Keen Games Privacy Policy for enshrouded.com / enshrouded.zendesk.com

Status: 01.12.2023

The protection of your personal data is important to us. With this data protection declaration, we would like to explain to you in more detail which personal data we collect from you and for what purpose the data is used when you visit our website www.enshrouded.com.

1. Responsible person and contact

Keen Games GmbH Dreieichstr. 59 60594 Frankfurt am Main

If you have any questions or suggestions on the subject of data protection, please feel free to contact us by e-mail at the following address: datenschutz@keengames.com

You can contact our data protection officer at the following e-mail address: dsb@keengames.com

2. Subject of data protection

The subject of data protection is personal data. According to Art. 4 No. 1 GDPR, personal data is any information relating to an identified or identifiable natural person; this includes, for example, the name or identification numbers.

3.Newsletter and promotional communication

You can register for our newsletter on our website. To register, we need your email address. You can voluntarily provide us with further information such as your title, first name and surname so that we can address you personally in the newsletter. After sending the newsletter order, you will receive a confirmation e-mail. Registration for the newsletter is only complete when you have clicked on the link in the confirmation e-mail.

We may also send you other promotional communications by email if you consent to the use of your personal data for this purpose.

We also analyse our newsletter campaigns with the help of our service provider MailChimp (see below). When you open an email sent with MailChimp, a file contained in the email (so-called web beacon) connects to a MailChimp server. This can be used to determine whether a newsletter has been opened and which links have been clicked on. In addition, technical information is recorded (e.g. time of the call, IP address, browser type and operating system). This information is used exclusively for the statistical analysis of newsletter campaigns. We use the results of these analyses to better adapt future newsletters to the interests of the recipients.

The above data processing is based on your consent, Art. 6 para. 1 p. 1 lit. a DSGVO. When you register for the newsletter or give your consent to other promotional communication, we also store the IP address and the date and time of registration or consent. This data processing is necessary in order to be able to prove that consent has been given (Art. 6 para. 1 p. 1 lit. c in conjunction with Art. 7 para. 1 DSGVO). We store this data until you unsubscribe from the newsletter or revoke your consent to receive promotional communication.

You can unsubscribe from the newsletter or from receiving other promotional communications at any time via the corresponding link in each newsletter or in each promotional communication.

For sending our newsletter and other promotional communication, we use the newsletter service provider "MailChimp", The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA, which processes your data on our behalf, Art. 28 DSGVO. We base the transfer of data to the USA on Module 2 "Controller-to-Processor" standard contractual clauses of the EU Commission, which we have concluded with MailChimp, in accordance with Art. 46 (2) lit. c DSGVO.

4. Google Analytics

If you agree, we will use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

Google Analytics collects pseudonymous data from you about the use of our website, including your IP address, and uses cookies. This data is transmitted to a Google server in the USA and stored there. However, your IP address will not be transmitted to the USA or otherwise stored by Google. Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity, and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf.

Your data will be stored by Google Analytics for a period of 14 months. After this period, the data is deleted and only aggregated statistics are kept.

The use of Google Analytics is based on your consent (§ 25 para. 1 TTDSG, Art. 6 para. 1 p. 1 lit. a DSGVO).

You can revoke your consent at any time and deactivate Google Analytics using a browser add-on. You can download this here: http://tools.google.com/dlpage/gaoptout?hl=de. You can also revoke your consent via our Cookie Consent Manager by clicking on the "C" at the bottom right and adjusting your settings there. This does not affect the lawfulness of the processing that took place until your revocation.

5. Google Tag Manager

If you agree, we use Google Tag Manager, a tool of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). With Google Tag Manager, we can integrate and manage tags on our website. Tags are small sections of code that, for example, track your activity on our website (e.g. Google Analytics).

Google Tag Manager helps to collect data about your web behavior on the website and forwards it to the connected tags, where it is stored and evaluated. Google Tag Manager does not store this data itself, but rather acts as an interface between the website and the analysis tags. However, when the Google Tag Manager is integrated on our website, data such as your IP address and browser information is also transmitted to Google.

The use of Google Tag Manager is based on our legitimate interest in providing an efficient and state-of-the-art website and to understand the use of our website (Art. 6 para. 1 p. 1 lit. f GDPR).

Google may also process your data at Google LLC in the USA. Google LLC is actively certified under the EU-US Data Privacy Framework, which governs the secure transfer of personal data from EU citizens to the USA.

6. Meta Pixel

If you agree, we use the Meta Pixel, a product of Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour Dublin 2, Ireland ("Meta") for remarketing purposes. Meta Pixel uses cookies to collect information about your use of our website (e.g. products you have viewed, unique ID numbers that can distinguish you from other users). This information is transmitted to Meta, which enables Meta to identify you across multiple websites. This allows interest-based advertisements ("Facebook Ads") to be displayed to you when you visit the Facebook or other websites that also use the process.

We are joint controllers with Meta for the collection and transmission of data in the context of the use of Meta Pixel. This applies for the following purposes:

• Creation of individualized or suitable advertisements, as well as for their optimization
• Delivery of commercial and transaction-related messages (e.g. via Messenger)

The following processing operations are not covered by joint controllership:

• Processing after collection and transmission is the sole responsibility of Meta.
• The creation of reports and analyses in aggregated and anonymized form is carried out as part of commissioned processing and is therefore our responsibility.

We have concluded a corresponding agreement with Facebook for being joint controllers, which can be accessed here: https://www.facebook.com/legal/controller_addendum.

You can find more information about Meta Pixel at https://www.facebook.com/business/tools/meta-pixel. Please also note Meta's privacy policy: https://www.facebook.com/privacy/policy/

The use of Meta Pixel is based on your consent (Art. 6 para. 1 p. 1 lit. a GDPR).

You can revoke your consent via our Cookie Consent Manager by clicking on the "C" at the bottom right and adjusting your settings there. This does not affect the lawfulness of the processing carried out until you withdraw your consent.

7. Reddit Pixel

If you agree, we use a conversion tracking and remarketing tool, the so-called Reddit Pixel of Reddit Ireland Limited, Reddit EU Data Inquiries, 70 Sir John Rogerson's Quay, Dublin 2 Ireland ("Reddit"), to evaluate our advertising measures on Reddit.

The Reddit Pixel collects data from you about the use of our website and uses cookies. With the help of the Reddit pixel, Reddit can determine you as a target group for the display of advertisements (so-called "Reddit ads") based on your visit to our website. We use Reddit pixels to display the Reddit ads placed by us only to those Reddit users who have also shown an interest in our website or who have certain characteristics (e.g. interest in one of our products). The information collected is transmitted to Reddit. In addition, Reddit and we can use the Reddit Pixel to track the actions of users on Reddit after they have clicked on a Reddit ad. This allows us to record and evaluate the effectiveness of advertisements for statistical and market research purposes in order to optimize future advertising measures.

Reddit is responsible for data processing in connection with the delivery of our ads within the social network. You can find more information about Reddit's data processing here: https://www.redditinc.com/policies/privacy-policy.

The use of the Reddit Pixel is based on your consent (Art. 6 para. 1 p. 1 lit. a GDPR).

You can revoke your consent via our Cookie Consent Manager by clicking on the "C" at the bottom right and adjusting your settings there. This does not affect the lawfulness of the processing carried out until you withdraw your consent.

8. Cloudflare

We use Cloudflare, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA ("Cloudflare"), to protect our website from attacks and to deliver our content in an optimised way. For this purpose, your IP address may also be collected by Cloudflare. The processing is based on our legitimate interest in securing our IT infrastructure and the efficient and user-friendly design and delivery of our website (Art. 6 para. 1 p. 1 lit. f DSGVO). We base data processing in the USA on Module 2 "Controller-to-Processor" standard contractual clauses of the EU Commission, which we have concluded with Cloudflare, in accordance with Art. 46 (2) lit. c DSGVO.

9. Enquiries

If you send us enquiries, for example also support enquiries about Enshrouded, for example via our contact form, by e-mail, social media, via Discord or by any other means, we will store and use the contact information and details you provide in order to process the enquiry.

To process enquiries by email or via our contact form, we use the CRM system "Zendesk" (Zendesk, Inc, 989 Market Street, San Francisco, CA 94103, USA), which processes your data on our behalf, Art. 28 DSGVO. We base the transfer of data to the USA on Module 2 "Controller-to-Processor" standard contractual clauses of the EU Commission, which we have concluded with Zendesk, in accordance with Art. 46 (2) lit. c DSGVO.

We store enquiries with Zendesk about contracts or of potential legal relevance for the general limitation period, i.e., three years from the end of the year in which we received your enquiry. We retain all other Zendesk enquiries for a period of 24 months. After that, your queries will be deleted unless we are required by law to retain them for a longer period.

The storage is based on our legitimate interest in the proper documentation of our business operations and the protection of our legal positions (Art. 6 para. 1 p. 1 lit. f DSGVO). In the case of enquiries about contracts, the data is stored for the purpose of initiating and implementing the respective contractual relationship (Art. 6 para. 1 p. 1 lit. b DSGVO) and, if applicable, for the purpose of fulfilling legal obligations (Art. 6 para. 1 p. 1 lit. c DSGVO).

10. Social media

You can also find us on various social media channels.

When you visit our social media accounts, we process certain data from you when you interact with us, e.g. like or comment on posts. We process this data on the basis of our legitimate interest in providing the corresponding functions on our accounts and evaluating the use of our social media channels (Art. 6 para. 1 sentence 1 lit. f DSGVO) and, if applicable, on the basis of your consent (Art. 6 para. 1 sentence 1 lit. a DSGVO) or your contractual relationship with the respective social network (Art. 6 para. 1 sentence 1 lit. b DSGVO).

You can find us on the following social media platforms:

• Facebook / Instagram: Meta Platforms Ireland Limited (Headquarters: Ireland, Privacy Policy Facebook: https://www.facebook.com/privacy/policy/, Privacy Policy Instagram: https://instagram.com/about/legal/privacy., Shared Responsibility Agreement: https://www.facebook.com/legal/controller_addendum)
• TikTok: TikTok Technology Limited (Headquarters: Ireland, Privacy Policy: https://www.tiktok.com/de/privacy-policy)
• Twitter: Twitter International Company (Headquarters: Ireland, Privacy Policy: https://twitter.com/privacy)
• Discord: Discord Netherlands B.V. (registered office: Netherlands, privacy policy: https://discord.com/privacy)
• Youtube: Google Ireland Limited (Headquarters: Ireland, Privacy Policy: https://policies.google.com/privacy)
• Twitch: Twitch Interactive Inc. (headquarters: USA, privacy policy: https://www.twitch.tv/p/en/legal/privacy-notice/)

11. Integrated third party content

We have integrated content from third-party providers on our website. This content is loaded from the servers of the respective providers, so that your end device transmits certain technically necessary data to the third-party provider. In particular, it cannot be ruled out that these providers can take note of the IP address assigned to you. Insofar as personal data is processed, this is done on the basis of the data protection declarations of the respective third-party providers. The integration by us takes place on the basis of our legitimate interests in being able to provide our users with the corresponding content and functionalities and to be able to operate our website economically, as well as the circumstance that your legitimate interests are not overridden, Art. 6 para. 1 sentence 1 lit. f DSGVO. In detail, we integrate the following third-party content:

• Youtube: Google Ireland Limited (Headquarters: Ireland, Privacy Policy: https://policies.google.com/privacy)
• Vimeo: Vimeo Inc. (registered office: USA, privacy policy: https://vimeo.com/privacy)

12. Hosting

We operate our website on the servers of the hosting service provider Host Europe GmbH, Friesenplatz 4, 50672 Cologne. Our hoster processes personal data on our behalf, Art. 28 DSGVO.

13. Other data processing and disclosure

If it is necessary to clarify an illegal use of our website or our services or for legal prosecution, personal data will be processed by us or forwarded to the law enforcement authorities and, if necessary, to injured third parties. However, this only happens if there are concrete indications of unlawful or abusive behavior. A transfer may also take place if this serves to enforce terms of use or other agreements. We are also legally obliged to provide information to certain public authorities upon request. These are law enforcement agencies, authorities that prosecute administrative offences subject to fines and the tax authorities.

The processing and disclosure of this data is based on our legitimate interest in combating abuse, prosecuting criminal offences and securing, asserting and enforcing claims and that your rights and interests in the protection of your personal data are not overridden, Art. 6 (1) sentence 1 lit. f DSGVO, or on the basis of a legal obligation pursuant to Art. 6 (1) sentence 1 lit. c DSGVO.

We process and disclose personal data to auditors, accounting service providers, lawyers, banks, tax advisors and similar bodies insofar as this is necessary for the provision of our services (Art. 6 para. 1 p. 1 lit. b DSGVO) or the proper operation of our business, including the enforcement of or defence against legal claims and legal prosecution (Art. 6 para. 1 p. 1 lit. f DSGVO) or we are obliged to do so (Art. 6 para. 1 p. 1 lit. c DSGVO).

14. Automated individual decisions or profiling measures

We do not use automated processing to make a decision about you or to profile you for this purpose.

15. Your rights as a data subject

As a data subject, you have a right to information about the data processed, a right to rectification of your personal data, a right to erasure of your personal data, a right to restriction of the processing of your personal data and a right to data portability in accordance with the legal requirements.

In addition, you have the right to object to the processing of your personal data at any time for reasons relating to your particular situation, if the data processing is based on Art. 6 (1) sentence 1 lit. e or lit. f DSGVO (including profiling) or if data is processed for direct marketing purposes.

In the event of consent, you have the right to revoke your consent at any time, Art. 7 (3) p. 1 DSGVO. This does not affect the lawfulness of the processing carried out until your revocation.

You also have the right to lodge complaints with a supervisory authority.

Finally, we would like to point out that we process the personal data provided by you when exercising your rights pursuant to Articles 15 to 22 of the GDPR for the purpose of implementing these rights and to be able to provide proof thereof. This processing is based on the legal basis of Art. 6 para. 1 sentence 1 lit. c DSGVO.

16. Changes to this privacy policy

The current version of this privacy policy is always available at https://www.enshrouded.com/privacypolicy