Privacy Policy

Overview

Throughout this Privacy Policy, the following terms have the following meanings.

Data Privacy Laws

Applicable data protection and data privacy laws and regulations, including but not limited to the EU General Data Protection Regulation (2016/679) (the GDPR).

United States Privacy Law

All applicable United States of America data protection and data privacy law on all levels applicable on the processing and the Services, including but not limited to the California Consumer Privacy Act.

Processing and Process

All activities involving your Personal Data, including collecting, handling, storing, sharing, accessing, using, transferring and disposing of information.

Services

Applications, games and other products, Websites, Forums, Webb shop, email communications, social media accounts and any related services or properties the Company controls.

Personal Data

Personal Data that relates to you as an identified or identifiable individual.

While operating the Services, Personal Data will be shared with partners the Company works with. Some of these partners act as Controllers independently and therefore independently determine how and why they process your data. Under certain circumstances, Personal Data may also be transferred to countries outside the European Economic Area.

Section 1

Who We Are

Section 2

What Information Do We Collect From You?

The Company does not expect or intend to collect or otherwise process special categories of data, such as genetic, precise location, biometric or health information, information revealing racial or ethnic origin, sex life or sexual orientation, political opinions, religious or philosophical beliefs, trade union membership, or information about criminal offences or convictions. Do not provide this kind of information or use the Services to make it available to others.

Section 3

How Do We Use Your Personal Data?

The Company uses your Personal Data for different purposes, including to provide requested Services, improve and develop Services, predict user trends, make recommendations and marketing activities based on usage, and customize the Services for you.

In addition, the Company may process your data for additional purposes that are compatible with any of the purposes listed above.

Section 4

Who We Share Your Information With

Your Personal Data may be transferred or disclosed to third parties for the processing of that Personal Data on the Company's behalf, such as the following categories.

• Other companies in the Stillfront Group that help develop, market, improve or operate games, applications and services, or provide other Services. See the most recent annual report published on stillfront.com.
• A limited group of employees in the Stillfront Group for analytical purposes, such as evaluating recent visits and how users move around different sections of the Services.
• Persons or companies that provide services and process Personal Data on the Company's behalf when providing those services.
• Third-party services when you link, connect or log in with a third-party service. Those services may share necessary information such as email for the specific purpose or as otherwise authorized by your settings.
• Professional advisors such as external legal and audit services.
• Third parties to whom certain services are outsourced, such as document processing and translation, confidential waste disposal, IT systems or software providers, support service providers, and document or information storage providers such as Dropbox, Didomi, Google and Amazon Web Services.
• Competent courts of law or other government authorities where disclosure is necessary as a matter of applicable law or regulation.
• Any person or entity where disclosure is necessary to exercise, establish or defend legal rights or to protect your or another person's vital interests.

This list is non-exhaustive. When Personal Data is shared with business partners, group affiliates or other trusted entities, the Company requires them to use the information in accordance with its instructions.

Section 5

Appropriate Safeguards to Countries Outside the EU/EEA

In connection with the processing activities described in this Privacy Policy, information may be shared outside of the European Union (EU) and the European Economic Area (EEA). A number of servers used for hosting data are located in the United States, the main office is in the United States, and some group companies or service providers are also located outside of the EU and EEA.

Where the Company transfers Personal Data outside the EU/EEA, it will ensure that Standard Contractual Clauses have been entered into between the transferring entity and the receiving external party, or that other equivalent safeguards are put in place prior to such transfers.

Data shared may consist of information you provide voluntarily when using the Services, Service-specific personal data, and data collected from your device by automatic means. Under the GDPR, you are entitled upon request to receive a copy of documentation demonstrating that appropriate safeguards have been taken. Requests can be sent to privacy@candywriter.com.

Section 6

How Long Do We Keep Hold of Your Information?

Information is retained only for as long as necessary for the purposes set out in this Privacy Policy. The retention period is established based on:

1. How long there is an ongoing relationship with you.
2. Legal obligations to which the Company is subject, such as tax and accounting obligations.
3. The Company's legal position, including applicable statutes of limitations.

For more specific information about data retention terms, contact the Data Protection Officer at dpo@stillfront.com.

Section 7

Security

The Company applies appropriate safeguards to protect your Personal Data, taking into account the state of the art, implementation costs, and the nature, scope, context, purposes and risks of processing. Technical, physical and organisational measures are in place to protect Personal Data against unauthorised or accidental destruction, alteration or disclosure, misuse, damage, theft, accidental loss or unauthorised access.

Section 8

Your Rights Under the GDPR and Applicable Data Protection Law

Providing data is not mandatory, but the Company may be unable to provide the Services or some features without processing your data. You may limit or control certain processing choices by not connecting third-party accounts, resetting or limiting your Advertising ID, or disabling some or all cookies in your browser settings.

Section 9

US Residents

If you are based in the United States and connecting from states in which data protection laws have been enacted, this section forms part of the Privacy Policy and should be read together with the other sections. If there is any conflict between this section and the remainder of the Privacy Policy, this section prevails.

Candywriter, LLC does not sell personal data and has not done so in the last 12 months. The Company may share identifiers and cookie information with third-party advertisement platforms to provide interest-based and personalised advertisements, measure attributed installs and optimise marketing. To the extent such practices are considered a sale under applicable data protection law, you may opt out by following the steps described below.

Section 10

Changes to the Terms of This Privacy Policy

The Company reserves the right to update this Privacy Policy from time to time, for example due to changes in operations, new partners or the legal obligations that apply. Updates will be made available here and, where appropriate, users will be informed of changes by other means appropriate to the significance of the changes.

Last updated: October 4, 2024

Section 11

Data Controllers

Section 12

Data Processors / Service Providers

Addendum

Privacy Policy Addendum - Asia

This section applies to residents connecting from or for the services offered in India, the Philippines, Indonesia, Malaysia, Thailand, Singapore, Japan, Bangladesh, Mongolia, Australia, New Zealand, and Vietnam.