Last updated: March 25, 2022

1. Who we are

1.1 We are Keystorm Holdings Ltd, located at 13, Kypranoros, 2nd floor, flat/office 201, 1061 Nicosia, Cyprus.

1.2 This Privacy Policy sets out how we collect and use your personal information when you use our products and services ("Services") offered by Keystorm Holdings Ltd and the choices available to you in connection with our use of your personal information (the Privacy Policy).

This Privacy Policy should be read alongside, and in addition to, our Terms of Service conditions (accessible online at https://legal.keystorm.net/keystorm/terms_en.html) (Terms).

In case of any contradictions between this Privacy Policy and the Terms, this Privacy Policy will prevail.

2. This Privacy Policy

2.1 By making available the Services we, acting reasonably and in good faith, believe that you:

(a) have all necessary rights to register on and use the Services;

(b) provide true information about yourself to the extent necessary for use of the Services;

(c) understand that by the posting your personal information you have manifestly made this information public, and this information may become available to other Site users and internet users, be copied and disseminated by them;

(d) understand that some types of information transferred by you to other Service users cannot be deleted by you or us;

(e) are aware of and accept this Privacy Policy.

2.2 We do not check the user information received from you, except where such check is necessary in order for us to fulfill our obligations to you.

3. Information we collect about you

3.1 In order to implement the agreement between you and us, and provide you with access to the use of the Services, we will improve, develop and implement new features to our Services, and enhance the available Services functionality. To achieve these objectives, and in compliance with applicable laws, we will collect, store, aggregate, organise, extract, compare, use, and supplement your data (hereinafter “processing”). We will also receive and pass this data, and our automatically processed analyses of this data to our affiliates and partners as set out in the table below and section 4 of this Privacy Policy.

3.2 We set out in more detail the information we collect when you use our Services, why we collect and process it and the legal bases below.

Information collected: Data you provide for registering in the Services such as nickname.

Purpose: We use this information in order to manage and administer the Services provided to you. We use this data to enable us to fulfill our obligations to you as part of the Services (e.g. in cases where you request restoration of your account).

Legal Basis: Performance of our contract with you
Information collected: Where necessary, a copy of your identity or another document containing your name, surname, photograph, number of the principal identity document of you or your representative, payment details and another additional data, with that you may provide us, including through our support service. We may take additional verification steps where we consider reasonable in order to verify your account.

Purpose: We use this data in order to identify you, verify your account and prevent abuse and infringements of your or other persons' rights. For example, we use this information to verify your identity if you lose your credentials and wish to access your account with us.

Legal Basis: Legitimate interests. Performance of our contract with you. Processing is necessary for compliance with a legal obligation (e.g. right of access granted by GDPR).
Information collected: Additional data you provide when you edit your Services profile or settings section such as avatar picture and language preferences or when you give your answers on questions from our questionnaires.

Purpose: We use this information in order to provide our Services to you, to manage and administer Services.

Legal Basis: Legitimate interests. Performance of our contract with you.
Information collected: Additional data received when you access the Services, including information regarding technical devices, technical interaction with the Service such as your IP-address, time of registration in the Services, time of accessing the Services, device ids, country and language settings, device model and operating system used, type of a browser, your Internet provider and/or phone network operator, network type, screen resolution, RAM size.

Purpose: We use your data for internal review in order to constantly improve the content of our Services and web pages, optimizing your user experience, to understand any errors you may encounter when using the Services, to notify you of changes to the Services and to personalise the use of our Services. We may also use this data in order to tailor and improve the adverts that are presented to you to and measure the effectiveness of these advertisements.

Legal Basis: Legitimate Interests. Performance of our contract with you
Information collected: Information that is created by you while using the Services (including information that you post in any game forums and/or chat rooms). Depending on the place of posting (chat room or forum) this information can be available to some or all other users of our Services.

Purpose: We use this information in order to manage and administer the Services including providing our services to you.

Legal Basis: Legitimate interests, which inter alia, include the processing of data manifestly made public by you, where it is accessible by other users of the Services. Performance of our contract with you
Information collected: Information that is created by you while placing requests to our Services support.

Purpose: We use this information in order to verify your identity and to fulfill your support request. We may also use this data in order to investigate any complaints on your behalf and to provide you with a more efficient service.

Legal Basis: Legitimate interests. Performance of our contract with you
Information collected: Information that is received as the result of your behavioral actions when using the Services (including your game actions and achievements, badges, information about goods and services purchased). This information can be available to other users of our Services (e.g. on Leaderboards).

Purpose: We use this information in order to manage and administer the Services including providing our Services to you. We may also use this data in order to tailor and improve the adverts that are presented to you to and measure the effectiveness of these advertisements.

Legal Basis: Legitimate interests, which, inter alia, include the processing of data manifestly made public by you, where it is accessible by other users of the Services. Performance of our contract with you
Information collected: Information that is received about you as the result of other users’ actions on the Services (in particular, information posted in chat rooms and forums by other users).

Purpose: We use this information in order to manage and administer the Services including providing our Services to you.

Legal Basis: Legitimate interests
Information collected: Information that is received as the result of your using payment functionality of the Services, information about payments (date, amount, payment type, payment status), information about goods and services purchased (name, amount), information about the activation status of goods and services purchased.

Purpose: We use this information in order to manage and administer the Services including providing our Services to you. We may also use this data in order to investigate any complaints on your behalf and to provide you with a more efficient service.

Legal Basis: Legitimate interests. Performance of our contract with you
Information collected: Data obtained via third parties, including your social network ids, application store ids, social network nickname, email and friends list, when you connect your social account (e.g. Facebook, Google or Apple Game Center) to our Services.

Purpose: We import this information into your profile. We use this information in order to manage and administer the Services provided to you. We use this information for certain social functions of our Services, such as to show you who of your friends play the same game as you or to provide you the ability to post your achievements into your social account. We also use this information to retain the data about your usage of our Services (such as game progress and achievements) across your different mobile devices, connected to the same social account.

Legal Basis: Legitimate interests. Performance of our contract with you

3.3 Our legitimate interests include (1) maintaining and administrating the Services; (2) providing the Services to you; (3) improving the content of the Services and web pages; (4) processing of the data that was manifestly made public by you; (5) ensuring your account is adequately protected; and (6) compliance with any contractual, legal or regulatory obligations under any applicable law.

3.4 As part of maintaining and administrating the Services we use the information to analyze user activity and ensure that rules and terms of use for the Services are not violated.

3.5 Your personal information may also be processed if it is required by a law enforcement or regulatory authority, body or agency or in the defence or exercise of legal claims.
We will not delete personal information if it is relevant to an investigation or a dispute.
It will continue to be stored until those issues are fully resolved and/or during the term that is required and/or permissible under applicable/relevant law.

3.6 Please note, if you do not want us to process sensitive and special categories of data about you (including data relating to your health, racial or ethnic origin, political opinion, religious or philosophical beliefs, sex life, and your sexual orientation) you should take care not to post this information or share this data when using the Services.
Once you have provided this data it will be accessible by other Service users and it becomes difficult for us to remove this data.

3.7 Please note, if you withdraw your consent to processing or you do not provide the data that we require in order to maintain and administer the Services, you may not be able to access the Services.

3.8 If we intend to further process your data for any other purpose to those set out in this Privacy Policy, we shall provide you with details of this further purpose before we commence processing.

4. Data sharing

4.1 Your nickname, other information depending on the place of posting (chat room or forum), can be available to all of the Service users. We take technical and organizational measures to ensure that your data is safe. Please note that by the posting your personal information you have manifestly made this information public, and this may become available to other Service users and internet users and be copied and/ or disseminated by such users. Once this data is transferred by you to other users you will not be able to delete this data.

4.2 We may share your data with our affiliates. Sometimes we may also need to share your data with a third party in order to provide our Services to you or to administer the Services, for example if you choose to share your data across social media platforms.

4.3 Keystorm Holdings Ltd or our selected third party partners with our permission, using their own ad servers, can show advertisements to you. Our ad management and recommendation system is designed so that generally your information will not be shared directly with our third party advertisers. An advertiser or maker of a recommendation can only choose to target advertisements to groups of users falling within criteria such as gender, general region information (such as country or city), or other, or to target communities according to their types. If you fall within one of the target groups, you will receive an advertisement or recommendation of such third party partners or our affiliates. However, such third party advertisers or our affiliates may gather some of your information in case you interact in any way with the ads provided by such advertisers.

4.4 An advertiser or maker of recommendations may also choose to upload a list of identifiers (e.g., emails, phone numbers) to our systems so that we (but not the adviser or maker of recommendations) can check for user matches. They will see the number of matches but not the matches themselves.

4.5 If you participate in public tournaments we may have the obligation to disclose your personal information to tax authorities. We also may publish your data as part of the tournament score tables on our and third parties web sites.

4.6 Integrated advertising and analytics. We may share your personal information with analytical systems for the purposes of performance measurement of our Website and our Services, and we may also provide such information to third parties such as advertisement networks. By using our Services you agree that we may transfer your data to such third parties and accept that your data will be processed in accordance with privacy terms of such third parties. The current list of integrated third-party systems used by us is provided here.

4.7. Apple and Google offer the owners of devices that use their operating systems, iOS and Android, options for limiting tracking and targeting in relation to ads. We do not control yours device level opt-out processes and we are not responsible for any choices user make through such mechanism or for the continued availability, accuracy, effectiveness, or location of that mechanism. Using a device level opt-out mechanism you may opt-out of all third-party personalized advertisements. If you use other operating systems (other than iOS and Android) and such operating systems do not provide a device level opt-out mechanism, you shall contact us in order to opt-out of all third-party personalized advertisements

5. Privacy Settings

5.1 The Services may contain links to sites operated by third parties. We are not responsible for your data privacy when you access these links or engage with third party services and you should ensure you review the relevant third party's privacy statement which will govern your data privacy rights.

5.2 We bear no liability for the actions of third parties which, as the result of your use of the internet or the Services, obtain access to your information in accordance with the confidentiality level selected by you.

5.3 We bear no liability for the consequences of use of the information which, due to the Services nature, is available to any internet user. We ask you to take a responsible approach to the scope of their information posted on the Site.

6. International Transfers

6.1 We may transfer and maintain on our servers or databases some of your personal information outside the European Economic Area (EEA) including in USA, Japan, CIS.

6.2 The countries to which we transfer your data may not have the same data protection laws as your jurisdiction. We take reasonable cyber security measures and/or put in place the Standard Contractual Clauses (e.g. Model Clauses, Data Processing Agreement/Addendum) to ensure your data is adequately protected.

7. Retention Periods

7.1 We will retain your personal information for as long as required to perform the purposes for which the data was collected depending on the legal basis for which that data was obtained and/or whether additional legal/regulatory obligations mandate that we retain your personal information during the term that is required and/or permissible under applicable/relevant law.

7.2 You may request to remove your account and personal data on our Services by contacting the Service support (see Section 12 for details) and/or using relevant functionality of the Services. Within thirty (30) calendar days we will remove your account and/or data on our Services and you will not be able to restore your account and/or data on our Services. Within the indicated period you may cancel your account and personal data removal request.

7.3 We may remove your account, or the information you post as provided by the Terms.

8. Your Rights

8.1 You have the following rights, in certain circumstances, in relation to your personal information:

(a) Right to access your personal information.

(b) Right to rectify your personal information: you can request that we update, block or delete your personal data, if the data is incomplete, outdated, incorrect, unlawfully received or no longer relevant for the purpose of processing.

(d) Right to request that your personal information is erased if:

- it is no longer required in relation to the purposes for which it was gathered or processed in another way;

- you withdraw your consent concerning processing subject to consent;

- you are justifiably opposed to the processing;

- it has been subject to illicit processing; or

- it is imposed by law.

(e) Right to object to processing of your personal information.

(f) Right to data portability (in certain specific circumstances).

(g) Right not to be subject to an automated decision.

(h) Right to lodge a complaint with a supervisory authority.

(i) For processing based upon your consent, the right withdraw that consent at any time.

(j) You may have other rights under your legislation of your country of residence, including right to define the instructions relative to the outcome of your personal data after your death.

8.2 You also have a right to independently remove personal information on your account and make changes and corrections to your information, provided that such changes and corrections contain up-to-date and true information. You can also view an overview of the information we hold about you. If you reside in France you have the right to register on the list of opposition to telephone canvassing on www.bloctel.fr.

8.3 If you would like to exercise these rights, please contact Service support at info@keystorm.net or send your request to us in writing to 13, Kypranoros, 2nd floor, flat/office 201, 1061 Nicosia, Cyprus. We will aim to respond to you within 30 days from receipt of request. We will need to verify your identity before we are able to disclose any personal data to you.

9. Your California Privacy Rights

9.1 This notice to California residents is provided under California law, including the California Consumer Privacy Act (“CCPA”), Cal. Civ. Code 1798.100, et seq. This notice supplements our Privacy Policy by explaining your California privacy rights if you are a California resident, and provides certain mandated disclosures about our treatment of California residents’ information, both online and offline.

9.2 If you are a California resident you have the following rights in relation to your personal information:

(a) Right to Access. If you are a California resident, you have the right to request, up to two times each year, access to categories and specific pieces of personal information about you that we collect, use, disclose, and sell.

(b) Right to Delete. If you are a California resident, you have the right to request that we delete personal information that we collect from you, subject to applicable legal exceptions.

(c) Process to Make a CCPA Request. To make an access or deletion request, please send your enquiries to Service s support at info@keystorm.net or send your request to us in writing to 13, Kypranoros, 2nd floor, flat/office 201, 1061 Nicosia, Cyprus.

(d) Before completing your request, we may need to verify your identity or the identity of your authorized representative. We will then take action to verify your email address and may request additional documentation or information solely for the purpose of verifying your identity.

(e) Right to Opt Out of Sale of Personal Information. If you are a California resident, you have the right to “opt out” of the “sale” of your “personal information” to “third parties” (as those terms are defined in the CCPA). You can exercise this right by amending the settings in the Services. Our Privacy Policy describes the limited circumstances in which we may share your information with third parties. Our Privacy Policy also provides you with certain controls and choices regarding our collection, use, and sharing of your information.

(f) Right to Non-Discrimination: You have the right not to receive discriminatory treatment for the exercise of your privacy rights conferred by the CCPA.

(g) Shine the Light Act. If you are a California resident, California Civil Code Section 1798.83 permits you to request information regarding the disclosure of your personal information by us and our affiliates to third parties for the third parties’ direct marketing purposes. We are dedicated to treating your personal information with care and respect. For inquiries regarding our disclosure policy, you may send your enquiries to Service support at info@keystorm.net or send your request to us in writing to 13, Kypranoros, 2nd floor, flat/office 201, 1061 Nicosia, Cyprus.

(h) Authorized Agents. If you would like to designate an authorized agent to make a request on your behalf, please be sure the agent can (i) demonstrate you have provided written permission for the agent to submit the request on your behalf, and (ii) provide proof of his or her own identity. If the agent does not satisfy these requirements, we will deny the request.

(i) Privacy Rights for California Minors. If you are a California resident under the age of 18, California Business and Professions Code Section 22581 permits you to view, correct and request the removal of content or information you have posted to the Site, message boards, or forums. You may exercise this right you may send your enquiries to Service support at info@keystorm.net or send your request to us in writing to 13, Kypranoros, 2nd floor, flat/office 201, 1061 Nicosia, Cyprus. Note that any information posted to the message boards or forums is publicly viewable. We strongly recommend that all users avoid posting personal or sensitive information.

Residual copies of content and/or information that have been deleted may remain on our backup servers. We do not have to remove posted content or information if it has been rendered anonymous. We may retain your information to resolve disputes, enforce our user agreements, or comply with legal requirements; in this case, your personal information will be blocked from use for any other purpose. Additionally, we do not have control over third parties (e.g., other users) who may have copied or reposted the content or information.

9.3 Mandatory Disclosures. In addition to the information provided elsewhere in our Privacy Policy, we make the following disclosures for purposes of compliance with the CCPA:

• We collected the following categories of personal information in the last 12 months: Identifiers, contact Information, demographic information, payment information associated with you, commercial information (such as information about goods and services you have purchased), Internet or other electronic network activity information, including information obtained from third parties, general location data (country, city), electronic information, and inferences drawn from the above. For detailed information please refer to “INFORMATION WE COLLECT ABOUT YOU” Section of this Privacy Policy.

• The sources of personal information that we collected are: our users, directly, third party sites or platforms that you link with your registration account, analytics tools, social networks, advertising networks, and trusted sources who update or supplement information we hold about you.

• The business or commercial purposes of collecting personal information are described in the “INFORMATION WE COLLECT ABOUT YOU” Section of this Privacy.

• We disclosed the following categories of personal information for a business purpose in the last 12 months: IP addresses, Identifiers, information about your web browsing and app usage, demographic information, payment information associated with you, commercial information, Internet or other electronic network activity information, including information obtained from authorisation services of third parties, general location data (country, city), electronic information, and inferences drawn from the above. We disclose these categories outside only as described in the “DATA SHARING” Section of this Privacy Policy.

• Although we do not sell personal information for monetary consideration, some of our partners may collect and process information when you interact with our Services, including IP addresses, digital identifiers, information about your web browsing and app usage, and how you interact with our advertising properties and ads in order to provide you with relevant ads across the Internet and for other analytics purposes, and such partners may “sell” that information to other businesses for advertising and other purposes under the definition of “sale” in the CCPA.

• As the term is defined by the CCPA, we “sold” the following categories of personal information in the last 12 months: IP addresses, Identifiers/Contact Information, Internet or other electronic network activity information, including information about your web browsing and app usage, and inferences drawn from the above. We “sold” each category to social networks (for the authorization purposes), advertising networks, data analytics providers and our infrastructure service providers.

• The business or commercial purposes of “selling” personal information is for third party companies to perform services on our behalf, like marketing, advertising, performance and audience measurement.

• We do not “sell” personal information of known minors under 16 years of age.

9.4 Online Tracking/Do Not Track. We and our third party service providers may use cookies, pixels, or other tracking technologies to collect information about your browsing activities over time and across different websites. California Business and Professions Code Section 22575(b) (as amended effective January 1, 2014) permits our users who are California residents to be informed as to how we respond to Web browser "Do Not Track" settings. As Do Not Track is a standard that is currently being developed, we do not take actions to respond to Do Not Track settings, and instead we adhere to the standards set out in this Privacy Policy.

10. Security Measures

10.1 We take technical, organizational and legal measures, including, where suitable, encryption, to ensure that your personal data are protected from unauthorized or accidental access, deletion, modification, blocking, copying and dissemination.

11. Changes to this Policy

11.1 From time to time, we may change and/or update this Privacy Policy. If this Privacy Policy changes in any way, we will post an updated version on this page. We will store the previous versions of this Privacy Policy in our documentation achieve. We recommend you regularly review this page to ensure that you are always aware of our information practices and any changes to such.

12. Contact Us

12.1 If you have any questions, please send your inquiries to Service support at info@keystorm.net or send your request to us in writing to 13, Kypranoros, 2nd floor, flat/office 201, 1061 Nicosia, Cyprus. So we can deal with your enquiry effectively, please quote this Privacy Policy. We will aim to respond to you within 30 days from receipt of request.

12.2 All correspondence received by us from you (written or electronic inquiries) is classified as restricted-access information and may not be disclosed without your written consent. The personal data and other information about you may not be used without your consent for any purpose other than for response to the inquiry, except as expressly provided by law.

12.3 The e-mail address of our DPO is dpo@keystorm.net.

13. Privacy Notice for parents/legal guardians

13.1 We encourage parents to discuss with their children the importance of personal data protection.

13.2 We will not require a child to provide more information than is reasonably necessary in order to use the Services.

13.3 If children are under 13 years old and under applicable law a parental consent is required, use of the Services if forbidden.

13.4 At any time, parent/legal guardian, who have revealed that their children use the Services in violation of these Privacy Policy, can request that we cease collecting of personal data of their children in association with a particular account, by sending a corresponding request via dpo@keystorm.net.