Privacy Policy

Article 1: Data controller

1.1 BELLOCCO (“we”, “us”) is the data controller for the processing of personal data as described in this policy.

1.2 You can reach us for privacy questions via the contact page.

Article 2: Definitions

2.1 Personal data: any information about an identified or identifiable natural person.

2.2 Processing: any operation performed on personal data, such as collecting, storing, using and deleting.

2.3 Processor: a third party that processes data on our instructions (e.g. the hosting provider).

Article 3: What data we process

3.1 Account data: username (pseudonym), email address and an encrypted (hashed) password. We cannot see your password.

3.2 Security data: if you enable two-factor authentication (2FA), we store the 2FA secret and hashed backup codes.

3.3 Technical data: IP address, browser and device information, session data and login attempts: needed for security and preventing abuse (such as multi-accounts and fraud).

3.4 Game data: your progress, statistics, in-game actions, possessions, family membership and logs.

3.5 Data you post: your profile description, avatar, background and chat/forum/private messages.

3.6 Push data: if you enable notifications, we store a subscription token from your browser/device so we can send notifications.

3.7 Payment data: for Premium purchases, payment is processed via an external payment provider. We only receive confirmation of the transaction; we do not store credit card or bank details.

3.8 Communication: emails you send us and emails we send you (such as the welcome email or notifications).

3.9 Origin data: for non-logged-in visitors, we may process referring links or campaign data to understand how players find us.

Article 4: Purposes and legal bases

4.1 Performance of the agreement (GDPR art. 6(1)(b)): creating and managing your Account and operating the game.

4.2 Legitimate interest (art. 6(1)(f)): security, fraud and abuse prevention (including anti-multi-account), enforcement of the Game Rules, and improvement of the Service.

4.3 Legal obligation (art. 6(1)(c)): for example, records of payments.

4.4 Consent (art. 6(1)(a)): for optional matters such as push notifications, a newsletter, or non-essential cookies. You can withdraw consent at any time.

Article 5: Cookies and local storage

5.1 We use cookies and similar technologies (such as local storage and a service worker for push). Details can be found in our Cookie Policy.

Article 6: Push notifications

6.1 Push notifications are optional and only work after your consent in the browser.

6.2 You can disable notifications at any time via the settings in the game or in your browser. We then remove the associated subscription upon sending or at your request.

Article 7: Sharing with third parties (processors)

7.1 We do not sell your data.

7.2 We share data only with parties that help us deliver the Service, such as our hosting provider, payment provider, email service and push service. We enter into data processing agreements with these processors.

7.3 We only provide data to authorities when the law requires us to do so.

Article 8: Transfers outside the EEA

8.1 We prefer to process your data within the European Economic Area (EEA). Should transfer outside the EEA take place, we ensure appropriate safeguards, such as the European Commission's standard contractual clauses.

Article 9: Retention periods

9.1 We retain account data for as long as your Account is active.

9.2 After your Account is deleted, we delete or anonymize your personal data within a reasonable period, except for data we are legally required to retain longer (such as payment records).

9.3 We do not retain security and log files longer than necessary for the purpose for which they were collected.

Article 10: Security

10.1 We take appropriate technical and organizational measures, including encryption (hashing) of passwords and backup codes, optional 2FA, secure connections (HTTPS), access restrictions and anti-abuse measures.

10.2 No service is 100% secure. Suspect a security breach? Report it via the %s.

Article 11: Your rights

11.1 Under the GDPR you have the right to:

• 11.1.a Access (art. 15) to the data we hold about you;
• 11.1.b Rectification (art. 16) of inaccurate data;
• 11.1.c Erasure (art. 17, the “right to be forgotten”);
• 11.1.d Restriction (art. 18) of processing;
• 11.1.e Objection (art. 21) to processing based on legitimate interest;
• 11.1.f Data portability (art. 20): a copy of your data in a common format;
• 11.1.g Withdrawing consent, without affecting the lawfulness of processing carried out prior to withdrawal.

11.2 You can submit a request via the contact page. We respond within the statutory period of one month. For verification purposes, we may ask for additional information.

Article 12: Automated processing

12.1 For security and fair play, we use automated checks (for example, to flag multi-accounts or abuse).

12.2 Significant measures against an Account are not taken solely by automated means; human review is possible. You can object via the contact page.

Article 13: Minors

13.1 The Service is intended solely for persons aged 18 and over. We do not knowingly collect data from minors.

13.2 Do you think a minor has left data with us anyway? Contact us and we will remove it.

Article 14: Data breaches

14.1 In the event of a data breach posing a risk to your rights and freedoms, we act in accordance with the GDPR and, where required, inform the Dutch Data Protection Authority and the individuals concerned.

Article 15: Complaints

15.1 Do you disagree with how we handle your data? Please contact us first.

15.2 You have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

Article 16: Changes

16.1 We may amend this Privacy Policy. The current version is always available on this page; important changes will be announced via the website.

Article 17: Contact

17.1 Questions about this Privacy Policy or a request regarding your data? Use the contact page.