Data Protection Office (Prezes UODO), uodo.gov.pl, or another competent supervisory authority. See account and data deletion for the practical email route.

7. Providing data, automated decisions and updates

Data in correspondence is voluntary, but without a return address we may be unable to answer. Technical request data is necessary to deliver a page. Identity and access data is required for invited testers to use an account; without it we cannot provide access. We do not use these informational pages for profiling or solely automated decisions with legal or similarly significant effects.

We update this notice when processing changes and inform affected account holders of material changes.