PRIVACY POLICY FOR ENTROPIA UNIVERSE

MindArk PE Aktiebolag (publ) (”we” or “MindArk”) care about your privacy. Therefore, we always strive to protect your personal data in the best possible way and to comply with all applicable laws and regulations for the protection of personal data. This policy applies when you use Entropia Universe, visit entropiauniverse.com (the “Website”), subscribe to our newsletter, chat with us, communicate with us, shop from our webshop as well as when you use our forum and social media.

Personal data means any information relating to an identified or identifiable natural person, it can be information about your name, address etc., but can also be your avatar’s name and activities in Entropia Universe.

You will find more detailed information about our data processing procedures below. Use the summary or the table of contents to navigate through this privacy policy. Do you want to know more about how we process your personal data? Please do not hesitate to contact us.

SUMMARY

When you create an account and use Entropia Universe: we process your personal data to enable you to create an Entropia Universe account and provide Entropia Universe to you as a user, and to enable our planet partners to provide their services to you through Entropia Universe.
To provide functionality in Entropia Universe: we process personal data to improve Entropia Universe, to send crash reports if there are technical issues, and to make Entropia Universe, the apps and the Website function technically.
If you consent on our Website: we analyze how our Website is used, and/or show relevant marketing and follow up on such marketing.
When you receive our marketing: we send newsletters to you, improve our newsletters, and comply with marketing legislation.
When we provide necessary information to Entropia Universe Users: we process your personal data to provide you with important information, e.g. updates to our EULA.
In chat and other communication: we process your personal data to communicate with you, for example regarding support cases, and to answer your questions in the most efficient way, with the help of AI.
If you use our forum and social media: we process your personal data to interact.
If you write user testimonials: we process your personal data to publish user testimonials that you have written.
When you make deposits and withdrawals: we process your personal data to administer exchanges of PED and items for your avatar and to handle deposits and withdrawals of funds, comply with applicable legal requirements, for example applicable accounting and bookkeeping acts, and to make sure we only offer you items that are available in your country.
If you purchase from our webshop: we process your personal data to handle your purchase and send any purchased real life items to you.
To supervise the use of Entropia Universe and handle any discussions or claims: we process your personal data to ensure that you do not use Entropia Universe in breach of the Terms of Use and other rules and policies governing the use of Entropia Universe, to protect us against fraud or attempted fraud, and to handle complaints and/or legal disputes.

Who is responsible for your personal data? Questions or queries?
Are you required to provide the personal data?
From whom or where do we collect your personal data?
Detailed description on how we process your personal data
Balance of interests tests when processing data based on “legitimate interests”
Who gains access to your personal data?
Where is your personal data stored/transferred to?
What rights do you have?
Changes to this privacy policy

Who is responsible for your personal data? Questions or queries?

MindArk PE Aktiebolag (publ), Swedish company registration number 556640-4769, located at Masthamnsgatan 5, 413 29 Gothenburg, Sweden and with the email address support@mindark.com is responsible for the processing of your personal data (the controller).

If you have any questions regarding our processing of your personal data, you may contact us via the Support Section of the Website, or via any of the contact details stated above. If you wish to contact us by post, please send a letter to the address stated above, attention Entropia Universe Support.

Are you required to provide the personal data?

The substantial parts of our processing of your personal data are necessary for us to process (for the fulfillment of the contract that we have with you). If you do not provide us with the personal data that we need to process, you will not be able to create an Entropia Universe account or use Entropia Universe.

As described below, some processing is also conducted due to legal requirements. If you do not provide us with the personal data which you are obligated to provide us with, for instance if you are making withdrawals over a certain limit and we need a copy of your passport or identity card for identity control purposes, you may not be able to make a deposit or withdrawal of funds.

In the tables below you see which personal data that you need to provide by reviewing the tables where we have stated that the legal ground is “fulfillment of contract” or “legal obligation”. Do not hesitate to ask us if you are unsure why we need specific personal data.

From whom or where do we collect your personal data?

We collect the majority of the personal data that we process about you from you, including when you use Entropia Universe. We also collect information about e.g. your IP address and/or MAC address associated with your device.

In addition, we also process some personal data about you that we have collected from other Entropia Universe users if they share information about you with us, either directly by addressing us or indirectly by mentioning you in chats within Entropia Universe.

If you communicate with us on social media or if you post on our social media page we process personal data from the social media platform.

Detailed description on how we process your personal data

Our aim is to be as transparent as possible regarding our processing of your personal data. Therefore, we provide detailed information about how we process your personal data below. Here you can read about why we process your personal data (the purposes of processing), what personal data we process and our legal basis according to the data protection legislation (“GDPR”) for processing your personal data.

Below you find information on how we handle your personal data in the following situations:

Account and game
Functionality in Entropia Universe
If you consent on our Website
Marketing
Information to Entropia Universe users
Chat and other communication
Our forumand social media
User testimonials
Deposits and withdrawals
Webshop
To supervise the use of Entropia Universe and handle any discussions or claims

Account and game

Purpose	Personal data	Legal ground
To create your Entropia Universe account When you create an Entropia Universe account, you will submit information about you and we will process this information to create an Entropia Universe account for you and thereafter process your email address to send a verification to your email address.	Log-in name Your email address Your password	Fulfillment of contract Processing is necessary for the performance of our contract and to take steps at your request prior to entering a contract (Article 6.1 (b) GDPR).
To provide Entropia Universe to you as a user If you log in and participate in Entropia Universe, we will process your personal data to administer and fulfill our obligations to you as an Entropia Universe user. This includes to technically provide the game to you and to enable you to log in via our app. Read more in our policy for cookies and similar functionality.	All information associated with your Entropia Universe account (see above) Information regarding your IP and MAC address Information about your game progress and in-game behavior in Entropia Universe, e.g. information about how your avatar interacts in Entropia Universe, what competitions and challenges you participate in, information about the equipment associated with your avatar, information relating to your PED Card balance, information about in-game transactions and settings you have chosen as well as information about your device such as hardware, related drivers and your IP address Information about how much time you spend in Entropia Universe We will also process personal data about you in logs from within Entropia Universe that you are either part of or referred to Any pictures that you provide when making your own picture frames within Entropia Universe	Fulfillment of contract Processing is necessary for the performance of our contract (Article 6.1 (b) GDPR).
To enable planet partners to provide their services to you through Entropia Universe We share your avatar name with planet partners so that they know who is using their planet and enable them to communicate if you are experiencing problems. If we send statistical information to our business partners, we always anonymize such information, i.e. they will not receive personal data about you in the statistics they receive from us.	Avatar name	Legitimate interest Your personal data will be processed based on our legitimate interest in enabling partners to provide their services through Entropia Universe (Article 6.1 (f) GDPR). You can read more about our balance of interests test below.
Storage period We will stop processing your personal data when you unregister your account or ask us to delete certain data (provided that the data cannot be stored by us thereafter in accordance with applicable data protection legislation, see further information bel ow). Please note that your Entropia Universe account and all thereby related personal data will be deleted if you have been inactive for a consecutive period of one year (excluding any personal data that needs to be stored for a longer period, as described below).
Who gains access to your personal data? Our planet partners get access to limited personal data as described above. Read as well about our IT suppliers below under the heading “Who gains access to your personal data?”.

Functionality in Entropia Universe

Purpose	Personal data	Legal ground
To improve Entropia Universe and send crash reports if there are technical issues We process your personal data, to improve Entropia Universe and your gaming experience. Gather and analyze information about why Entropia Universe has crashed in order to understand how we can implement necessary adjustments to Entropia Universe. However, we do not process information about what you did before the crash or information about other software running at the same time. Optimize Entropia Universe based on information about how you and other users interact and move when playing. To be able to compile statistics about Entropia Universe we process personal data, for example to know how many males and females that use Entropia Universe, the age of our users, how many users have participated in a specific event, how much activity occurred during an event, and what the most popular content was. The statistical compilation will be aggregated so that your personal data will only be processed for the initial part of the compilation. Thereafter the information is only used in anonymized statistical information. Read more in our policy for cookies and similar functionality.	Information about your hardware and software setup Information about your game progress and in-game Gender Age Information about events that you participate in and content that you use During any technical issues leading to a crash, we process: Information about the crash, i.e. that you have experienced a crash and information about what happened during the crash Technical information from your device, i.e. graphics card, drivers, sound card, MAC address, operating system, total system memory (RAM), information about how much memory is available Name of your account Your avatar name and information about which avatar you use Position in Entropia Universe (X, Y or Z sector and server) Information about how long Entropia Universe had been running before the crash In some cases we also process other relevant information such as the texture your client was loading when the crash happened Behavior	Legitimate interest Your personal data will be processed based on our legitimate interest in improving Entropia Universe to offer a better user experience for you and other Entropia Universe users protecting other users and ourselves against fraud and fraud attempts (Article 6.1 (f) GDPR). You can read more about our balance of interests test below. Note that you can choose if you want to automatically send information regarding crashes in your settings.
To make Entropia Universe, the apps and the Website function technically We process your personal data to ensure that Entropia Universe, the apps and the Website functions in a satisfying and secure manner, including to track the use of Entropia Universe, the apps and the Website in order to find errors, to avoid spam and adapt the Entropia Universe to your device. Remember your choices, e.g. whether you have consented. Read more in our policy for cookies and similar functionality.	Your IP address A unique ID for your session Information about how you use Entropia Universe, the apps and the Website Information about your device Information about your choices, e.g. your consent	Legitimate interest Your personal data will be processed based on our legitimate interest to ensure the functionality of Entropia Universe, the apps and the Website as well as to remember your choices (Article 6.1 (f) GDPR). You can read more about our balance of interests test below.
Storage period We mainly use this type of information during your use of Entropia Universe or the Website.
Who gains access to your personal data? Read about our IT suppliers below under the heading “Who gains access to your personal data?”.

If you consent at our Website

Purpose	Personal data	Legal ground
To analyze how our Website is used Analyze how you use and interact with our Website to improve the Website and services. To do this we use the analytic service Google Analytics. The analytic service means that we place a random ID on your device to distinguish your device from other users and to acknowledge patterns in how our Website is used. We at MindArk will however not know who you are. The personal data we gather will be used e.g. to optimize functions, loading speed and to adapt the Website and the activities to become better adapted to our users. Read more in our policy for cookies and similar functionality.	An encrypted version of your IP- address which we ourselves cannot connect to you as an individual Information about your device/browser Your location Information about how you use the Website and your activities on the Website, e.g. what you click on Other information Google have about you, e.g. information about from which site you found us	Consent The personal data will be processed based on your consent (Article 6.1 (a) GDPR). You can withdraw such consent at any time. You can prevent Google Analytics to use your personal data by downloading and installing this browser program.
To show you relevant marketing and follow up on such marketing Market our services by showing you offers we believe you could be interested in when you visit other websites or social media. To do this we use marketing services from Meta (Instagram and Facebook), Google, CPM Star and Ogno. You see marketing based on information that these companies have about you beforehand and the analysis of how you used the Website (so called profiling*). This means that we share your personal data with these marketing services, so they have information about which types of users that are interested in us. Read more in our policy for cookies and similar functionality.	An encrypted version of your IP- address which we ourselves cannot connect to you as an individual You will see search results and ads based on: An analysis of how you use the Website Information that the marketing services we use have about you since before, e.g. information about from which site you found us	Consent The personal data will be processed based on your consent (Article 6.1 (a) GDPR). You can withdraw such consent at any time. Here you can make choices about the marketing you see from Google and here on Facebook under the heading ad settings you can choose which marketing you want to see on Facebook.
Storage period We will continue to process your personal data maximum two years after your visit to our Website. You can withdraw your consent at any time. Google, Meta, CPM Star and Ogno will continue to store your personal data for their own purposes as independent controllers. Information about how long they will store your personal data can be found in their respective information texts.
Who gains access to your personal data? When you visit our Website and have given your consent, your personal data will be processed by the analytics- and marketing services that we use, i.e., Meta (Instagram and Facebook), Google, CPM Star and Ogno. These recipients process personal data on our behalf as processors but are also processing your personal data as controllers. These services inform you separately about the processing that they are responsible for.

* Profiling: We use so called profiling to be able to show you offers that are relevant to you and to provide you with customized marketing. We use profiling because without it, you would instead see offers and information which you are probably not interested in. You have the right to object to profiling as described below under the section explaining your rights.

Marketing

Purpose	Personal data	Legal ground
To send newsletters to you If you have asked us to send you newsletters we will periodically send you emails with information about Entropia Universe that we think is relevant for Entropia Universe users. This could be information regarding upcoming events or competitions. We may also send more personalized emails to you based on personal data that we have collected about you. For example, an email may be sent when you have been inactive for an extended period. If you do not download the Entropia Universe client to your device after an Entropia Universe account has been created, we process information about your email address to send you an email reminder to download the client.	Email address Information from your account and activity that we use to personalize the email, for instance your date of birth, or your activity within Entropia Universe	Consent You only receive information, newsletters and/or marketing if you have given us your consent to do so (Article 6.1 (a) GDPR). If you withdraw your consent we will stop sending you such information. You can withdraw such consent at any time by contacting us. If you withdraw your consent you will be added to our “unsubscribe-list” to comply with marketing legislation (see below).
Improve our newsletters Improve and develop our newsletters by analyzing how you open them and what you click on. Read more in our policy for cookies and similar functionality.	Information about how you use our newsletters, i.e. if you open them and what you click on IP-address Email address	Consent The personal data will be processed based on your consent (Article 6.1 (b) GDPR). You can withdraw such consent at any time by contacting us.
To comply with marketing legislation If you have stated that you do not wish to receive marketing from us, we will store such information in an “unsubscribe-list” to make sure we do not send any marketing to you.	Name Email address	Legal obligation The processing is necessary to comply with legal obligations which we are subject to, i.e. marketing law, which require us not to send marketing material to individuals who have objected to receiving such marketing (Article 6.1 (c) GDPR). We cannot make sure you will not receive marketing from us without processing your personal data for this purpose and you are therefore required to provide your personal data to us.
Storage period We will send such newsletters and marketing until you unsubscribe or no longer have an account. If you unsubscribe from our newsletters and marketing, you will be listed in our “unsubscribe-list” until further notice.
Who gains access to your personal data? We will share your personal data with the newsletter service which we use to send marketing. The newsletter service act on our behalf and following our instructions. To provide a safe transfer of your personal data we have concluded a data processing agreement with the newsletter service and the newsletter service are only allowed to process personal data on our instructions.

Information to Entropia Universe users

Purpose	Personal data	Legal ground
Provide you with important information This information includes notifying you of updates to our Terms of Use, this privacy policy or other rules and policies regarding the use of Entropia Universe, e.g. receipts and information about any changes to your account. If you forget your Entropia Universe account password, we will upon your request send an email to the email address that you have registered for your Entropia Universe account.	Email address Password	Fulfillment of contract Processing is necessary for the performance of our contract (Article 6.1 (b) GDPR).
Storage period We will send you notifications with important information and updates for as long as you have an Entropia Universe account.
Who gains access to your personal data? Read about our IT suppliers below under the heading “Who gains access to your personal data?”.

Chat and other communication

Purpose	Personal data	Legal ground
Communicate with you, for example regarding support cases Communicate, for example via our support channels, mobile apps, chat etc. Answer your questions and give you the best service. Read more in our policy for cookies and similar functionality.	Information about your avatar name, gears and stats Information about your gaming patterns Information you share with us when you communicate through the chat at our Website or with any NPCs in Entropia Universe	Legitimate interest Your personal data will be processed based on our legitimate interest in answering your questions in the most efficient way and to be able to draw conclusions on how to improve Entropia Universe and our services (Article 6.1 (f) GDPR). You can read more about our balance of interests test below.
Answer your questions in the most efficient way, with the help of AI We use AI to communicate with you in the chat on our Website and when you communicate with any NPCs in Entropia Universe. We also use the information for statistical purposes, to be able to improve Entropia Universe and our services, for example to draw conclusions about how the AI functionality works and how we answer questions from users in the best way. As a precaution and in line with best practices for online interactions, we urge you to never share personal information with the AI chat – to avoid sharing and processing personal data.	Information about your avatar name, gears and stats Information about your gaming patterns Information you share with us when you communicate through the chat at our Website or with any NPCs in Entropia Univers	Legitimate interest Your personal data will be processed based on our legitimate interest in answering your questions in the most efficient way and to be able to draw conclusions on how to improve Entropia Universe and our services (Article 6.1 (f) GDPR). You can read more about our balance of interests test below.
Storage period We store your personal data for as long as it is necessary to answer your questions or help you with a support case. Personal data from our communication is thereafter erased regularly in accordance with our retention policy. However, if the matter is part of a complaint or dispute, we will continue to store the personal data as stated below here. When you have used the AI chat, we aim to only use and store aggregated data.
Who gains access to your personal data? Our support supplier which handles support cases for Entropia Universe. If you use our AI chat at the Website or ask questions to our NPCs in Entropia Universe, OpenAI will process some of your personal. When you use the chat on our Website, we also share your personal data with D-ID. Both parties have made efforts to avoid being able to identify you, therefore only very limited information is shared with them. OpenAI and D-ID only get access to information about your avatar name, gears, stats and different gaming patterns. When you use the chat on our Website, we also share your personal data with our supplier Zendesk, which helps us make the chat at the Website work.

Our forum and social media

Purpose	Personal data	Legal ground
Interact Communicate via the forum or social media, e.g., if you comment on our site or our social media page. he social media channels ‘process your personal data either on our instructions or, as data controllers, in their own right. We suggest that you also familiarize yourself with the privacy information of that platform.	Any other information that you share with us when communicating Personal data from your profile (for example user name and the picture that you have chosen)	Legitimate interest Your personal data will be processed based on our legitimate interest in interacting with you and handle any comments/posts that you make (Article 6.1 (f) GDPR). You can read more about our balance of interests test below.
Storage period You can delete your comments and communication with us on our forum and our social media channels at any time. We will remove posts or comments that breach the rules of the platform or conflict with legislation as soon as possible.
Who gains access to your personal data? If you interact with us or visit our social media accounts, such platform will process personal data about you as a user.

User testimonials

Purpose	Personal data	Legal ground
To publish any user testimonials that you’ve written We may ask you to write a user testimonial and thereafter publish your user testimonial if you agree to let us publish it.	Your name Other information that you share in your user testimonial	Legitimate interest Your personal data will be processed based on our legitimate interest in being able to request user testimonials from our users, and to share such testimonials that you have chosen to write (Article 6.1 (f) GDPR). You can read more about our balance of interests test below.
Storage period The user testimonial is published until you ask for the publication to be deleted.
Who gains access to your personal data? To post any user testimonials, we will make your personal data publicly available via our social media platforms. In that case the social media platform will process your personal data. The social media platform is itself processing your personal data as a controller. Read about our IT suppliers below under the heading “Who gains access to your personal data?”.

Deposits and withdrawals

Purpose	Personal data	Legal ground
To administer exchanges of PED and items for your avatar and to handle deposits and withdrawals of funds To handle any exchanges of PED and/or items for your avatar from the Entropia Universe webshop and to handle deposits or withdrawals of funds relevant payment information is transferred to and handled by our payment providers. In some cases, the payment providers themselves are the personal data controllers and will in such case provide information about their processing to you separately, this is the case for example when making a bank transfer to us. We process your personal data for the purposes of administering and fulfilling our obligations to you when you make a purchase and/or deposit or withdrawal of funds.	Information about your Entropia Universe account (see above) Age Country of residence Address Date of birth Information about your debit/credit card or bank account details Which personal data is processed depends on the payment method you choose. Your credit card number and CVV code are however only processed in encrypted form by us.	Fulfillment of contract Processing is necessary for the performance of our contract (Article 6.1 (b) GDPR). The personal data will also be stored to comply with applicable laws and regulations (see below).
To comply with applicable laws and regulations We process your personal data to comply with applicable laws and regulations.	To comply with applicable accounting, bookkeeping, tax and VAT acts and regulations we process: Name Address Country Your PED transactions Deposits Withdrawals and payment information (see above for information regarding our processing for handling withdrawals).	Legal obligation The processing is necessary to comply with legal obligations to which we are subject, i.e. accounting, bookkeeping and tax legislation (Article 6.1 (c) GDPR).
To make sure we only offer you items that are available in your country Depending on where you live, it might be possible for you to purchase Strongboxes. We use services that give us information about which country your device is located in, to avoid selling Strongboxes if you are based in Sweden where we do not offer Strongboxes. Read more in our policy for cookies and similar functionality.	Your IP address Bank account number Information about which country your device is located in Your avatar status (to make sure that you are not on your deposit limit cap)	Legitimate interest Your personal data will be processed based on our legitimate interest to only offer you items that are available in your country (Article 6.1 (f) GDPR). You can read more about our balance of interests test below.
Storage period We will store your personal data that we process to administer exchanges of PED and items for your avatar and to handle deposits and withdrawals of funds as long as you have an account. We will continue to store the personal data to comply with Swedish accounting and bookkeeping acts and regulations for seven years from when the fiscal year that the payment refers to ended.
Who gains access to your personal data? Depending on the method you use to deposit or withdraw, we may share information about your credit/debit card number (if you choose to make a deposit by card) or other relevant information with our payment processor or our bank to administer any deposit and/or withdrawal of funds. If you choose a payment solution for which the service provider itself is the personal data controller, you will receive separate information from them regarding such processing. Read about our IT suppliers below under the heading “Who gains access to your personal data?”.

Webshop

Purpose	Personal data	Legal ground
Handle your purchase and send you any real life items purchased Handle your order. Handle payment. Remember a product you have placed in the chart in the webshop. Read more in our policy for cookies and similar functionality. Send your purchase to you, if you have made a purchase of a real life item. This includes when we share your personal data with the transporter that handles your delivery. We also process personal data to comply with applicable laws and regulations as we describe in the table above.	Name Contact information Order information, for example the product which you have purchased Delivery information Payment information	Fulfillment of contract Processing is necessary for the performance of our contract regarding your purchase (Article 6.1 (b) GDPR). The personal data will as well be stored to comply with applicable laws and regulations (see below).
Storage period Personal data related to your purchase will be processed by us for a few days in order to administer and manage your order so that you can receive the products you have ordered. Thereafter, information about your purchase will be stored to handle any questions about your purchase, returns, guarantees and complaints in a smooth manner and in accordance with applicable consumer legislation. Some personal data is stored for a longer period for other purposes, such as for accounting and bookkeeping purposes. You can read more about this above.
Who gains access to your personal data? If you make a purchase from us, we will share your name, address and contact details with our courier PostNord in order to deliver your products. Read more in PostNords’ privacy policy here. These recipients are independently responsible for the processing of your personal data. Read about our IT suppliers below under the heading “Who gains access to your personal data?”.

To supervise the use of Entropia Universe and handle any discussions or claims

Purpose

Personal data

Legal ground

To monitor and ensure that you do not use Entropia Universe in breach of the Terms of Use and/or other rules and policies governing the use of Entropia Universe

We will process personal data to monitor and ensure that you use Entropia Universe and your Entropia Universe account in accordance with the Terms of Use and other rules and policies for the use of Entropia Universe.
When necessary, we may process your personal data to investigate any suspected noncompliance.

Information about how you use Entropia Universe, including logs, and your Entropia Universe account (see more information above)
In case we suspect noncompliance we process the personal data necessary to investigate any attempts of noncompliance, for example information about repeated attempts to withdrawal in breach of the Terms of Use or repeated insults directed at other users of Entropia Universe

Legitimate interest

Your personal data will be processed based on our legitimate interest in ensuring that your use of Entropia Universe complies with applicable rules and policies (Article 6.1 (f) GDPR). You can read more about our balance of interests test below.

To protect us against fraud and attempted fraud

We process your personal data to prevent and handle fraud or fraud attempts, for example credit card fraud.
To make deposits and withdrawals we can take measures to verify your identity. Which specific measures we take depends on money transfer method as well as your deposit level.
To identify a potential fraud attempt or an actual fraud.
To verify you as a legitimate user for the purpose of protecting us against economic fraud.

Information about how you use Entropia Universe (including logs)
Information about suspicious behavior, insults or abuse directed at other users in chat
Information about your Entropia Universe account
If we need to verify your identity we process:
Your name
Address
Bank information regarding your bank statements
To increase your deposit level even further or for other money transfer methods we will request and process personal data in a verified copy of your passport or government-issued ID
To verify where the money comes from we process:
Personal data in logs
Information from security checks
Information about whether you have completed the required information or not
To protect us against economic fraud we may process:
Information about whether you are located in the same country as your IP,
Your birth certificate
A verified copy of your passport and your MAC address

Legitimate interest

Your personal data will be processed based on our legitimate interest in protecting other users and ourselves against fraud and fraud attempts (Article 6.1 (f) GDPR). You can read more about our balance of interests test below.

To handle complaints and/or legal disputes

To handle any questions or complaints.
To defend ourselves against complaints.

Name
Email address
Phone number
Any other personal data which is relevant within the framework of the claim, complaint and/or legal dispute. This may include information about your behavior within Entropia Universe, information about any transactions and so on

Fulfilment of contract, legal obligation and legitimate interest

Processing is necessary for the performance of our contract (Article 6.1 (b) GDPR).
When your claim follows from your legal rights, such as requests of withdrawal or complaint, the processing is also necessary for us to be able to act in accordance with consumer law and therefore to comply with a legal obligation (Article 6.1 (c) GDPR).
The personal data is also processed based on our legitimate interest to establish, exercise or defend us against legal claims (Article 6.1 (f) GDPR). You can read more about our balance of interests test below.

Storage period

We store your personal data from the date that a claim, complaint and/or legal dispute, including a potential claim, complaint or legal dispute, comes to our attention and for as long as it is ongoing. If we decline your claim, we always store the information for one year in case you choose to have your legal dispute reviewed by a relevant instance.

Who gains access to your personal data?

To control whether you are located in the same country that your IP address suggests we share information about your IP address with our supplier that provides us with the service.
Read about our IT suppliers below under the heading “Who gains access to your personal data?”.

Balance of interests tests when processing data based on “legitimate interests”

For some purposes, MindArk process your personal data and rely on our legitimate interest as the legal basis for the processing. When assessing the balance of interests test, we have determined that our legitimate interest for the processing outweighs your interests or rights which require the protection of your personal data. We have stated our legitimate interests above.

You are welcome to contact us if you wish to get more information about how we have undertaken this test.

Who gains access to your personal data?

As a starting point, only MindArk processes your personal data. To conduct our business in an efficient way, we do however need to employ and collaborate with certain third parties. In the tables above we have listed these third parties.

In addition to the specific third parties that we have listed above, we also will share your personal data with our IT suppliers who will process the personal data on our behalf and following our instructions to ensure good and secure IT operations. We only share your personal data with our IT partners if it is necessary for them to fulfil their obligations towards us according to our agreement with them. To provide a safe transfer of your personal data we have concluded a data processing agreement with the IT suppliers and the IT suppliers are only allowed to process personal data on our instructions.

If you want to know more about who we share your personal data with, please feel free to contact us.

Where is your personal data stored/transferred to?

As a main rule, MindArk do not process your personal data outside of the EU/EEA. If you are using Entropia Universe from outside the EU/EEA, your personal data will of course be processed where you are. However, we at MindArk does not transfer your personal data outside the EU/EEA by purpose.

Nonetheless, your personal data will be processed outside the EU/EEA in the below listed situations. If your personal data will be processed outside the EU/EEA, then we will make sure that such processing is based either on a decision from the Commission establishing that the country in question ensures an adequate level of protection or on appropriate safeguards that ensure that your rights are protected or based on another ground for such transfer in accordance with GDPR.

To our IT suppliers that are located outside of the EU/EEA. For example, if you have a support matter your personal data will be transferred outside the EU/EEA since Zendesk (support) are located there. However, to protect your personal data and minimize the risk of personal data being transferred outside the EU/EEA, we ensure that your personal data is stored exclusively on servers of our IT suppliers that are situated within the EU/EEA. Regarding support matters, we have taken measures to ensure that support data from our EU customers are only accessible by support personnel located within the EU/EEA.
If you visit and communicate with us on our social media channels (e.g. LinkedIn, Facebook (Meta) and YouTube), your personal data will be transferred outside the EU/EEA. One reason being that many of these companies are based in the United States.
When we use Meta (Instagram and Facebook), Google, CPM Star and Ogno or if you visit our social media, your personal data will be transferred outside the EU/EEA. One reason is that many of these companies are based in the United States. We have anonymized your personal data as far as possible to avoid your personal data being transferred outside of the EU/EEA.
If you use our AI chat on the Website or ask questions to any NPCs in Entropia Universe, your personal data will be transferred outside the EU/EEA. The reason for this is that the supplier of these services (OpenAI) is based in the United States.

We rely on an adequacy decision regarding most transfers to the US, when our American suppliers are certified under the EU-US Data Privacy Framework. An adequacy decision means that the European Commission has assessed that a particular country has an adequate level of protection for your personal data under Article 45 GDPR. You can find the adequacy decision for the US here. Google and Meta are certified under the EU-US Data Privacy Framework.

In the absence of an adequacy decision, or when our transfer is not protected under an adequacy decision, we and our suppliers will instead rely on Standard Contractual Clauses (Article 46.2 c GDPR) Module 1 (controller to controller), and Module 2 (controller to processor), and supplementary security measures for the transfer of personal data outside of the EU/EEA. We will rely on the Standard Contractual Clauses when your personal data is processed through for example OpenAI. The use of Standard Contractual Clauses is an effort to provide a safe transfer of your personal data. You can find the Standard Contractual Clauses here.

If you want to know more about where your personal data will be processed, please feel free to contact us.

What rights do you have?

In accordance with GDPR, you have certain rights – see below for more information.

If you have any questions regarding your rights or want to exercise any of your rights, please contact us by using the contact details above. You can also find more detailed information about your rights and when they apply at The Swedish Authority for Privacy Protection (IMY).

Right to complain – Article 77 of GDPR
You have the right to lodge a complaint with the competent supervisory authority if you consider that the processing of your personal data violates the GDPR. In Sweden, the competent supervisory authority is The Swedish Authority for Privacy Protection (IMY)
Right to withdraw consent – Article 7.3 of GDPR
You have the right to withdraw your consent at any time by contacting us. You can always withdraw any consent you give on the Website directly on the Website.
Right of access – Article 15 of GDPR
You have the right to obtain confirmation as to whether or not we are processing your personal data. You can send a request by contacting us. If we are processing your personal data, you also have the right to receive a copy of the personal data we are processing and information about the processing, such as the purposes of the processing and how long the data is stored.
Right to object – Article 21 of GDPR
You have the right to object at any time to processing of your personal data for direct marketing purposes (including profiling) and to processing of your personal data that is based on our legitimate interests (including profiling).
Right to rectification – Article 16 of GDPR
You have the right to have inaccurate personal data concerning you rectified without undue delay. You also have the right to have incomplete personal data completed.
Right to erasure (“right to be forgotten”) – Article 17 of GDPR
Under certain conditions, you have the right to have your personal data erased by us without undue delay. For example, if you withdraw your consent and there is no other legal basis for the processing or if the personal data is no longer necessary for the purposes for which it was collected or processed.
Right to restriction of processing – Article 18 of GDPR
Under certain conditions, you have the right to request that we restrict our processing of your personal data. For example, if you contest the accuracy of the personal data, or if the processing is unlawful and you oppose the erasure of the personal data and instead request a restriction on the use of the personal data.
Right to data portability – Article 20 of GDPR
If we process your personal data based on your consent or to fulfil a contract, you have the right to receive personal data concerning you. This right applies to personal data that you have provided to us in a structured, commonly used and machine-readable format. You also have the right to transmit those personal data to another controller, where technically feasible.

Changes to this privacy policy

If any of the information in this privacy policy changes, we will share our revised privacy policy on our Website. You find our privacy policy here. We will however inform you about any subsequent, substantive or material changes to the policy by contacting you.

This Privacy Policy was last updated on the May 21, 2024.