Privacy policy

Version 30 September 2023

  1. Galaxy Grove

Galaxy Grove B.V. and affiliated companies (’Galaxy Grove’) are Dutch companies. We are active in the European Economic Area (EEA) and we keep our data on servers in the EEA, unless stated otherwise below.

We process your personal data when you use our games, applications, websites and software and when we contact you or if we have a business relationship with you. In this privacy statement we summarize when and how we collect, use and secure your personal data.

  1. General

We may change provisions of this privacy statement from time to time. If we do that, we will inform you of the changes. However, we also advise you to check for yourself from time to time whether the privacy statement has been changed.

  1. Which personal data do we collect and for which purposes?

There are a number of ways in which we can collect your personal data. In this section we explain which personal data we may collect from you. The personal data is processed according to your role and to the different processing purposes. The data retention period also differs depending on the processing goal. This period will also be mentioned below. Note that should there be any legal changes to the possible data retention periods, these legal changes will take precedent over the periods mentioned in this privacy statement. Please note that, insofar possible, we may anonymise your personal data for statistical and analytical purposes. Once personal data is anonymized it is no longer personal data as it cannot be traced back to you in any way. The retention periods below do not apply to anonymized personal data.

3.1 If you are a player of our games

A. If you contact us as a player, we process the personal data mentioned below. Our processing ground is our legitimate interest to be able to reply on your requests.

  • Name
  • E-mail address
  • Communication and content of e-mails

We may send our e-mail via Mailchimp. Mailchimp may store this personal data in the United States. Mailchimp is bound to the standard contractual clauses as approved by the European Commission. The privacy policy of Mailchimp can be found here: https://mailchimp.com/legal/privacy/.

3.2 If you are a visitor to our websites (including the sub-pages of our games)

A. If you contact us as a visitor to one of our websites, we process the personal data mentioned below. Our processing ground is our legitimate interest to be able to reply on your requests.

  • Name
  • Company name (if you are a business customer)
  • E-mail address
  • Communication and content of e-mails

We may send our e-mail via Mailchimp, which may store your personal data outside of the EEA. For more information, see the information under clause 3.1 sub D.

B. If you sign up for our newsletter, we process the personal data mentioned below until you sign off. Our processing ground is your permission, granted by signing up for the newsletter.  

  • Name
  • E-mail address
  • Your general location (country and/or province level)

We may send our e-mail via Mailchimp, which may store your personal data outside of the EEA. For more information, see the information under clause 3.1 sub D.

3.3 If you are a business customer or supplier

A. We have a legal (tax) obligation to maintain a decent administration. For this purpose we process the personal data mentioned below.

  • Name
  • Company name
  • Address
  • Payment data and information
  • Invoice data
  • VAT identification number 

B. To handle payments, we process the personal data mentioned below. Our processing ground is the performance of a contract with you.

  • Payment data and information
  • Invoice data

If you use a foreign payment provider, your personal data may be stored outside of the EEA. Please refer to the privacy policy of your payment provider.

C. To be able to contact you, we process the personal data mentioned below. 

If we need to contact you for the performance of our agreement, we process the personal data mentioned below.

  • Name
  • Company name 
  • Address
  • E-mail address
  • Telephone number
  • Communication and content of e-mails

If you contact us for another reason than the performance of a contract, we process the personal data mentioned below. Our processing ground is our legitimate interest to be able to reply on your requests.

  • Name
  • Company name 
  • Address
  • E-mail address
  • Telephone number
  • Communication and content of e-mails
  • Your general location (country and/or province level)
  • Your work related function
  • Professional information and statistics (such as your website, channel, number of visitors and/or biographic information)

We may send our e-mail via Mailchimp, which may store your personal data outside of the EEA. For more information, see the information under clause 3.1 sub D.

D. To be able to invite you to events, we process the personal data mentioned below. Our processing ground is our legitimate interest to invite our customers to events for marketing purposes.

  • Name
  • Company name
  • E-mail address
  • Telephone number
  • Your work related function 

We may send our e-mail via Mailchimp, which may store your personal data outside of the EEA. For more information, see the information under clause 3.1 sub D.

E. We may send you our newsletter. We process the personal data mentioned below until you sign off for the newsletter. Our processing ground is our legitimate interest to send our customers and suppliers marketing materials for comparable services.

  • Name
  • E-mail address

We may send our e-mail via Mailchimp, which may store your personal data outside of the EEA. For more information, see the information under clause 3.1 sub D.

3.4 If you are press

A. To be able to contact you, we process the personal data mentioned below. 

If you contact us, we process the personal data mentioned below. Our processing ground is our legitimate interest to be able to reply on your requests.

  • Name
  • Company name 
  • E-mail address
  • Communication and content of e-mails
  • Your general location (country and/or province level)

We may send our e-mail via Mailchimp, which may store your personal data outside of the EEA. For more information, see the information under clause 3.1 sub D.

B. To be able to invite you to events, we process the personal data mentioned below. We will first ask you for permission to be able to invite you.

  • Name
  • Company name
  • E-mail address
  • Telephone number
  • Your work related function 

We may send our e-mail via Mailchimp, which may store your personal data outside of the EEA. For more information, see the information under clause 3.1 sub D.

C. To be able to send you promotional gifts, we process the personal data mentioned below. We will first ask you for permission to be able to send you promotional gifts.

  • Name
  • Address

4. Sharing personal data

We may use so called data processors to process your personal data on our behalf. We conclude data processing agreements with these processors, to assure they only process your personal data on our instruction. 

We use the following types of processors:

  • companies that provide storage of (personal) data and database management and maintenance: 
  • research firms and providers of analytical software to improve our services (e.g. privacy-friendly Google Analytics that does not share personal data with Google);
  • hosting provider(s);
  • providers of customer management software;
  • providers of video software and storage.

If you provide additional information to these processors yourself, we are not responsible for this. It is wise to inform yourself properly about the processor and his company before you provide your personal data. 

Sharing data with your consent

We may also share personal data with others if you give us permission to do so. For example we can cooperate with other parties to offer you specific services or offers. If you register for these services or marketing offers, we may provide your name or contact details if they are necessary to provide that service or contact you. Before we do this, you will always be expressly asked for your consent.

Sharing based on our legal responsibility

We may also share personal data with third parties if this is:

1.  necessary to comply with our legal obligations; 
2. necessary to comply with legal requests from authorities; 
3. is required to respond to any legal claims; 
4. necessary to protect the rights, property or safety of us, our users, our employees or the public; 
5. is required to protect ourselves or our users against fraudulent, abusive, inappropriate or unlawful use of our services.

We will immediately notify you if a government agency makes a request that relates to your personal data, unless we are not allowed to do so on the grounds of the law.

Merger or sale (part) of the company

It may happen that we disclose, share or transfer your personal data when we transfer part of our business. Examples include (negotiations about) a merger, sale of parts of the company or obtaining loans. We will of course try to limit the impact for you as far as possible by transferring personal data only when necessary and anonymizing where possible. 

5 . Protection of personal data

Protecting your personal data is of the utmost importance for us. We have therefore taken appropriate technical and organizational security measures in order to protect your personal data. These measures include, but are not limited to:

–     We protect our databases with physical and electronic measures, to minimize the risk of unauthorized access, loss or misuse of personal data.

–     We use TLS (Transport Layer Security) technology to encrypt sensitive information or personal data, such as account passwords and other identifiable information about payments.

–     We make backups of personal data.

–     Sensitive information is stored encrypted.

–     Vulnerabilities in the software are dealt with as quickly as reasonably possible.

We would like to point out that we cannot guarantee absolute security when sending personal data via the internet or storing personal data. We advise you to take this into account before sharing personal data. 

6 . Links to third party sites

Our websites and games may contain links to other websites and services. In addition, our platform can also provide advertisements from third parties. Third party websites and services can collect and retain information about you. If you provide your personal data to third parties, then we are not involved. We have no control over this sites or the activities of the third parties. In that case, the privacy policy of the third party applies. We are not responsible for the content of the privacy policy of these parties and the way in which these parties deal with personal data. We encourage you to review their privacy and security practices and policies before you provide personal information to them.

7. Your rights

Privacy legislation gives you certain rights with regard to your own personal data. The rights that we describe below are not absolute rights. We will always consider whether we can reasonably meet your request. If we cannot meet your request, or if it would be at the expense of the privacy of others, we can refuse your request. If we refuse a request, we will let you know and explain our reasons.

Right of access

You have the right to request which personal data we process about you. You can also ask us to provide insight into the processing grounds, relevant categories of personal data, the (categories of) recipients of personal data, the retention period, the source of the data and whether or not we use automated decision making.

You may also request a copy of your personal data that we process. Do you want additional copies? Then we can charge a reasonable fee for this.

Right to rectification

If the personal data processed by us about you is incorrect or incomplete, you can request us to adjust or supplement the personal data.

If we grant your request, we will, to the extent reasonably possible, inform the parties to whom we provide information.

Right to erasure

Do you no longer want us to process certain personal data about you? Then you can request us to delete certain (or all) personal data about you. Whether we will delete data depends on the purpose of processing. Data that we process due to a legal obligation or for the performance of the agreement, we will only delete if the personal data is no longer necessary for the purpose of performing the legal duty or the performance of the agreement. If we process data on the basis of legitimate interest, we will only delete data if your interest (your right to privacy) outweighs our rights and freedoms or those of others. We will then make this assessment as to whether our rights and freedoms, or those of others, outweigh your right to privacy. For example, invoking your rights is not intended to erase traces of criminal conduct

If we process the data on the basis of consent, we will only delete the data if you withdraw your consent. Have we accidentally processed data or does a specific law require that we delete data? Then we will delete the data. If the data is necessary for the settlement of a legal proceeding or a (legal) dispute, we will only delete the personal data after the end of the proceedings or the dispute.

If we grant your request, we will, to the extent reasonably possible, inform the parties to whom we provide information.

Restriction of processing

If you dispute the accuracy of personal data processed by us, if you believe that we have processed your personal data unlawfully, if we no longer need the data or if you have objected to the processing, you can also request us to restrict the processing of that personal data. For example, during the time that we need to assess your dispute or objection, or if it is already clear that there is no longer any legal ground for further processing of those personal data, but you still have an interest in us not deleting the personal data. If we limit the processing of your personal data at your request, we may still use that data for the settlement of legal proceedings or a (legal) dispute.

Right to data portability

At your request, we may transfer the data that we automatically process to execute the agreement or based on your consent, to you or another party designated by you. You can make such a request at reasonable intervals.

Automated individual decision making

We do not take decisions based solely on automated processing.

Right of restriction of processing and withdrawal of permission

If we process data on the grounds of a legitimate interest, you may object to the processing. If we process data on the basis of your consent, you may withdraw that consent. For more information, please refer to the relevant processing purposes above.

Exercising your rights

You can send a request for access, correction, deletion, data transfer of your personal data or request for withdrawal of your consent or objection to the processing of your personal data to privacy@galaxy-grove.com.

To prevent abuse, we ask you to identify yourself adequately in the case of a written request for access, rectification or erasure. You can do this by sending a copy of a valid proof of identity. Do not forget to screen off your citizen service number and passport photo on the copy.

We strive to process your request, complaint or objection within a month. If it is not possible to make a decision within a month, we will inform you of the reasons for the delay and the time when the decision is expected to be made (no longer than 3 months after receipt).

Dutch Data Protection Authority

Do you have a complaint about our processing of your personal data? Please contact us. We are naturally happy to assist you. If we cannot come to a solution, you are also entitled to submit a complaint to the national privacy authority, in this case the Dutch Data Protection Authority. For this you can contact the Dutch Data Protection Authority via https://autoriteitpersoonsgegevens.nl. 

9. Contact

If you have questions, concerns or comments about this privacy statement or our data processing, please contact us via e-mail on privacy@galaxy-grove.com

Galaxy Grove B.V.
Europalaan 93, 3526 KP Utrecht
Netherlands