Prisma Rift — Privacy Policy

1. Data controller

The controller responsible for your personal data is:

Company:

Prisma Game studio s.r.o.

Company number (IČO):

C457564

Registered office:

Podskalská 1512/22, Nové Město, 128 00 Praha 2, Czech Republic

General and privacy enquiries:

info@prismarift.com

Customer support:

support@prismarift.com

2. Personal data we collect

Depending on how you use the Platform, we may collect the following categories of personal data:

2.1 Account information

• username;
• email address;
• password (stored only in encrypted/hashed form);
• account identifier;
• profile settings and preferences.

2.2 Transaction information

• Digital Content purchased through the Store;
• order history;
• payment status and payment amount;
• transaction identifiers.

We do not store full payment card details. Card and other payment data are processed directly by independent payment service providers, who are responsible for their own compliance with the Payment Card Industry Data Security Standard (PCI DSS).

2.3 Technical information

• IP address;
• browser type and version;
• operating system and device characteristics;
• language settings and time zone;
• access logs, diagnostic logs and security logs.

2.4 Usage information

• gameplay activity necessary to operate the Game and administer your account;
• interactions with features of the Platform;
• preferences and settings;
• communications with our customer support.

2.5 Affiliate Program information

If you apply to participate in our Affiliate Program, we may additionally collect:

• full legal name, residential address and date of birth;
• government-issued identity document;
• proof of address;
• payment details required for commission payouts;
• a photograph/selfie or biometric liveness data, where used for identity verification;
• any other information reasonably required for identity verification, fraud prevention, sanctions screening and compliance with legal requirements.

3. How we use your personal data

We use personal data to:

• create and maintain your account;
• provide access to the Platform and the Game;
• process purchases of Digital Content through the Store;
• provide customer support;
• send marketing communications about the Platform, where you have consented or where otherwise permitted by law (you can unsubscribe at any time);
• administer the Affiliate Program;
• verify Affiliate Program applicants through identity verification (KYC) checks;
• detect, prevent and investigate fraud, abuse, unauthorised activity and security incidents;
• improve the functionality, performance and security of the Platform;
• comply with our legal and regulatory obligations;
• resolve disputes and establish, exercise or defend legal claims.

We do not sell your personal data to third parties.

4. Legal bases for processing

We process personal data only where we have a legal basis under Article 6 GDPR, namely:

• performance of a contract — to provide the Platform and the services you request from us (Article 6(1)(b) GDPR);
• compliance with legal obligations — for example accounting, tax and regulatory requirements (Article 6(1)(c) GDPR);
• legitimate interests — for example security, fraud prevention, improvement of the Platform and direct marketing to existing customers, where these interests are not overridden by your rights and freedoms (Article 6(1)(f) GDPR);
• consent — where required by law, for example for non-essential cookies and certain marketing communications (Article 6(1)(a) GDPR).

Where biometric data is processed to verify the identity of Affiliate Program applicants, we rely on your explicit consent (Article 9(2)(a) GDPR). You may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

5. Affiliate Program verification (KYC/AML)

• Participation in the Affiliate Program requires successful completion of identity verification.
• Verification is carried out for the purposes of fraud prevention, sanctions compliance, anti-money laundering checks and other purposes described in the Terms & Conditions.
• Required documentation must be provided before an application is approved and before any commission is paid out.
• If you do not provide the requested information, your application may be rejected or your participation suspended until verification is completed.
• Verification may be performed by the Company or by independent identity verification providers acting on our behalf.

6. Cookies and similar technologies

We use cookies and similar technologies to provide essential functionality, maintain sessions, remember preferences, ensure security, analyse performance and measure usage of the Platform. Non-essential cookies are used only with your consent, where required by law. For more information, please see our Cookie Notice.

7. Sharing of personal data

We disclose personal data only where reasonably necessary to operate the Platform or where required by law. Recipients may include:

• payment service providers;
• identity verification providers;
• fraud prevention and security providers;
• IT infrastructure and software providers;
• cloud hosting providers;
• analytics providers;
• customer support providers;
• legal, accounting and other professional advisers;
• public authorities, regulators or law enforcement bodies, where required by law.

We do not sell or rent personal data to third parties for their own marketing purposes. Our service providers may process personal data only as necessary to provide their services to us and are required, by law and by contract, to protect it.

8. International data transfers

Our service providers may process personal data in countries outside the European Economic Area (EEA). Where personal data is transferred outside the EEA, we ensure an adequate level of protection by relying on an adequacy decision of the European Commission (Article 45 GDPR), the European Commission’s Standard Contractual Clauses (Article 46 GDPR), the EU–U.S. Data Privacy Framework (where the recipient is certified), or another lawful transfer mechanism.

9. Data retention

We retain personal data only for as long as necessary to provide the Platform, maintain your account, administer purchases and affiliate relationships, comply with legal, accounting, tax and regulatory obligations, resolve disputes and enforce our agreements.

• Affiliate verification records are retained for as long as necessary to complete and administer verification, comply with legal requirements, prevent fraud, resolve disputes and enforce our rights.
• Accounting and tax records are retained for the periods required by Czech law (in particular Act No. 563/1991 Coll., on Accounting, and Act No. 235/2004 Coll., on Value Added Tax), which may be up to 10 years.
• Other personal data is generally retained for the lifetime of your account and thereafter for the applicable statutory limitation period, unless a longer period is required by law.

When personal data is no longer needed, it is securely deleted, anonymised or otherwise disposed of.

10. Your rights

Subject to applicable law, you have the right to:

• access your personal data;
• rectify inaccurate personal data;
• request erasure of your personal data;
• restrict processing;
• object to processing based on legitimate interests, including profiling, and to object at any time to direct marketing;
• data portability, where applicable;
• withdraw your consent at any time, where processing is based on consent;
• lodge a complaint with a supervisory authority.

To exercise your rights, contact us at info@prismarift.com. We will respond within one month of receiving your request; this period may be extended where permitted by the GDPR. We may ask you to verify your identity before acting on a request.

The competent supervisory authority in the Czech Republic is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, www.uoou.gov.cz. You may also contact the supervisory authority in your EU Member State of residence or place of work.

11. Security measures

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, destruction or loss. These measures include encrypted communications, access controls, authentication, system monitoring, security logging and regular

updates. However, no method of transmission over the internet or of electronic storage is completely secure.

12. Children’s privacy

The Platform is intended only for users who are at least 18 years old or the age of majority in their jurisdiction, whichever is higher. We do not knowingly collect personal data from persons who do not meet this requirement. If we become aware that we have collected such data, we may delete it and terminate the associated account.

13. Third-party services

The Platform may contain links to third-party websites or integrate third-party services. This Privacy Policy applies only to personal data processed by the Company through the Platform. We are not responsible for the privacy practices or content of third parties, and we encourage you to review their privacy policies.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time for legal, business or operational reasons. Updates take effect upon publication on the Platform unless a different effective date is stated. Where changes are material, we will take reasonable steps to inform you. Continued use of the Platform after the effective date constitutes acknowledgement of the updated Privacy Policy.

15. Contact information

If you have any questions about this Privacy Policy or the processing of your personal data, please contact us:

Company:

Prisma Game studio s.r.o.

Company number (IČO):

C457564

Registered office:

Podskalská 1512/22, Nové Město, 128 00 Praha 2, Czech Republic

General and privacy enquiries:

info@prismarift.com

Customer support:

support@prismarift.com