Privacy Policy
Information on how we process your personal data

1.                  Introduction

This Privacy Policy (the “Policy”) describes how Luau AB, reg. no. 559149-3290 (“Luau”, “we”, “us” or “our”), at the address Djäknegatan 23, 211 35 Malmö, processes your personal data when you register and use our mobile application, visit our website, or contact us through telephone or e-mail.

We are responsible for the processing of your personal data as described in the Policy in the capacity of data controller. If you would like to know more about our processing of your personal data, you are welcome to contact us, e.g., via the address above or via our email address: support@luau-games.com.

It is important to us that you feel comfortable with how we process your personal data, and we therefore ask you to read through this Policy, which we may update from time to time. If we make changes to the Policy, the new version will apply from the time it is published on our website. At the top of the page, you can see when the Policy was last changed.

 

1.1                Introduction and the connection concept

We strive to process as little personal data as possible and allow our players to play our game without having to share their personal data with third party vendors. Hence, we have constructed our game in a way that allows you to choose when we will share your personal data with third parties.

In order to clearly demonstrate our intention to process as little of our players personal data as possible, we will start by introducing the connection concept. We will do this by describing the way you, as a player, interacts with the Luau Game Server when you log-in to the server and connect with another platform to be able to save the progress across devices.

The first step is the initial installation of the mobile application to your device. After conducting this first step, the next step is that the game register you as a player. When you register as a player you will have to choose a player name and an optional picture ID (i.e., an avatar of choice). Thereafter, you will be given a tracking ID. When provided with this (mainly optional) information an origin account is registered and sent back to the game. You, as a player, can now access the game. When choosing your player name, we recommend you to choose another name than your own, if you prefer to remain as unidentifiable as possible.

If you want to access and play the game on multiple devices or share your score with your friends, you’ll have to connect your user account with one of the following third parties; Apple (Apple ID), Google (Google account) or Facebook. This is a completely voluntary option that we provide you, in order to simplify your player experience by multiplying the options you have of accessing the game. If you choose to apply this option, the game fetches a so called “identity token” which is then verified and, if it is valid, returned with a unique identifier of you as a user. When this process is completed you as a player can now access the game and save and sync progress across devices. If you have any questions regarding any data that is shared between you and Apple, Google, or Facebook or how these platforms process your personal data, please review their respective privacy policies.

 

2.                  How we collect your personal data

The personal data we process relating to you is mainly collected from you when you use our mobile application, visit our website or when we come into contact with you – e.g., via email or telephone. We may also collect your personal data from a third party, usually from the service providers of our in-game store features.

 

3.                  How we process your personal data

3.1                Introduction

We only process your personal data to the extent permitted in accordance with applicable data protection legislation. This means inter alia that we need to have a legal basis for the purposes for our processing your personal data, which in our context generally means one of the following legal bases.

Performance of legal obligations – the processing is necessary in order to fulfil our legal obligations according to law or other statutes that we are subject to, or if we are subject to orders or decisions by courts or authorities, which require us to process your personal data.

Legitimate interests – the processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, provided that they are not overridden by your interests or fundamental rights or freedoms (in which case the processing would not be allowed).

Consent – the processing is carried out with your prior consent, where we inter alia are responsible for clearly informing you of what processing you consent to and your right to withdraw your consent in relation to our continued processing.

Below, we explain more about the categories of personal data we process, for what purposes we process them and what legal bases we rely on when processing your personal data, including for how long we store your personal data.

 

3.2                To maintain and improve our mobile application

Purposes of the processing
Categories of personal data

To collect statistical data in our mobile application, in order to maintain and improve their functionality, the user experience, and in order to discover and handle errors, breaches and incidents.

To allow you to access the game data across devices by connecting the origin account to Apple, Google or Facebook.

The personal data we process consist of:

·       Your name (if you choose it as your player name);

·       Player Name

·       User ID connected to your Player Name

·       Origin account (randomised email and password connected to your User ID)

·       IP-address

Legal basis: Legitimate interest, where our legitimate interest is to collect information to maintain and improve the functionality, content, and security of our mobile application.
Storage period: We collect and store information on how players interact with our mobile application for as long as you player account is active. Once you have deleted your player account under the Operations page, all related information is deleted and can no longer be restored.
Sharing of personal data: We will share your Tracking ID with Google Analytics. If you choose, we will connect you Origin Account to Apple, Google or Facebook. The statistics we produce and the analysis we carry out by using these services are based on aggregated data and other pseudonymised or anonymized data.
3.3                Advertisement in the mobile application

Purposes of the processing
Categories of personal data

To provide you with suitable advertisement within the mobile application.
The personal data we process consist of:

·       User ID

·       Tracking ID

·       Advertising IDs (IDFA)

·       IP-address

·       usage statistics such as session, duration, impression, and click-throughs
Legal basis: Your consent, which must be voluntarily given. Thus, it is completely up to you if you want to provide it or not – and it can be withdrawn at any time.
Storage period: We collect and store information for direct marketing for as long as you player account is active or until you withdraw your consent.
Sharing of personal data: We will share your personal data with the relevant marketing service providers.
3.4                Support and troubleshooting

Purposes of the processing
Categories of personal data

To administer complaints and bugs as part of our gaming support and troubleshoot failed transactions in the in-game store services. Complaints can for example be submitted through our “contact us” form on our website.
The personal data we process consist of:

·       Player Name

·       Purchase history and receipts

·       Any communication you send to us, in-game or through external sources

·       First and last name (optional)

·       Email address (optional)

·       Phone number (optional)
Legal basis: Legitimate interest, where our legitimate interest is to collect information to maintain and improve the functionality, content, and security of our mobile application and website.
Storage period: We collect and store information on how players interact with our mobile application for as long as you player account is active. Once you have deleted your player account under the Operations page, all related information is deleted and can no longer be restored.

We collect and store any communication regarding bugs, troubleshooting and failed transactions that you send to us using external sources for as long as the case is open, but no longer than two (2) months after the matter has been closed.

If we need to take measures in order to establish, exercise or defend legal claims, we will store your personal data for a longer time for these purposes.
Sharing of personal data: Where the matter concerns bugs or troubleshooting in relation to our mobile application, we will not share your personal data with any 3rd party.

Where the matter concerns failed transactions in the in-game store, we will share your personal data with the relevant service provider of the in-game store features depending on what platform you are using (i.e. Apple or Android).

3.5                Job applications

Purposes of the processing
Categories of personal data

For selection and recruitment of candidates based on submitted application documents (such as CVs and cover letters) for example submitted through our “contact us” form on our website, interviews, taking of references, and, where applicable, personality and intelligence tests.
The personal data we process consist of:

·       First and last name

·       Address

·       Contact information such as e-mail address and phone number

·       Application documents such as CVs and cover letters

·       Picture (where applicable)

·       Information provided about you during interviews and reference taking, such as reviews from previous employers

·       Test results from personality and intelligence tests
Legal basis: Legitimate interests where our legitimate interest is to be able to evaluate your merits and skills in connection with selections for and decisions on recruitment.

Compliance with a legal obligation to document information on education, work experience and other merits relating to those who become employed in order to comply with the regulations in Chapter 2 Section 4 of the Swedish Discrimination Act (Sw. diskrimineringslagen (2008:567)).
Storage period: Data collected about you in connection with your application for a job with us is deleted as a starting point after the recruitment process has ended and no later than two (2) years thereafter.

Sharing of personal data: We will share your personal data with our supplier of recruiting system.

3.6                To fulfil legal obligations or to establish, exercise or defend legal claims

We may process your personal data in order to fulfil our legal obligations according to law or other statutes that we are subject to, or if we are subject to orders or decisions by courts or authorities, which require us to process your personal data.

We may also process your personal data so that you, we ourselves, our any relevant third party can establish, exercise or defend its legal claims, e.g. in connection with an ongoing dispute.

 

4.                  Security measures

We have taken measures to ensure that your personal data is handled in a safe way. For example, access to systems where personal data is stored is limited to our employees and service providers who require it in the course of their duties. Such parties are informed of the importance of maintaining security and confidentiality in relation to the personal data we process. We maintain appropriate safeguards and security standards to protect your personal data against unauthorized access, disclosure or misuse. We also monitor our systems to discover vulnerabilities.

 

5.                  How we share your personal data

Access to your personal data is limited to persons who require such access for the purposes described in Section 3 above. Your personal data will therefore be shared with the following categories of 3rd party recipients:

a)    Service providers: We use third party service providers to manage parts of our business operations. We will share personal data with such third parties in order for them to supply us with services, e.g. IT services or other administrative functions or provide services as sub-contractors in connection with our own services. When we use such service providers, we enter into data processing agreements and take other suitable measures to ensure that your personal data is processed in line with this Policy.

b)    Our partners: We will from time to time cooperate with external parties in order to improve our services and business. Such parties either process your personal data as data controllers according to their own terms and policies for handling personal data, or as our data processors according to our instructions. In the latter case, we enter into data processing agreements and take other suitable measures to ensure that your personal data is processed in line with this Policy.

c)     Sale or transfer of business or assets: We will share your personal data with a buyer/investor or prospective buyer/investor in the event of a sale, assignment or other transfer of all or parts of our shares, assets or operations. When such transfer occurs, we will take actions in order to ensure that the receiving party processes your personal data in accordance with this Policy. The purpose of such sharing or processing of your personal data is to allow a (potential) buyer/investor to carry out an assessment of us as a company and, where necessary, take actions and make preparations in the event a sale, assignment or other transfer should occur, where such sharing or processing of your personal data is carried out with reference to the legitimate interests of allowing such assessment, actions and preparations by the (potential) buyer/investor.

d)    Public authorities: We will share your personal data with public authorities such as the Swedish Police or the Swedish Tax Agency when we are required to do so by e.g. applicable law or other legal statutes or orders or decisions by courts or authorities in order to fulfil the legal obligation specified therein.

 

6.                  Where we process your personal data

We strive to always process your personal data within the EU or EEA. However, we will transfer your personal data to service providers who, either themselves or by their sub-contractors, are located or have business activities in a country outside the EU or EEA. In such cases, we are responsible for ensuring that the transfer is made in accordance with applicable data protection legislation before it occurs, e.g. by ensuring that the country in which the recipient is located ensures an adequate level of data protection according to the European Commission, or by ensuring appropriate safeguards based on the use of standard contractual clauses that the European Commission has adopted and other appropriate measures to safeguard your rights and freedoms.

You may access a list of the countries that the European Commission has decided provide an adequate level of data protection at http://ec.europa.eu/justice/data-protection/international-transfers/adequacy/index_en.htm.

You may access the European Commission’s standard contractual clauses at http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32010D0087.

The countries outside the EU/EEA to which our suppliers currently transfer personal data are: USA.

 

7.                  Your rights

You have rights in relation to us and our processing of your personal data. Below, you will find information about your rights and how you can exercise them.

Please note that your rights apply to the extent that follows from applicable data protection legislation and that there may be exceptions to the rights where applicable. We also ask you to note that we may need more information from you in order to e.g. confirm your identity before proceeding with your request to exercise your rights.

To exercise your rights or request information about them we ask that you contact us, which is most easily done via email: support@luau-games.com.

7.1                Right of access

You have the right to obtain a confirmation as to whether or not we process your personal data. If that is the case, you also have the right to receive copies of the personal data concerning you that we process as well as additional information about the processing, such as for what purposes the processing occurs, relevant categories of personal data and the recipients of such personal data.

7.2                Right to rectification

You have the right to, without undue delay, have incorrect personal data about you rectified. You may also have the right to have incomplete personal data completed.

7.3                Right to erasure

You have the right to obtain that we erase your personal data without undue delay in the following circumstances:

·       The personal data is no longer necessary in relation to the purposes for which they were collected or otherwise processed;

·       Our processing is based on your consent and you withdraw your consent to the relevant processing;

·       You object to processing that we carry out based on a legitimate interest, and your objection overrides our or another party’s legitimate interest of the processing;

·       The processed personal data is unlawfully processed;

·       The processed personal data has to be erased for our compliance with one or more legal obligations.

As a player of our mobile application, you can delete your player account under the Operations page in each game. Doing to will delete all related player data (i.e. progress, inventory, purchases, team association, merge history and 3rd party connections). Such deletion is permanent and the data cannot be restored after it is performed.

7.4                Right to restriction

You have the right to request that we restrict the processing of your personal data in the following circumstances:

 

·       You contest the accuracy of the personal data during a period enabling us to verify the accuracy of such data;

 

·       The processing is unlawful and you oppose erasure of the personal data and request restriction instead;

 

·       The personal data is no longer needed for the purposes of the processing, but is necessary for you for the establishment, exercise or defense of legal claims;

 

·       You have objected to the processing of the personal data which we carry out based on a legitimate interest, pending the verification whether your objection overrides our or another party’s legitimate interest to continue with the processing.

 

7.5                Right to object

You have a right to object to our processing of your personal data when it is based on our or another party’s legitimate interest. If you object, we must demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms in order to be allowed to continue with our processing.

7.6                Right to data portability

If our processing of your personal data is based on the performance of a contract with you or your consent, you have the right to receive the personal data you have provided us relating to you in an electronic format. You also have the right to have the personal data transferred from us directly to another data controller, where technically feasible.

We ask you to observe that this right to so called data portability does not cover personal data which we process manually.

7.7                Right to withdraw consent

If our processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. A withdrawal of your consent does not affect the lawfulness of the processing that took place based on the consent before your withdrawal.

8.                  Complaints with the supervisory authority

In Sweden, the Swedish Authority for Privacy Protection (Sw. Integritetsskyddsmyndigheten) is the authority responsible for supervising the application of current data protection legislation. If you believe that we process your personal data in a wrongful manner, we encourage you to contact us so that we can review your concerns. However, you may file a complaint with the Swedish Authority for Privacy Protection at any time.

_______________________