Privacy Policy www.clansoflondon.com website
We – Well Played Games Ltd. („Well Played“ or „we“) – would like to inform you about our processing of your personal data in accordance with the General Data Protection Regulation ("GDPR").
Our privacy policy is modular in structure. Is consists of general information for all processing of personal data and processing situations (I.) and special information, the content of which relates only to the processing situation specified there (II. ff.). To find the parts relevant to you, please refer to the following structure:
II. Supplementary information on data processing when visiting the website
III. Supplementary information for users of the game "Vampire: The Masquerade - Clans of London"
I. General information
1. Controller
"Controller" means the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data.
Controller of the website and the app:
Well Played Games Ltd.
3d floor, Walton House, 11-15 Parade
Leamington Spa CV32 4DG
United Kingdom
mail: info@wellplayed.games
website: www.wellplayed.games
2. Legal basis of the processing of personal data
As a matter of principle, we collect and use personal data of our users only to the extent necessary to provide our website, our content and our services. The collection and use of personal data of our users is regularly only carried out with the consent of the user. An exception is made in those cases where prior consent cannot be obtained for factual reasons and the processing of the data is permitted by legal regulations.
We process your personal data based on the following legal bases:
a) Consent of the data subject
Insofar as we obtain the consent of the data subject for processing of personal data, Art. 6 para. 1 lit. a EU General Data Protection Regulation (GDPR) serves as the legal basis for the processing of personal data.
b) Performance of contract
When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Art. 6 para. 1 lit. b GDPR serves as the legal basis. This also applies to processing operations which are necessary to carry out pre-contractual measures.
c) Legal obligation
Insofar as processing of personal data is necessary to fulfill a legal obligation to which our company is subject, Art. 6 para. 1 lit. c GDPR serves as the legal basis.
d) Legitimate interets
If the processing is necessary to safeguard a legitimate interest of our company or of a third party and if the interests, fundamental rights and freedoms of the data subject do not outweigh the former interest, Art. 6 para. 1 lit. f GDPR serves as the legal basis for the processing.
3. Data deletion and storage period
The personal data of the user will be deleted or blocked as soon as the purpose of the storage no longer applies. Furthermore, data may be stored if this has been provided for by the European or national legislator in EU ordinances, laws or other regulations to which the person responsible is subject. Data will also be blocked or deleted when a storage period prescribed by the above-mentioned standards expires, unless there is a need to continue storing the data for the purpose of concluding or fulfilling a contract.
4. Recipient of personal data
Internally, only those entities process personal data that require it for the fulfillment of their processing purposes. This also applies to the order processors, service providers and vicarious agents employed by us. All offices and persons who work with personal data are obliged to maintain data secrecy and have been made aware of the sensitive nature of handling such data.
Personal data will only be passed on to third parties if this is in accordance with data protection regulations. In particular, persons employed to carry out our business operations (e.g. banks, tax consultants, service providers for EDP and IT services) as well as government agencies/authorities may receive your personal data if this is necessary to fulfill a legal obligation.
5. Data processing in third countries
In some cases, our services require the processing of personal data in countries outside the EU/EEA ("third countries") by our contract processors. Insofar as personal data is processed and there is no level of data protection in the country that corresponds to the European standard, which has been confirmed by an adequacy decision pursuant to Article 45 (3) of the GDPR by the EU Commission, we have concluded EU standard contractual clauses with the processors concerned in order to establish suitable guarantees within the meaning of Article 46 of the GDPR. A copy of the EU standard contractual clauses can be found here: https://eur-lex.europa.eu/legal-content/DE/TXT/PDF/?uri=CELEX:32021D0914&from=DE.
Insofar as third-country processing takes place, we point this out in the following.
6. Rights of data subjects
If your personal information is processed, you have the following rights.
a) Right of access
You have the right to obtain from us confirmation as to whether or not personal information concerning you are being processed, and, where that is the case, access to the personal data and the following information:
(1) the purposes of the processing;
(2) the categories of personal data concerned;
(3) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
(4) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
(5) the existence of the right to request from us rectification or erasure of personal data or restriction of processing of personal information or to object to such processing;
(6) the right to lodge a complaint with a supervisory authority;
(7) where the personal data are not collected from you, any available information as to their source;
(8) the existence of automated decision-making, including profiling, referred to in Art. 22 para. 1 and 4 and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.
You have the right to request information as to whether the personal data concerning you is transferred to a third country or to an international organization. In this context, you may request to be informed of the appropriate guarantees pursuant to Art. 46 GDPR in connection with the transmission.
b) Right of rectification
You have the right to obtain from us within undue delay the rectification of inaccurate or incomplete personal information. Taking into account the purposes of the processing, you shall have the right to have incomplete personal information completed, including by means of providing a supplementary statement.
c) Right to restriction of processing
You shall have the right to obtain from us restriction of processing where one of the following applies:
(1) the accuracy of the personal data is contested by yourself, for a period enabling us to verify the accuracy of the personal data;
(2) the processing is unlawful and the data subject opposes the erasure of the personal information and requests the restriction of their use instead;
(3) we no longer need the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
(4) You have objected to processing pursuant to Art. 21 para. 1 pending the verification whether the legitimate grounds override those of the data subject.
Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a Member State.
If you have obtained restriction of processing pursuant to the above, you shall be informed by us before the restriction of processing is lifted.
d) Right to erasure (‘right to be forgotten’)
You shall have the right to obtain from us the erasure of personal information concerning without undue delay and we shall have the obligation to erase personal information without undue delay where one of the following grounds applies:
(1) the personal information is no longer necessary in relation to the purposes for which they were collected or otherwise processed;
(2) you withdraw consent on which the processing is based according to Art. 6 para.1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR, and where there is no other legal ground for the processing;
(3) you object to the processing pursuant to Art. 21 para. 1 GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 para 2 GDPR;
(4) the personal information has been unlawfully processed;
(5) the personal information has to be erased for compliance with a legal obligation in the European Union
(6) the personal information has been collected in relation to the offer of information society services referred to in Article 8 para.1.
Where we have made the personal information public and is obliged pursuant to the above to erase the personal information, we, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
The right to erasure shall not apply to the extent that processing is necessary:
(1) for exercising the right of freedom of expression and information;
(2) for compliance with a legal obligation which requires processing by the European Union or for the performance of a task carried out in the public interest
(3) for reasons of public interest relating to public health pursuant to Article 9(2)(h) and (i) and Article 9(3) of the DPA;
(4) for archiving, scientific or historical research purposes in the public interest or for statistical purposes in accordance with Art. 89 para. 1 GDPR, insofar as the right referred to in section a) is likely to make it impossible or seriously impede the attainment of the objectives of such processing, or
(5) for the establishment, exercise or defence of legal claims.
e) Notification regarding rectification or erasure of personal data or restriction of processing
We shall communicate any rectification or erasure of personal data or restriction of processing carried to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. We will inform you about those recipients if you request it.
f) Right to data portability
You have the right to receive the personal information, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal information have been provided, where:
(1) the processing is based on consent pursuant to Art. 6 para 1 lit. a or Art. 6 para 1 lit. b or Art. 2 para 2 lit. a
(2) the processing is carried out by automated means.
The right shall not adversely affect the rights and freedoms of others.
In exercising your right to data portability you shall have the right to have the personal information transmitted directly from one controller to another, where technically feasible.
The exercise of this right shall be without prejudice to the right of erasure. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
g) Right to object
You shall have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning him or her which is based on Art. 6 para. 1 lit e) or lit. f). We shall no longer process the personal information unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims.
Where personal information is processed for direct marketing purposes, you shall have the right to object at any time to processing of your personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing.
Where you object to processing for direct marketing purposes, the personal information shall no longer be processed for such purposes.
At the latest at the time of the first communication with you, the right referred to above shall be explicitly brought to your attention shall be presented clearly and separately from any other information.
In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise his or her right to object by automated means using technical specifications.
h) Right to revoke the declaration of consent
You have the right to revoke your data protection declaration of consent at any time. Revocation of your consent does not affect the legality of the processing that has taken place on the basis of your consent until revocation.
i) Automated individual decision-making
You shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you
This shall not apply if the decision:
(1) is necessary for entering into, or performance of, a contract between you and us
(2) is authorised by European Union law and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
(3) is based on your explicit consent.
We shall implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on our part, to express our point of view and to contest the decision.
Decisions shall not be based on special categories of personal data referred to in unless Art. 9 para.2 lit. a) or lit g) applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place.
j) Right of complain to a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right of appeal to a supervisory authority, in particular in the European Member State where you reside, work or suspect of infringement, if you believe that the processing of personal information concerning you is not in compliance with GDPR. The supervisory authority to which the complaint has been lodged shall inform the complainant of the status and results of the complaint, including the possibility of a judicial remedy under Art. 78 GDPR.
II. Supplementary information on data processing when visiting the website
We are responsible for our website www.clansoflondon.com and its subpages ("Website"). Through the use of our website, personal data is processed. Below we inform in detail about the data processing that takes place.
1. Providing the website and creating logfiles
When our website is accessed, we automatically collect data and information from the user's terminal device (so-called log files).
Processor
To provide our website, we use the processor Wix.com Inc. (Nemal St. 40, 6350671 Tel Aviv, Israel), with whom we have concluded a data processing agreement and who processes the personal data exclusively on our behalf. Wix provides sufficient with whom we have concluded a data processing agreement and who processes the personal data exclusively on our behalf. A transfer of personal data to Israel takes place on an adequacy decision of the Commission of the European Union; Art. 45 GDPR.
Processed information & duration of processing
The following information is processed during website visits:
-
Information about the browser type and version used
-
The operating system of the end device
-
The user's Internet service provider
-
The IP address of the end device
-
Date and time of access
The log files are deleted within seven days at the latest.
Purpose of processing and legal basis
The data is required for the presentation of the website on the user's terminal device, its functionality and for the analysis of any malfunctions. In addition, we use the data to optimize the website and to ensure the security of our information technology systems.
The legal basis is Art. 6 para. 1 p. 1 lit. f DSGVO. The collection of log files is absolutely necessary for the operation of the website. Consequently, there is no possibility for the user to object.
2. Social media links
We maintain online presences on social networks and platforms to communicate with clients, interested parties, and users who are active on those networks, and to be able to inform clients, interested parties, and users of our services.
Our Website therefore links to the website of Facebook, operated by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, ("Facebook"). Otherwise no data are exchanged with Facebook on our Website.
Our Website also links to the website of Instagram, operated by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Instagram”). Otherwise no data are exchanged with Instagram on our Website.
Our Website also links to the website of TikTok, operated by TikTok Technology Ltd., 10 Earlsfort Terrace, D02 T380 Co Dublin, Ireland (TikTok”). Otherwise no data are exchanged with TikTok on our Website
When you access the aforementioned networks or platforms, the terms and conditions and data processing policies of the companies that operate those networks or platforms will apply. Unless otherwise provided in our data privacy policy, we will process data of users if they communicate with us through social networks or platforms, e.g., if they post on our Facebook pages, or send us messages.
III. Supplementary information for users of the game „Vampire: The Masquerade – Clans of London“
We are responsible for the services available through our native app "Vampire: the Masquerade - Clans of London" (hereinafter "App"). Personal data is processed through the use of these services. Below we provide detailed information about the data processing that takes place.
-
Register and profile
The registration required for the use of our services is generally carried out via the respective platform (in particular Apple App Store and Google Play Store through which the user can obtain our app. The platforms also offer the option of in-app purchases and other services of their own. We have no influence on their data processing and the respective platform operator is responsible under data protection law. Their respective terms of use and privacy notices apply.
You can find the privacy policy of the Google Play Store here: https://policies.google.com/privacy?hl=de
The privacy policy of the Apple AppStore can be found here: https://support.apple.com/de-de/HT211970
The following personal data is processed by us as the person responsible for the app when the app is used:
-
Device-ID
-
IP-address
-
In-app purchase data
When using services subject to payment, the following additional data is processed:
-
Account data
The purpose of the processing is the provision of our contractually obliged services to users. The legal basis for the processing is the service agreement; Art. 6 para. 1 p. 1 lit. b DSGVO. The data is processed for the duration of the service agreement, unless there is a purpose and a legal basis for storage beyond this. This includes the statutory retention periods (Art. 6 para. 1 p. 1 lit. c DSGVO) as well as the storage for the assertion or defense of civil claims based on overriding legitimate interests (Art. 6 para. 1 p. 1 lit. f DSGVO).
2. Processor
To be able to provide our App we need sufficient server capacity. For this purpose we use the processor GameUp Online, Inc., d/b/a Heroic Labs, a Delaware corporation,(440 N Barranca Ave #3231, Covina, Ca 91723, USA), with whom we have concluded a data processing agreement and who processes the personal data exclusively on our behalf. A transfer of personal data to the USA takes place on Standard Contractual Clauses; Art. 46 GDPR.
3. Gameplay
The use of our games requires data processing without which the game cannot be operated. This data processing is particularly necessary to make the game available and playable in the first place, to detect and correct errors, to retrieve game scores or to link in-app purchases to the player account.
For this purpose, the following categories of personal data may be processed:
● Account name
● Internal ID
● Number and content of in-app purchases
● Country in which the game was downloaded
● Type of terminal device used (iPhone, iPad, etc.)
● Model number
● Operating system of the end device
● Language settings of the end device
● Date of the download
● App version
● Days since download ("age of the account")
● Duration of use of the game
● Number of times the game has been called up
Data processing is carried out on the basis of the service agreement and thus in accordance with Art. 6 (1) p. 1 lit. b GDPR.
4. Analytics
We process in-game data for the purpose of creating analytics and reports about our business activities. For analyzing the App, we also use the service Wix.com as our processor (see above).
The following personal data is processed for analysis:
-
Device ID
-
IP-adress
-
In-app purchase data[…]
Recipients of the analyzed data are The Phoenix Lighthouse GmbH (Karlsruhe, Germany) as our data processor, with whom we have concluded a data processing agreement and who processes the personal data exclusively on our behalf.
5. Newsletter
If you would like to receive the newsletter offered by us, we require an e-mail address from you as well as information that allows us to verify that you are the owner of the specified e-mail address and agree to receive the newsletter. Further data is not collected or only on a voluntary basis. We use this data exclusively for sending the requested information and do not pass it on to third parties. The technical processing of the newsletter dispatch is carried out by the service provider Wix.com, Inc., (Nemal St. 40, 6350671 Tel Aviv, Israel), with whom we have concluded a data processing agreement and who processes the personal data exclusively on our behalf. A transfer of personal data to Israel takes place on an adequacy decision of the Commission of the European Union; Art. 45 GDPR.
The processing of the data entered in the newsletter registration form is based on your consent (Art. 6 para. 1 sentence 1 lit. a DSGVO in conjunction with § 7 para. 2 no. 3 UWG) or, if you use our App, on the basis of our overriding legitimate interests in providing you with information about the App and related services (Art. 6 para. 1 sentence 1 lit. f) DSGVO in conjunction with § 7 para. 3 UWG). § Section 7 (3) UWG). We would like to point out that as a user of the App, you can object to the sending of the newsletter at any time. Likewise, you can revoke your consent to the storage of the data, the e-mail address and their use for sending the newsletter at any time, for example via the "unsubscribe" link in the newsletter. The legality of the data processing operations already carried out remains unaffected by the objection or revocation.
The data you provide for the purpose of receiving the newsletter will be stored by us or the newsletter service provider until you unsubscribe from the newsletter and will be deleted from the newsletter distribution list after you unsubscribe. Data that has been stored by us for other purposes remains unaffected by this.
6. Marketing
We use various types of analytics and advertising tools to successfully promote ads in our games and to provide ads on other websites.
For this purpose, the following categories of personal data may be processed:
● Android ID
● Type of terminal device used (iPhone, iPad, and the like).
● Installation source of the game (source from which the user downloaded the app.).
● Game ID
● Country code
● IP address of the end device
● Google Advertising ID (advertising ID from Google).
● Marketing-specific attribution information (if the user installed the game after viewing an ad).
● Paying user status
● User name
● Country in which the user registered.
● Date on which the user registered.
● Time at which the user registered.
The legal basis for the processing is your voluntary consent (Art. 6 para. 1 p. 1 lit. a GDPR). You can revoke your consent at any time. The legality of the data processing operations already carried out remains unaffected by the revocation.
The personal data will be processed for advertising purposes until you revoke your consent. If the personal data is not required for any further purposes, it will be deleted.
For this purpose, we use the processor ironSource, Derech Menachem Begin 121, Tel Aviv 6513307, Israel ("ironSource"). Further information on the processing of personal data at ironSource can be found in the privacy policy of ironSource: https://developers.is.com/ironsource-mobile/air/ironsource-mobile-privacy-policy/#step-1
7. Surveys
We do surveys of our users from time to time. When you participate in a survey, we process the following personal data:
● communicated player interests
● communicated player preferences
The legal basis for the processing is your voluntary consent (Art. 6 para. 1 p. 1 lit. a GDPR). You can revoke your consent at any time. The legality of the data processing operations already carried out remains unaffected by the revocation.
The personal data will be processed for advertising purposes until you revoke your consent. If the personal data is not required for any further purposes, it will be deleted.
8. Debugging
In order to fix game errors/bugs that occur with an individual user, it is sometimes not sufficient to process only aggregated information, but it is also necessary to sift through and evaluate personal data.
For this purpose, depending on the error, the following categories of personal data can be processed:
● User-ID
● Device-ID
● Android ID
● Device type
● Operating system of the end device
● Version of the operating system of the end device
● Language setting of the end device
● Audio setting of the terminal device
● List of other games published by the respective responsible party that have been played
● Graphics setting of the terminal device
● Installation source of the game
● IP address of the terminal device
● Google Advertising ID (advertising ID from Google).
● Apple IDFA (ID from Apple for advertisers)
● IDFV (ID from Apple for providers).
● Payer user status
● Player name
● Days since download
● Setting for push notifications
● Country in which the game was downloaded
● Date of download
● Version of the app that was downloaded
● Amount of real money spent
● Game time
● Number of games
● Number of purchases
● Country in which the user is using the app.
● Current app version
The data processing is based on the usage agreement that you accepted with us when you opened the game for the first time and thus in accordance with Art. 6 (1) p. 1 lit. b GDPR.
9. Support
You can send us support requests. Your data will be stored by us exclusively for the purpose of processing the support request and in case of follow-up questions.
The following categories of personal data may be processed for this purpose:
● E-mail address
● User name
● Contents of your request
● Operating system and version
● Device type
● Saved user ID
● Money spent on in-game purchases.
● IP address
● Location of registration
● Location
The legal basis for processing the data is Art. 6 para. 1 p. 1 lit. f GDPR. Our interest in answering your request corresponds to your interest. Since you are writing to us, a response is in your interest and you are aware that we need to process your data to respond to your request. If you have accepted our terms of use, the processing is based on Art. 6 para. 1 p. 1 lit. b GDPR.
The data will be deleted as soon as they are no longer necessary to achieve the purpose for which they were collected. This is the case when the respective conversation with the user has ended. The conversation is ended when it is clear from the circumstances that the matter in question has been conclusively clarified.
September 2023