Privacy Notice for
Midnight Stories: Choice Games Website / Game

Personal data

Sources of data

We receive your data when you visit the Website / Game and interact with it, depending on your actions on the Website / Game.

You can change your personal data by exercising your right to rectification or by the Website / Game Functionality. Please note that the same lawful basis and storage terms apply to the changed data.

We may also (although we do not necessarily do so) receive data from third parties.

It depends on your settings and the features you use.

Lawful bases for processing

To process your personal data, we rely on the following lawful bases:

• performance of the contract - for the processing of personal data necessary for the negotiating on, conclusion, and performance of a contract (mainly, the Terms of Use) with you;

• legitimate interest - for the processing necessary for the development of our services, taking into consideration your interests, rights, and expectations;

• legal obligation - for the processing as required by applicable laws (for example, to comply with tax or KYC/AML regulations) or if requested by a law enforcement agency, court, supervisory authority, or another state-authorised public body;

• consent - for additional specific purposes.

Player’s data

When you register an account and start to play, we collect the data to enable your access and correct work of our Game.

Data	Reasons for processing	Lawful basis
Name, email address and password	Create an account	Performance of the contract
Data about the gameplay	To provide the smooth operation of the Game.	Performance of the contract
Data on the device (device name and operating system)
IP address and mobile device identifiers (device ID, MAC address, IMEI);
General location data (country and city)	To understand the regions our users are from.	Legitimate interest
Payment data	To handle in-app purchases	Performance of the contract
Data storage
Data that is processed based on performance of the contract	Stored for 3 years from the last interaction.
Data that is processed based on legitimate interest	Stored for 3 years from the last interaction or until you object to the processing.

Support Requestor’s Data

When you address your request to support in the Game, we collect some information to help you.
We may collect your detailed log files to help you with your problem. These log files may contain personal information and are connected to you

Data	Reasons for Processing	Lawful Basis
Email	To fulfil your support request	Performance of the contract
Name
Type of device
Text of the request
Attached files
Logs
Data Storage
We store the data during your use of the Game and 3 years after the termination of the agreement between us and you

Data received from third parties

We may receive some personal data from third parties.
The amount of data collected, the purposes, and the lawful basis for processing is determined by the respective privacy documents of these third parties.

Data sharing with third parties

We can share your personal data with third parties without any harm to you and in full compliance with applicable law. In addition, we have implemented organizational and technical measures to ensure the security of personal data during data transfer to third-party.

Third parties	Description
Analytics tools	We use analytics tools to understand and promote our business.
Messengers	We use messengers to communicate with you in ways that are convenient for you.
Contractors, services providers on Website / Game	We cooperate with service providers and contractors to provide you with their services, operate, develop and improve the features and functionality of the Website / Game, fulfil your support requests, complete payment transactions, etс.
Providers of the services our team use	We use CRM systems, messengers, and other services in our organization to provide you with our services.
State authorities, courts, law enforcement agencies, etc	We may be obliged to transfer some of your data to tax authorities, courts, law enforcement agencies, and other governmental bodies: to comply with a government request, court order, or applicable law; to prevent unlawful use of the Website / Game; to protect against claims of third parties; to help prevent or investigate fraud.
To get a detailed list of the third-party recipients of your personal data, contact us.

To share your data, we rely on the following lawful bases, depending on the case: consent, compliance with the law, and performance of a contract.

Data transfer outside the European Economic Area

The personal data we collect is stored on Playfab servers.

If there is no adequate decision by the European Commission regarding the country we transfer data to, we use adopted Standard Contractual Clauses based on legislation assessments for data protection during transfer and storage.

If there is an adequate decision by the European Commission regarding the country we transfer data to, we can transfer personal data to that third country without any further safeguard being necessary.

You can read more detailed measures to protect your personal data here.

Data protection

We are building our product in accordance with ISO 27001 Standard.

We apply a variety of security measures appropriate to the possible risks.

Organizational measures
Staff training
Non-disclosure agreements (NDA)	Transfer protection

Technical measures
Two-factor authentication	Backups
Firewalls	Encryption technologies

Data subjects rights

You, as a data subject (individual), have the right to interact with your data directly or through a request to us. This section describes these rights and how you can exercise them depending on your residency.

European Economic Area residents

You, as a data subject, have the right to interact with its data directly or through a request to us. This section describes these rights and how you can exercise them:

Right	Description
Right to access	You can request an explanation of the processing of your personal data.
Right to rectification	You can change the data if it is inaccurate or incomplete.
Right to erasure	You can send us a request to delete your personal data from our systems. We will remove them unless otherwise provided by law.
Right to restrict the processing	You may partially or completely prohibit us from processing your personal data.
Right to data portability	You can request all the data you provided to us and request to transfer data to another controller.
Right to object	You may object to the processing of your personal data.
Right to withdraw consent	You can withdraw your consent at any time.
Right to file a complaint	If your request was not satisfied, you could file a complaint to the regulatory body.
To exercise your rights, contact us. If your request was not satisfied, you can submit a complaint to your local Data Protection Authority. You may find it here. UK residents enjoy the same rights, but may lodge a complaint at the other Authority in the UK – Information Commissioner’s Office. You can contact them at 0303 123 1113 or go online at www.ico.org.uk/concerns.

United States residents

You, as data subjects, have some special privacy rights. To use them, please contact us.

Please note! Depending on the state and legislative requirements, we have from 30 to 60 days to exercise your request, with the right to postpone it for 30 days more.

If your complaint is not satisfied, you can file a complaint with the Federal Trade Commission.

Your rights vary depending on the laws that apply to you, but may include:

Right	Description	Area
Right to access	You can request an explanation of the processing of your personal data.	California Montana Colorado Tennessee Connecticut Texas Utah Indiana Virginia Iowa
Right to correct	You can change the data if it is inaccurate or incomplete.	California Montana Colorado Tennessee Connecticut Texas Virginia Indiana
Right to delete	You can send us a request to delete your personal data from our systems.	California Montana Colorado Tennessee Connecticut Texas Utah Indiana Virginia Iowa
Right to portability	You can request all the data you provided to us and request to transfer data to another controller.	California Montana Colorado Tennessee Connecticut Texas Utah Indiana Virginia Iowa
Right to opt out of sales	The right to opt out of the sale of personal data to third parties.	California; Montana; Colorado; Tennessee; Connecticut; Texas; Utah; Indiana; Virginia; Iowa.
Right to opt out of certain purposes	The right to opt-out of processing for profiling/targeted advertising purposes.	Colorado; Tennessee; Connecticut; Texas; Indiana; Utah; Montana; Virginia.
Right to opt out of processing of sensitive data	The right to opt-out of processing of sensitive data.	California.
Right to opt in for sensitive data processing	The right to opt in before processing of sensitive data.	Colorado; Tennessee; Connecticut; Texas; Indiana; Montana; Virginia.
Right against automated decision-making	A prohibition against a business making decisions about a consumer based solely on an automated process without human input	California; Montana; Colorado; Tennessee; Connecticut; Texas; Indiana; Iowa; Virginia.
Private right of action	The right to seek civil damages from a controller for violations of a statute.	California.
Please note! Some states do not have privacy laws. The rights of residents of such states are governed by U.S. federal law. If your state is not on the list, please contact us.