PRIVACY POLICY

We, at X-FLOW LTD (“X-FLOW”, “we” or “us”), are committed to respecting your privacy and the integrity and security of your personal data.

X-FLOW is data controller with the registered office at 8 Genethliou Mitella, 3036, Limassol, Cyprus.

This Privacy Policy applies to https://www.xflowgames.com/, all other sites or online services that are owned or operated by X-FLOW, all mobile games and apps published by X-FLOW, app-specific pages on social media platforms, X-FLOW games that can be played through third party platforms (collectively “Services”). This Privacy Policy explains how we collect, process, store, use and share your personal data and how you can exercise your privacy rights.

If you participate in our Promotion, this Privacy Policy applies to you only in the scope defined by the Supplemental Privacy Notice for Promotions.

By downloading, accessing and/or using our Services, you acknowledge the collection and use of your information in accordance with this Privacy Policy, including X-FLOW’s and our partners’ use of your data for the purposes as described below.

Please read the following carefully and make sure you fully understand this Privacy Policy. If you have any concerns about providing information to us or it being used as described in this Privacy Policy, please discontinue and avoid using our Services.

1. What Data We Collect

Summary: We aim to collect the minimum data that we need to fulfill our purposes. We collect data you provide to us when you contact us (e.g. your name or email); automatically when you use our Services (e.g. device & ads identifiers, IP address, technical information about your device), and from our partners (e.g. non-financial data relating to the in-app purchase). You don’t have to share your data with us, but some part of the Services may not be accessible without relevant data.

We collect only the data that is necessary for the purposes described in this Privacy Policy — we don't gather any more information than we need. The personal data we collect will depend on the circumstances and the Services you are using.

We collect data in three ways:

(a) data you provide to us;

(b) data we collect automatically;

(c) data we collect from our partners.

We do not knowingly collect special categories of personal data such as data revealing racial or ethnic origin, political opinion, religious or philosophical beliefs, or trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. Please be cautious when sharing this information about yourself (or others) in our Services.

You are not obliged to actively provide any of your personal data. However, some functionalities of our Services may not be accessible if you do not provide us with the respective personal data (such as contact information for the customer support service).

a. Data you provide to us

When you contact us via e-mail or another direct communication channel, we may collect the following categories of data:

• Contact information (such as name and email address)
• Your messages to the Services (such as chat logs and player support tickets)
• Other data you choose to provide us when you contact us (through the Services, social media (for example, we can see your public profile in social media), e-mail or any other channels).

b. Data we collect automatically

When you use our Services, we may automatically collect the following categories of personal data:

• User ID;
• Device identifiers, such as your device ID, advertising ID (IDFA, AAID), IDFV;
• Third-party ID, such as Firebase ID, Adjust ID, and other identifiers generated by a third party;
• IP address;
• Approximate location data, such as country or city-level location inferred from your IP address (we do not collect precise geolocation);
• Non-identifying data about your device, such as device manufacturer, device type, device model, RAM, operating system name and its version, device performance information, browser type, time zone, language, locale, timestamp, HTTP header, push notification token, platform, and other technical data like screen size or processor, or combination of this data available for a developer for checking the device compatibility with a particular Service;
• Usage data, such as your game progress, the date and time you used a Service, session length, features you have used, your in-app purchase history (if applicable), app version, install date of the app, your interaction with advertisements (including clicks, views, impressions) and your interaction with other players inside the Services, crash logs (errors, bugs), privacy preferences, and other data generated when you use the Services.

Note that we do not use such data to learn a person’s true identity or contact details, but mostly to provide our Services and understand how our users typically use and interact with our Services, so that we could maintain and improve them.

c. Data we collect from our partners

• Third-party tools. We may receive certain data if you choose to link a third-party tool with the Services (such as Facebook, Google or Apple) in order to be able to log in with the same account on multiple devices and synchronise progress across those devices. Exactly what information we receive from such third-party tool will depend on your privacy settings, but it would typically include your basic profile information such as your user id, username, picture, e-mail, your friends playing the same game and user token of the relevant tool (“Profile Data”). We do not get access to or store your logins or passwords for any of these third-party tools. Please note that these third-party tools are governed by their own privacy policies and terms of service, and we encourage you to review them for further information about their privacy practices.
• Third-party platforms. In-app purchases are typically processed by the platforms (e.g. Apple App Store, Google Play, Amazon AppStore or Facebook). We do not access, collect or store your financial data, such as your credit card number or bank account. You are requested to provide payment details directly to the relevant platform. We may, however, receive limited non-financial data relating to the purchase (e.g. platforms may notify us if a purchase was successful and provide transaction details such as list of purchased items, transaction ID, currency, purchase date and time) (“Purchase Data”). Any post-purchase processes are controlled by the platforms. We encourage you to review privacy policies and terms of service of the platforms for further information before making a purchase in the Services.
• Advertising partners. From time to time, we may receive non-personal information from our advertising partners concerning the performance of our advertising campaigns displayed outside our Services (e.g. we may be provided with data about interaction with our advertisement (such as clicks, views, impressions and installs), information from which ad network and advertising campaign the install of our Service originated from or data necessary to fight fraud (such as refund abuse in games or click fraud in advertising) (“Ads Performance Data”).
• Third-party analytics service providers. Our analytics providers may provide us with information regarding your use of our Services (such as in-game events, your interaction with the Services and in-game advertisements, software bugs and errors, etc.) so that we could improve our Services and detect and prevent fraud in our Services.
• Social Media Platforms. We operate app-specific pages on Facebook and Instagram ("Fanpage"), which are services of Meta Platforms Ireland Limited, Serpentine Avenue, Block J, Dublin 4 Ireland.

  Meta collects and uses data to provide analytics services, known as "Insights" to page operators. These insights help us understand how people interact with our page and its content. The data includes information about the types of content users view or interact with, or the actions they take, and information about the devices they use, such as IP addresses, operating system, browser type, language settings, cookie data.

  We are jointly responsible with Meta Platforms Ireland Limited for the collection and processing of data of visitors to our Fanpage. The legal basis for this processing is our legitimate interest in enhancing the Fanpage user experience, conducting effective social media promotions, communicating about Services, and measuring and adjusting these activities. In this regard we have entered into a joint controller agreement with Meta regarding the processing of your data pursuant to Art. 26 GDPR. This agreement with Meta specifies in particular which security measures Meta must take and that Meta must fulfill the data subject rights.

  You can find more information about Page Insights and on how to exercise your data subject rights in the "Information on page insights". You can view the terms and conditions of the contract concluded with Meta here. You can find Meta's privacy policy here.

2. Why We Collect and Use Your Data

Summary: We use your personal data only when we have a legal basis and for a limited number of purposes. In this Section 2 we explain which data we process for which purposes and what is the corresponding legal basis for such processing.

When we process your personal data, we do so only if we have one of the legal bases stipulated by the applicable privacy laws. If the data processing is based on our legitimate interest, you have the right to object our use of your data. When we rely on your consent for data processing, you have the right to withdraw it any time. We provide more details about your rights and how to exercise them in the relevant section of this Privacy Policy.

3. How We Share Your Data

Summary: We may disclose your information to certain categories of recipients ( e.g. cloud storage, analytics, customer support providers, ads & marketing partners) in order to provide and improve our Services. We share some data with these third parties only when legally permitted or under data processing agreements, and you can refer to our List of Partners and their privacy policies for more details.

Apart from X-FLOW, your data can be accessed by others in the following situations:

• Other players and users. Some of our Services may include social features. In such a case other players and users may, for example, see your profile data, in-game activities and read the messages you have posted.
• Other companies and public authorities. In order to combat fraud and illegal activity, we may exchange data with other companies and organizations and provide it to public authorities in response to lawful requests.
• Our service providers and partners. We use third parties to help us operate and improve our Services. These third parties assist us with various tasks and may include the following:
  • Cloud storage providers: we engage them for storage of Services data.
  • Analytics providers: we engage them for analytics, attribution and mobile measurement services which allows us to improve our Services through data analysis and know our audience.
  • Customer support providers: we collaborate with them to facilitate customers requests and questions.
  • Advertising partners: we may also share information (such as device identifiers, IP address and non-identifying data about your device) with advertising partners who distribute advertising in our Services or allow them to collect data directly from you through their mobile SDKs or similar technologies embedded in our Services. Our advertising partners may combine this information with data they have collected about you when you use their services or third-party websites and services. This helps them show you more relevant advertising in our Services and improve their ad targeting and measurement systems. We advise you to check their privacy policy for further details.
  • Marketing partners: we collaborate with several marketing partners who help us advertise our Services. They assist us in measuring and optimizing our advertising campaigns so we can reach audiences interested in our Services and expand our user base.
  • Other service providers: we may share data with our service providers who help us with on-going development, technical support and maintenance of the Services.

We share your personal data with these third parties only where we have a legal basis as set out above or where such third parties process data on our behalf based on a data processing agreement, which may restrict further subcontracting by such third parties.

For further information about privacy practices of our partners, please see our List of Partners and their privacy policies. We may update it from time to time, so you understand who we partner with to bring you our Services.

4. International Data Transfers

Summary: Due to the global nature of our Services we may transfer and process your personal information in different countries only when the adequate safeguards are in place to protect your data. We may only transfer the data to countries offering adequate level of data protection, basing on standard contractual clauses (approved by EU Commission) and other methods as prescribed by the relevant regulators in third countries.

Our Services are global by nature and your data can therefore be transferred and processed in other countries other than the country in which you are resident. Because different countries may have different data protection laws than your own country, we take steps to ensure adequate safeguards are in place to protect your data as explained in this Policy. Adequate safeguards that our partners may use include transfer of data to the jurisdictions, which are considered by the European Commission to be offering an adequate level of protection for personal data of EU residents or standard contractual clauses approved by EU Commission or other methods approved by the relevant regulators in other countries.

If you are a user located in South Korea, please see more details about overseas transfers of personal information in our Overseas Transfer Schedule.

5. Your Rights and Options

Summary: You have certain rights regarding your personal information. You can exercise these rights at any time by contacting us outlined in Section 10 below. Users located in the United States should review the US Privacy Rights section.

Opt-out of personalized advertising

You can opt-out of personalized advertising on mobile applications at any time by checking the privacy settings of your device or via the privacy settings of our apps.

Option 1 - App Settings (where applicable under your local privacy laws):

1. Open app Settings menu
2. Select Consent Preferences
3. Tap Manage preferences and adjust your choices

Option 2 - Device Settings

Apple devices:

For iOS 14 and newer:

1. Open Settings
2. Select Privacy
3. Select Tracking and disable “Allow Apps to Request to Track”

For iOS 13 and older:

1. Open Settings
2. Select Privacy
3. Select Advertising and enable "Limit Ad Tracking"

Android devices:

Delete your device’s advertising ID

To delete your device’s advertising ID:

1. Open Settings
2. Tap Privacy > Ads
3. Tap Delete advertising ID and confirm your changes

On some older versions of Android

Device (version is 4.4 or older):

1. Open Settings
2. Tap Privacy > Advanced > Ads
3. Select Ads and enable "Opt out of Ads Personalization"

Fire OS (Amazon) devices:

1. Swipe down twice from the top of the screen to show Quick Settings.
2. Tap the Settings icon.
3. Tap Security & Privacy > Advertising ID.
4. Disable Interest-based Ads.

Tap Reset if you want to create a new Advertising ID for your device.

If you are interested in more information about personalized advertising and your choices in this regard, you may visit the following websites:

• Network Advertising Initiative Consumer Opt-Out Page or the Digital Advertising Alliance Opt-Out Page for U.S.-based advertising; and
• Your Online Choices website for EU-based advertising.

All of the opt-out tools described in this subsection are provided by third parties, not by us. We do not control or operate these tools or the choices that advertisers and others provide through these tools.

Please note that opting out via any option described above does not mean that you will stop seeing advertisements in our Services. Instead, third-party advertising networks will consider your choise as withdrawal of consent for personalised advertising experience and will show you contextual advertisements not tailored to your interests in the same volume. Please be aware that such actions may result in decrease of advertising quality and less enjoyable user experience.

X-FLOW participates in, and complies with the policies and technical specifications of the IAB Europe Transparency and Consent Framework (IAB TCF). X-FLOW operates Consent Management Platform with the identification number 436 (CMP ID).

PUSH NOTIFICATIONS

From time to time we can use push notifications to send you Services-related communications. If you opt-in to receive push notifications on your device, we will receive push notifications token, so we can verify whether we are allowed to send them to you. You can manage it any time in your device settings:

Apple devices:

1. Open Settings
2. Tap Notifications
3. Find our app from the list under Notification Style and tap it
4. Manage toggle “Allow Notifications” (On/Off)

Android devices (settings can vary by phone, please see details here):

1. Open Settings
2. Tap Notifications
3. Find our app under "Most recent" or by tapping All apps in the dropdown menu and tap it
4. Manage the app's notifications (On/Off)

Data subject rights

In case we process personal data about you and if you are an EU resident or the resident of another jurisdiction that affords you the below rights you:

• have the right to be informed how we process your personal data and why (we provide this information to you in this Privacy Policy);
• have the right to know what data we hold on you (right to access);
• may request us to make any changes and corrections to your personal data or restrict the processing if it is inaccurate or incomplete (right to rectification);
• may request that your personal data is erased where we do not have a compelling reason to continue to process all or part of your personal data in certain circumstances, for example, when we have a legal obligation to keep storing these data or we need it to protect and enforce our legal rights (right to erasure);
• may ask to receive your data in a structured, commonly used and machine-readable format and, where technically feasible, to transmit those personal data to another controller (right to data portability);
• may withdraw your consent where you have previously given your consent to the processing of your personal data (right to withdraw consent). Note that withdrawal of your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect the processing of your personal data conducted pursuant to lawful processing grounds other than consent.
• have the right not to be subject to a decision based solely on automated processing, (including profiling), which produces legal effects or could significantly affect you. Please note that we do not carry out any decision-making based solely on automated processing, including profiling;
• have the right to object to or restrict how we use or process your data in certain circumstances (right to object). Please note in case of such a request we may not be able to provide you with all of our Services or the quality of our Services may be decreased;
• right to lodge a complaint with a data protection supervisory body.

To submit your request, please use the in-app support feature (“Contact Us”) in our games or the contact details in Section 10 below. However, we may still redirect you to make the same request through the in-app support feature to verify you as our user and/or request additional information necessary for us to respond.

Please note that your request must:

• provide sufficient information necessary to verify you as our user about whom we collected and processed personal data or to verify you as an authorized representative of such a user;
• contain sufficient details describing your request to allow us to properly understand, review and respond to it.

We reserve the right to ask for reasonable information to verify your identity before we process your request, and not to respond to your request or provide you with personal data, in case we were unable to verify your identity or authority to make such a request.

If you are a resident of the United States, please read additional information about US Privacy Rights carefully.

6. Cookies and Similar Technologies

Summary: We and our partners may use cookies to provide and personalize Services, analyze usage, target ads, and prevent fraud. If you want to learn more, please read our Cookie Policy.

Like most online services, we and our partners use cookies and similar technologies to provide and personalize the Services, analyze use, target advertisements and prevent fraud. You can disable optional cookies in your browser settings or via updating Cookie Preferences on the website, but some parts of the Services may then not function properly.

If you would like to opt-out of personalised advertisement in our Services, please refer to Section 5 above.

For further information how we use cookies on our websites, please read our Cookie Policy.

7. How We Protect Your Data

Summary: We use various security measures like encryption and restricted access to protect your data. We keep your information only as long as necessary to provide our services and comply with legal obligations, then we destroy or anonymize it.

Security Safeguards

In order to help ensure a secure and safe player experience, we are continuously developing and implementing administrative, technical and physical security measures to protect the confidentiality, security and integrity of the collected data and to prevent from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to the data under our control. This includes, but is not limited to, data encryption and limitation of access to personal information based on a “need-to-know” principle.

Although we use commercially reasonable efforts to assure that your data remains secure when maintained by us, please be aware that no security measures are perfect or impenetrable.

Data retention

We keep your information only so long as we need it to provide our Services to you and fulfill the purposes described in this Privacy Policy. When we no longer need to use your information and there is no need for us to keep it to comply with our legal or regulatory obligations, we will either permanently destroy it or anonymize it so that we cannot identify you. Personal information printed on paper will be destroyed by shredding thereof.

8. Age Limits

Summary: Our Services are intended only for adults; children are not permitted to use them, and we do not knowingly collect their data. If you believe we might unintentionally collected children's information, please contact us so we can delete it.

Our Services are generally intended for use only by adults (i.e. individuals who are over 18 years of age or of the age of majority in your country, whichever is older). Children are not allowed to use our Services. We do not knowingly collect personal information from children. If you believe that we might unintentionally collect personal data from or about children, please contact us via the in-app support feature in our Services or at the address provided in Section 10 below and we will take reasonable measures to promptly delete such personal data from our records.

9. Updates

Summary: We may update our Privacy Policy periodically; significant changes will be notified, but minor ones may not. Please check it regularly to stay informed.

We may update our Privacy Policy from time to time. When we do so, we will revise the date at the top of the policy. Any updates to this Privacy Policy shall be effective as of the stated “Last updated”. If we make changes that are material, we will use reasonable efforts to notify you (such as by placing an in-game notice or a push-notification). If we make minor amendments, no notice will follow. We encourage you to check this Privacy Policy regularly for updates, so that you know our current practices.

10. Contact us

Summary: You may contact us if you have any questions about this policy.

If you have questions about data protection, or if you have any requests for resolving issues with your personal data, you can contact us through the in-app support feature “Contact Us” or via e-mail at [email protected]. However, we may still redirect you to make the same request through the in-app support feature to verify you as our user and/or request additional information necessary for us to respond.

You can also contact our Data Protection Officer at [email protected].