eCHESS PRIVACY NOTICE

Last updated: 29 January 2024

eChess AS, with business address Nydalsveien 14, 0484 Oslo, Norway and org.no. 928 753 069 ("Company", "we", "us" or "our") has prepared this privacy notice to its end users ("User", "you", or "your") to give you more information about our processing and collection of your personal data in connection with your use of our eChess game ("Game") and its associated services ("Services").

1. INFORMATION COLLECTION AND USE

We process the following categories of personal data about our Users:

User account: When you create a user account, we will process your e-mail address and username, which you choose at your own discretion, password and profile picture. Your profile picture will be publicly visible to other players. Your username will be used to identify you within the Game.
Usage data: We collect information regarding your interactions with our Game and Services, such as game history, rankings, preferences, feedback, responses to promotions, amount of coins, tutorials completed, purchases made, themes acquired, XP earned, player level, challenges and achievements completed.
Interactions: If you choose to interact with other players via chat functions or video chats (which is completely voluntary), we will process the data you provide. However, none of the data will be stored, e.g. chats with other users will be deleted when you log off or end your session and no video will be stored by us.
Payment information: If you pay for any services related to the Game or Services, we will collect and use your name, address and credit card information. We will also store your order information, i.e. what you have purchased.

2. HOW WE USE YOUR INFORMATION

We process your personal data for the following purposes and legal bases:

To manage your account and provide you with customer support and to communicate directly with you. We process these personal data because it is necessary for the performance of the agreement with you and/or our legitimate interests in providing you with our Game and Services.
To provide and maintain our Services, including to monitor the usage of our Game. We provide and maintain our Services because it is necessary for the performance of the agreement with you. When we monitor the usage of our Game, we will do so based on our legitimate interests in ensuring appropriate information security for our Game and Services.
To direct marketing to your e-mail address. We may for example send you game-related news, special offers and general information about other goods, services and events which we offer that are similar to those that you have already purchased or enquired about unless you have opted not to receive such information. We process these personal data because it is necessary for our legitimate interests in providing you relevant marketing information.
To improve and develop our Game and Services, including troubleshooting, data analysis, testing, research, statistical and survey purposes. We process these personal data because it is necessary for our legitimate interests in improving our services. Please also note that analytics data may be processed if you provide us your consent to do so (see https://echess.com/?cookies=1).
To detect, prevent, and address security, technical issues or potentially prohibited or illegal activities. When we monitor the usage of our Game, we will do so based on our legitimate interests in ensuring appropriate information security for our Game and Services.

3. SHARING, DISCLOSURE AND TRANSFERS OF PERSONAL DATA

We may share personal data with the following recipients or categories of recipients:

Service suppliers. We may use service suppliers, such as IT suppliers, marketing companies, etc., that process personal data on our behalf as data processors. We will always enter into data processor agreements with our data processors.
Payment service provider. We use Stripe as our payment provider. We use Stripe as our data processor for payments. When you purchase something in eChess via Stripe, a user account in Stripe will be created with your username and e-mail (that we share with Stripe). Stripe will be the data controller related to your user account and you can read more about Stripe's processing of personal data here (see https://stripe.com/en-no/privacy).
Professional advisors. We may share personal data with our professional advisors, such as lawyers, accountants, auditors, consultants etc.
Public authorities or other parties if requires by law. We will disclose your personal data if we are required to do so by law or in response to valid requests by public authorities (for example a court or a government agency).

The sharing of personal data with our suppliers of marketing services may involve the transfer of personal data to the USA. The data transferred is the customer's nickname and e-mail address. For such transfers we ensure that the personal data is afforded a level of protection that is equivalent to that guaranteed within the EU/EEA, including by entering into agreements based on the European Commission's standard contractual clauses. For more information on the transfer of data outside the EU/EEA and applicable transfer mechanisms, please contact us according to sections 5 and 8 below.

4. DATA RETENTION

We will delete your personal data when it is no longer necessary in relation to the purposes for which they were collected or otherwise processed. In practice, we will store your nickname, e-mail, game statistics (i.e. usage data) and payment details as long as you are a User of our Game and/or Services or until you request the deletion of such personal data.

We may keep your personal data if we are required to do so in compliance with a legal requirements (for example we are obliged to store accounting material for five years after the end of the financial year pursuant to the Norwegian Bookkeeping Act) or for the establishment, exercise or defence of legal claims.

5. YOUR RIGHTS

As a User you are a data subject that have certain rights under the GDPR:

Access. You may ask us whether or not your personal data is processed by us and, if this is the case, access your personal data and information about the processing.
Rectification. You may ask us to rectify inaccurate personal data about you.
Deletion. You may ask us to erase your personal data.
Restriction. You may ask us to restrict our processing of your personal data.
Objection. You may object to our processing of personal data concerning you.

If our processing of your personal data is based on consent, you may request a copy of your personal data that you have provided to us and request the transfer of these personal data to another controller without our hindrance and also withdraw your consent at any time.

Please also note that your rights described above may be subject to limitations and exemptions and that exercising you rights may prevent our provision of the Services and Game to you.

You can exercise your rights by sending us an e-mail at support@echess.com.

6. CHILDREN

We do not allow that our Game is used by individuals under the age of 13. We do not knowingly process personal data from children under 13. If we become aware that we have processed personal data from a child without verification of parental consent, we take steps to remove that personal data.

7. UPDATES TO THIS PRIVACY POLICY

We may update our Privacy Notice from time to time. We will notify you of any changes by posting the new Privacy Notice on this page and updating the "Last updated" at the top of this document.

We will let you know via e-mail and/or a prominent notice on our Game and/or Service, prior to the change becoming effective and update the "effective date" at the top of this Privacy Notice.

8. CONTACT AND COMPLAINTS

If you have any questions about this Privacy Policy, please contact us at support@echess.com.

You have the right to complain about the processing to the relevant supervisory authorities, which in Norway is the Norwegian Data Protection Authority (Nw: Datatilsynet). The Norwegian Data Protection Authority can be contacted by phone +47 22 39 69 00 and at the e-mail address postkasse@datatilsynet.no. You can also complain to any relevant data protection authorities in any EU/EEA country where you work or in where you believe that an infringement has occurred.