Privacy policy

1. Controller and scope

The controller is Exiria Games spółka z ograniczoną odpowiedzialnością. KRS 0001255280 · NIP 9512652549. Sąd Rejonowy dla m.st. Warszawy w Warszawie, XIII Wydział Gospodarczy Krajowego Rejestru Sądowego. Contact us about privacy at admin@exiriagames.com. This notice covers this website and correspondence with the company as well as Exiria test accounts and participation.

2. Website visits and correspondence

When a browser requests a page, the hosting infrastructure handles the IP address, request time, requested address, response status and technical browser information. These data allow delivery of the site, diagnosis and protection against abuse. The legal basis is our legitimate interest in operating a reliable and secure information service (Article 6(1)(f) GDPR).

If you contact us, we process your email address, the name or identifier you provide, the message and the reply history. The basis is our legitimate interest in handling correspondence, or steps at your request before a contract and performance of that contract where applicable (Article 6(1)(b)/(f)). For statutory requests and obligations we use Article 6(1)(c). Please avoid sending unnecessary sensitive data.

3. Accounts, tests and identity providers

For invited testers we process the account identifier, email address and verification status, username, sign-in provider, access groups, session information, invitation and acceptance records, and game state or diagnostic information linked to the account. Account access and participation are processed to perform the testing agreement (Article 6(1)(b)); security, abuse investigation and proportionate fault diagnosis rely on legitimate interests (Article 6(1)(f)). Applicable legal obligations rely on Article 6(1)(c).

Authentication uses Amazon Cognito in AWS region eu-central-1 (Frankfurt). If you choose an available Google, Facebook or Apple sign-in option, the identity provider supplies information disclosed in its consent flow and processes data under its own privacy terms. We do not receive your password for the account held by that provider.

4. Cookies and browser storage

The informational pages do not set cookies, run analytics scripts, use browser storage or load third-party fonts or embeds. The separate account and game services use cookies necessary to maintain sessions, authenticate users and protect account access. The informational site does not use account cookies to personalise its content. Cookies used by an identity provider are controlled under that provider’s terms.

5. Recipients and service providers

Access is limited to authorised company personnel and service providers supporting hosting, infrastructure, email and, for game accounts, authentication and game operation. Professional advisers and public authorities may receive data where necessary and lawful. Service providers acting on our behalf must be subject to appropriate data-processing arrangements. We do not sell personal data.

Our website hosting provider is OVHcloud, and our email provider is home.pl. The servers used for both services are located in Poland. Exiria account authentication uses Amazon Web Services through Amazon Cognito in the eu-central-1 region in Frankfurt.

6. Retention

Logs and backup copies are retained for three months. Test account data is retained during authorised participation. After account closure we remove data that is no longer needed, subject to applicable legal obligations and the establishment, exercise or defence of claims.

Correspondence is retained while a request is handled and afterwards only for as long as required by a legal obligation or a justified claim. Records of accepted documents are retained according to the same necessity-based criteria.

7. Your rights and requests

Depending on the applicable legal basis and conditions, you may request access, rectification, erasure, restriction and portability, and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing. Contact admin@exiriagames.com. Requests are normally free; any GDPR exception must be explained.

We respond without undue delay and normally within one month of receiving a rights request. Where the GDPR permits an extension for complexity or number of requests, we tell you within that first month, explain why and may extend by up to two further months. If we refuse all or part of a request, we explain the grounds and available remedies. We may request additional information where reasonably necessary to verify your identity.

You may complain to the President of the Personal Data Protection Office (Prezes UODO), uodo.gov.pl, or another competent supervisory authority. See account and data deletion for the practical email route.

8. Providing data, automated decisions and updates

Data in correspondence is voluntary, but without a return address we may be unable to answer. Technical request data is necessary to deliver a page. Identity and access data is required for invited testers to use an account; without it we cannot provide access. We do not use these informational pages for profiling or solely automated decisions with legal or similarly significant effects.

We update this notice when processing changes and inform affected account holders of material changes.