1. Data controller
- Company: KAL INTERNATIONAL HOLDING LTD
- Address: [a completar]
- VAT no.: [a completar]
- Privacy contact: [email protected]
2. What data we process
- Account: username and password (stored only as an argon2id hash, never in plain text). We do not ask for an email address to sign up.
- Technical data: IP address and connection data, used for security (blocking abuse and repeated login attempts) and to run the game.
- Purchases: the pack bought, amount, date, order status and the email address you enter on Stripe's payment page, needed for the receipt.
- Game data: characters, progress and items linked to your account.
We use no profiling cookies or advertising tools. The site only sets a technical session cookie, needed for login and to protect forms.
3. Why, and on what legal basis
- Providing the game and the store: performance of a contract (GDPR art. 6(1)(b)).
- Service security and fraud prevention: legitimate interest (art. 6(1)(f)).
- Keeping order records: legal tax and accounting obligations (art. 6(1)(c)).
4. Who we share it with
- Stripe (Stripe Payments Europe Ltd.): processes payments as an independent controller for card data. We only receive the payment result and the receipt email.
- Cloudflare (Cloudflare, Inc.): content delivery network and attack protection; it sees the IP address and technical request data.
- The hosting provider of the servers running the site and the game.
Some providers may process data outside the European Union; such transfers rely on the safeguards required by the GDPR (adequacy decisions or standard contractual clauses).
5. How long we keep it
- Account and game data: as long as the account is active, and up to 12 months after a closure request.
- Technical logs containing IP addresses: 90 days at most, unless an abuse investigation is ongoing.
- Order data: 10 years, as required by tax law.
6. Your rights
You can request access, rectification, erasure, restriction and portability of your data, and object to processing based on legitimate interest, by writing to [email protected]. You also have the right to lodge a complaint with a data protection authority (in Italy: Garante per la protezione dei dati personali, garanteprivacy.it).