PRIVACY NOTICE FOR PROCESSING PERSONAL DATA BY СYBERYAL

Version 1.1 – 06.07.2023

Playstar Platform OÜ, address Harju maakond, Tallinn, Artelli tn 19, 10621, registry code 16306741 (hereinafter “Cyberyal”) processes personal data of individuals who use the information society service сyberyal.com.

1. GENERAL PROVISIONS

1.1 Cyberyal ensures that the processing of personal data is in accordance with the legislation regarding the protection and security of personal data (including the General Data Protection Regulation of the European Union, hereinafter, “GDPR”), other personal data protection legislation, and good business practices.

1.2 Cyberyal considers the privacy of individuals and the protection of their data important and makes the best efforts to ensure the security and protection of the information system and other data carriers.

1.3 Please note that the cyberyal.com Platform is used in different countries. Personal data processing conditions may differ from country to country, and the corresponding data processing notice can be found on localised versions of the Platform.

2. DEFINITIONS

2.1 User means a person who signs up for the Platform or uses the services provided by Cyberyal.

2.2 Processing of personal data means viewing, collecting, saving, storing, altering, transmitting, or receiving personal data and other activities related to personal data.

2.3 Platform means Software as a Service, including the website https://Cyberyal.com/ and the mobile applications through which the services of the Cyberyal are available.

3. PURPOSE OF THE PROCESSING OF PERSONAL DATA AND ITS LEGAL BASIS

3.1 Cyberyal processes personal data necessary for the management of the accounts of the Users and for the collection of data regarding the object of the services, for example, user content, payments and competitions.

3.2 In general, the legal basis for such a purpose is carried out in accordance with Article 6(1)(b) of the GDPR. Such processing is necessary for the performance of a contract to which the User is a party or in order to take such steps at the specific request of the User prior to entering into a contract. Sometimes the processing of data is necessary for legitimate interests under Article 6(1)(f) of the GDPR provided those interests are not outweighed by the Users’ rights and interests.

3.3 Cyberyal is operating a Platform which provides several functions for data processing activities.

Processing activity (controller)Data categoriesPurposeLegal basis
Creating accountsFull name, address, telephone number, email address, date of birth, billing type, residential address.Providing the Platform,wallet and conducting the necessary payments for the UsersContract
AML Checks (if applied)Taxpayer identification number, Government identification number, source of funds, government issued documents, marital status, title, gender, residential address, nationality.Fulfilling legal obligationContract
Platform usageHelpdesk requests, alerts, and account logs, in-game Data and Performance Metrics, user-generated Content (e.g. chats, forums, reviews),  usage and interaction DataCustomer support for Users, provision of the serviceContract, legitimate interest
Service updatesName, e-mail addressCustomer support for UsersLegitimate interest
NewslettersName, e-mail addressMarketingConsent
Reminders and notificationsName, e-mail addressNotificationLegitimate interest
Payment dataThe bank account number, payment data, invoice or payment notification data and other payment dataPayment management for usersContract
Processing the data received from supported gamesData collected by the supported games and delivered to the Platform to aggregate the data. The scope of collected data is determined by the respective game.Providing the serviceDPA provided by the supported games

4. HOW CYBERYAL COLLECTS PERSONAL DATA

4.1 Cyberyal collects personal information on the Platform directly when:

4.1.1 the User enters the data necessary for creating an account on the Platform;

4.1.2 the User authorises Cyberyal to make inquiries for the collection of activity from the supported games and other integrated services, e.g. usage activity data or match results from a supported game. Cyberyal performs queries in an automated form (API solution) or by making individual requests.

4.2 Cyberyal collects indirectly personal information on the Platform when providing IT infrastructure (Platform) for provision of goods or services, specifically when:

4.2.1 the User enters into a contract with another user;

4.2.2 the Users exchange information related to the goods or services;

4.2.3 the User provides their account information for the purposes of fulfilling an order or handling competitions..

5. TRANSMISSION OF THE PERSONAL DATA

5.1 Cyberyal processes personal data in the European Union (EU) and within the European Economic Area (EEA). Cyberyal receives, transmits, and processes personal data only digitally.

6. DISCLOSURE OF PERSONAL DATA

6.1 Cyberyal will disclose the User´s personal data to third parties (e.g. other users), if the services are requested between users.

6.2 Cyberyal engages third-party service providers to perform functions on our behalf, such as payment processing, data analysis, marketing, and customer support. These service providers have access to your personal data only to the extent necessary to perform their services, and they are contractually obligated to maintain the confidentiality and security of your information.

6.3 In order to provide in-game training, coaching, and assistance, we may share your relevant personal data, such as your account information, in-game performance metrics, and communication preferences, with the professional players and experts you choose to connect with on the platform.

6.4 When you participate in the platform's community features, such as forums, reviews, or chat rooms, your username, profile picture, and any content you submit may be visible to other users.

6.5 We may disclose your personal data if required to do so by law or in good faith belief that such action is necessary to comply with legal obligations, such as platform exchange of tax information or anti-money laundering obligations.

6.6 We integrate third-party services, such as Xsolla to operate payment transactions. Xsolla may collect various personal data both directly from users and indirectly from the third parties by acting strictly in accordance with all applicable laws and regulations, and the goals of personal data collection. Xsolla does not process transactions on its own. Xsolla's sole responsibility is to manage payment flows, not to process, facilitate, control, or support any money transactions.

6.7 Infrastructure service providers:

Processing activity (controller)ActivityTerritory
XsollaManagement of payment flowsIf your data is collected in the United Kingdom, the European Union or Switzerland, Xsolla will transfer your personal data subject to appropriate safeguards, such as Standard Contractual Clauses.
Amazon AWSStorage of cloud servicesFrankfurt, Germany

7. RETENTION AND DELETION OF PERSONAL DATA

7.1 The storage period of personal data depends on the legal obligations to store data (i.e. accounting regulations), contractual obligations, and legitimate interest or consent to provide the best services.

Data TypePurposeRetention Time
Account informationWe will retain your account information for the duration of your account's active status. If you choose to delete or deactivate your account, we will retain some of your personal data as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. Personal data will not be deleted if there is a dispute between the User(s) or Cyberyal.If the User deletes the account or has been inactive on the Platform for the last 24 calendar months, the User's personal data shall be deleted, except to the extent allowed by the law or for a duration of up to 3 months following the deletion.
User-generated ContentWe will retain user-generated content, such as forum posts, reviews, and chat logs, for as long as the associated feature or service remains active, or as required by legal obligations, dispute resolution, or agreement enforcement.User-generated Content will be deleted only upon request.
AccountAccount managementAccount management If no purchases are made by the User, the account will be deleted after 24 months from the first sign-up
Payment dataAccountingSeven years since the payment is made
Email address, newsletter consentMarketingUntil withdrawal of consent

8. RIGHTS OF THE USER (DATA SUBJECT)

8.1 The User (data subject) shall have the right at any time to request:

8.1.1 access to personal data (accessed via the Platform);

8.1.2 correction of inaccurate personal data (given when data is automatically collected from supported games, Cyberyal cannot correct activity data);

8.1.3 require the deletion of personal data (not applicable to supported games);

8.1.4 restriction of processing of personal data;

8.1.5 transfer personal data to the controller designated by the User (only applicable to data, which Cyberyal is the controller);

8.1.6 withdrawal of data-processing consent (applicable to requests made by the User).

8.2 In order to exercise these rights, the User must submit a declaration to support@cyberyal.com. The application shall be responded to within a maximum of 30 calendar days.

8.3 The User has the right to lodge a complaint against the processing of personal data with the supervisory authority, which is the Estonian Data Protection Inspectorate (www.aki.ee).

9. CHANGES AND VALIDITY

9.1 Cyberyal has the right to change the conditions for processing personal data. In the event, that there are substantial changes, Cyberyal will provide at least 1 (one) month’s notice in advance through the Platform before the substantial changes take effect.

9.2 The conditions for processing personal data are valid from [23.07.] 2023.