“Applicable Data Protection Legislation” means any legislation in force from time to time which implements the European Union Directive 95/46/EC and Directive 2002/58/EC and the General Data Protection Regulation (“GDPR”) 2016/679 of April 27th, 2016 and is applicable to this Agreement and all other applicable laws and regulations that may apply to the transfer of Personal Data. “Personal Data” shall mean any information relating to a Data Subject; an identifiable person is one who can be defined, directly or indirectly, notably by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to his/her physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Contact data and Service Data are Personal Data. “Contact Data” means any names, phone numbers, email addresses and certain financial details held within commercial systems to conduct the Parties’ relationship management and billing transactions between the Parties; “Controller”, “Data Subject”, “Personal Data”, “Process/Processing” and “Processor”, shall have the same meaning as in the European Union Directive 95/46/EC or the General Data Protection Regulation 2016/679 of April 27th, 2016. “Service Data” means any Party’s Personal Data (that is not Contact Data) held within the Parties’ systems, applications or databases and that may be accessed, processed, used or stored as a consequence of performing the services under the Agreement. “Third Country” means a country that is: (i) outside of the European Economic Area; and (ii) not the subject of a formal decision by the European Commission, made pursuant to Section 25(6) of the European Union Directive 95/46/EC or under Article 45 (1) of the General Data Protection Regulation 2016/679, stating that that country ensures an adequate level of protection for Personal Data.
2. Collection of information
3. Cookies and logs etc.
4. Use of information – Purpose and legal basis
Systemic Reaction will use information about you for the following purposes in accordance with applicable laws:
Information you provide or is collected from you in or in relation to the Game and information from other sources
Information is provided by you or collected in or in relation to the Game and/or collected from other sources in order to:
- provide, operate, improve and maintain the Game, game experience and services, your account(s);
- personalize the Game, content, loyalty programs and related services to you;
- send technical notices, updates, security alerts;
- facilitate support and for troubleshooting reasons;
- send support and administrative messages;
- provide news and information about the Game; and/or about our games and products;
- monitor the end users’ playing of the Game and activities in the Game;
- facilitate sharing on social networks;
- provide adults with advertising in accordance with given consent and/or permissible laws;
- provide children reasonable contextual advertisements in the Game in accordance with permissible laws;
- identify, fix, and troubleshoot bugs and service errors, provide software updates etc;
- resolve disputes, investigate and help curb fraud and illegal behavior, comply with applicable laws, and to enforce our agreements and policies;
- survey end users’ opinions about the game and related matters through surveys or questionnaires;
- effect communications for reasons related to the Game and/or matters related to the Game;
- manage the Game, send confirmations and important information about your account, products, purchases, subscriptions, and warranties;
- present offers and/or information relating to the Games and other games that you might like;
- make recommendations to you; and
- personalize advertising for you and deliver targeted marketing, service updates, and promotional offers.
Processing of this information is necessary for the purpose of performance of a contract to which you are party, in order to support the operation of the Game, facilitate the delivery of requested products and services, enable maintenance and update of the Game under Article 6(1)(b) of the GDPR, and purposes are justified by our legitimate interests in providing advertisements and content of interest to you, and improving our services in accordance with Article 6(1)(f) of the GDPR (“the balancing-of-interest rule”). Disclosure of your advertising ID to third parties for the purposes of behavioral advertising will be done in accordance with Article 6(1)(a) of the GDPR. We only process your information to the extent that is necessary to achieve the purposes for which the information has been collected.
5. Storage of Personal data
With respect to processing of Personal Data, Systemic Reaction is Data Controller. Systemic Reaction shall (i) Not keep the Personal Data for longer than is necessary for the purposes of performing the Agreement unless further storage is required in order to establish, exercise or defend a legal claim or to comply with applicable law, including accounting rules; (ii) Store, process and use the Personal Data for the sole purpose of performing the Agreement; and (iii) Ensure that its employees, employees of its affiliates, and subcontractors involved in the performance of the Agreement comply with the provisions of this agreement (iv) Implement all reasonable technical and organizational measures to protect your Personal Data against any accidental or unlawful destruction, accidental loss, unauthorized alteration, communication or access, (v) Where applicable report to you, upon its occurrence, any unauthorized access, disclosure, use, modification or destruction of your Personal Data, (vi) Refrain from exporting or transferring your Personal Data to any Third Country, and from collecting, using or Processing Personal Data within any Third Country, unless prior to the transfer we have ensured that an adequate level of protection of the Personal Data has been implemented in accordance with the terms and conditions stated in section 9 of this Agreement (International Data Transfers). Personal Data are deleted or anonymized as soon as it no longer serves one of the above mentioned purposes and in any event no later than three (3) years after your interaction with us has ended.
6. Information we share with third parties
As a general rule, Systemic Reaction will not share Personal Data that directly identifies end users (e.g. your name, email or postal address, etc.) with independent third parties without end users’ consent, unless it is either required by law or we determine that disclosure is reasonably necessary to enforce our rights, property, operations, or to protect our players or third parties. We may share anonymous or aggregated information, or other data that does not directly identify end users, with third parties, for instance persona on leaderboards or to show trends about use of our products. Notwithstanding the foregoing, we may share information about you with certain third parties based on the legal basis in Articles 6(1)(b), 6(1)(c) and 6(1)(f) of the GDPR as follows:
- Third Party Agents and Contractors
- Social networks
Where the Game and related services are accessed and/or provided through social networks.
- Third parties
When required by applicable law, rule, regulation, legal process, in the process of negotiations of any mergers and acquisitions, sale of company assets, financing or acquisition of all or a portion of our business by another company where personally identifiable information submitted to us may be transferred to the acquiring entity.
- Courts, law enforcement agencies, legal authorities etc.
When ordered or requested by courts, legal authorities etc. and/or required in order for us to abide by applicable laws, or to protect our rights, property or safety of Systemic Reaction, the Game, end users, in defense of lawsuits or other legal actions etc.
- Other end users
In order to provide certain Game features.
- Advertising networks
7. Payment information
In order to access the complete Game, certain premium game functions, levels, content and features etc., you are required to pay certain fees. When purchasing such features and functions etc. you may be asked by the platform/service providers to provide certain personally identifiable information, such as full name, billing address, email address, phone number, credit card number/expiration date etc. Please note that you must be the age of 18 or older to make purchases in the Game, however children over thirteen but under eighteen may access and play the game under the supervision of a legal guardian. Once end users have successfully entered valid credit card information etc. and completed the order process, a purchasing account will be created and maintained for them. The platform/service providers will use the information provided to process the End User’s order and to send order confirmations via email, as well as to make future purchases easier for the End User. Systemic Reaction does not sell, transfer or share customer information with third parties, except where applicable the information is transferred, disclosed to, and shared with its third-party agent(s) who uses the information solely to handle and deliver certain online activities necessary to operate Systemic Reaction business (e.g. processing orders and payments).
Systemic Reaction has taken reasonable steps to ensure that the personally identifiable information it collects is secure, and we have taken reasonable measures to protect the confidentiality, security, and integrity of the Personal Data collected from our Game’s end users. Personal Data is stored in secure operating environments that are not available to the public and that are only accessible to authorized employees and contractors. We also have security measures in place to protect the loss, misuse, and alteration of the information under our control. However, there is no such thing as perfect security. As a result, although we strive to protect personally identifying information, we cannot ensure or warrant the security of any information transmitted to us through or in connection with the Game, that we store on our systems, or that is stored on our service providers’ systems. Please note that Systemic Reaction may provide links to other games and websites that are operated and hosted by third parties who may have their own information collection practices. Those other games and websites are governed by their own privacy policies, which may be substantially different from Systemic Reaction policies. Visitors to other games and websites are encouraged to review the privacy policies and information collection practices of those websites. Any improper collection or misuse of User Content or information provided in the Game is a violation of the End User License Agreement and should be reported to Systemic Reaction at firstname.lastname@example.org.
9. International Data Transfers
We may transfer and share your information to third parties (including service providers operating on our behalf) which may be located in countries outside the European Union (“EU”) and/or the European Economic Area (“EEA”) which may not have the same level of data protection laws as those in the country where you are located. Where your data is sent to a country outside the EU/EEA that is not subject to an adequacy decision by the EU Commission, the transfers will only occur based on the following safeguards: i) If the entity is certified to comply with the principles for data protection under the US-EU Privacy Shield Framework (“Privacy Shield”), or ii) If we have entered into EU Commission approved standard contractual clauses with the entity, which is deemed to offer sufficient safeguards with respect to the protection of the privacy and fundamental rights and freedoms of individuals.
10. Your Choices and Controls
You have the following rights regarding your Personal Data:
The right to request access
In accordance to Chapter III, Article 15 of the GDPR a Data Subject may request access to processed Personal Data. This includes confirmation as to whether or not Personal Data concerning the Data Subject is being processed, and, where that is the case, access to the Personal Data and the following information:
- the purposes of the processing;
- the categories of Personal Data concerned;
- the recipients or categories of recipients to whom the Personal Data have been or will be disclosed, in particular recipients in third countries or international organizations;
- where possible, the envisaged period for which the Personal Data will be stored or, if not possible, the criteria used to determine that period;
- the existence of the right to request from the controller rectification or erasure of Personal Data, or restriction of processing of Personal Data concerning the Data Subject, or to object to such processing;
- the right to lodge a complaint with a supervisory authority;
- where the Personal Data is not collected from you, any available information as to the source;
- the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the Data Subject.
Where Personal Data is transferred to a third country or to an international organization, you have the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer. You shall be provided a copy of the Personal Data undergoing processing. For any further copies requested, we may charge a reasonable fee based on administrative costs. Where you make the request by electronic means, and unless otherwise requested by you, the information shall be provided in a commonly used electronic form. The right to obtain a copy shall not adversely affect the rights and freedoms of others. Please note that the access may be restricted due to intellectual property or trade secrets.
The right to object
You have the right to object to the Personal Data processing on grounds relating to your particular situation when the data are processed based on the balancing-of-interest rule in Article 6(1)(f) of the GDPR, see Article 21 of the GDPR. In this case, we will cease the processing unless there are compelling legitimate grounds for the processing which override your interests, rights and freedoms or if the processing is necessary for the establishment, exercise or defense of legal claims. You have the right to object to our processing of your Personal Data for direct marketing purposes at any time. We will cease the processing of your Personal Data for this purpose after the objection. Please note that if you exercise this right, your user license to use the Game and related services will cease automatically.
Right of correction and erasure
You have the right to have inaccurate Personal Data rectified, in accordance with Article 16 of the GDPR. You have the right to have your Personal Data erased where one of the following grounds applies, see Article 17 of the GDPR:
- The Personal Data is no longer necessary in relation to the purposes for which it was collected or otherwise processed,
- if you have withdrawn your consent and there are no other legal grounds for the processing,
- if you have objected to the processing and there are no overriding legitimate grounds for the processing,
- the Personal Data have to be erased for compliance with a legal obligation in Union or Member State law,
- the Personal Data have been unlawfully processed or
- the Personal Data have been collected in relation to the offer of information society services.
Please note that your right to erasure may be limited if the data are necessary for compliance with a legal obligation or for the establishment, exercise or defense of legal claims.
The right to restriction
You have the right to obtain restriction of processing in certain circumstances, in accordance with Article 18 of the GDPR. If you have the right to restriction, we will only process your Personal Data with your consent or for the establishment, exercise or defense of a legal claim or to protect a person or important grounds of public interest.
The right to withdraw consent
If we have asked for your consent to our processing of your Personal Data, you have the right to withdraw your consent at any time, in accordance with Article 7 of the GDPR. You may at any time opt out of and/or unsubscribe from emails from Systemic Reaction and our service providers, or withdraw consent to Personal Data storage, either via the unsubscribe link included in the emails, or by emailing email@example.com. If you withdraw your consent, we will cease processing of the Personal Data for which you have withdrawn consent, unless we have a legal obligation to keep some or parts of your data. Please note that if you withdraw your consent, your right to play the Game and related services will cease automatically. The withdrawal of your consent does not affect the lawfulness of processing based on your consent before its withdrawal.
The right to data portability
You have the right to receive your Personal Data that you have provided to us in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance if the processing is based on consent or contract performance, in accordance with Article 20 of the GDPR.
Changing or Removing Account Information
Access and control over most Personal Data in the Game is readily available through the profile editing tools on your account with the applicable platform/service provider that you are accessing the game through. End users may modify or delete any or all of their profile information at any time by logging into their accounts. Information will be updated as soon as possible. End users who wish to deactivate their Game account may do so in their accounts with the applicable platform/service provider that you are accessing the game through. Removed information may persist in backup copies for a reasonable period of time but will not be generally available to other end users or visitors of the Game. You cannot however remove communications made in any communication features in the Game, which might have been shared with other end users (for example sending personal messages to another end users). If you wish to invoke any of the rights described above, you may contact us at any time by emailing us at firstname.lastname@example.org. We will process and answer your requests without undue delay and in any event within one month of our receipt of the request unless a longer period is required due to the complexity of the request. In this case, our response time can be up to three months in total as permitted by Article 12 of the GDPR.
Disputes between you and Systemic Reaction OUR GOAL IS TO RESOLVE DISPUTES FAIRLY AND QUICKLY. FOR ALL DISPUTES AGAINST SYSTEMIC REACTION, YOU AGREE TO FIRST CONTACT SYSTEMIC REACTION AND TRY TO RESOLVE THE DISPUTE INFORMALLY BY SENDING A WRITTEN NOTICE OF THE CLAIM (“NOTICE”) TO SYSTEMIC REACTION. THE NOTICE TO SYSTEMIC REACTION MUST BE SENT VIA REGISTERED LETTER TO THE ADDRESS LISTED IN SECTION 17 BELOW OR BY EMAIL WITH CONFIRMATION OF RECEIPT. THE NOTICE MUST (A) INCLUDE YOUR NAME, YOUR RESIDENTIAL ADDRESS AND EMAIL ADDRESS AND / OR MOBILE PHONE NUMBER ASSOCIATED WITH YOUR ACCOUNT REGISTERED WITH SYSTEMIC REACTION AND/OR THE PLATFORM/SERVICE PROVIDER; (B) DESCRIBE THE TYPE AND REASON FOR THE CLAIM; AND (C) SPECIFY THE SPECIFIC COMPENSATION SOUGHT, IF ANY. IF YOU AND SYSTEMIC REACTION CANNOT AGREE ON A SOLUTION TO THE DISPUTE WITHIN 60 DAYS OF RECEIVING SUCH A NOTICE, EITHER PARTY MAY INITIATE LEGAL PROCEEDINGS IN ACCORDANCE WITH SECTIONS 12-15 BELOW. User disputes You are solely responsible for your interactions with other users of the Game. We reserve the right, but have no obligation, to monitor disputes between you and other users.
If you are located within the United States of America, the following applies to you: Any claim (excluding claims for injunctive or other equitable relief) where the total amount of the award sought by either party is less than $10,000 shall be resolved via binding non-appearance-based arbitration initiated through the American Arbitration Association (“AAA”). The AAA Rules are available online at www.adr.org or by calling the AAA at 1-800-778-7879. In any such arbitration, the parties and AAA must comply with the following rules: (a) the arbitration shall be conducted by telephone, online and/or be solely based on written submissions, the specific manner shall be chosen by the party initiating the arbitration; (b) the arbitration shall not involve any personal appearance by the parties or witnesses unless otherwise mutually agreed by the parties; (c) the arbitrator may award injunctive or declaratory relief only in favor of the individual party seeking relief and only to the extent necessary to provide relief warranted by that party’s individual claim; and (d) any judgment on the award rendered by the arbitrator may be entered in any court of competent jurisdiction. Nothing in this Agreement shall prevent either party from seeking remedies in small claims court of competent jurisdiction. The right to refrain from arbitration. You may choose to waive this arbitration term. Then neither you nor Systemic Reaction can demand that the other party take part in arbitration proceedings. In order to refrain, you must inform Systemic Reaction in writing about this within 30 days of learning of or obtaining notice of this Arbitration section. You must provide the name and address, the email address associated with your Game account (if you have one) and a clear wording that you want to waive the arbitration terms. All requests to refrain from arbitration must be sent to: Systemic Reaction AB, Västgötagatan 5, SE-11827 Stockholm, Sweden and marked “Waiver of Arbitration”. If you do not waive this arbitration section it will continue to apply to you.
13. Class action waiver
YOU AGREE THAT ANY AND ALL CLAIMS MUST BE MADE IN YOUR INDIVIDUAL CAPACITY, AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS OR REPRESENTATIVE PROCEEDING.
15. Governing law