Privacy Policy for Apps
Lotum GmbH, Am Goldstein 1, 61231 Bad Nauheim, Germany, games@lotum.de ("Lotum" or "we") respects and protects your personal data.
The following Privacy Policy is intended to provide you with more detailed information about the collection, processing and use of data in connection with our games offered as mobile applications ("the Apps").
Lotum collects, processes and uses personal data exclusively in accordance with the applicable legal regulations. Therefore, the high data protection level of the General Data Protection Regulation ("GDPR") and of the German Telecommunications Digital Services Data Protection Act ("TDDDG") applies.
1. Scope of Application
1.1 This Privacy Policy is intended for all users of the Apps ("Users").
1.2 If certain services or individual apps of Lotum have a different privacy policy, such privacy policy shall apply.
1.3 The scope of this Privacy Policy does not include services and offers of third parties that may be referred to in the App by so-called links. Lotum generally assumes no responsibility for their content or for compliance with data protection regulations by these third parties, unless otherwise stated in the privacy policy of the linked content. This applies, for example, to links via which social networks such as Facebook or chat apps such as WhatsApp can be accessed, and to links in advertisements that are played. For information on the handling and protection of the User's personal data on these platforms, please refer to the privacy policy of the respective platform.
2. Downloading and Installing the Apps
When you download and install our Apps, the operator of the platform through which you obtain the respective app (for example Apple, Inc. for the AppStore and Google Ireland Limited for the Google PlayStore) collects personal data required for the download. These data include in particular your name, your e-mail address and your postal code, time of download, the IP address and the individual device identification number of your device (so-called IMEI), as well as your payment information, if applicable. This collection and processing of your personal data is generally carried out solely by the respective platform operator without our participation in the data processing or our ability to influence it. In this respect, the data protection provisions of the platform operator apply, which can be viewed on the platform in question. We only receive and process personal data collected by the platform operator to the extent necessary for the download and provision of the App. If we process personal data as part of the installation, this is done on the basis of the contract on the acquisition and use of the App that you concluded with us when downloading and installing the App, in accordance with Article 6 (1) sentence 1 lit. b) GDPR.
3. Collection, Processing and Use of Data When Using the Apps
3.1 When you start and use Lotum's Apps, depending on the respective App, a connection may be automatically established to the servers used by us in order to retrieve current content. Information that your device transmits to us is logged in the process. This includes the IP address of the device you are using, data on the operating system used as well as the installed App and its version, date and time (including time zone) of the respective access to the contents of the App as well as the information on which specific contents have been requested for the respective App. In addition, Lotum may collect and process personal data in order to fulfil its contractual obligations with the User, e.g. to create the User's player profile. Depending on the respective App, these data include, among other things, name and IP address and data identifying the User's device.
3.2 Lotum collects and processes these data in order to provide the App and the respective current content of the App. The provision of these data is not required by law, but is necessary for the conclusion of the user contract for the respective App and the associated service by Lotum. In this respect, these are data that are strictly necessary for the use of the game requested by the User. The User may voluntarily provide Lotum with further data with respect to the offer. The basis for the collection of these data is Section 25 (2) No. 2 TDDDG, and the basis for the further data processing for the fulfilment of contractual obligations is Article 6 (1) sentence 1 lit. b) GDPR.
4. In-App Payments
4.1 In some Apps, we may offer certain additional versions and content for purchase, e.g. the use of an ad-free version of the App. In order to conclude the corresponding contract and the associated payment processing, it is necessary to enter bank details or other payment-related data (e.g. credit card). For payment processing, we use the services provided for payment processing by the respective operator of the platform through which you have obtained the App (for example, Apple, Inc. for the AppStore and Google Ireland Limited for the Google PlayStore). The aforementioned information will be processed accordingly together with the necessary usage data by the operator of the respective platform, insofar as this is necessary to process the payment. Details on the handling of your personal data in connection with the payment processing can be found in the privacy policy of the respective platform operator, which can be viewed on the corresponding platform.
4.2 The use of these payment services is mandatorily required by the platform operator in order for us to be allowed to offer the App on the respective platform and also serves to provide you with an easy and seamless payment process in the App.
4.3 This data processing in connection with the purchase of additional content in the respective App, including payment processing, is carried out for the conclusion and performance of the contract regarding this content and thus on the basis of Article 6 (1) sentence 1 lit. b) GDPR.
5. Withdrawal from Purchases
5.1 In our Apps, you can make paid purchases (in-app purchases) and, where applicable, take out subscriptions; the following information on withdrawal applies equally to both. If you are entitled to a statutory right of withdrawal in this respect and you exercise this right, we process the data required to handle your withdrawal request. These include in particular details of the purchase or subscription concerned (such as the order or transaction number, the product purchased and the date of purchase), your declaration of withdrawal and the date and time of the withdrawal; where applicable, we additionally process a user identifier, insofar as this is necessary to allocate your withdrawal.
5.2 We will confirm receipt of your withdrawal. The reversal of the purchase, in particular the refund of the purchase price, is carried out via the respective distribution platform (app store) through which you made the purchase; we do not process your payment data in this context.
5.3 The legal basis for this processing is Article 6 (1) sentence 1 lit. b) GDPR, as the processing is necessary for the reversal of the purchase contract concluded with you, as well as Article 6 (1) sentence 1 lit. c) GDPR, insofar as we are legally obliged to accept your withdrawal, to confirm its receipt and to initiate the refund. In addition, we process the aforementioned data to protect our legitimate interests pursuant to Article 6 (1) sentence 1 lit. f) GDPR; our legitimate interest lies in the proper documentation of withdrawals and the proof that they have been handled in due time, as well as in the prevention of abuse.
6. Support Requests and Contact via the App
6.1 If you notify our customer support or otherwise contact us (e.g. with a contact form in the App), the information you provide in the contact, including the contact details given there, will be processed for the purpose of handling and processing your enquiry, including investigating and rectifying any problems in the App, and in the event of follow-up questions. In the event of a request to our customer support via the App, information on the App, your game progress, Player-ID and, if applicable, the problematic part of the game as well as technical data on your device will also be processed automatically.
6.2 We process these data in accordance with Article 6 (1) sentence 1 lit. b) GDPR, as far as you contact us within the framework of an existing contract for the use of the App or for the purpose of initiating such a contractual relationship. If you report to us, as part of the notice and action mechanism pursuant to Article 16 DSA, specific items of information that you consider to be illegal content, the processing is carried out in accordance with Article 6 (1) lit. c) GDPR in conjunction with Article 16 DSA. Otherwise, the storage and use of the data takes place on the basis of Article 6 (1) sentence 1 lit. f) GDPR, whereby our legitimate interest is the careful processing of your respective request and the solution of any technical problems. Access to the data stored on your device is strictly necessary pursuant to Section 25 (2) No. 2 TDDDG so that Lotum can respond to your (support) request.
7. Notice and Action Mechanism
We are legally obliged to establish a mechanism that allows individuals or entities to notify us of the presence in our services of specific items of information that they consider to be illegal content.
Pursuant to Article 16 (2) DSA, we are obliged to put in place measures to receive the following information:
a) a sufficiently substantiated explanation of the reasons why the information in question is considered to be illegal content;
b) a clear indication of the exact electronic location of that information;
c) the name and e-mail address of the individual or entity submitting the notice, except in the case of information considered to involve one of the offences referred to in Articles 3 to 7 of Directive 2011/93/EU;
d) a statement confirming the bona fide belief of the individual or entity submitting the notice that the information and allegations contained therein are accurate and complete.
Pursuant to Article 16 (4) and (5) DSA, we will send you a confirmation of receipt after submission and will notify you of our decision regarding the reported content by e-mail once it has been taken. Your e-mail address collected in the notice form will be used exclusively for the purpose of handling the notice. The basis for the processing of your personal data as part of the notice and action mechanism is Article 6 (1) sentence 1 lit. c) GDPR in conjunction with Article 16 DSA.
8. Usage Analysis
8.1 The App may include data processing to improve its content, functions and performance ("Analytics"). We use Analytics to understand and illustrate how Users interact with the App. This helps us to identify any need for improvement and to make the App more user-friendly. For example, we analyse how Users interact with certain functions and game content, such as whether a certain game level is reached and successfully completed. Depending on the App and its use, Analytics may record which areas of the App are used, how often and for how long. In the process, technical data such as your IP address, device information (e.g. manufacturer, model, language settings and country of use) and an anonymised user ID are collected. Our analysis procedures are designed to evaluate these data at an aggregated level without identifying individual Users. Insights into how Users interact with functions or game content (e.g. whether certain levels are reached and completed) are essential for optimising the App and for its further development.
8.2 In order to ensure the correct functioning of the App, to monitor its overall performance and to better understand User behaviour, Lotum may process a limited amount of data on App usage. This helps us to meet User interests by checking whether the App works as expected, whether it performs as intended and in which areas Users may encounter difficulties. This information is essential in order to continuously improve the performance of the App, to fix technical problems and to optimise the overall user experience – always in the best interest of our Users.
8.3 This data processing is carried out without the use of third-party analytics services. The legal basis for this is Article 6 (1) lit. f) GDPR.
9. Data Aggregation and Visualisation
9.1 We use data aggregation and visualisation to identify how the user base generally interacts with our Apps and whether and how certain functions and game content are generally used (for example, whether a certain game level is reached and successfully completed at all), in order to identify any need for improvement and potential for making the functions and content of our Apps more user-friendly, and to be able to further develop our Apps on this basis. The aim is to be able to understand how Users interact with our Apps as a whole and, if applicable, in specific game sections. The evaluation is carried out exclusively in aggregated form and does not contain any personal or individualisable data. This processing is based exclusively on data previously collected via other analytics services.
9.2 We use the service "Hex", offered by Hex Technologies Inc., 2261 Market Street, #4233, San Francisco, CA 94114, USA, as well as "Looker", offered by Looker Data Sciences Inc., 101 Church Street, Santa Cruz, CA 95060, USA ("Looker"), for certain data processing operations. Hex is a cloud-based data analytics platform that supports us in processing and analysing User interactions, device data and other app-related information – for example, to improve gameplay or to optimise the user experience.
9.3 The service provider operates servers in the USA on which these data may be processed. We would like to point out that the transfer of data to servers in the USA used by the service provider may involve additional risks, e.g. the enforcement of your rights with regard to these data may be more difficult. In order to counter these risks, we have taken several measures. The transfers are protected by transport encryption. We have ensured that the service provider is a participant in the EU-U.S. Data Privacy Framework. The data transfer is therefore based on Article 45 GDPR. In addition, we have concluded the standard data protection clauses adopted by the EU Commission with the service provider in order to safeguard the data transfer to the USA. Furthermore, we have concluded a data processing agreement with the service provider. The transfer of personal data to the service provider in connection with the aforementioned services can therefore also be based on Article 46 (2) lit. c) and Article 28 GDPR.
9.4 These data are processed for the technical provision, improvement and analysis of our services. The legal basis for this is Article 6 (1) lit. f GDPR (legitimate interest) or Article 6 (1) lit. b GDPR (performance of contract), insofar as Users make use of contractual services.
10. Singular
10.1 The Apps also implement the Singular service provided by Singular, Inc., 181 South Park Street Unit 2 San Francisco, CA 94107, USA. This is an analytics service that we use to analyse Users' interactions with third-party advertisements that we display in our respective App to fund the Apps. These interactions are an important factor in the funding of the App through advertising, which is what enables us to provide the App for free in the first place. These interactions allow us to examine the contribution of certain advertising formats to the funding of the App in order to determine possible improvements to the advertising integration in the App that most appropriately consider and balance the sustainable advertising funding of the App and the enjoyable gaming experience. In this context, Singular also takes into account whether advertising funding is improved by our own advertising campaigns for the respective App and the new Users acquired as a result.
10.2 For the above purposes, Singular collects data about the installation of the respective App and how you found your way to downloading the App, as well as your use of the App including individual events in the App such as purchases and interactions with advertisements, as well as the IP address and individual Device-Related Data of your device. These data are used by Singular, Inc. to compile reports on App usage on our behalf for the aforementioned purposes.
10.3 You can object to the use of your data as part of the Singular service at any time, for example by changing your settings in the App.
10.4 For more information on how Singular, Inc. handles personal data, please see https://www.singular.net/privacy-policy/.
10.5 By using the Singular service, personal data are transferred to Singular, Inc. in the USA. For this reason, we have concluded with Singular, Inc. not only a data processing agreement within the meaning of Article 28 GDPR but also the EU standard contractual clauses approved by the EU Commission in order to ensure an appropriate level of data protection. Part of these clauses are also obligations regarding technical protection measures which, depending on the concrete need for protection of the data concerned, also include, among other things, the encryption of these data. By implementing these obligations, Singular, Inc. and we ensure an adequate level of data protection. The transfer of data to Singular, Inc. in the USA therefore takes place on the basis of Article 46 (2) lit. c) GDPR.
10.6 We only use Singular for the analyses described above if you have given your consent to this. The legal basis for the access to the data described above is therefore Section 25 (1) TDDDG, and the legal basis for the subsequent data processing in this context is Article 6 (1) sentence 1 lit. a) GDPR. You may revoke your consent at any time with effect for the future.
11. Inviting Players Using Links
11.1 To generate the direct link to the gaming session and to match the relevant Users in the same gaming session, we furthermore use the Singular service. When the recipient clicks on an accordingly generated link to a gaming session, Singular collects the recipient's IP address as well as information about the respective App and Device-Related Data about the device used. Singular uses these data on our behalf so that the recipient is directed straight to the correct gaming session in the respective App. For this purpose, the App must determine that it was your contact who clicked on the link and for which gaming session you invited the recipient. For these reasons, access to the aforementioned data is strictly necessary within the meaning of Section 25 (2) No. 2 TDDDG.
11.2 The data processing in connection with the direct link to the gaming session is carried out for the purpose of giving players an easy way to start a gaming session specifically with other persons and is therefore based on Article 6 (1) sentence 1 lit. f) GDPR. Our legitimate interest is to make it as easy and convenient as possible for our Users to start a game together and thus to provide Users with a special gaming experience. This is also in the interest of our Users, both the sender and the recipient of invitations to gaming sessions. A possible conflicting interest of the recipients to the effect that their data are not transferred to Singular is taken into account by the fact that such a data transfer only takes place if the recipient voluntarily clicks on the sent invitation link and thereby expresses that he or she accepts the game invitation. From this point on, it can no longer be assumed that the recipient has a conflicting interest regarding the processing of his or her personal data through our App.
11.3 From the aforementioned data, Singular also compiles reports on the use of links to Apps, which we evaluate. These reports provide us with information about the use of the generated links, the functioning of the links and any subsequent app openings or installations of the respective App. All these reports only ever contain aggregated data and do not allow us to draw any conclusions about individual Users; data about individual Users are not visible to us. The data processing described above is necessary to protect our legitimate interests (Article 6 (1) sentence 1 lit. f) GDPR), whereby our legitimate interest is to be able to provide Users with the best possible functionalities in our Apps in order to offer Users an optimal gaming experience. For this purpose, we need insights from the Users' interactions with the provided links and their functionalities. At the same time, access to these data is necessary in order to be able to monitor and improve the functionalities for inviting others to a joint gaming session. This is the only way we can provide and maintain this service requested by the Users (Section 25 (2) No. 2 TDDDG).
11.4 Singular also processes the aforementioned data collected via the Singular service to the extent covered by its own privacy policy, which you can find at https://www.singular.net/privacy-policy/. There you will also find additional information on Singular's handling of personal data.
11.5 We would like to point out that the transmission of data to servers in the USA used by Singular, Inc. may involve additional risks, for instance the enforcement of your rights to these data may be more difficult. In order to counter these risks, we have agreed the standard data protection clauses of the EU Commission with Singular, Inc. for this data transfer and also stipulated appropriate protective measures therein, which, depending on the need for protection of the data, also include their encryption and can be improved in accordance with the legal and technical conditions for appropriate protection of the data. If data are transferred to Singular, Inc. in the USA, such transfer is therefore based on Article 46 (2) lit. c) GDPR.
11.6 In certain Apps, you may also be able to create an invitation to a joint gaming session with a direct link to the specific gaming session in order to send this game invitation to a contact via a messenger app or by other means (e.g. e-mail). When the game invitation is created, a specific link is generated in the App that leads directly to the gaming session in the App.
12. Partner Services for Advertising in the Apps
12.1 We integrate services of advertising networks in the Apps with which we cooperate in order to be able to display third-party advertising to you while you are using the Apps.
12.2 In this context we use services of different advertising networks, whereby the personal data concerning you may be sent to several of the integrated advertising networks. By integrating different advertising networks, we ensure that only advertisements are displayed that have been approved by the advertiser and are specifically available for the respective country from which you have installed and use the relevant App. We generally make our Apps available worldwide, which is why the advertisements shown in them are subject to different legal requirements depending on the User's country. The advertising networks each work with different advertisers who may target their ads only at certain countries and adapt them solely to the legal requirements applicable there. In addition, advertisers have also set certain restrictions, such as a general maximum number of advertisements to be displayed per user or certain media in which the advertisements are to be displayed. However, we can only view individual advertisers and advertising campaigns relevant to our Apps in advance in very limited cases and therefore cannot evaluate them more precisely. To ensure that we are nevertheless always able to display advertising that has been approved by the advertiser for the User's region and may specifically be played, we use different advertising networks.
12.3 We use AppLovin MAX as the central mediation service. Via AppLovin MAX, we integrate the advertising networks listed below. Not every App uses every one of the services listed below.
12.4 Since we can only provide the free Apps by financing them through advertising, we have a legitimate interest in generally displaying advertising to the individual User in our Apps in order to generate revenue and to be able to continue to offer the Apps free of charge, worldwide where possible.
12.5 However, personalisation of displayed advertising is only activated to the extent permitted by law. In particular, we only use data of a User who is located in the EU to display personalised advertising to this User if the respective User has consented to this in advance. In these cases, the legal basis for the processing of your data in connection with personalised advertising is your consent pursuant to Section 25 (1) TDDDG and Article 6 (1) sentence 1 lit. a) GDPR. You may, of course, revoke an already granted consent to data processing for personalised advertising at any time with effect for the future.
12.6 Please note that we also display advertising to finance the free Apps if you have not consented to personalised advertising or have revoked such consent. In that case the advertising displayed will not be personalised, i.e. not adapted to your personal interests and usage habits. Only general information will be taken into account, for example the respective App and the country from which the App was installed and launched. More details on the display of these non-personalised advertisements and their legal basis are explained below for the individual advertising services.
12.7 For some games we may also offer you the option of purchasing a paid, ad-free version. In such a version, of course, no advertising services whatsoever are implemented and accordingly no data processing takes place for the purpose of displaying advertising in the App.
12.8 AppLovin MAX
12.8.1 Our Apps use, as the central mediation service, the mediation platform AppLovin MAX, which is operated by AppLovin Corporation, 1100 Page Mill Road, Palo Alto, CA 94304, USA ("AppLovin"), in order to integrate third-party advertising and to mediate and optimise the delivery of advertising from various advertising networks. In this context, AppLovin receives information about the respective App (name, category and language of the App), Device-Related Data of your device as well as the IP address of your device and information about some of your interactions in the App. The aforementioned data may also be transmitted to servers of AppLovin Corporation in the USA as part of the AppLovin MAX service. AppLovin processes these data in order to select or mediate the specific advertisements – without giving us any more precise opportunity to exert influence – and to limit the display of an advertisement, especially in the case of multiple displays to a specific User. We have no insight into the selection of specific advertisements and the related data processing, nor do we have any more precise setting options to be able to influence this. AppLovin uses the collected data in accordance with AppLovin's privacy policy.
12.8.2 When the advertisement is played, AppLovin also records whether and how you interact with the advertisement, the IP address and individual Device-Related Data of your device as well as, if applicable, your further usage behaviour following a click on the advertisement, in order to measure the success of the respective advertisement together with the aforementioned data and to properly invoice us and the advertiser accordingly. Based on these measurements, AppLovin also creates aggregated reports for us on the scope and results of the advertising. However, this only gives us access to aggregated data on the results of the advertising, which Lotum cannot trace back to individual persons.
12.8.3 Further details on the processing of data by AppLovin can be found in AppLovin's privacy policy at https://www.applovin.com/privacy/.
12.8.4 The legal basis for the data processing as part of the AppLovin MAX service is our legitimate interest pursuant to Article 6 (1) sentence 1 lit. f) GDPR. It is our legitimate interest to play advertising to Users in order to finance the creation and further development of the Apps that are available free of charge. Financing through advertising allows us to generally offer the Apps worldwide. It is also in our legitimate interest to use a mediation platform specifically tailored to advertising for apps in order to display advertising that fits as coherently as possible into the format of the Apps and is not perceived by Users as annoying or inappropriate. Insofar as your consent is required for the advertising or for the access to information stored on your device, the processing is carried out only on the basis of your consent pursuant to Section 25 (1) TDDDG and Article 6 (1) sentence 1 lit. a) GDPR; you may revoke your consent at any time with effect for the future. As the Apps are available free of charge and are solely for your entertainment purposes, it is not apparent that your interests are overriding in this respect. For certain Apps we also offer you, where possible, the option to use a paid, ad-free version of the Apps.
12.8.5 The transfer to servers of AppLovin Corporation in the USA is based on Article 46 (2) lit. c) GDPR. For this transfer we have agreed the standard data protection clauses of the EU Commission with AppLovin Corporation. Together with these clauses, we and AppLovin Corporation have also defined and implemented appropriate protection measures that take into account the need for protection of the data in each specific case and include encryption of the data. These measures are also continuously adapted in accordance with the legal and technical conditions for effective protection of the data in order to provide continuous assurance of an adequate level of protection.
12.9 Google AdMob
12.9.1 The advertising network AdMob, which is operated by Google, is also used in our Apps to integrate third-party advertising. In this context, Google receives information about the respective App (name, category and language of the App), Device-Related Data of your device as well as the IP address of your device, which is, however, shortened and only used in an abbreviated form, and information about some of your interactions in the App. The aforementioned data may also be transmitted to servers of Google LLC in the USA as part of the AdMob service. Google processes these data in order to select the specific advertisements, without giving us any more precise opportunity to exert influence, and to limit the display of an advertisement, especially in the case of multiple displays to a specific User. We have no insight into the selection of specific advertisements and the related data processing, nor do we have any more precise setting options to be able to influence this. Google uses the collected data in accordance with Google's privacy policy.
12.9.2 When the advertisement is played, Google also records whether and how you interact with the advertisement, the IP address and individual Device-Related Data of your device as well as, if applicable, your further usage behaviour following a click on the advertisement, in order to measure the success of the respective advertisement together with the aforementioned data and to properly invoice us and the advertiser accordingly. Based on these measurements, Google also creates aggregated reports for us on the scope and results of the advertising. However, this only gives us access to aggregated data on the results of the advertising, which Lotum cannot trace back to individual persons.
12.9.4 The basis for the access to the aforementioned data is Section 25 (2) No. 2 TDDDG, and the basis for the data processing as part of the AdMob service is our legitimate interest pursuant to Article 6 (1) sentence 1 lit. f) GDPR. It is our legitimate interest to play advertising to Users in order to finance the creation and further development of the Apps that are available free of charge. Financing through advertising allows us to generally offer the Apps worldwide. Access to the aforementioned data on your device is therefore also necessary in order to be able to offer you the games you have selected. It is also in our legitimate interest to use the AdMob network, which is specifically tailored to advertising for apps, in order to display advertising that fits as coherently as possible into the format of the Apps and is not perceived by Users as annoying or inappropriate. As the Apps are available free of charge and are solely for your entertainment purposes, it is not apparent that your interests are overriding in this respect. For certain Apps we also offer you, where possible, the option to use a paid, ad-free version of the Apps.
12.9.5 The transfer to servers of Google LLC in the USA is based on Article 46 (2) lit. c) GDPR. For this transfer we have agreed the standard data protection clauses of the EU Commission with Google LLC. Together with these clauses, we and Google LLC have also defined and implemented appropriate protection measures that take into account the need for protection of the data in each specific case and include encryption of the data. These measures are also continuously adapted in accordance with the legal and technical conditions for effective protection of the data in order to provide continuous assurance of an adequate level of protection.
12.10 UnityAds
12.10.1 Our Apps also include the UnityAds advertising network, which is maintained by Unity Technologies Finland Oy, Kaivokatu 6, 00100 Helsinki, Finland ("Unity"). In this context, Unity receives the following information: the respective App, the IP address of your device and Device-Related Data about your device. Unity processes these data independently for the purpose of deciding on the specific advertising to be displayed. We have no insight into the selection of the specific advertising and the related data processing, nor can we make any detailed settings in this regard.
12.10.2 When advertising is displayed in the App, Unity also records whether and how you interact with the advertisement and, if applicable, your further usage behaviour following a click on the advertisement. Unity processes all of the aforementioned data collected in the course of the advertising display in order to verify and evaluate the results of the advertising and to properly invoice us and the advertiser. In this context, Unity also provides us with reports. In this respect, we receive extracts of information from Unity about the advertising results, but only in aggregated form, so that Lotum cannot trace this information back to individual persons.
12.10.4 The legal basis for the data processing related to UnityAds is the pursuit of our legitimate interest pursuant to Article 6 (1) sentence 1 lit. f) GDPR. Access to the aforementioned data stored on your device is justified pursuant to Section 25 (2) No. 2 TDDDG, because without access to these data for the purpose of displaying advertising we cannot offer the games you have requested. Our legitimate interest is to play advertising to Users in order to finance the creation and further development of the Apps that are available free of charge. Financing through advertising allows us to generally offer the Apps worldwide and without financial costs for the User and to continuously provide new content for the Apps. As the Apps are available free of charge and are solely for your entertainment purposes, it is not apparent that your interests are overriding in this respect. For certain Apps we also offer you, where possible, the option to use a paid, ad-free version of the App.
12.10.5 When providing the UnityAds service, Unity may also transfer the personal data processed to its own servers in the USA, insofar as this is necessary for the provision of the UnityAds service. Insofar as this occurs, Unity will ensure that an appropriate level of protection for the personal data is guaranteed by means of suitable safeguards, in particular the agreement of the standard data protection clauses of the EU Commission with protective measures, including technical ones, adapted to the specific planned transfer. In these cases, the data transfer is based on Article 46 (2) lit. c) GDPR.
12.11 Vungle
12.11.1 We also implement the Vungle advertising service. This service is maintained by Liftoff Mobile, Inc., 555 Bryant Street, Suite #133, Palo Alto, CA 94301, USA (brand "Vungle"). Vungle collects your IP address and Device-Related Data about your device, including the mobile network provider you use and how you are connected to the Internet, as well as the Apps of Lotum installed on your device. Vungle uses these data to decide on the specific advertising to be displayed without any further involvement or possibility of influence on our part.
12.11.2 If advertisements are loaded via Vungle in the App you use, or if you click on one of these advertisements, Vungle also collects, among other things, your interaction with the advertisement and, if applicable, your further usage behaviour after clicking on the advertisement. Vungle processes all of the aforementioned data processed as part of the advertising display in order to record the success of the advertising, to properly invoice it and to prepare reports on it, extracts of which are made available to us in aggregated form. However, we cannot trace these data back to individual persons.
12.11.3 Vungle's privacy policy on the handling of the personal data collected can be found at https://liftoff.ai/privacy-policy/.
12.11.4 Data processing in connection with the Vungle service is carried out to pursue our legitimate interests pursuant to Article 6 (1) sentence 1 lit. f) GDPR. Our legitimate interest is to generate revenue by displaying advertising in order to be able to offer the Apps that are available free of charge. In addition, we have a legitimate interest in developing new content for the Apps which is also available at no cost to the User and is financed accordingly through advertising revenue. As the Apps are available free of charge and are solely for your entertainment purposes, it is not apparent that your interests are overriding in this respect. For certain Apps we also offer you, where possible, the option to use a paid, ad-free version of the App.
12.11.5 For the transfer of data to Vungle in the USA, Vungle and we establish the required level of data protection for this transfer by having concluded the standard data protection clauses of the EU Commission, which provide for appropriate protection measures such as encryption of the data for the individual case, in accordance with Article 46 (2) lit. c) GDPR.
12.12 Facebook Audience Network
12.12.1 Our Apps also include advertising through the advertising network Facebook Audience Network. This advertising network is offered by Facebook. With this network, Facebook collects data on the respective App, Device-Related Data on your device and the IP address of your device. Facebook may also process these data on servers in the USA. Facebook uses these data to independently select the specific advertising in a process that is not accessible to us, as well as to limit the display of an advertisement, especially in the case of multiple displays to a specific User. We have no insight into the selection of specific advertisements and the related data processing, nor do we have any more precise setting options to be able to influence this.
12.12.2 If an advertisement is displayed to you by the Facebook Audience Network or if you click on such an advertisement, Facebook also records your interaction with the advertisement, as well as your further usage behaviour, if any, following a click on the advertisement. With these data, Facebook determines the results of the respective advertisement and processes them for the purpose of invoicing us and the advertiser. In this context, Facebook also provides reports for us and the advertiser, which, however, only comprise aggregated data on the respective advertising display and its results and which we are therefore unable to trace back to individual persons or sort by individual persons.
12.12.4 The processing of data as part of the Facebook Audience Network is carried out in order to pursue our legitimate interest pursuant to Article 6 (1) sentence 1 lit. f) GDPR. This legitimate interest is to display advertising to Users in order to finance the development and expansion of the Apps that are available free of charge. Financing through advertising allows us to generally offer the Apps worldwide. As the Apps are available free of charge and are solely for your entertainment purposes, it is not apparent that your interests are overriding in this respect. At the same time, access to the aforementioned data stored on your device is strictly necessary in order to be able to provide you with the requested games free of charge at all (Section 25 (2) No. 2 TDDDG). For certain Apps we also offer you, where possible, the option to use a paid, ad-free version of the App.
12.12.5 The transfer to Facebook servers in the USA is based on Article 46 (2) lit. c) GDPR. We have agreed with Facebook the standard data protection clauses of the EU Commission for the transfer of data by the Facebook Audience Network and have also agreed therein on the implementation of appropriate protective measures. Facebook and we also regularly review the need for additions and, if necessary, the implementation of additional appropriate protection measures within the meaning of Article 44 et seq. GDPR, to the extent this is necessary to continuously guarantee an appropriate level of data protection.
12.13 Pangle
12.13.1 The advertising network Pangle, which is operated by ByteDance Pte. Ltd., 1 Raffles Quay, #26-10, Singapore 048583 ("Pangle"), is also used in our Apps to integrate third-party advertising. In this context, Pangle receives information about the respective App (name, category and language of the App), Device-Related Data of your device as well as the IP address of your device and information about some of your interactions in the App. The aforementioned data may also be transmitted to servers of ByteDance Pte. Ltd. in the USA and in Singapore as part of the Pangle service. Pangle processes these data in order to select the specific advertising, which may be tailored to your interests, – without giving us any more precise opportunity to exert influence – and to limit the display of an advertisement. We have no insight into the selection of specific advertisements and the related data processing, nor do we have any more precise setting options to be able to influence this. Pangle uses the collected data in accordance with Pangle's privacy policy.
12.13.2 Further details on the processing of data by Pangle can be found in Pangle's privacy policy at https://www.pangleglobal.com/privacy.
12.13.3 The legal basis for the personalised advertising displayed as part of the Pangle service is your consent pursuant to Section 25 (1) TDDDG and Article 6 (1) sentence 1 lit. a) GDPR, which we obtain via our consent management; you may revoke your consent at any time with effect for the future. Insofar as advertising is displayed without personalisation, we base the associated processing on our legitimate interest pursuant to Article 6 (1) sentence 1 lit. f) GDPR, which consists in the financing of the Apps that are available free of charge through advertising.
12.13.4 The transfer to servers in the USA and in Singapore is based on Article 46 (2) lit. c) GDPR: We have agreed with ByteDance Pte. Ltd. the standard data protection clauses of the EU Commission, which provide for appropriate protection measures in the specific case, such as encryption of the data.
12.14 InMobi
12.14.1 The advertising network InMobi, which is operated by InMobi Pte. Ltd., 30 Cecil Street, #19-08, Prudential Tower, Singapore 049712 ("InMobi"), is also used in our Apps to integrate third-party advertising. In this context, InMobi receives information about the respective App (name, category and language of the App), Device-Related Data of your device as well as the IP address of your device and information about some of your interactions in the App. The aforementioned data may also be transmitted to servers of InMobi Pte. Ltd. in the USA as part of the InMobi service. InMobi processes these data in order to select the specific advertising, which may be tailored to your interests, – without giving us any more precise opportunity to exert influence – and to limit the display of an advertisement. We have no insight into the selection of specific advertisements and the related data processing, nor do we have any more precise setting options to be able to influence this. InMobi uses the collected data in accordance with InMobi's privacy policy.
12.14.2 Further details on the processing of data by InMobi can be found in InMobi's privacy policy at https://www.inmobi.com/privacy-policy.
12.14.3 The legal basis for the personalised advertising displayed as part of the InMobi service is your consent pursuant to Section 25 (1) TDDDG and Article 6 (1) sentence 1 lit. a) GDPR, which we obtain via our consent management; you may revoke your consent at any time with effect for the future. Insofar as advertising is displayed without personalisation, we base the associated processing on our legitimate interest pursuant to Article 6 (1) sentence 1 lit. f) GDPR, which consists in the financing of the Apps that are available free of charge through advertising.
12.14.4 The transfer to servers in the USA is based on Article 46 (2) lit. c) GDPR: We have agreed with InMobi Pte. Ltd. the standard data protection clauses of the EU Commission, which provide for appropriate protection measures in the specific case, such as encryption of the data.
12.15 Mintegral
12.15.1 The advertising network Mintegral, which is operated by Mintegral International Limited, Room 1204, 12/F, Officeplus @Prince Edward, 794–802 Nathan Road, Kowloon, Hong Kong ("Mintegral"), is also used in our Apps to integrate third-party advertising. In this context, Mintegral receives information about the respective App (name, category and language of the App), Device-Related Data of your device as well as the IP address of your device and information about some of your interactions in the App. The aforementioned data may also be transmitted to servers of Mintegral International Limited in, among other places, Hong Kong, the USA and Singapore as part of the Mintegral service. Mintegral processes these data in order to select the specific advertising, which may be tailored to your interests, – without giving us any more precise opportunity to exert influence – and to limit the display of an advertisement. We have no insight into the selection of specific advertisements and the related data processing, nor do we have any more precise setting options to be able to influence this. Mintegral uses the collected data in accordance with Mintegral's privacy policy.
12.15.2 Further details on the processing of data by Mintegral can be found in Mintegral's privacy policy at https://www.mintegral.com/en/privacy.
12.15.3 The legal basis for the personalised advertising displayed as part of the Mintegral service is your consent pursuant to Section 25 (1) TDDDG and Article 6 (1) sentence 1 lit. a) GDPR, which we obtain via our consent management; you may revoke your consent at any time with effect for the future. Insofar as advertising is displayed without personalisation, we base the associated processing on our legitimate interest pursuant to Article 6 (1) sentence 1 lit. f) GDPR, which consists in the financing of the Apps that are available free of charge through advertising.
12.15.4 The transfer to servers in, among other places, Hong Kong, the USA and Singapore is based on Article 46 (2) lit. c) GDPR: We have agreed with Mintegral International Limited the standard data protection clauses of the EU Commission, which provide for appropriate protection measures in the specific case, such as encryption of the data.
12.16 Digital Turbine Exchange
12.16.1 The advertising network Digital Turbine Exchange, which is operated by Digital Turbine, Inc. (service formerly "Fyber" or "DT Exchange"); representative in the EU pursuant to Article 27 GDPR: Rickert Rechtsanwaltsgesellschaft mbH, Colmantstraße 15, 53115 Bonn ("Digital Turbine"), is also used in our Apps to integrate third-party advertising. In this context, Digital Turbine receives information about the respective App (name, category and language of the App), Device-Related Data of your device as well as the IP address of your device and information about some of your interactions in the App. The aforementioned data may also be transmitted to servers of the Digital Turbine group in the USA as part of the Digital Turbine Exchange service. Digital Turbine processes these data in order to select the specific advertising, which may be tailored to your interests, – without giving us any more precise opportunity to exert influence – and to limit the display of an advertisement. We have no insight into the selection of specific advertisements and the related data processing, nor do we have any more precise setting options to be able to influence this. Digital Turbine uses the collected data in accordance with Digital Turbine's privacy policy.
12.16.2 Further details on the processing of data by Digital Turbine can be found in Digital Turbine's privacy policy at https://www.digitalturbine.com/fyber-website-privacy-policy/.
12.16.3 The legal basis for the personalised advertising displayed as part of the Digital Turbine Exchange service is your consent pursuant to Section 25 (1) TDDDG and Article 6 (1) sentence 1 lit. a) GDPR, which we obtain via our consent management; you may revoke your consent at any time with effect for the future. Insofar as advertising is displayed without personalisation, we base the associated processing on our legitimate interest pursuant to Article 6 (1) sentence 1 lit. f) GDPR, which consists in the financing of the Apps that are available free of charge through advertising.
12.16.4 The transfer to servers in the USA is based on Article 46 (2) lit. c) GDPR: We have agreed with the Digital Turbine group the standard data protection clauses of the EU Commission, which provide for appropriate protection measures in the specific case, such as encryption of the data. In addition, the transfer is based on a certification under the EU-U.S. Data Privacy Framework (Article 45 GDPR).
13. Advertising on Facebook for Lotum's Offers
13.1 We advertise our own offers and Apps on websites and apps of other providers using Facebook's advertising services. Through these services, our advertisements are displayed on the websites and apps of other providers who are part of the Facebook advertising network and have implemented the advertising network accordingly. Facebook also provides us with aggregated reports to track the success of our advertisements.
13.2 Facebook decides independently on the specific advertisements displayed and on the processing of your personal data in connection with the selection and display of these advertisements via the Facebook advertising network. In this respect, we can only impose, in advance when ordering the advertising and on the basis of a number of default settings delimited by Facebook, abstract restrictions on the user categories to which our advertising can potentially be shown. However, Facebook carries out the data processing in connection with the selection of the user and the display of the advertisement independently and without any further instructions from us. Facebook does not receive any personal data from us in this context, and we neither have any insight into the data processed by Facebook of the users to whom advertisements are shown, nor do we have any further influence on the related data processing.
13.3 Facebook also records the success of our advertisements for invoicing and analysis purposes. When the Apps are installed, both we and Facebook receive the information that the User clicked on one of our advertisements, was thereby redirected to the platform page where the respective App can be downloaded, and installed our App. This information may also be sent to Facebook servers in the USA. This links contacts that Users have with advertisements in apps of the Facebook advertising network (visual contacts and clicks on advertising banners) with subsequent interactions of the Users in our Apps, including the installation and launch of the specific App. The data collected in this way are also statistically analysed by Facebook. Facebook provides us with parts of the evaluations in the form of aggregated reports (so-called Facebook Ads Manager function), with which we gain an overview of the effectiveness of the advertising. In this context, we receive data on the results of our advertising and aggregated demographic information (such as approximate age group and gender) about the total Users who have viewed and clicked on our ads. However, we cannot view any information that would allow Users to be personally identified. We never combine the reports with any other personal data of individual Users.
13.4 The legal basis for the data processing described above in connection with the measurement of the effectiveness of our advertising on Facebook is our legitimate interests pursuant to Article 6 (1) sentence 1 lit. f) GDPR. These consist in being able to track the results and effectiveness of our advertisements via Facebook and to validate Facebook's invoicing for advertisements based on this. This is the only way we can provide you with the games you have selected free of charge, which is why the related data access is strictly necessary (Section 25 (2) No. 2 TDDDG). Your interests are taken into account by the fact that Facebook only displays advertisements to registered users of the Facebook social network and therefore only data of these Facebook users are used in the context of our advertising measurement. During the registration process for the Facebook network, Facebook explicitly points out the processing of data for advertising purposes, including by advertisers such as us, and asks for the Facebook user's consent to such data processing. In addition, you can object to our processing for measuring the effectiveness of our advertising.
13.5 Data are transferred to Facebook only in compliance with appropriate protective measures in accordance with Article 44 et seq. GDPR. To this end, we have concluded the standard data protection clauses of the EU Commission with Facebook in accordance with Article 46 (2) lit. c) GDPR. The clauses also provide for protective measures tailored to the transfer, which are continuously developed and supplemented in order to ensure an appropriate level of data protection throughout.
13.6 Further information on the processing of your personal data by Facebook in the context of advertising on Facebook and the rights to which you are entitled in this context can be found here: https://www.facebook.com/policy.php.
13.7 You can also control the types of advertisements you see on the Facebook advertising network by visiting the page set up by Facebook and following the instructions there on the settings for usage-based advertising: https://www.facebook.com/settings?tab=ads. The settings you make on this website are applied across all platforms, i.e. they are applied to all devices on which you log into your Facebook account (such as desktop computers or mobile devices).
14. Facebook Login Function
14.1 In some Apps, you will need to create a player profile and provide some information (such as the player name you choose) according to the registration form. In individual Apps, we also offer you the option of creating a player profile by entering the login data of your Facebook user account (so-called "Facebook Login", formerly known as "Facebook Connect"), if you express your consent to this by clicking on the corresponding button to connect to Facebook ("Log in with Facebook"). The Facebook Login function is offered by Facebook. The login data of your Facebook account will be sent directly to Facebook. We do not have access to your login data. After verification of your login data, Facebook only informs us about the following data from your Facebook user account: the registered name, your profile picture, your language setting, and the country from which you are playing. Facebook further checks which other Facebook users with whom you are connected on Facebook (so-called "friends") have already played the respective App and provides us with this information. Lotum receives and uses the aforementioned data to set up your player profile in the App. We also use the information about your friends on Facebook to enable you to invite a Facebook friend to a joint game session and to easily start this game session. However, we only process this information to the extent necessary for the joint game session.
14.2 By using the Facebook Login function, Facebook receives the information that you have created a player profile for the respective App and can link this information to your Facebook user account. Information on how Facebook handles your personal data can be found in Facebook's privacy policy at: https://www.facebook.com/privacy/explanation
14.3 The legal basis for the data processing as part of the Facebook Login function is your consent (Section 25 (1) TDDDG, Article 6 (1) sentence 1 lit. a) GDPR), which you give when calling up the Facebook Login function and subsequently entering your login data to your Facebook account. You can revoke your consent to data processing when using the Facebook Login function at any time with effect for the future.
14.4 The transfer of your personal data to Facebook in this context is based on Article 46 (2) lit. c) GDPR. In this respect, the above statements in section 12.12.5 apply accordingly.
15. Apple Sign in Function
15.1 In some Apps that require you to register a player profile, you may also create your player profile by signing in to your profile set up for Apple services (so-called Apple ID account) if you express your consent to do so by clicking on the corresponding button to connect to Apple. The function required for this (called "Apple Sign in") is provided by Apple Distribution International Ltd. Hollyhill Industrial Estate, Hollyhill, Cork, Ireland ("Apple"). We do not have access to the login data of your Apple profile. After verification of your login data, we will only be informed about the following data from your Apple profile: the registered name, the identifier of your Apple profile, your language setting, and the country from which you are playing.
15.2 The legal basis for the data processing as part of the Apple Sign in function is your consent (Section 25 (1) TDDDG, Article 6 (1) sentence 1 lit. a) GDPR), which you give when calling up this function and subsequently entering your login data to your Apple ID account. You may revoke your consent at any time with effect for the future.
15.3 If you use Apple Sign in, Apple may receive the information that you have created a player profile for the respective App. Information on how Apple handles your personal data can be found in Apple's privacy policy at: www.apple.com/de/privacy
15.4 In the event that personal data concerning you are transferred to Apple, Inc. in the USA through the Apple Sign in function, Apple has ensured prior to the transfer that this transfer is safeguarded by the agreement of the standard data protection clauses of the EU Commission pursuant to Article 46 (2) lit. c GDPR. Apple and we also take additional technical precautions to protect your data, including appropriate encryption, pseudonymisation and the greatest possible reduction of the data processed.
16. Google Sign in Function
16.1 In some Apps that require you to register a player profile, you may also create your player profile with the help of your Google account if you express your consent to do so by clicking on the corresponding button to connect to Google. The function required for this (called "Google Sign-In") is provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA, ("Google LLC"). We do not have access to the login data of your Google profile. After verification of your login data by Google LLC, we will only be informed about the following data from your Google profile: the registered name, the registered e-mail address and the identifier of your Google profile.
16.2 The legal basis for the data processing as part of the Google Sign in function is your consent (Article 6 (1) sentence 1 lit. a) GDPR), which you give when calling up this function and subsequently entering your login data to your Google account. You may revoke your consent at any time with effect for the future.
16.3 Further details on the processing of data by Google LLC can be found in Google's privacy policy at https://policies.google.com/privacy and in the information on the use of data from integrated Google services at https://policies.google.com/technologies/partner-sites?hl=de.
16.4 The transfer to servers of Google LLC in the USA is based on Article 46 (2) lit. c) GDPR. For this transfer we have agreed the standard data protection clauses of the EU Commission with Google LLC. Together with these clauses, we and Google LLC have also defined and implemented appropriate protection measures that take into account the need for protection of the data in each specific case and include encryption of the data. These measures are also continuously adapted in accordance with the legal and technical conditions for effective protection of the data in order to provide continuous assurance of an adequate level of protection.
17. Error Evaluation Using Sentry Analytics
17.1 In order to detect and correct technical errors, we use the Sentry Analytics service provided by Functional Software, Inc. dba Sentry, 132 Hawthorne Street, San Francisco, CA 94107 ("Sentry"). For this purpose, during a game session in our Apps, technical details on the use of our Apps and on game actions performed are stored locally on your device. In the event of an error, these technical details, insofar as they are temporally related to the occurrence of the error, as well as your IP address are transmitted to Sentry and processed by Sentry together with the following data: information on the hardware and the operating system used on your device, name and version of the App used as well as the date, time, details of the error that occurred and game-related data in connection with the error. It is not possible for Sentry or us to identify you from the data transmitted to and processed by Sentry. Sentry also does not create a profile of you at any time. On the basis of the above information, Sentry only produces, on behalf of Lotum, reports and evaluations of identifiable errors, including the circumstances under which the error occurred, which may therefore provide information about possible causes of the error. In this context, the aforementioned information is also transmitted to a Sentry server in the USA and stored there. However, the data transmitted as part of the Sentry service will not be combined with other data by Sentry and will be used solely for the analysis and correction of the technical error. The data collected will be stored by the Sentry service for a maximum of 90 days and then deleted.
17.2 Further information and Sentry's applicable privacy policies can be found at https://sentry.io/terms/ and https://sentry.io/privacy/.
17.3 We use the Sentry service to eliminate errors in our Apps and difficulties in their use as quickly and comprehensively as possible and thus to be able to continuously develop our offer towards a smooth user experience. For these purposes, access to the aforementioned data is strictly necessary pursuant to Section 25 (2) No. 2 TDDDG. The basis for the subsequent data processing when using the Sentry service is our legitimate interest, as described above, pursuant to Article 6 (1) sentence 1 lit. f) GDPR. Your legitimate interests are taken into account by removing any personal reference after the transmission of the technical data from your device, but before their analysis. If you nevertheless do not want your data to be collected by the Sentry service in case of a possible error analysis, we must ask you to refrain from playing our free Apps.
17.4 We would like to point out that the data processing by Sentry may also take place outside the EU or the European Economic Area, in particular on servers located in the USA. This may result in risks for Users, for example because it may make it more difficult to enforce Users' rights. We take these risks into account by taking appropriate protective measures in accordance with Article 44 et seq. GDPR, in particular by agreeing on the standard data protection clauses of the EU Commission with Sentry, which provide for appropriate protective measures such as encryption of data in individual cases. If data are transferred to Sentry in the USA, this is therefore based on Article 46 (2) lit. c) GDPR.
18. Surveys in Apps
18.1 Some of our Apps implement functions of the Survicate service, which is provided by Survicate SP. Z O.O., 8 Zamiany St. LU 2, 02-786 Warsaw, Poland ("Survicate").
18.2 Via Survicate, we display surveys in our App which help us to continuously develop the App and to align it with the needs of our players. For these purposes, information on whether and how you have interacted with the survey is collected together with the IP address and other technical data on your device, such as the language setting and the version of the operating system (hereinafter "Device-Related Data"). At the same time, these survey results are also evaluated by Survicate and made available to us in the form of aggregated reports. Depending on the questions asked in the survey, these reports give us insights into questions such as which aspects of our game are popular with our Users or which additional functions our Users would like to have.
The data transmitted to Survicate are anonymised within the analysis process and are also only made available to Lotum in anonymised form. It is therefore not a matter of creating user profiles for Lotum, but rather of providing functional Apps through the evaluation of aggregated reports based on surveys. In this context, data are only transmitted to and evaluated on servers within the EU. At no time are data transmitted to servers in third countries, such as the USA.
18.3 Survicate does not process the aforementioned data collected in the course of the survey for its own purposes. Further information on Survicate's handling of data can be found at https://help.survicate.com/en/articles/3943207-terms-of-service-priva- cy-policy-gdpr-and-dpa.
18.4 We only use Survicate for the display and evaluation of surveys described above if you have given your consent to this. The legal basis for the access to the information stored on your device is Section 25 (1) TDDDG, and the legal basis for the further data processing in this context is Article 6 (1) sentence 1 lit. a) GDPR. You may revoke your consent at any time with effect for the future. We have also concluded a data processing agreement with Survicate in accordance with Article 28 GDPR on the data processing in connection with surveys. Accordingly, Survicate will only process the data collected in this context in accordance with our instructions for this purpose. This forwarding of data to Survicate is therefore based on Article 28 GDPR.
19. Data Hosting
19.1 We store the data which we collect when the Apps are used with the help of third-party services. For this purpose, we use the Google Cloud and Google Firebase services, both of which are provided by Google. These services may also collect and possibly store the IP address of your device when you use the Apps, but for a maximum of 30 days. However, Lotum does not receive the IP addresses directly and only views IP addresses collected by these services in exceptional cases and only if a legal basis exists, in particular insofar as this is necessary to protect Lotum's legitimate interests (e.g. during maintenance work or in the event of the investigation of technical problems). Google also transfers the collected data to its servers in the USA. We use these services to provide the aforementioned data for playing the App efficiently and with the lowest possible susceptibility to errors and thereby ensure a smooth use of the game features. The legal basis for the associated data processing is Article 6 (1) sentence 1 lit. f) GDPR, whereby our legitimate interest is an optimal, technically sound provision of the App. As we have already explained several times above, we have concluded the standard data protection clauses of the EU Commission with Google to safeguard the transfer of data to the USA. We have also concluded a data processing agreement with Google. The forwarding of personal data to Google in connection with the aforementioned services is therefore based on Article 46 (2) lit. c) and 28 GDPR.
20. Storage, Storage Period and Deletion of Data
20.1 We process your personal data for as long as is necessary to achieve the purposes of the processing or as required by a statutory obligation to retain the data. Subsequently, the data will be deleted in accordance with the statutory provisions.
20.2 However, we retain data that we store for legal reasons for as long as this is legally required. After expiry of a statutory retention period, the data are deleted without undue delay, unless there are other reasons preventing deletion within the meaning of Article 17 (3) GDPR.
21. Data Security
21.1 Lotum has taken appropriate technical and organisational measures to protect personal data against accidental loss, damage, unauthorised access or unauthorised alteration. In particular, data are transferred by Lotum only in encrypted form to the greatest extent possible. Lotum, however, clarifies that data protection and data security cannot be guaranteed for transfers outside Lotum's sphere of influence.
22. Disclosure of Personal Data to Third Parties
22.1 Unless stated otherwise elsewhere in this Privacy Policy, personal data will only be disclosed to third parties without the User's explicit consent if this is necessary for the provision of Lotum's services (e.g. for the technical provision of the offer). Accordingly, a transfer of data to such service providers (such as technical service providers) takes place in order to protect our legitimate interests pursuant to Article 6 (1) sentence 1 lit. f) GDPR, namely in order to be able to make our Apps available for retrieval at all. Of course, Lotum will ensure, before disclosing the User's personal data, that the respective service provider has taken appropriate technical and organisational measures to guarantee the security of the data.
22.2 Otherwise, Lotum will not disclose the User's personal data to third parties, unless the User has expressly consented to the disclosure (Article 6 (1) sentence 1 lit. a) GDPR) or Lotum is entitled or obliged to disclose the data due to legal provisions or court orders. In the latter case, Lotum will transfer the data in order to fulfil a legal obligation pursuant to Article 6 (1) sentence 1 lit. c) GDPR.
23. User Rights
23.1 Right to Object
The User has the right to object at any time, on grounds relating to the User's particular situation, to data processing based on Article 6 (1) sentence 1 lit. e) or f) GDPR, unless Lotum can demonstrate compelling legitimate grounds which override the interests of the User, or the processing serves the establishment, exercise or defence of legal claims. The User may object to data processing for the purpose of direct marketing at any time without any particular grounds being required.
23.2 Right of Access
The User has the right to obtain from Lotum, free of charge, information on the personal data concerning the User stored at Lotum, the purposes of the processing, their origin, which disclosures have been made to which recipients or categories of recipients, the storage period and the data subject rights available to the User.
23.3 Right to Rectification, Erasure and/or Restriction of Data Processing
The User also has the right to demand at any time the rectification of inaccurate data, the erasure and/or, under the statutory conditions, the restriction of the processing of the personal data stored about the User. The right to erasure exists only to the extent that Lotum is not subject to a statutory retention obligation and that there are no other reasons within the meaning of Article 17 (3) GDPR that prevent the erasure. Insofar as this includes personal data that are necessary for the provision of services to the User, the erasure or restriction of the processing of such data may only be carried out once the User no longer uses Lotum's offer.
23.4 Right to Data Portability
If the User provides data concerning the User and Lotum processes these data on the basis of the User's consent or for the performance of a contract, the User may request to receive these data from Lotum in a structured, commonly used and machine-readable format or that Lotum transmits these data to another controller, where this is technically feasible (so-called right to data portability).
23.5 Right to Withdraw Consent
All consents to the use of personal data declared by the User can be freely revoked by the User at any time with effect for the future.
23.6 Right to Lodge a Complaint with a Supervisory Authority
The User may also lodge a complaint with a supervisory authority against data processing which, in the User's opinion, violates the statutory provisions.
24. Changes to this Privacy Policy
24.1 Lotum reserves the right to change this Privacy Policy at any time, and Lotum will always comply with the statutory data protection requirements. Therefore, Lotum recommends that Users regularly take note of the currently applicable Privacy Policy.
Lotum GmbH, Am Goldstein 1, 61231 Bad Nauheim, Germany, games@lotum.de
Data Protection Officer: Susanne Klein, c/o Beiten Burkhardt Services GmbH, Ganghoferstraße 33, 80339 Munich, Germany, privacy@lotum.de