In the following, we inform you about the processing of personal data by us as the responsible party (controller) when using our website under the domain thecycle.game and the game "THE CYCLE: Frontier". The processing of personal data (e.g. name, address, email address or telephone number of a data subject) is carried out in accordance with the statutory provisions, in particular the requirements of the European Union General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

I.           Controller

The responsible party (controller) within the meaning of the GDPR and the national data protection laws of the member states as well as other data protection provisions is:

YAGER Development GmbH

Pfuelstraße 5

10997 Berlin

Germany

Tel:                   +49 30 69597660

email:   contact (at) yager.de

II.         Data Protection Officer

You can reach the data protection officer of the controller as follows:

YAGER Development GmbH

- Data Protection Officer -

Pfuelstraße 5

10997 Berlin

Germany

gdpr (at) yager.de

III.        General information on data processing

Personal data is any information relating to an identified or identifiable natural person, such as your name or email address. “Processing of data" means in particular the collection, recording, use and transmission of your data.

Insofar as we obtain the consent of the data subject for processing operations involving personal data, Article 6 (1) sentence 1 lit. a GDPR serves as the legal basis.

When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Article 6 (1) sentence 1 lit. b GDPR serves as the legal basis. This also applies to processing operations that are necessary for the performance of pre-contractual activities.

Insofar as the processing of personal data is necessary for the fulfilment of a legal obligation to which our company is subject, Article 6 (1) sentence 1 lit. c GDPR serves as the legal basis.

In the event that vital interests of the data subject or another natural person make it necessary to process personal data, 6 (1) sentence 1 lit. d GDPR serves as the legal basis.

If the processing is necessary to protect a legitimate interest of our company or a third party and the interests, fundamental rights and freedoms of the data subject do not outweigh the first-mentioned interest, Article 6 (1) sentence 1 lit. f GDPR serves as the legal basis for the processing.

The personal data of data subjects shall be erased or blocked as soon as the purpose of storage ceases to apply. Storage after the purpose of storage has ceased to apply may take place if this is provided for by law. Data will also be blocked or erased if a storage period prescribed by the aforementioned standards expires, unless there is a necessity for the continued storage of the data for the conclusion or fulfilment of a contract.

Further information on the legal basis for processing and the storage period for specific personal data can be found in the respective subsection. If you would like further information on our balancing of interests in the data processing that we base on Art. 6 (1) sentence 1 lit. f GDPR, please contact us using the contact options provided above.

IV.        Rights of the data subject

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the data controller (if applicable, subject to further requirements set out in the relevant regulations). To assert the rights listed below under 1. to 7., please contact the contact details listed under II.

1.             Right to information (right of access)

You may request confirmation as to whether personal data concerning you is being processed by us. If such processing is taking place, you can request information from us about the following:

(1)        the purposes for which the personal data are processed;

(2)        the categories of personal data which are processed;

(3)        the recipients or categories of recipients to whom the personal data concerning you have been or will be disclosed;

(4)        the planned duration of the storage of the personal data concerning you or, if concrete information on this is not possible, criteria for the determination of the storage duration;

(5)        the existence of a right to rectify or erase personal data concerning you, a right to have processing restricted by the controller or a right to object to such processing;

(6)        the existence of a right of appeal to a supervisory authority;

(7)        any available information on the origin of the data if the personal data are not collected from the data subject;

(8)        the existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) GDPR and, at least in these cases, meaningful information about the logic involved and the scope and intended effects of such processing for the data subject.

You have the right to request information on whether personal data concerning you is transferred to a third country or to an international organisation. In this context, you may request to be informed about the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.

2.             Right to rectification

You have the right to rectification or completion if the personal data processed concerning you are inaccurate or incomplete. The rectification shall be carried out without delay.

3.             Right to erasure

a)         Obligation to delete

You may request that we delete personal data relating to you without delay, with the consequence that we are obliged to delete such data without delay if one of the following reasons applies:

(1)   The personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed.

(2)   You withdraw your consent on which the processing was based pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR and there is no other legal basis for the processing.

(3)   You object to the processing pursuant to Art. 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 (2) GDPR.

(4)   The personal data concerning you has been processed unlawfully.

(5)   The erasure of the personal data concerning you is necessary for compliance with a legal obligation under Union or Member State law to which we are subject.

(6)   The personal data concerning you was collected in relation to information society services offered in accordance with Art. 8 (1) GDPR.

b)         Information to third parties

If we have made the personal data concerning you public and we are obliged to erase it pursuant to Article 17(1) of the GDPR, we shall, taking into account the available technology and the cost of implementation, take reasonable steps, including technical measures, to inform the data controllers processing the personal data that you, as the data subject, have requested that they erase all links to, or copies or replications of, that personal data.

c)         Exceptions

The right to erasure does not exist insofar as the processing is necessary

(1)   to exercise the right to freedom of expression and information;

(2)   for compliance with a legal obligation which requires processing under European Union or member state law to which we are subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us;

(3)   for reasons of public interest in the area of public health pursuant to Art. 9 (2) (h) and (i) and Art. 9 (3) GDPR;

(4)   for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Art. 89 (1) GDPR, insofar as the right referred to in section a) is likely to render impossible or seriously prejudice the achievement of the purposes of such processing, or

(5)   for the assertion, exercise or defence of legal claims.

4.             Right to restrict processing

You may request the restriction of the processing of personal data concerning you under the following conditions:

(1)   if you dispute the accuracy of the personal data relating to you for a period of time that enables us to verify the accuracy of the personal data;

(2)   the processing is unlawful and you refuse to erase the personal data and instead request the restriction of the use of the personal data;

(3)   we no longer need the personal data for the purposes of processing, but you need them for the assertion, exercise or defence of legal claims, or

(4)   if you have objected to the processing pursuant to Art. 21 (1) GDPR and it has not yet been determined whether the legitimate grounds to which we are entitled outweigh your grounds.

5.             Right to revoke the declaration of consent under data protection law

You have the right to revoke a declaration of consent granted by you under data protection law at any time. The revocation of the consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

6.             Right to data portability

You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from us, where:

(1)   the processing is based on consent pursuant to Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR or on a contract pursuant to Art. 6 para. 1 lit. b GDPR; and

(2)   the processing is carried out by automated means.

In exercising this right, you also have the right to have the personal data concerning you transferred directly from us to another controller, where technically feasible. The freedoms and rights of other persons must not be affected by this.

The right to data portability does not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

7.             Right to object

Insofar as we process personal data as explained above in order to protect our legitimate interests which prevail in the context of a balance of interests, you can object to this processing with effect for the future, but only if there are grounds arising from your particular situation (Art. 21 GDPR). If the processing is carried out for direct marketing purposes, you may exercise this right at any time even without grounds. After you have legitimately exercised your right to object, we will no longer process your personal data for these purposes unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or if the processing serves the purpose of asserting, exercising or defending legal claims. This restriction does not apply if the processing is for direct marketing purposes.

8.             Right to complain to a supervisory authority

If you feel that we are not respecting your rights to the extent that we should, you have the right to complain to a data protection supervisory authority about our processing of your personal data. Before you do so, however, we would appreciate it if you would inform us of your criticism beforehand so that we can remedy the cause of the complaint ourselves if necessary.

V.         Website visit and log files

1.         Scope of the processing of personal data

Each time our website is accessed, our system automatically records the following data and information from the computer system of the accessing computer.

(1)   Information about the browser type and version used

(2)   The operating system of the user

(3)   The IP address of the user

(4)   Date and time of access

(5)   Websites from which the user's system accesses our website

This data is stored in the log files of our system.

2.         Legal basis for the processing of personal data

The legal basis for the collection and storage of the data is Art. 6 para. 1 lit. f GDPR.

3.         Purpose of the data processing

The temporary storage of the IP address is necessary to be able to display the website to you. For this purpose, the IP address must remain stored for the duration of the session. The other data is collected for technical reasons to ensure stability and security. This also constitutes the legitimate interest in processing according to Art. 6 (1) lit. f GDPR.

4.         Duration of storage

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of the collection of data for the provision of the website, this is the case when the respective session has ended.

In the case of storage of data in log files, this is the case after seven days at the latest. Storage beyond this period is possible. In this case, the IP addresses of the users are deleted or altered so that an assignment of the visiting client is no longer possible.

5.         Recipient

Our website is hosted by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA („Cloudflare“). The data listed in this section is processed on Cloudflare servers located within the EU/EFTA. We have concluded a data processing contract with Cloudflare and agreed on the standard contractual clauses (SCC).

VI.        Contacting us

1.         Scope of the processing of personal data

If you contact us by email, by post, via a contact form or in any other way, the data you provide (e.g. your email address, name and telephone number, if applicable) will be processed by us in order to process or respond to your request. In the case of electronic enquiries, the time of the enquiry is also stored.

2.         Legal basis for the processing of personal data

If you provide us with your data in a pre-contractual context, for example with a request to send an offer or with questions about our products, the legal basis is Art. 6 (1) lit. b GDPR. If you have given us your consent to contact you, the legal basis is Art. 6 (1) (a) GDPR. In all other cases, Art. 6 para. 1 lit. f GDPR is the legal basis.

3.         Purpose of the data processing

Personal data is processed exclusively for the purpose of contacting you. As a rule, this concerns support enquiries in the event of existing problems with the technical operation of the game or other questions about the game. This also constitutes the possibly necessary legitimate interest in the processing of the data.

4.         Duration of storage

Your data will be deleted when it is clear from the circumstances that your enquiry or the matter in question has been conclusively clarified.

5.         Recipient

In relation to support requests for the game "The Cycle: Frontier", the ticket system Zendesk of Zendesk, Inc. 989 Market St San Francisco, CA 94103, United States of America is used. We have concluded a data processing contract with Zendesk.

VII.      Newsletter

1.         Scope of the processing of personal data

You can subscribe to a newsletter on our website. To do so, you must enter your email address in the corresponding form on the website. This will be transmitted to us and stored by us. At the same time, the following additional data is collected and stored when you send the request:

(1)   The IP address of the user

(2)   Date and time of the request

(3) Website language setting

For the processing of the data, your consent is obtained during the registration process and reference is made to this privacy policy.

2.         Legal basis for the processing of personal data

The legal basis for the processing of the email address is Art. 6 para. 1 lit. a GDPR. The legal basis for the processing of the other data is Art. 6 para. 1 lit. f GDPR.

3.         Purpose of the data processing

The collection and storage of the email address serves the purpose of being able to send you the newsletter. The processing of further data within the scope of the registration process serves to prevent misuse of the services or the email address used.

4.         Duration of storage

The data collected will be stored for as long as the subscription to the newsletter continues. After that, the processing is limited and the data is kept for another 42 months starting from the end of the year in which the newsletter subscription ended.

5.         Recipient

In the context of sending the newsletter, we use the service of Amazon Pinpoint (Pinpoint). Pinpoint is a newsletter management service that handles the sending of our newsletter for us. Pinpoint is provided to us by Amazon Web Services EMEA SARL (“AWS”), avenue John F. Kennedy 38, 1855 Luxembourg, Luxembourg.Your personal data is processed by this company in the EU (Ireland) on our behalf within the scope of the newsletter dispatch.

We have concluded a data processing contract with AWS in accordance with Art. 28 GDPR to protect your personal data. In addition, we have agreed the standard contractual clauses with AWS.

VIII.     Playing "THE CYCLE: Frontier“

1.         Scope of the processing of personal data

You can play "THE CYCLE: Frontier" using your account on a platform such as the Epic Game Store of Epic Games Inc. or Steam of Valve Corporation. In the course of providing the game, we process data of the players. The processing in the game operation concerns the following data:

·         IP address

·         Platform User ID

·         Platform User Name

·         Geolocation/location of players (via IP address) limited to the respective country

·         Game-related player data such as:

- Game progress (progression)

- unlocked content

- purchased content

- player ID

- statistics

·         Chat content

·         Friends list (if any)

·         Last used MAC address

·         Eventual ban history

·         Date and time of first and last login

Provided you give your consent in the Epic Game Store, Epic Games Inc. will also provide us with your email address. Through this channel, we can then send you information about the game that is necessary for using the game and for a comprehensive gaming experience.

During a multiplayer game, some of the game-related data may also be visible to the other players, such as platform user name, position (in the game), health of the game character, etc.

In addition, your platform user name may be published with your game results as part of leaderboards in the game and on our website.

2.         Legal basis for data processing

The legal basis for the processing of the data is Art. 6 (1) lit. f GDPR and, insofar as the personal data are processed for the performance of a contract, Art. 6 (1) lit. b GDPR.

3.         Purpose of the data processing

The purpose of the data processing is the technical implementation and provision as well as the operation of the game and the improvement of our offer. This purpose also constitutes our legitimate interest in processing the personal data.

4.         Duration of storage

The personal data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected.

This is the case as soon as the data is no longer required for the use and provision of the game, for example when you have deleted your account and there are no further reasons for storing the data.

The content of voice chats is not stored. The content of text chats is displayed on the players' clients as long as the player is in the respective channel. Text chats are not stored beyond this time.

If data accumulates in the course of the game operation that we are obliged to retain or store due to tax, commercial or other regulations, it will only be deleted after the respective statutory retention or storage periods have expired. The legal basis for this storage is Art. 6 para. 1 lit. c GDPR.

5.         Recipient

For the individual matches between the players, local so-called battle servers are used for the duration of the respective match, which can be located in different regions worldwide. These are started up at the beginning of a match and then shut down again. No permanent storage of data takes place there. The battle servers are selected automatically according to player location and latency. For the Battle servers, we use Microsoft Azure, from Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 D18, Ireland.

To protect your personal data, we have each concluded a commissioned processing agreement with Microsoft Ireland Operations Limited in accordance with Art. 28 DSGVO and agreed to the standard contractual clauses (SCC).

IX.        Twitch Drops

1.     Scope of the processing of personal data and purpose of the processing

When you sign up for our TwitchDrops campaigns, your Twitch account will be linked to your chosen platform account. In this context, please refer to the relevant privacy notices of Twitch and the platform providers.

If you then participate in a corresponding event on Twitch with your Twitch account and fulfil the corresponding requirements of the campaign (e.g. watching a stream over a certain period of time), Twitch will transmit the email address stored for your Twitch account and your platform ID to us. We use this data exclusively to send you the rewards offered as part of the relevant TwitchDrops campaign by email or in the game. We do not process or store the data beyond this.

2.     Legal basis for the processing of personal data

The legal basis for the processing of the email address is Art. 6 para. 1 lit. a DSGVO.

3.     Unsubscribe

You can unsubscribe from participation in our TwitchDrops campaigns at any time and thus also revoke your consent to the corresponding data processing by deactivating participation in our campaigns in your Twitch account.

X.         Participation in the Content Creator Program

1.     Scope of the processing of personal data and purpose of the processing

If you would like to apply for our Content Creator Program, you can use the online form provided for this purpose by Microsoft Forms. When you submit the form, in addition to the data you have entered in the form, we also receive your email address and the name you have stored in your Microsoft account. We use the transmitted data to contact you and, if necessary, to reach an agreement about your participation in our Content Creator Program.

2.     Legal basis for the processing of personal data

The legal basis for processing the data is Art. 6 Para. 1 lit. b DSGVO.

3.     Duration of storage

If we conclude an agreement with you on your participation in the Content Creator Program, we will store the relevant data for the duration of your participation and subsequently for a maximum of a further 48 months in the event that possible claims are asserted after termination of the contract. The legal basis for the storage after termination of the contract is Art. 6 para. 1 lit. f DSGVO.

If data accumulates in connection with your participation in the Content Creator Program, which we are obliged to retain or store due to tax, commercial or other regulations, it will only be deleted after expiry of the respective statutory retention or storage periods. The legal basis for this storage is Art. 6 para. 1 lit. c DSGVO.

XI.        Participation in online surveys about the game „The Cycle: Frontier“

1.         Scope of the processing of personal data

We conduct occasional online surveys in the game "The Cycle: Frontier" to find out players' opinions about the game. Participation in such surveys is completely voluntary. If you participate in such a survey and submit the answers and any other information (e.g. age, gender) you provide in the survey to us by clicking on the corresponding button, your geolocation/location (via IP address) limited to the respective country and your player ID will be transmitted to us in addition to your answers and the other information. The player ID is an internal identifier that we use to associate game-related content (see VIII. 1. above) with a specific player. We link the player ID and thus your game-related content (e.g. your game progress) and your geolocation/location with your answers and the other information from the survey. This allows us to better understand your answers. For example, it is important for us to know whether the answers come from an experienced player or which country the player comes from.

2.         Legal basis for data processing

The legal basis for the processing of the data is Art. 6 (1) lit. f GDPR.

3.         Purpose of the data processing

The purpose of the data processing is to find any possible bugs and improve the game and optimally adjust it to the preferences and needs of the players. This purpose also constitutes our legitimate interest in processing the personal data.

4.         Duration of storage

The personal data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. This is the case when we no longer need the data for the evaluation of the surveys.

5.         Recipient

To conduct the surveys, we use the services of ZOHO CORPORATION B. V., based in the Netherlands (ZOHO NL). The data is stored and processed in the Netherlands by ZOHO NL before it is transmitted to us. In individual cases, it is also possible that ZOHO CORPORATION PVT. LTD. located in India (ZOHO IND) may have access to the data if this is necessary for support services provided by ZOHO IND from India.

To protect your personal data, we have concluded a data processing contract with ZOHO NL and ZOHO IND in accordance with Art. 28 GDPR to protect your personal data. In addition, we have agreed the standard contractual clauses with ZOHO IND.

XII.      Embedded YouTube videos

1.     Scope of the processing of personal data

We have embedded YouTube videos on our website. YouTube is a service of Google Ireland Limited, Gordon House, Barrow Street Dublin 4, Ireland ("Google Ireland"). When you call up a website with an embedded YouTube video, your IP address is transmitted to Google Ireland in order to be able to display the preview of the video.

2.         Legal basis for the processing of personal data

The legal basis for the processing of the data is Art. 6 para. 1 lit. f GDPR. Our legitimate interest is to present a functional and interesting web offer by integrating videos from third-party providers.

3.         Purpose of the data processing

We use the YouTube embedded videos feature to provide you with an easy and convenient way to view the video content offered on YouTube.

4.         Duration of storage

The IP address is not stored for the purpose of providing the video. Further information on data processing by Google Ireland can be found at https://www.google.com/intl/de/policies/privacy/.

5.         Recipient

The recipient of the IP address is Google Ireland. Google Ireland is itself the controller within the meaning of the GDPR with regard to the processing of the data.

XIII.     Categories of recipients of personal data

Personal data is only transferred to third parties in the cases mentioned in this policy or if we expressly inform you of this elsewhere. In addition, we sometimes use external data processors (Art. 28 GDPR) to provide our services (e.g. host providers, email providers). However, these process personal data exclusively within the European Union.