GRAND
CRU PRIVACY NOTICE
Grand Cru Oy (“Grand Cru”, “we”) collects and processes personal
data of users of Grand Cru’s online services. This Privacy Notice applies to
personal data we obtain from individuals (“Users”)
through our websites, online services, and web-based applications
(collectively, the “Services").
Our Privacy Notice explains what data we process, how we do that and how
the data subjects, i.e. Users, may use their rights (e.g. right to object,
right of access).
This Privacy Notice may be updated if required to reflect the changes in
data processing practices or otherwise. The current version can be found at http://legal.grandcrugames.com/privacy.html
This Privacy Notice only covers data processing
carried out by Grand Cru.
Your privacy, security and online safety are important to us, and we
process all personal data with due care and in accordance with applicable laws
and regulations.
We understand the need to provide extra privacy protections to users who
are children. Please see the section 2 for our Notice regarding children.
For questions and information about Privacy Notice and data subject's
rights, please contact us at:
Grand Cru Oy, Kaisaniemenkatu 2b, 00100 Helsinki, Finland.
https:/grand-cru.helpshift.com
www.grandcrugames.com
1.
PERSONAL DATA PROCESSED AND SOURCES OF DATA
We collect two types of information from the Users: (i) User Data; and
(ii) Technical Data. Although we do not normally use Technical Data to identify
individuals, sometimes individuals can be recognized from it, either alone or
when combined or linked with User Data. In such situations, Technical Data can
also be personal data under applicable laws and we will treat the combined data
as personal data.
Grand Cru collects and processes for example the following User Data
from Users:
·
advertising id
·
IP address (location,
fraud prevention)
·
general location
based on IP address
·
data about your
mobile device, such as device name, operating system, hardware type, language
data about your usage of the game, such as
character progression data and interactions in the game
In addition, you may voluntarily submit following data:
·
player name
·
preferred language
·
messages to the
service (such as chat logs and player support tickets)
or other data you
choose to give us (such as data to identify a lost account)
Technical Data includes typically the following data:
·
User’s IP address;
·
preferred language;
·
geographic location
using IP address;
·
mobile device ID,
hardware type and operating system;
·
areas of our Services
User have visited
Data on player's
interactions and progression within the game:
·
transactions with in-game
currencies
·
hero inventory and hero
progression
·
player profile
progression
·
battle history
·
UI interactions
·
interactions with
guilds and friends
2.
OUR NOTICE REGARDING CHILDREN
We are a general audience service directed to and intended for users 13
and over. Grand Cru will not knowingly collect personal information from anyone
under the age of 13..
In the event that we learn that we have collected personal information
from a child under the age of 13, we will delete that information as quickly as
possible. If You believe that we might have any information from or about a
child under the age of 13, please contact us at contact@grandcrugames.com.
3.
PURPOSES AND LEGITIMATE GROUNDS FOR PROCESSING OF PERSONAL DATA
Purposes
We process personal data for the following purposes:
To
provide our Services and carry out our contractual obligations
We process personal data in the first place to be able to offer the
Services to Users and to run, maintain and develop our business. In some cases,
personal data may be processed in order to carry out our contractual
obligations towards the User. We may use the data for example to offer
essential functionalities of the Services and to provide access to the
Services. If User contacts our customer service, we will use the provided
information for answering questions and solving possible issues.
For
customer communication
We may process personal data for the purpose of contacting Users
regarding our Services and to inform Users of changes in our Services. Data may
also be used for research and analysis purposes in order to improve our
Services.
For
quality improvement and trend analysis
We may process information regarding the use of the Services to improve
the quality of our Services e.g. by analyzing any trends in the use of our
Services. When possible, we will do this using only aggregated, non-personally
identifiable data.
Legitimate
grounds for processing
We process personal data to perform our contractual obligations towards
Users, to serve the game, and to comply with legal obligations.
Furthermore, we process personal data to pursue our legitimate interest to run,
maintain and develop our business.
In some parts of the Services, Users may be requested to grant their
consent for the processing of personal data. In this event, Users may withdraw
their consent at any time.
4.
TRANSFER TO COUNTRIES OUTSIDE EUROPE
We have operations, entities, and service providers in several
geographical locations. As such, we and our service providers may transfer
personal data to, or access it in, jurisdictions outside the European Economic
Area or the User’s domicile. We will take steps to ensure that Users’ personal
data receives an adequate level of protection in the jurisdictions in which we
process it.
We provide adequate protection for the transfer of personal data to
countries outside of the European Economic Area through a series of
intercompany agreements and agreements with our service providers based on the
Standard Contractual Clauses or other similar arrangements such as Privacy
Shield for data transfers to USA.
5.
RECIPIENTS
We only share personal data within the organization of Grand Cru if and
as far as reasonably necessary to perform and develop our Services.
We do not share personal data with third parties outside of Grand Cru’s
organization unless one of the following circumstances applies:
It
is necessary for the purposes set out in this Privacy Notice
To the extent that third parties need access to personal data to perform
the Services, Grand Cru has taken appropriate contractual and organizational
measures to ensure that personal data are processed exclusively for the
purposes specified in this Privacy Notice and in accordance with all applicable
laws and regulations.
For
legal reasons
We may share personal data with third parties outside Grand Cru’s
organization if we have a good-faith belief that access to and use of the
personal data is reasonably necessary to: (i) meet any applicable law,
regulation, and/or court order; (ii) detect, prevent, or otherwise address
fraud, security or technical issues; and/or (iii) protect the interests,
properties or safety of Grand Cru, our Users or the public in accordance with
the law. When possible, we will inform Users about such transfer and
processing.
To
authorized service providers
We may share personal data to authorized service providers who perform
services for us (including data storage, sales, marketing and customer support
services). Our agreements with our service providers include commitments that
the service providers agree to limit their use of personal data and to comply
with privacy and security standards at least as stringent as the terms of this
Privacy Notice. Please bear in mind that if you provide personal data directly
to a third party, such as through a link on our website, the processing is
typically based on their policies and standards.
For
other legitimate reasons
If Grand Cru is involved in a merger, acquisition or asset sale, we may
transfer personal data to the third party involved. However, we will continue
to ensure the confidentiality of all personal data. We will give notice to all
Users concerned when the personal data are transferred or become subject to a
different privacy notice as soon as reasonably possible.
We may share personal data with third parties outside Grand Cru’s
organization for other reasons than the ones mentioned before, when we have the
User’s explicit consent to do so. The User has the right to withdraw this
consent at all times.
6.
STORAGE PERIOD
Grand Cru does not store personal data longer than is legally permitted
and necessary for the purposes of providing the Services or the relevant parts
thereof. The storage period depends on the nature of the information and the
purposes of processing.
Typically, we will store User’s personal data for as long as the User is
a registered subscriber or a registered user of our Services or for as long as
we have another purpose to do so and, thereafter, for no longer than is
required or permitted by law or reasonably necessary for internal reporting and
reconciliation purposes.
In general, personal data of Users are deleted within reasonable time
after the User no longer uses any part of the Services or when the User makes a
request regarding deletion of User’s personal data. In any case we will not
store data for longer period than ten (10) years unless there is a mandatory
legal requirement or binding court order.
7.
USERS’ RIGHTS
Right
to access
As a User you have the right to access your personal data that is processed
by Grand Cru. This means that Users may contact us and we will inform what
personal data we have collected and processed regarding the said User and the
purposes such data are used for.
Right
to correct
You have the right to have incorrect, imprecise, incomplete, outdated,
or unnecessary personal data we have stored about you corrected or
completed.
Right
to deletion
You may also ask us to delete your personal data from our systems. We
will comply with such request unless we have a legitimate ground to not delete
the data. We may not immediately be able to delete all residual copies from our
servers and backup systems after the active data have been deleted. Such copies
shall be deleted as soon as reasonably possible.
Right
to object
You may object to certain use of personal data if such data are
processed for other purposes than purposes necessary for the performance of our
Services to you or for compliance with a legal obligation.
You may also object any further processing of personal data after prior
given consent. If you object the further processing of personal data, this may
lead to fewer possibilities to use our Services.
Notwithstanding any consent granted beforehand for the purposes of
direct marketing, you have the right to prohibit us from using your personal
data for direct marketing purposes, market research and profiling by contacting
us on the addresses indicated above or by using the functionalities of the
Services or the unsubscribe possibility offered in connection with any direct
marketing messages.
Right
to restriction of processing
You may request us to restrict certain processing of personal data, this
may however lead to fewer possibilities to use our Services.
8.
LODGING A COMPLAINT
In case you consider our processing of personal data to be inconsistent
with the applicable data protection laws, you can lodge a complaint with the
local supervisory authority of data protection.
You can find your data protection authority contact information in EU
here: https://ec.europa.eu/info/law/law-topic/data-protection/reform/rights-citizens/redress/what-are-data-protection-authorities-dpas-and-how-do-i-contact-them_en
9.
INFORMATION SECURITY
We have taken administrative, organizational, technical, and physical
safeguards to protect the personal data we collect and process. Our security
controls are designed to maintain an appropriate level of data confidentiality,
integrity, and availability. We regularly test our websites, data centers,
systems, and other assets for security vulnerabilities.
10.
FURTHER INFORMATION
This Privacy Notice is governed by Finnish law
excluding its choice of law provisions.