Privacy Policy Snap Games
Lotum One GmbH, Am Goldstein 1, 61231 Bad Nauheim, Germany ("Lotum" or "we") respects and protects your personal data.
Lotum collects, processes or uses personal data exclusively within the applicable legal framework. Therefore, the high data protection level of the General Data Protection Regulation (GDPR) holds true.
1. Field of application
1.1. We develop games ("Snap Games") that are available on the social network Snapchat, a platform provided by the Snap Group Limited, 77 Shaftesbury Avenue, London, W1D 5DU, United Kingdom ("Snapchat"). In this privacy policy we inform you on the collection, processing and use of data concerning the Snap Games.
1.2. Insofar as individual services of Lotum have different privacy policies, these apply.
1.3. The Snap Games can only be accessed via the Snapchat network, which is operated solely by Snapchat, and only if you have registered for the Snapchat network and are logged into your Snapchat account. The processing of data by Snapchat when you register your Snapchat account and every time you access the Snapchat network is excluded from the field of application of this privacy policy. Likewise, cookies that Snapchat may use for statistical evaluations when you access the Snapchat platform are not within this privacy policy's scope. Snapchat organizes the aforementioned data processing independently and on its own responsibility, without us having any influence on this. For further information on this data processing by Snapchat see Snapchats’ privacy policy under https://snap.com/en-US/privacy/privacy-policy.
2. Data processed when accessing and using the Snap Game
2.1. When you first access one of our Snap Games, Snapchat will assign you one unique ID per Snap Game (the "Snap Game ID"), which is linked to your personal information, and will disclose this ID to us. Snapchat also provides us with the name you have entered in your Snapchat account, the language selected, the country you are playing in, the operating system of your technical device (iOS/Android), a session ID, and the Snapchat avatar which you might have created in your Snapchat account ("BITmoji"). Lotum receives and uses the Snap Game ID and the other aforementioned data solely to create your player profile in the Snap Game to the extent necessary for using the game. Hence, the data processing in this context is carried out for the purpose of performing the contract with you on the use of the Snap Game pursuant to Art. 6 (1) (b) GDPR. We would like to point out that Lotum does not receive any additional personal data from your Snapchat user account. Lotum will not use the data to identify you or to create user profiles for purposes other than providing the Snap Games. If you want to have the aforementioned data on you including the player profile deleted, you can, for example, send an email to games@Lotum.de. In order to be able to identify the data concerning you for deletion, we need your Snap Game ID. Please note that it is not possible to use the Snap Games without such a player profile. If you use our Snap Games again after deletion of your player profile, a new player profile will be set up for you.
2.2. In order for you to access and play the respective Snap Game including all game functions, Lotum collects and processes data on the use of the Snap Game (data on game progress such as completed levels, decisions and answers made in the game, jokers and player aids used, high scores achieved, ongoing and paused game sessions). This data is linked to the Snap Game ID and added to your player profile by Lotum. The processing of this data for the use of the Snap Game is carried out for performance the contract with you on the use of the Snap Game pursuant to Art. 6 (1) (b) GDPR. Lotum does not receive any further personal data of your Snapchat account and is not able to identify you via the Snap Game ID. Lotum will not use this data to create user profiles for any other purpose than to provide the Snap Games.
2.3. Each time you access a Snap Game, Snapchat automatically logs your gender, age and the country you are located in while playing, the operating system of your technical device (iOS/Android), the beginning and end of a game session, how you accessed and started the game, the Snap Game ID, and, if applicable, the number of other players as well as the duration of your use of the Snapchat network. Snapchat collects this information to provide Lotum with aggregated reports and analyses on the general usage of the games through the Snap Games platform, based on which Lotum can gain insights for possible improvements and further developments of the Snap Games. As Lotum only offers the Snap Games in the network operated by Snapchat and therefore has no general access to the Snapchat network, Lotum generally does not obtain any information on Snapchat user accounts or other data that would allow conclusions to be drawn about the identity of individual players. The only exceptions to this are the data mentioned in Sect. 2.1, which Lotum only obtains and uses to create player profiles. Also, Lotum will not merge the data from the aggregated Snapchat reports with other data about individual players, in particular not with the data mentioned in Sect. 2.1.
The data processing in connection with the above analyses of general game use is based on our legitimate interest pursuant to Art. 6 (1) (f) GDPR, which consists in the continuous improvement of our games to ensure the best possible, entertaining gaming experience. For such adjustments based on user experience, we need to know the actual use of the games.
2.4. Furthermore, Snapchat uses the aforementioned, recorded information independently and on its own responsibility for its own, individual purposes and also collects and processes additional data including information from your Snapchat account for these purposes, without us being involved or having any influence on this. Details of this use of your personal data are explained in the Snapchat privacy policy, which you can view under https://snap.com/en-US/privacy/privacy-policy.
2.5. We would like to point out that data processing by Snapchat can also take place outside the EU or the European Economic Area, in particular on servers of the Snap, Inc. located in the United States. This can result in risks for the users, because, for example, the enforcement of the users' rights could become more difficult. For this particular case, Snapchat has confirmed that appropriate protection measures are in place in accordance with Article 44 et seq. GDPR.
3. Advertising via Snapchat
3.1. In our Snap Games, Snapchat may display advertisements. When an advertisement is to be displayed in a Snap Game or clicked on, Snapchat will record notably your interaction with the advertisement, your IP address and, if applicable, your further usage behaviour after the click on the advertisement. Snapchat processes this information in order to measure the success of the respective advertising and to provide us with excerpts of the results. However, Snapchat only provides Lotum with access to aggregated data on the results of the advertising feed, which Lotum cannot trace back to individual persons. Besides, Lotum only receives excerpts of data in the context of the advertisements that cannot be attributed to individual persons. In particular, Lotum does not receive and process any IP addresses or cookies from user devices or other data that allow conclusions to be drawn about the identity of individual users.
3.2. Snapchat autonomously decides on the specific advertisements that are displayed in each case and on the processing of your personal data in the context of selecting and playing these advertisements. Snapchat uses this information to display the advertisements: which specific Snap Game you are playing, information about your usage behaviour in the Snapchat network and your interaction with other content in the Snapchat network, as well as information that you have entered in your Snapchat account. Snapchat also uses cookies for this purpose. Further information on the data processing by Snapchat can be found in the Snapchat privacy policy, which you can view under https://snap.com/en-US/privacy/privacy-policy.
3.3. You will only receive personalised advertising via Snapchat if you have consented to this in your Snapchat settings. The legal basis is therefore Art. 6 (1) (a) GDPR. Of course, you can withdraw your consent at any time for the future by changing your Snapchat settings. Please note that we can only provide the Snap Games free-of-charge with advertise funding. This means that even if you do not consent to receive personalised advertising, you will still see ads in Snap Games, but they will not be personalised, i.e., they will not be tailored to your personal interests. We have a legitimate interest in displaying advertisements in our Snap Games in order to generate revenue and thereby offer our games to you for free. There is also no indication apparent that your interest in not receiving advertising via Snapchat is prevailing when you voluntarily play our Snap Games for free. The associated data processing is therefore justified in accordance with Art. 6 (1) (f) GDPR.
3.4. The data processed in this way are transferred to servers of Snap, Inc. which are also located in the U.S. As explained before, Snapchat has confirmed for this case, that appropriate protection measures are in place in accordance with Article 44 et seq. GDPR.
4. Error analysis with Sentry Analytics
4.1. In order to detect and correct technical errors, we use the service Sentry Analytics provided by Functional Software, Inc. dba Sentry, 132 Hawthorne Street, San Francisco, CA 94107 ("Sentry"). For this purpose, during the play session of a Snap Game, technical details regarding the use of the game and any in-game actions will be stored locally on your device. In the event of an error, these technical details, insofar they are relevant based on the time at which the error occurred, as well as your IP address will be transmitted to Sentry and processed by Sentry along with the following data: Information regarding the hardware and operating system of your device, the name and version of the Snap Game used, a hash of the Snap Game ID as well as the date, time, details of the error that occurred and game-related data connected to the error. Sentry will not profile you at any time. Based on the aforementioned information, Sentry, on behalf of Lotum, merely provides reports and evaluations of apparent errors, including the circumstances of the error's occurrence which may therefore provide insight on possible causes for the error. In this context, the above-mentioned information will also be transmitted to and stored on a Sentry server in the USA. However, Sentry will not merge the data transmitted as part of the Sentry service with any other data and the data will only be used to analyse and correct the technical error. The data collected will be stored by the Sentry service for a maximum of 90 days and deleted afterwards.
4.2. For further information and the applicable privacy policies of Sentry please visit https://sentry.io/terms/ and https://sentry.io/privacy/.
4.3. We use the Sentry service to resolve any errors in our Snap Games and difficulties in using them as swiftly and thoroughly as possible, and thus to further develop our services continuously for ensuring a smooth user experience. The basis for using the Sentry service is our legitimate interest, as described above, in accordance with Art. 6 (1) (f) GDPR. Your legitimate interests are taken into account by removing any personal reference after a transmission of the technical data from your end device, but before its analysis. If you still do not want your data to be collected by the Sentry service in case of a possible error analysis, we must ask you to refrain from playing the free Snap Games.
4.4. We would like to point out that Sentry may also process data outside the EU or the European Economic Area, in particular on servers located in the USA. This may result in risks for users, for example because it may make it more difficult to enforce users' rights. We take these risks into account by taking appropriate protective measures in accordance with Art. 44 et seq. GDPR in particular by agreeing on the standard data protection clauses of the EU Commission with Sentry, which may provide for appropriate protective measures such as encryption of data in individual cases. If data is transferred to Sentry in the USA, this is based on Art. 46 (2) (c) GDPR.
5. Storage period and erasure of data
5.1. We process your personal data as long as it is necessary to achieve the purposes of the processing, or is prescribed by a legal obligation to store the data. Subsequently, the data is deleted in accordance with statutory laws.
5.2. Data that we store for legal reasons, however, is stored for as long as this is required by law. After expiry of a statutory retention period, the data will be deleted without undue delay, unless there are other reasons within the meaning of Art. 17 (3) GDPR opposing the deletion.
6. Data security
Lotum has taken appropriate technical and organisational measures to protect personal data against accidental loss, damage, unauthorised access or unauthorised changes. In particular, Lotum will transmit data only in encrypted form. However, Lotum points out that privacy and data security cannot be guaranteed for transmissions outside Lotum's sphere of influence.
7. Transmission to Third Parties
7.1. Personal data will only be passed on to third parties - unless otherwise set out elsewhere in this privacy policy - without the express consent of the user, if this is necessary for the provision of Lotum's services or for contract execution with the user (e.g. for the technical provision of the offer, see Sect. 7.2). Accordingly, the data are transmitted to such service providers (such as technical service providers) in our legitimate interests pursuant to Art. 6 (1) (f) GDPR, namely to provide access to our Snap Games. Of course, before passing on the user's personal data, Lotum ensures that the relevant service provider has taken appropriate technical and organizational measures to ensure the security of the data.
7.2. We store the data collected by us in the context of access and use of the Snap Games (i.e. data of the player profile including Snap Game ID, name, language, country, operating system, session ID, BITmoji, and data on the use of the game such as game progress and completed levels, used jokers and player aids and achieved high scores) via third party services. We use the hosting service of Snap, Inc., located in the United States. We use these services to provide the aforementioned data for playing the Snap Games efficiently and with the lowest possible susceptibility to errors, thus ensuring the smooth use of the game functions. The legal basis for the associated data processing is Art. 6 (1) (f) GDPR, whereby our legitimate interest is an optimal, technically flawless provision of the Snap Games. We have concluded a data processing agreement with Snap, Inc., including the standard data protection clauses adopted by the EU Commission to safeguard the transfer of data to the USA. The forwarding of personal data to Snap, Inc. in connection with the aforementioned services is therefore based on Article 46 (2) lit. c) and 28 GDPR.
7.3. Otherwise, Lotum will not pass on the user's personal data to third parties unless the user has expressly consented to the transfer (Art. 6 (1) (a) GDPR), or Lotum is entitled or obliged to do so by legal provisions or court orders. In the latter case, the transmission is carried out by Lotum to fulfil a legal obligation pursuant to Art. 6 (1) (c) GDPR.
8. User rights
8.1 Right to object
The user has the right to object at any time to data processing based on Art. 6 (1) (e) or (f) GDPR for reasons arising from his particular situation, unless Lotum can prove compelling reasons worthy of protection, which outweigh the interests of the user, or the processing serves to assert, exercise or defend legal claims. The user can object to data processing for the purpose of direct advertising at any time without special reasons being required.
8.2 Right to information
The user has the right to obtain free of charge from Lotum the personal data stored by Lotum concerning him or her, the processing purposes, their origin, which transfer to which recipients or categories of recipients took place, the storage period and the rights of the data subjects available to him or her.
8.3 Right to correction, deletion and/or restriction of data processing
Furthermore, the user has the right to request at any time the correction of incorrect data, the deletion and/or restriction of the processing of personal data stored about him or her, insofar as there is no legal obligation for Lotum to keep records or other reasons in the sense of Art. 17 (3) GDPR which prevent deletion. Insofar as this includes personal data that is necessary for the provision of services to the user, the deletion or restriction of the processing of this data can only take place when the user no longer uses Lotum's services.
8.4 Right to data portability
If the user provides data relating to him or her and Lotum processes such data on the basis of the user's consent or in order to fulfil the contract, the user may request that he/she receives such data in a structured, current and machine-readable format from Lotum or that Lotum transmits such data to another controller, insofar as this is technically possible (so-called right to data portability).
8.5 Right to revoke consent
Any consent given by the user to the use of personal data can be freely revoked by the user at any time with effect for the future.
8.6 Right to complain to a supervisory authority
The user may also lodge a complaint with a supervisory authority against data processing which he or she considers to be in breach of the statutory provisions.
9. Changes to the Privacy Policy
Lotum reserves the right to change this privacy policy at any time, while Lotum will always comply with the legal requirements of data protection. Therefore, Lotum recommends that users regularly take note of the applicable privacy policy.
Lotum One GmbH, Am Goldstein 1, 61231 Bad Nauheim, Germany
Data Protection Officer of Lotum One GmbH: Susanne Klein, c/o Beiten Burkhardt Services GmbH, Ganghoferstraße 33, 80339 München, Deutschland, privacy@Lotum.de