Informativa sulla privacy

Voluntarily Disclosed Personal Data

Pursuant to the operational requirements of our interactive entertainment platforms and ancillary digital services, we collect, process, and maintain personally identifiable information ("PII") that you voluntarily submit, furnish, or otherwise make available in connection with account registration, participation in community-organized events, correspondence with our customer support representatives, or any other interaction with our services, platforms, subsidiaries, or affiliated entities. Such information may include, without limitation, the following categories of data:

• Full legal names, aliases, pseudonyms, gamertags, and user-designated identifiers
• Primary and secondary electronic mail addresses associated with the account holder
• Telecommunications identifiers including mobile and landline telephone numbers
• Cryptographically hashed authentication credentials, passwords, and multi-factor verification tokens
• Communication preference configurations, opt-in/opt-out designations, and notification channel selections

Financial Transaction and Payment Instrument Data

In connection with monetary transactions, including but not limited to the acquisition of virtual goods, in-game currency, premium subscriptions, downloadable content (DLC), and other digital merchandise offered through our platforms, all payment processing is conducted through our authorized third-party payment service provider, XSolla Inc. (hereinafter "Payment Processor"). Fawkes Games does not directly collect, store, retain, or have access to complete payment card numbers, card verification values (CVV/CVC), or banking credentials. The Payment Processor's collection and processing of financial data is governed by its own privacy policy, available for review at xsolla.com/privacypolicy. Users are strongly encouraged to review said policy prior to initiating any financial transactions.

Third-Party Authentication and Social Media Login Data

In the event that you elect to authenticate your identity and/or create an account through a third-party social media platform or federated identity provider (including but not limited to Meta Platforms, Inc. (Facebook), Alphabet Inc. (Google), Apple Inc., or any other OAuth 2.0-compliant identity provider), we shall receive and process certain profile information as permitted by the applicable platform's authorization scope, including your publicly available name, electronic mail address, profile photograph, and unique platform identifier.

Automatically Collected Technical and Telemetric Data

During your use of our interactive entertainment products, web-based platforms, the Fawkes Hub desktop application, and any associated microservices or API endpoints, we automatically collect, aggregate, and process certain technical, telemetric, and device-specific information through server logs, software development kits (SDKs), application programming interfaces (APIs), and analogous data collection mechanisms. Such automatic collection is necessary for the maintenance of platform security, fraud prevention, service optimization, and compliance with applicable regulatory requirements:

• Internet Protocol (IP) addresses (both IPv4 and IPv6), user-agent strings, browser fingerprints, and device-specific hardware identifiers
• Operating system type, version, kernel build, installed language packs, timezone offsets, and display resolution parameters
• Gameplay telemetry data including but not limited to session duration metrics, input event logs, achievement progression, character statistics, and in-game activity timestamps
• Approximate geolocation data derived from IP address geolocation databases (accurate to the city or metropolitan level; precise GPS coordinates are not collected)
• HTTP cookies, web beacons, pixel tags, local storage objects, and analogous persistent and session-based tracking technologies (refer to our comprehensive Cookie Notice published at fawkesgames.com/cookies/ for further particulars)

We process, analyze, and utilize your personally identifiable information and associated data strictly in furtherance of the legitimate operational, commercial, and regulatory purposes enumerated herein. The processing activities undertaken are proportionate to, and necessary for, the delivery, maintenance, improvement, and optimization of our interactive entertainment services and related digital infrastructure. Specifically, and without limitation, your information is processed for the following purposes:

• Provisioning, instantiation, and lifecycle management of user accounts across all titles, platforms, and services operated by Fawkes Games LTD and its subsidiaries
• Delivery of interactive entertainment services, including but not limited to game client distribution, patch deployment, hotfix application, content updates, and the facilitation of in-game microtransactions and virtual economy operations
• Provision of technical and customer support services, including ticket management, escalation procedures, and resolution of player-reported issues through our designated support channels
• Dissemination of mandatory service communications (e.g., scheduled maintenance windows, server migration notifications, terms of service amendments, privacy policy revisions, and regulatory compliance notices)
• Processing, settlement, and reconciliation of in-game commercial transactions, order fulfillment, refund adjudication, and chargeback dispute management
• Enablement and moderation of in-game and platform-level communication features including but not limited to real-time chat systems, guild management interfaces, private messaging protocols, and forum-based community interaction tools
• Implementation and enforcement of anti-cheat measures, fraud detection algorithms, behavioral anomaly detection systems, and Terms of Service compliance monitoring
• Statistical analysis of aggregated and anonymized gameplay patterns, player engagement metrics, session flow data, and A/B testing results for the purposes of game balance optimization, user experience enhancement, and product development roadmap prioritization

Data Subjects Located Within the European Economic Area (EEA), United Kingdom, and Swiss Confederation

In accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, "GDPR"), the United Kingdom General Data Protection Regulation as retained under the European Union (Withdrawal) Act 2018 ("UK GDPR"), and the Swiss Federal Act on Data Protection ("FADP"), the lawful bases upon which we rely for the processing of personal data are as follows:

• Consent (Article 6(1)(a) GDPR) — where you have provided explicit, informed, and unambiguous consent to the processing of your personal data for one or more specific purposes, including but not limited to the receipt of direct marketing communications, participation in optional analytics programs, and enrollment in beta testing initiatives
• Performance of a Contract (Article 6(1)(b) GDPR) — where processing is necessary for the performance of a contract to which you are a party, specifically the Terms of Service and End User License Agreement governing your use of our interactive entertainment products
• Compliance with Legal Obligations (Article 6(1)(c) GDPR) — where processing is necessary for compliance with a legal obligation to which the Controller is subject, including but not limited to tax reporting requirements, anti-money laundering regulations, and law enforcement cooperation mandates
• Protection of Vital Interests (Article 6(1)(d) GDPR) — in exceptional and exigent circumstances where processing is necessary to protect the vital interests of the data subject or another natural person, such as imminent threats to physical safety communicated through our platforms

Data Subjects Domiciled in Canada

In conformity with the Personal Information Protection and Electronic Documents Act (PIPEDA, S.C. 2000, c. 5) and applicable provincial privacy legislation (including but not limited to Alberta's Personal Information Protection Act, British Columbia's Personal Information Protection Act, and Quebec's Act Respecting the Protection of Personal Information in the Private Sector), we process your personal information on the basis of express or implied consent as appropriate to the sensitivity of the information and the reasonable expectations of the individual. You retain the right to withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice, by submitting a written request to our Data Protection Officer at [email protected].

We disclose, transfer, or otherwise make available personal data to third-party recipients solely to the extent necessary for the operation, maintenance, and improvement of our interactive entertainment services and the conduct of our legitimate business operations. All third-party data recipients are contractually bound by data processing agreements (DPAs) incorporating Standard Contractual Clauses (SCCs) where applicable, and are subject to obligations of confidentiality, data minimization, purpose limitation, and implementation of appropriate technical and organizational measures pursuant to Article 28 GDPR. Categories of authorized third-party recipients include:

• Cloud infrastructure and hosting service providers responsible for the provisioning, maintenance, and scaling of game servers, database clusters, content delivery networks (CDNs), and disaster recovery systems
• Authorized payment processing intermediaries (XSolla Inc.) for the settlement of financial transactions, fraud screening, and regulatory compliance with Payment Card Industry Data Security Standards (PCI DSS)
• Analytics and business intelligence service providers for the aggregation, analysis, and visualization of anonymized player behavioral data, engagement metrics, and platform performance indicators
• Anti-cheat technology vendors, behavioral analysis platforms, and cybersecurity service providers for the detection, investigation, and mitigation of unauthorized access, exploitation, and Terms of Service violations
• Customer relationship management (CRM) and technical support platforms for ticket routing, escalation management, and quality assurance monitoring
• Marketing automation, electronic mail service providers, and communication platforms for the dissemination of newsletters, promotional announcements, product launch notifications, and community engagement initiatives

Corporate Restructuring, Mergers, and Acquisitions

In the event that Fawkes Games LTD undergoes, initiates, or becomes subject to a merger, acquisition, divestiture, asset sale, corporate reorganization, dissolution, bankruptcy proceeding, or analogous corporate transaction or proceeding, your personal information may be transferred, assigned, or disclosed to the acquiring entity, successor-in-interest, or relevant third party as part of such transaction. In all such cases, we shall endeavor to ensure that the receiving entity assumes obligations consistent with this Privacy Notice and applicable data protection legislation, and that you are notified of any material changes to the processing of your personal data.

Our websites, web applications, the Fawkes Hub desktop client, and associated digital properties deploy cookies (both first-party and third-party, persistent and session-based), web beacons (clear GIFs), pixel tags, local storage objects (HTML5 localStorage/sessionStorage), and analogous client-side tracking technologies for the purposes of session management, user preference persistence, cross-session identification, and behavioral analytics. Certain third-party analytics services, including but not limited to Google Analytics (operated by Alphabet Inc.), may set additional cookies subject to their own privacy policies and data processing terms:

• Strictly Necessary / Essential Cookies — required for the proper functioning of authentication mechanisms, session integrity maintenance, Cross-Site Request Forgery (CSRF) protection, load balancing, and other core platform operations; these cookies cannot be disabled without impairing service functionality
• Performance and Analytics Cookies — deployed for the collection of aggregated, pseudonymized usage data pertaining to page views, navigation paths, session durations, bounce rates, and feature utilization metrics for the purposes of service optimization and product development
• Marketing, Advertising, and Retargeting Cookies — utilized for the delivery of contextually relevant game announcements, cross-platform retargeting campaigns, conversion attribution, and audience segmentation in compliance with applicable advertising regulations

You may exercise granular control over cookie deployment through your browser's privacy and security settings, including the ability to block or delete specific categories of cookies. Please note that the restriction of essential cookies may result in degraded service functionality. For comprehensive information regarding our use of tracking technologies, please consult our Cookie Notice published at fawkesgames.com/cookies/. To opt out of Google Analytics data collection, you may install the Google Analytics Opt-out Browser Add-on available at tools.google.com/dlpage/gaoptout.

When you elect to authenticate your identity through a third-party social media platform or federated identity provider utilizing OAuth 2.0 or OpenID Connect protocols, we receive and process only the minimum scope of profile information authorized by the platform's permission framework and your explicit authorization grant. We do not, under any circumstances, publish content to your social media accounts, access your social graph or friend/connection lists, or request elevated permissions beyond those strictly necessary for authentication and account provisioning, unless you provide separate, explicit, informed consent for such activities. All social login data received is processed exclusively for the purposes of identity verification, account creation, and session management, and is subject to the same security measures and data protection obligations applicable to all other categories of personal data processed by Fawkes Games.

We retain your personally identifiable information and associated account data for the duration of your account's active status, plus an additional retention period of up to twelve (12) calendar months following the date upon which you submit a verified account closure or deletion request. This post-closure retention period is maintained to facilitate the resolution of any outstanding disputes, chargebacks, or support inquiries; to comply with mandatory record-keeping obligations imposed by applicable tax, financial reporting, anti-money laundering, and consumer protection legislation; to process any pending transactions, refund requests, or contractual obligations; and to preserve evidence that may be required in connection with actual or reasonably anticipated litigation, regulatory investigation, or law enforcement proceedings. Upon expiration of the applicable retention period, your personal data shall be irreversibly deleted from our active systems using industry-standard secure deletion methods, or alternatively, subjected to irreversible anonymization techniques rendering the data incapable of being associated with any identified or identifiable natural person.

We implement and maintain appropriate technical and organizational measures designed to ensure a level of security commensurate with the risk associated with the processing activities, in accordance with Article 32 of the GDPR and analogous provisions of applicable data protection legislation. Such measures include, but are not limited to: encryption of data in transit using Transport Layer Security (TLS 1.2+) and at rest using AES-256 encryption standards; implementation of role-based access control (RBAC) policies with the principle of least privilege; regular penetration testing, vulnerability assessments, and code security audits conducted by qualified internal and external security professionals; implementation of intrusion detection and prevention systems (IDS/IPS); maintenance of comprehensive audit logs and access trails; and establishment of incident response procedures in compliance with applicable breach notification requirements. Notwithstanding the foregoing, no method of electronic transmission or digital storage is completely infallible, and we cannot provide an absolute guarantee of security. We strongly recommend that all users employ unique, complex passwords for their Fawkes accounts, enable all available multi-factor authentication (MFA) mechanisms, and exercise reasonable vigilance against social engineering and phishing attempts.

Rights Available to All Data Subjects

Subject to applicable jurisdictional requirements, exemptions, and limitations prescribed by law, you may be entitled to exercise the following rights with respect to your personal data:

• Right of Access (Article 15 GDPR) — the right to obtain confirmation as to whether personal data concerning you is being processed, and to receive a copy of such data in a structured, commonly used, and machine-readable format
• Right to Rectification (Article 16 GDPR) — the right to obtain without undue delay the rectification of inaccurate personal data, and to have incomplete personal data completed by means of a supplementary statement
• Right to Erasure / Right to Be Forgotten (Article 17 GDPR) — the right to obtain the erasure of personal data where one of the grounds enumerated in the applicable legislation applies, subject to the exceptions and limitations set forth therein
• Right to Withdraw Consent (Article 7(3) GDPR) — the right to withdraw previously granted consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal
• Right to Object (Article 21 GDPR) — the right to object, on grounds relating to your particular situation, to processing of personal data based on legitimate interests, including profiling
• Right to Data Portability (Article 20 GDPR) — the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit such data to another controller without hindrance

Procedures for Exercising Data Subject Rights

Many of the foregoing rights may be exercised directly through the self-service account management features available within your game account settings or the Fawkes Hub platform. For formal data subject access requests (DSARs), requests for erasure, or other rights-related inquiries, please submit a verified request to our Data Protection Officer at [email protected] or through our designated DSAR submission portal. We shall process your request in accordance with the timeframes mandated by applicable data protection legislation.

Supervisory Authority Complaints for EEA and UK Data Subjects

If you are located within the European Economic Area or the United Kingdom and believe that our processing of your personal data infringes upon your rights under the GDPR or UK GDPR, you have the right to lodge a complaint with your competent national data protection supervisory authority. A list of EEA supervisory authorities is available at edpb.europa.eu. For UK-based data subjects, complaints may be directed to the Information Commissioner's Office (ICO) at ico.org.uk.

As of the effective date of this Privacy Notice, there exists no universally adopted, industry-recognized technical standard for the interpretation and implementation of Do-Not-Track (DNT) preference signals transmitted by web browsers, as acknowledged by the World Wide Web Consortium (W3C) Tracking Protection Working Group. Consequently, our digital properties do not currently alter data collection or processing practices in response to DNT header signals. Should a uniform, legally mandated standard for DNT compliance be formally adopted by relevant regulatory authorities or industry standards bodies, we shall revise this Privacy Notice and implement appropriate technical modifications in a timely manner. Notwithstanding the foregoing, we do recognize and honor Global Privacy Control (GPC) opt-out preference signals transmitted in accordance with the GPC specification (globalprivacycontrol.org), as required by the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) and analogous state privacy legislation.

If you are a natural person domiciled in a US state that has enacted comprehensive consumer privacy legislation — including but not limited to California (California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, Cal. Civ. Code §§ 1798.100–1798.199.100), Colorado (Colorado Privacy Act, C.R.S. §§ 6-1-1301 et seq.), Connecticut (Connecticut Data Privacy Act, Conn. Gen. Stat. §§ 42-515 et seq.), Virginia (Virginia Consumer Data Protection Act, Va. Code §§ 59.1-575 et seq.), Utah (Utah Consumer Privacy Act, Utah Code §§ 13-61-101 et seq.), and any subsequently enacted state privacy statutes — you may be entitled to exercise the following supplemental rights:

• Right to Know / Right to Access — the right to request disclosure of the specific categories and pieces of personal information collected, the sources from which such information was collected, the business or commercial purposes for collection, and the categories of third parties with whom such information has been shared or disclosed
• Right to Deletion — the right to request that we delete personal information we have collected from you, subject to certain statutory exceptions including but not limited to data necessary to complete a transaction, detect security incidents, comply with legal obligations, or exercise free speech rights
• Right to Opt-Out of Sale or Sharing — the right to direct us not to sell or share your personal information to third parties for cross-context behavioral advertising purposes (we hereby affirm that Fawkes Games does not engage in the sale of personal information as defined under applicable state privacy statutes)
• Right to Non-Discrimination — the right not to receive discriminatory treatment, including but not limited to denial of goods or services, imposition of different prices or rates, or provision of a different level or quality of service, for exercising any of your privacy rights
• Right to Opt-Out of Targeted Advertising — the right to opt out of the processing of personal data for the purposes of targeted advertising, as defined by applicable state privacy legislation

We hereby certify that we have not sold, shared, or disclosed for valuable consideration any personal information of consumers to any third party for business or commercial purposes during the twelve (12) month period preceding the effective date of this Privacy Notice. To exercise any of the rights enumerated above, please submit a verified consumer request to our Data Protection Officer at [email protected]. We shall verify your identity before processing any request and respond within the timeframes prescribed by applicable law (generally forty-five (45) calendar days, subject to one permitted extension of forty-five (45) additional days upon notice to the consumer).

Commonwealth of Australia and New Zealand

For data subjects located within the Commonwealth of Australia, we process personal information in compliance with the Australian Privacy Act 1988 (Cth) as amended, including the Australian Privacy Principles (APPs) set forth in Schedule 1 thereto, and any applicable registered APP codes. For data subjects located in New Zealand, we process personal information in accordance with the Privacy Act 2020 (NZ) and the Information Privacy Principles contained therein. You retain the right to request access to, and correction of, any personal information we hold about you at any time, subject to the exemptions and limitations prescribed by applicable legislation. Complaints regarding our handling of personal information may be directed to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au, or the Office of the Privacy Commissioner (New Zealand) at privacy.org.nz, as applicable.

Republic of South Africa

For data subjects located within the Republic of South Africa, we process personal information in compliance with the Protection of Personal Information Act, 2013 (POPIA, Act No. 4 of 2013) and the regulations promulgated thereunder. You have the right to request access to, correction of, or deletion of your personal information, and to object to the processing of your personal information on reasonable grounds. If you are dissatisfied with our handling of a complaint relating to the processing of your personal information, you have the right to lodge a complaint with the Information Regulator (South Africa) at [email protected] or via the Regulator's official complaints portal at inforegulator.org.za.

We reserve the right to amend, revise, supplement, or otherwise modify this Privacy Notice at any time, in our sole discretion, to reflect changes in our data processing practices, applicable legal or regulatory requirements, industry standards, or organizational structure. When we make material amendments to this Privacy Notice — defined as changes that substantively alter the scope, purpose, or manner of processing, or that materially affect your rights as a data subject — we shall provide conspicuous notice through one or more of the following channels: in-game notification systems, the Fawkes Hub desktop application, electronic mail transmitted to the address associated with your account, or prominent placement on our corporate website. The "Last Updated" date displayed at the top of this document shall be revised to reflect the effective date of the most recent amendment. Your continued use of our services following the posting of an amended Privacy Notice constitutes your acknowledgment of, and agreement to be bound by, the modified terms, to the extent permitted by applicable law.

If you have questions, concerns, complaints, or requests regarding this Privacy Notice, our data processing practices, or the exercise of your rights as a data subject under applicable data protection legislation, you may contact our Data Protection Officer and/or our legal department through the following channels:

• Electronic Mail: [email protected]
• Registered Office: Fawkes Games LTD, Pere Toshev 105, Plovdiv 4004, Republic of Bulgaria (European Union Member State)

You may review, update, and rectify your account information and communication preferences at any time through the self-service account management interfaces available within your game account settings or the Fawkes Hub platform. To submit a formal Data Subject Access Request (DSAR) for a comprehensive export of all personal data associated with your account, or to request the erasure of your personal data in accordance with applicable data protection legislation, please submit a verified request through our designated DSAR submission portal or transmit a written request to our Data Protection Officer at [email protected]. All requests shall be processed in accordance with the verification procedures, timelines, and obligations prescribed by applicable law. We may require you to provide sufficient information to verify your identity and confirm your authority to make the request before processing any DSAR.