Privacy Notice

This privacy notice (the “Notice”) applies to the processing of personal data (hereinafter, “Personal Data”) of the users (hereinafter, the “User/s” or the “Data Subject's”) carried out by Bending Spoons S.p.A., based in Corso Como 15, Milan (Italy) (hereinafter, the “Data controller” or the “Company”) in relation to the use of the games that will be rendered available on the service “Playond” and to the service itself (hereinafter, “Playond”) in accordance with Regulation (EU) no. 679 of 27 April 2016 - General Data Protection Regulation or the “GDPR” - as well as the Italian Legislative Decree 196/2003 and other applicable local laws, as amended or replaced (jointly, the “Applicable Privacy Laws”).

I. Data Controller’s contact details

The Data Controller is Bending Spoons S.p.A., based in Corso Como 15, Milan (Italy). Email: privacy@bendingspoons.com

II. Categories of the processed Personal Data, purposes and legal basis for the processing

The Company processes the following categories of Personal Data, for the purposes and on the legal bases indicated below.

Purpose Legal basis Categories of processed data
a) To enable Users to use Playond (e.g. to send to the Users a code to authenticate them, to recognize the access level of the Users across different games and devices). The legal basis for the processing is the performance of a contractual relationship with the User (art. 6(1)(b) of the GDPR). Identification and contact information (such as the email address). In case the User decides to register by using the Facebook login, the Company receives access to the identification and contact information available on the social network (such as name, profile picture, email address if the User chooses to share it). Information necessary to allow the use of Playond (IP address, device type, OS version, ID univocally assigned by the Company to each User, device language, country as set by the User in the settings of the device, IDFA Apple).
b) To fulfill Company’s legal obligations and any other obligation potentially arising from the authorities’ instructions. The legal basis for the processing is the compliance with a legal obligations to which the Data Controller is subject (art. 6(1)(c) of the GDPR). Identification and contact information (such as the email address).

Any other information, which may be requested according to the law or upon authorities’ instructions.
c) To carry out activities aimed at improving the user experience (e.g., market researches, statistical analysis, or other researches aimed at improving products and services, as well as for assess customers satisfaction in relation to the service). The legal basis for the processing is legitimate interest of the Data Controller (art. 6(1)(f) of the GDPR).

The legitimate interest of the Data Controller is to reach improvements in relation to its products and services.
Contact information (such as email address) and further information collected to improve Playond functionality (such as – IP address, device type, OS version, ID univocally assigned by the Company to each User, device language, country as set by the User in the settings of the device, IDFA Apple).
d) To send to subscribed Users promotional communications and special offers on Playond. The legal basis for the processing is the legitimate interest of the Data Controller (art. 6(1)(f) of GDPR).

The legitimate interest of the Data Controller is to keep the Users up to date on the latest initiatives related to the service.
Contact information (such as email address).
e) To send promotional communications on Bending Spoons’ products and services or special offers. The legal basis for the processing is consent of the Data Subject (art. 6(1)(a) of GDPR). Contact information (such as email address or the device identifiers to show the information within the Playond system).
f) To process any request for information and/or clarification raised by the Data Subjects (also by allowing them to contact the Company support staff). The legal basis for the processing is the legitimate interest of the Data Controller (art. 6(1)(f) of GDPR).

Legitimate interest of the Data Controller is to process and give a proper feedback to any request raised by the Data Subjects.
Identification and contact information (such as name, email address).

Potential further information inserted within the contents of Data Subjects’ request.
g) To receive the position of the Data Subjects, if the game they play requires such information. The legal basis for the processing is consent of the Data Subject (art. 6(1)(a) of GDPR). The device geolocalization.
h) To process the voice and/or camera recording. The legal basis for the processing is consent of the Data Subject (art. 6(1)(a) of GDPR). The Data Subjects’ voice recording.
i) To access the pictures stored in the device. The legal basis for the processing is consent of the Data Subject (art. 6(1)(a) of GDPR). The Data Subjects’ pictures.(My Friends Are Zombies)

When the processing of Personal Data requires the User’s consent, the Data Subject may give his/her consent only if aged at least 16 years (see art. 8 of the GDPR).

The Company apps and services are not for children under the age of 16. The Company do not knowingly collect personal data from children. If you believe we have received personal data from children under the age of 16, please email us at privacy@bendingspoons.com.

If the Data Subject is under the age of 16, the consent must be given by a parent or other holder of parental responsibility (in the latter case, the Data Controller shall make every reasonable effort to verify that consent is given or authorized by the holder of parental responsibility).

Should the Data Controller realize that some Users are aged below 16 and consents have not been given by parents (or holders of parental responsibility), it shall immediately delete the processed data and close the related account forthwith.

III. Data retention of User’s Personal Data

Personal Data may be processed by both paper and electronic means.
The Data Controller adopts all technical and organizational measures for preventing the loss, improper use and alteration of Data Subjects’ Personal Data, and, in some cases, may adopt data encryption measures, too.

Personal Data processed to fulfill legal obligations and obligations related to the use of Playond (points II.a), II.b) and II.f)) will be kept for a period not exceeding the one necessary for the said purposes and, in each case, for no more than 10 (ten) years from the termination of the agreement (i.e., after the cancellation of the User’s account) except for any legal obligation that sets a longer data retention period. At the end of this period, the processed data will be deleted or anonymized.

User’s Personal Data processed for the purposes referred to in points II.c), II.d) and II e) will be kept for no more than two years from the termination of the agreement (i.e., after the cancellation of the User’s account). At the end of this period, the processed data will be deleted or anonymized.

The information regarding the Users’ position, as referred to in point II.g) will be processed during the use of the game only and will not be stored.

The information regarding the Users’ voice and images, as referred to in points II.h) and II.i) will be kept for a period not exceeding the one necessary to use the game on the Playond service.

IV. Mandatory or optional nature of the supply of personal data and consequences of the refusal to answer

The provision of User’s Personal Data for the purposes referred to in points II.a) and II.b) above is mandatory. Any refusal to provide the requested data could make it impossible to create an account and to enjoy Playond service.

The processing of User’s Personal Data for the purposes referred to in points II.c), II.d) and II.f) above occurs on the basis of the legitimate interest of the Data Controller, pursuant to art. 6(1)(f) of the GDPR. Data Subjects can at any time exercise the rights referred to in point no. VII to have such processing ceased. Any refusal to provide such data will not result in any detrimental consequences within the use of Playond service.

The processing of User’s Personal Data for the purpose referred to in points II.e), II.g), II.h) and II.i) above is optional. Any refusal to provide such data will not result in any detrimental consequences within the use of Playond.

V. Recipients of Personal Data
  1. 1. public, judicial or police authorities, within the limits established by applicable laws and regulations;

  2. 2. third parties carrying out activities that are related or instrumental to the Data Controller’s activities, as outsourced data processors duly appointed in writing by the Company in accordance to the Applicable Privacy Laws or acting as autonomous data controllers (such as, by way of example only, suppliers providing IT maintenance and development services, IT or filing services providers, suppliers of mobile marketing services).

In order to provide the games, the Company uses the technology developed by Unity Technologies, Inc.: therefore, a number of data will be shared to such provider, in order to allow the functionality of the games only (i.e. unique device identifier generated from the device MAC/IMEI/MEID, which the provider alters to limit the ability to identify the relevant device in the future; an advertising ID, such as the Apple IDFA or the Android Ad ID; IP address; device manufacturer and model; the operating system and version running on your system or device; browser type; language; the make of the CPU, and number of CPUs present; the graphics card information, such as type, vendor and driver name, version and graphics API; amount of system and video RAM present; current screen resolution; Unity Player and Unity Editor versions; operating system identifier (e.g., Mac, Windows, etc.); a checksum of all the data that gets sent to verify that it did transmit correctly; and App ID of the game installed).

The complete and updated list of such entities is available for consultation, upon request, at the Company’s headquarters or by sending an email to privacy@bendingspoons.com.
Users’ data will not be disclosed, unless such disclosure is deemed necessary for the fulfillment of legal obligations and/or regulations.

The Company will not share the Personal Data with other third parties for any reason other than those stated above.

VI. Transfer of Personal Data outside EEA

The Company may also transfer personal data of the Data Subjects to countries located outside the European Economic Area (EEA). In such cases, the Company will make sure that such transfer is based on appropriate safeguards listed in the GDPR, including (a) the standard contractual clauses developed by the European Commission; (b) the decisions of adequacy of the European Commission concerning the States in which the addressees are based; (c) binding corporate rules adopted by the Company and approved by the competent authorities or that are parties of agreements with the Company in this regard.

Copies of appropriate warranties are available on request at the holder's office or by sending an email to privacy@bendingspoons.com.

VII. Rights of the Data Subjects

The Users, at any time and free of charge, can have and/or exercise the following rights, as specified in the GDPR:

  1. a) the right to be informed on the purposes and methods of the processing;

  2. b) the right of access;

  3. c) the right to obtain a copy of the data held overseas and obtain information concerning the place in which such data are kept;

  4. d) the right to ask for updating, rectification or integration of the data;

  5. e) the right to request the cancellation, anonymization or blocking of the data;

  6. f) the right to restrict the processing;

  7. g) the right to object to the processing, wholly or partly, also where it is carried out through automated individual decision-making, including profiling;

  8. h) the right to withdraw the consent to the processing of the data freely and at any time – in such a case, the processing carried out before withdrawal of consent shall remain valid;

  9. i) the right to data portability, (i.e., to receive an electronic copy of User’s personal data, if the User would like to port his/her personal data to himself or a different provider);

  10. j)the right to limitation of the processing.

Data Subjects also have the right to lodge a complaint before the competent national data protection or judicial authority.

For the exercise of their rights, Users may contact the Data Controller, in writing by sending a letter with proof of receipt to the Company’s headquarters, or by sending an email to privacy@bendingspoons.com.

If a Data Subject is under the age of 18 in California, in certain circumstances, he/she may request and obtain removal of Personal Data or content shared by him/her and posted. To make any request pursuant to California privacy law, please click the following link and follow the instructions: [link to new form]. Please be aware that such a request does not ensure complete or comprehensive removal of the content or information posted by the User and that there may be circumstances in which the law does not require or allow removal even if requested.

VIII.Automated decision-making

No entirely automated decision-making is carried out within the processing of the Users’ Personal Data (there included profiling under Article 22(1) and 22(4) of GDPR).

Third party websites and apps

Playond may include links to other websites or apps operated by third parties. The practices described in this Notice do not apply to data gathered through these third party websites and apps. The Company has no control over, and is not responsible for, the actions and privacy policies of third parties and other websites and apps.

Third party websites and apps Changes and updates of this Notice

The Company may modify, integrate and/or update, in whole or in part, this Notice, also in view of future changes that may involve the Applicable Privacy Laws. It is understood that any modification, integration or update will be communicated to the Data Subjects promptly and on time via email or at the time of the start of use of Playond. In this regard, it could be required to the User to read the new version of the Notice and to accept it before continuing to use Playond.

Date of last amendment:

April 18, 2019