Source: https://bytro.com/data-protection-guidelines/?lang=en
Timestamp: 2019-04-22 12:03:48+00:00

Document:
This is the data protection guideline of Bytro Labs GmbH (“Bytro Labs,” “we”). On our website („website“), we offer information on our services (“games”). In this data protection guideline we will inform you about which personal data we collect and process. We will also inform you about your rights. The responsibility of protecting and processing personal data is an important concern to Bytro Labs. Thanks to various technical and contractual measures, your data is protected against unauthorized access as well as loss. Bytro Labs took all technical and organizational measures necessary for this. In case of links directing to websites of third parties, please note that these companies provide own data protection guidelines that are applicable then. We provide our services only to persons of at least 16 years of age. Thus, we do not knowingly gather and process data of persons younger than 16 years of age.
We gather and use personal data of our users generally only as far as it is necessary for providing a functional website as well as our contents and services. Gathering and using personal data of our users normally will happen only after the user’s consent was given. An exception is made for those cases where for factual reasons no prior consent could be obtained and processing the data is allowed by legal provisions.
Insofar as we receive consent for the processing procedures from the affected person, Art. 6 para. 1 lit. a EU General Data Protection Regulation (GDPR) serves as legal basis for processing personal data.
For processing personal data necessary for executing a contract the affected person is contracting party of, Art. 6 para. 1 lit. b GDPR serves as legal basis. This also applies to processing procedures necessary to perform precontractual measures.
Insofar as processing personal data is necessary in order to fulfill legal obligations our company is subject to, Art. 6 para. 1 lit. c GDPR serves as legal basis.
In case vital interests of the affected person or another natural person call for personal data to be processed, Art. 6 para. 1 lit. d GDPR serves as legal basis.
If processing is necessary for upholding a justified interest of our company or a third party, as long as the interests, fundamental rights, and fundamental freedoms of the affected person do not outweigh the former interest, Art. 6 para. 1 lit. f GDPR serves as legal basis for processing.
All personal data of the affected person get deleted or blocked as soon as the reason for storing them expires. Besides, storing can take place when intended so by European or national lawmakers in form of Union regulations, laws, or other provisions the liable entity is subject to. Blocking or deletion of data also takes place when a storage period prescribed by said norms expires, unless there exists a necessity for continuing to store the data to conclude or fulfill a contract.
We are eager to make arrangements to a reasonable extent in order to prevent unauthorized access or distortion of these data and minimize the according risks. Nonetheless, providing personal data, be it personally, by phone, or via internet, always involves a certain amount of risk as no technological system can be entirely free from the possibility of getting manipulated or sabotaged.
We process the data gathered from you in accordance with German and European data protection laws. All employees are bound to data secrecy and data protection regulations and trained accordingly. For payment processes, your data is transmitted in an encrypted form using the SSL method.
Upon every access of our website, our system automatically records data and information from the computer system of the accessing computer.
The data are also saved in the log files of our system.
Legal basis for temporarily saving data and log files is Art. 6 para. 1 lit. f GDPR.
Having the system temporarily save the IP address is necessary in order to make delivering the services to the user’s computer possible. For this purpose the user’s IP address must be saved over the course of the session.
The saving in log files is done in order to ensure the functionality of the services. Also the data serve us in optimizing the services and in securing the security of our information technological systems. Only a statistical evaluation of the data sets takes place.
These purposes also make up our justified and overriding interest in processing data pursuant to Art. 6 para. 1 lit. f GDPR.
The data are deleted once they are no longer needed for fulfilling the purpose they were gathered for.
Gathering data for services and saving data in log files is absolutely necessary to operate the website. Consequently, the user has no possibility of objecting those.
Making contact is possible via the e-mail address provided. In this case the user’s personal data transmitted along with the e-mail are saved.
In this context no data are passed on to third parties. The data are used to process the request exclusively.
Legal basis for processing data when the user’s consent is present is Art. 6 para. 1 lit. a GDPR.
Legal basis for processing data transmitted in the course of sending an e-mail is Art. 6 para. 1 lit. f GDPR. If the e-mail contact is targeted at forming a contract, Art. 6 para. 1 lit. b GDPR is additional legal basis for processing.
Processing the personal data for us serves the sole purpose of processing the contact. This is also what makes up the required justified interest in processing the data.
The data are deleted once they are no longer needed for the purpose they were gathered for. For personal data transmitted via e-mail that is the case when the respective conversation with the user has come to an end. The conversation has come to an end when it can be concluded from the circumstances that the issue in question has been resolved conclusively.
The user has the possibility to at any time revoke their consent to having personal data processed. If the user makes contact with us, they may at any time object to having their personal data stored. In such an event, the conversation cannot be continued. All personal data saved in the course of making contact will be deleted in this case.
We gather and process personal data of applicants for the purpose of handling the application process. The data is used to check your suitability for the position (or, as the case may be, other job openings in our company) and complete the application process. The processing may take place electronically as well. That is the case in particular if an applicant transmits their respective application documents to the head of department electronically, for example via e-mail or by using the online form that can be found on the website. Your applicant data will be sighted by the human resources department after receiving them. Suitable applications are then forwarded internally to the department heads in charge of the respective vacant position. Then the further procedure gets coordinated. As a matter of principal, in our company only those who need access to your data to ensure an orderly run of our application process will be granted it. If the person in charge of processing an application enters an employment contract with an applicant, the transmitted data, bearing in mind all legal provisions, will be saved for the purpose of handling the employment. If the person in charge of processing an application does not enter an employment contract with the applicant, the application documents will be deleted after announcing the rejection, unless the person in charge of processing the application holds other justified interests opposing deletion. Other justified interests in this sense are, for example, a burden of proof in a lawsuit under the General Equal Treatment Act (Allgemeines Gleichbehandlungsgesetz AGG). Legal basis for processing is Art. 6 para. 1 lit. b GDPR. Should the occasion arise that after completing the application process the data are required for prosecution, the data can be processed based on the requirements of Art. 6 GDPR, especially to appreciate justified interests pursuant to Art. 6 para. 1 lit. f) GDPR. Our interest in that case would be assertion of or defense against claims. We will delete data six months after a rejection unless you gave consent to a longer period of storing. Should your application be crowned by success in form of being offered a position, the data will be moved from the applicant data system over to our human resource management system.
You may demand confirmation from the liable entity on whether personal data regarding your person are processed by us.
the existence of an automated decision making including profiling pursuant to Art. 22 para. 1 and 4 GDPR and – at least in these cases – insightful information on the logic involved as well as scope and intended impact of such processing for the person affected.
You are granted the right to demand information on whether the personal data regarding your person are transmitted to a third country or an international organization. In this context you may demand to be educated about any suitable guarantees pursuant to Art. 46 GDPR connected with this transmitting.
You hold a right to correction and/or completion against the liable entity, insofar as the processed personal data regarding your person are incorrect or incomplete. The liable entity has to make corrections immediately.
if you appealed against the processing pursuant to Art. 21 para. 1 GDPR and it is not decided yet whether the justified reasons of the liable entity outweigh your reasons.
If the processing of personal data regarding your person was limited, these data may – apart from storing them – be processed only with your consent, or in order to assert, exercise, or defend legal claims, or to protect the rights of another natural or legal person, or because of an important public interest of the Union or a member state.
If the limitation of processing was limited according the above-mentioned requirements, you will be informed by the liable entity before the limitation is lifted.
We offer the possibility of deleting or correcting your own personal data ingame on your own. When logged into your account, you may delete your personal data by choosing “Settings” and “Delete Account” at the end of the page.
The personal data regarding your person are no longer required to fulfill the purposes they were gathered or processed in another way for.
You revoke your consent the processing pursuant to Art. 6 para. 1 lit a or Art. 9 para. 2 lit. a GDPR was based on and there is no other legal basis for processing.
You object the processing pursuant to Art. 21 para. 1 GDPR and there are no overriding justified reasons for processing, or you object the processing pursuant to Art. 21 para. 2 DPGR.
The personal data regarding your person were processed illegally.
The deletion of the personal data regarding your person is necessary in order to meet a legal obligation of Union law or law of a member state the liable entity is subject to.
The personal data regarding your person were gathered in regards to services offered by the information corporation pursuant to Art. 8 para. 1 GDPR.
If the liable entity published the personal data regarding your person and if pursuant to Art. 17 para. 1 GDPR they are obliged to delete them, they will, bearing available technology and implementation costs in mind, take measures, including technical measures, to inform persons responsible for data processing, who process the personal data, that you, being the affected person, demanded deletion of all links to these personal data or copies or replicas of these personal data.
for assertion, exercise, or defence of legal claims.
If you asserted your right to correction, deletion, or limitation of processing against the liable entity, they are obliged to communicate this correction or deletion of data or limitation of processing to all receivers the personal data regarding your person were disclosed to, unless this turns out to be impossible or connected with disproportional efforts.
You hold the right against the liable entity to be informed about these receivers.
processing takes places using automated procedures.
In application of this law, you also hold the right to have the personal data regarding your person transmitted from one liable entity directly to another liable entity, as far as that is technically possible. Freedoms and rights of other persons are not to be affected by this.
The right to data transferability does not apply to processing personal data necessary for performing tasks of public interest or in the exercise of public authority granted to the liable entity.
You hold the right to object the processing of personal data regarding your person, happening pursuant to Art. 6 para. 1 lit. e or f GDPR, at any time for reasons resulting from your special situation; this also applies to any profiling based on these provisions.
The liable entity no longer processes the personal data regarding your person, unless they can proof compelling legitimate reasons that outweigh your rights and freedoms, or if the processing serves the purpose of asserting, exercising, or defending legal claims.
If the personal data regarding your person is processed in order to pursue direct advertising, you hold the right to object the processing of personal data regarding your person for the purpose of advertisements of that kind at any time; this also applies to any profiling connected with such direct forms of advertising.
If you object the processing for purposes of direct advertising, the personal data regarding your person will no longer be processed for these purposes.
You have the possibility, in the context of services performed by the information corporation – regardless of directive 2002/58/EG – to exercise your right to objection by means of automated methods using technical specifications.
You hold the right to revoke your data protectional declaration of consent at any time. The legality of any processing that took place based on the consent prior to the revocation remains untouched by the revocation of consent.
c) happens with your explicit consent.
However, these decisions must not be based on special categories of personal data pursuant to Art. 9 para. 1 GDPR, unless Art. 9 para. 2 lit a or g apply and appropriate measures to protect the rights and freedoms as well your justified interests were taken.
Regarding the cases mentioned in (a) and (c), the liable entity takes appropriate measures to protect the rights and freedoms as well as your justified interests, part of which at minimum must be the right to have a person intervene on the part of the liable entity, to explain the own standpoint, and to challenge the decision.
Irrespective of any other legal or judicial remedy, you hold the right to complain to a supervisory authority, in particular in the member state of your residence, your workplace, or the presumed place of breach, if you are of the opinion that the processing of the personal data regarding your person violates the GDPR.
The supervisory authority receiving the complaint informs the complainant on the status and results of the complaint, including the possibility of legal remedy pursuant to Art. 78 GDPR.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 22
 Art. 46
 Art. 21
 Art. 6
 Art. 9
 Art. 21
 Art. 21
 Art. 8
 Art. 17
 Art. 6
 Art. 9
 Art. 9
 Art. 78