Data Privacy Information Responsible body for this online offer Bigpoint GmbH Drehbahn 47-48 20354 Hamburg Germany Tel.: +49 (0) 40 8814130 (no support) info@bigpoint.net (no support) Name and address of the data protection officer Data protection agency Maximilian Hartung Frauentorstraße 9 86152 Augsburg Germany Tel.: +49 821 90786458 privacy@bigpoint.net General This Data Privacy Information informs you of which personal data is collected by Bigpoint in the context of our websites and the games and other services provided by us (jointly referred to as the “Online Offer”). It also explains how such data is processed and used. The protection of your personal information is important to us. Your data is protected against unauthorised access and loss through the use of various electronic, technical, physical, administrative and contractual measures. Bigpoint has taken the necessary technical and organisational precautions to ensure that the regulations for data privacy are respected both internally and by external service providers. This Data Privacy Information contains transparent and clear information to ensure that visitors to our site and customers are well informed regarding the collection, processing and use of their personal data. What is personal data? Personal data is any information relating to an identified or identifiable natural person (e.g. name, address, telephone number, date of birth or email address). Basically, you can use our Online Offer without providing personal information; however, the use of certain services may require you to submit personal information, e.g. registration for our games or participation in a competition. Legal basis We process personal data in accordance with the legal bases of the General Data Protection Regulation (GDPR). Please note that, in addition to the provisions of the GDPR, the national data protection requirements in your, or our country, of residence and domicile may also apply. Consent Insofar as we obtain the consent of the data subject to process personal data, Article 6 para 1 (a) GDPR serves as the legal basis for the processing of such personal data. Contract fulfilment and pre-contractual enquiries Article 6 para (b) GDPR serves as the legal basis for processing personal data that is required to fulfil a contract to which the data subject is a party, or to carry out pre-contractual measures. Legal obligation Article 6 para 1 (c) GDPR serves as the legal basis insofar as the processing of personal data is necessary to fulfil a legal obligation to which our company is subject. Protection of vital interests Article 6 para 1 (d) GDPR serves as the legal basis should the vital interests of the data subject or another natural person require the processing of personal data. Legitimate interests Article 6 para 1 (f) GDPR serves as the legal basis for processing should such processing be necessary to safeguard a legitimate interest of our company or a third party, and if the interests, fundamental rights and freedoms of the data subject do not outweigh the former interest. If the processing of personal data is based on our legitimate interest, this will be to enable us to conduct our business activities, in particular with respect to the well-being of our employees and the owners of the company. Purposes of processing We collect personal data for various purposes as described in this Data Privacy Information; these include: To provide our Online Offer and to perform a contract in accordance with our General Terms and Conditions; For contact requests and communication, in particular to provide help and support, and to send you relevant information regarding your contract; For the use and payment of fee-based goods and services; For our own and third-party advertising, market research and reach measurement to the extent permitted by law or based on your consent; To send a newsletter subject to your consent; To shape and improve our offer as required, partially in pseudonymised and/or anonymous form; To prevent, investigate and report criminal offences, e.g. fraud, e.g. credit card misuse, identity fraud; To assert legal claims, including debt collection and defence in legal disputes; To fulfil legal obligations, and, in particular, to ensure compliance with retention obligations. If you have used our games for an extended period of time, we would like to inform you that we also use data from our predecessor company, Bigpoint S.à.r.l. Co, SCS, 10A rue Henri M. Schnadt, L-2530 Luxembourg. This refers to master data that we require to continue offering games without interruption. This data refers in particular to game progress, game scores and information regarding the use of and payment for services. Credit information For German users, we will obtain information about your previous payment history from infoscore Consumer Data GmbH, Rheinstr. 99, 76532 Baden-Baden, insofar as this is necessary for the conclusion or performance of a contract between the data subject and the responsible body (data controller). Cookies and the collection of log files Bigpoint collects the following non-personal information within the context of the use of our websites, forums and games: IP addresses, including the time and date; Statistical information including the browser type, operating system, redirecting URL, date, time, pages used, total time of use, frequency of use. This data is used for statistical analyses of anonymous data records only, and not for personal use. IP addresses and the corresponding Internet information are saved for a period of a maximum of six months within the scope of our legal obligations regarding data retention. Data may also be retained for data security purposes to ensure the stability and reliability of our system. In certain circumstances Bigpoint may also use your IP address and the corresponding Internet information to track and prevent the use of multiple accounts for fraudulent purposes. Cookies and similar technologies We and our partners use cookies and similar technologies that fulfil the same functions as cookies (“Cookies”) in our Online Offer, among others to improve our Online Offer, to improve the user experience and to carry out personalised online advertising. Cookies are small text files that contain data from websites visited, e.g. the language settings on a website or the login status. Cookies are stored on your device by the browser you are using for their respective lifetime. Some Cookies are automatically deleted after the browser session has ended (“session” Cookies), while others are stored for a specified time or permanently in the user's browser, and delete themselves automatically after the specified time has elapsed (“temporary” or “permanent” Cookies). We may sometimes request your consent for the use of Cookies by us and our partners to save and retrieve information on your device. If you provide your consent, we will process your data on the legal basis of the declared consent. In certain cases, the data processed using Cookies is processed based on our legitimate interests or those of our partners, or if the use of Cookies is essential to fulfil our contractual obligations to you (e.g. the secure operation of our Online Offer). You can revoke your consent to the use of Cookies at any time with effect for the future. To do this, simply change your selection in our cookie manager, which you can access via the "Cookie Settings" of our Online Offer. You can also disable the storage of Cookies in your browser settings and delete the Cookies saved in your browser at any time. However, please note that our Online Offer may not function, or only to a limited extent, without the use of Cookies. In addition, please note that objections to the use of Cookies are sometimes implemented through opt-out Cookies. Should you delete all the Cookies, any objections may therefore no longer be taken into account and must be obtained from you again. Range measurement Our online service uses the “Scalable Central Measuring method” (SCM/SCMnG) from INFOline Ltd. GmbH (https://www.infonline.de) to determine statistical values for the use our offers. Anonymous measured data will be collected. For the recognition of computer systems, the SCM measurement method alternatively uses either a cookie with the ID “ioam.de”, “ivwbox.de”, a local storage object or a signature that is automatically created from different information transmitted by the browser. IP addresses are only processed in anonymous form. The range measurement was developed under strict observation of data protection policies. The objective of the range measurement system is to statistically determine how intensively, and by how many users, a website is being used. At no point in time will individual users be identified; their identities will always remain protected and they will receive no promotional material via the system. For online offers that are part of the Association of the Distribution of Advertising Materials (Informationsgemeinschaft zur Feststellung der Verbreitung von Werbeträgern e.V., IVW – www.ivw.eu) or are a part of the German Study Group for Online Research (Arbeitsgemeinschaft Online-Forschung e.V., AGOF – www.agof.de) study, “Internet Facts,” the usage statistics will be published on a monthly basis by AGOF, the Working Group of Media Analysis (Arbeitsgemeinschaft Media-Analyse e.V., ag.ma - www.agma-mmc.de), and by the IVW. The results can be viewed at: http://www.agof.de, http://www.agma-mmc.de and http://www.ivw.eu. In addition to the publication of measured data, the IVW regularly checks the SCM process to make sure it remains consistent with the data protection regulations. Additional information on the SCM process is available on the INFOnline GmbH website (https://www.infonline.de), which operates the system itself, on the AGOF’s data protection website (http://www.agof.de/datenschutz), and on the IVW’s data protection website (http://www.ivw.eu). You can object to SCM processing your data via the following website: http://optout.ioam.de and http://optout.ivwbox.de. Data transfer and service providers We will treat your data as strictly confidential and will not disclose it to third parties unless we are legally permitted to do so. We may, in individual cases, be legally obliged to disclose your information, for example to investigating authorities, whereby disclosure will only take place to the extent required by law. We use the companies affiliated with the Bigpoint Group and/or third parties to provide services on our behalf. This is mainly for payment transactions by external service providers (PayPal, Global Collect, etc.) and, in the event of default, by a debt collection company. Moreover, we provide your data to affiliated companies of the Bigpoint Group for marketing purposes and to further develop and improve our games. These affiliated companies of the Bigpoint Group and external companies are under an obligation to handle your data confidentially and securely, and may only use your data insofar as it is required for completing the task they have been assigned. Service providers are generally involved as processors who are only authorised to process the personal data of users of this Online Offer in accordance with our explicit instructions. Period of storage/retention periods We store your data for as long as this is necessary for the provision of our Online Offer and the associated services, or if we have a legitimate interest in the further retention of such. In all other cases, we will delete your personal information except for data we may be required to retain in accordance with the contractual or statutory requirements (e.g. tax or commercial purposes, invoices, etc.). Contractual retention periods may also arise from contracts with third parties (e.g. owners of copyrights and ancillary copyrights). We will block any data that is subject to a retention period until the expiry of the relevant period. Game information and partner offers When you check the box next to “Game information and partner offers”, you are granting us your express consent to receive this information. Your consent will be recorded and saved, and may be revoked at any time by using our contact form (www.bigpoint.net/support/). Surveys We carry out satisfaction surveys to improve our Online Offer. We therefore collect and process your data as stated in the declaration of consent or the surveys. The legal basis for the processing of this data is your consent in accordance with Article 6 para 1 (a) GDPR. You can withdraw your consent to the processing of your data at any time, e.g. via our contact form (www.bigpoint.net/support/). We use the services of LimeSurvey GmbH, Papenreye 63, 22453 Hamburg ("LimeSurvey") to conduct the surveys. We have concluded a data processing agreement with LimeSurvey in accordance with Article 28 GDPR. The data collected from the surveys is stored on LimeSurvey servers at Host Europe GmbH in Germany. Google Analytics This website uses Google Analytics and Google Analytics reports to evaluate demographic characteristics and interests. These services are provided by Google LLC (“Google”). Google Analytics uses “cookies”, which are text files placed on your computer to help the website analyse how users use the site. The information generated by the cookie about your use of the website is normally transmitted to, and stored by, Google on servers in the United States. If, however, you activate the Anonymise IP option on this website, Google will truncate your IP address so it only locates you within the member states of the European Union or other contracting states of the European Economic Area. Only in rare cases will the full IP address be transmitted to a Google server in the USA and truncated there. Google will use this information to evaluate your use of the website, to compile reports on website activity for website operators and to provide other services relating to website activity and Internet usage. The operator of this website will use information gathered via interest-related advertising and third-party visitor data (e.g. age, gender and interests) for the purpose of evaluation to find out more about the users of this website. No data that can be attributed to a specific person will be used here; this is for the exclusive purpose of a statistical evaluation of anonymous data sets. Google will not associate your IP address as transmitted by Google Analytics with any other data held by Google. You may refuse the use of cookies by selecting the appropriate settings in our cookie manager or your browser software, however please note that, if you do this, you may not be able to use the full functionality of this website. Furthermore, you can prohibit Google from collecting and analysing the data generated by the cookie about your use of the website (including your IP address) by downloading and installing the browser plugin available here http://tools.google.com/dlpage/gaoptout. Should you wish to adjust or prevent the analysis of your demographic or interest-based information, you can disable Google Analytics display ads and adjust the ads in the Google Display Network: https://www.google.com/settings/ads. If you access this website via a mobile device (smartphone, tablet, etc.) you may object to the use of your data by Google by clicking a separate link in the dialog box displayed. Social media plugins Facebook Various Facebook links are embedded on our website; this web presence is operated exclusively by Facebook Inc., 1601 S California Ave, Palo Alto, CA 94304, USA (Facebook). In the context of our web presence, these links are identified by the Facebook logo or by the phrase ‘Like’ (no Facebook plugins are used). If a user clicks one of these links, the Facebook plugins will be activated and will establish a direct connection via the user’s browser to a Facebook server. If the user clicks (follows) one of the links while visiting our website and is logged into their personal Facebook account, Facebook will be notified that the user has visited our website. Facebook may link your visit to the website to your account. This information will be transmitted to Facebook and stored there. To prevent this, the user must log out of their Facebook account before clicking the link. The functions embedded in the links by Facebook, in particular the transfer of data and user information, are not activated when you visit our website, but only when you click the corresponding links. The purpose and scope of data collection via Facebook, the processing and use of such data at Facebook, your respective rights and personal setting options to protect your privacy are available in the Facebook privacy settings section (http://de-de.facebook.com/privacy/explanation.php). Please contact us if you have further questions regarding the collection, processing or use of your personal data and regarding the disclosure, correction, blocking or deleting of data in this respect. Facebook Connect We're offering you the opportunity to register for our services through Facebook Connect. To do this, you will be redirected to Facebook where you can log in with your Facebook user data. Your Facebook account will then be linked to our services. Depending on your Facebook settings, linking your account will allow the following data to be transmitted to us and/or retrieved by us: name, date of birth and email address. We will use this information exclusively for the purposes of identification and contract processing. For more information on Facebook Connect and the privacy settings, please refer to the Data Privacy Policy and Terms of Use of Facebook Inc. Mobile apps Our apps are provided through various app and software platforms, including the Apple App Store, the Google Play Store and social networks like Facebook. If you access, register with or use the platform or social network, personal data may be collected and used by the respective platform or social network over which we basically have no influence. You can find all the relevant information in the data protection guidelines or provisions of the respective platform or social network. IT security With the help of an IT security provider, we use Cookies to collect and process specific data anonymously about the features of the terminal device used by the user (“device-specific data”), raw data from the TCP/IP connection and data on the use of our website to prevent the misuse of our services. Initially, the IP address is also collected and processed but encrypted within a few seconds. No personal data is collected or stored. The information is stored with the IT security provider in a database for the prevention of fraud. If you conclude a contract on our website that involves a fee, or if the conclusion of a contract that involves a fee is approaching (e.g. at the beginning of the checkout process), we can access a risk evaluation regarding the terminal device you are using from the IT security provider's database which has been stored there. The risk evaluation is used, not exclusively, as a basis for deciding whether a contract for pecuniary interest can be concluded. Should we detect that a user is abusing, or has attempted to abuse, our services, we shall also transmit the data collected to the IT security provider. In this process, however, only device-specific data, and no personal data, shall be transmitted. Right of revocation, deletion of data If you have given consent to process personal data, you can withdraw this consent at any time. Bigpoint deletes your personal data insofar as it is no longer required or if you have requested the deletion of such data. Please note that data cannot be deleted if legal or other requirements to retain the data exist, or if we require the data to bill our services. Information on data protection, right to information and the correction, deletion and blocking of data Should you have any general questions regarding this Data Privacy Information and data protection, or if you would like to query, correct, block or delete your personal data in accordance with the legal stipulations, please contact us via email or post, stating your user ID, username, email address and, if applicable, your game. You can contact us or the data protection officer directly via the contact details at the top of this Data Privacy Information. Right of appeal to the regulatory body You have the right to file a complaint with a data protection authority. You can contact the competent data protection authority for your respective place of residence or region, or the authority which is responsible for us, which is: the Hamburg Commission for Data Protection and Freedom of Information, Klosterwall 6 (Block C), 20095 Hamburg, Tel.: 040 / 428 54 – 4040, Fax: 040 / 428 54 – 4000, email: mailbox@datenschutz.hamburg.de Security provisions All the employees in our company receive regular training in data protection and are committed to data protection. Our computer centre and our in-house EDP department continuously adapt the technical security precautions to the current security conditions and requirements. Both are subject to constant monitoring by our internal procedures and the data protection officer. Nevertheless, Internet technologies may have security loopholes that cannot guarantee 100% full protection and users can therefore submit data to us via other methods, e.g. fax. Changes and updates to the Data Privacy Information We would ask you to keep regularly informed regarding the content of this Data Privacy Information. We will amend this Data Privacy Information if any changes to the data processing carried out by us make this necessary. We will notify you when such changes require your cooperation (e.g. consent) or other individual notification. If we provide addresses and contact information of companies and organisations in this Data Privacy Information, please note that the addresses may change over time, so please check the information before contacting us. Version date: 26.04.2021