PRIVACY POLICY

The present version of the Privacy Policy is effective since 20.07.2021.

1. Introduction

XS SOFTWARE JSCo (“XS Software”, “we”, “us” or “our”), is a company organized and existing under the laws of the Republic of Bulgaria, with seat and registered address at 78 Alexander Malinov Blvd., Sofia 1799, UIC 200757660, represented by Fix Ltd. through Hristo Dimitrov Tenchev, with e-mail for communication: privacy@xs-software.com.

Thank you for playing our games! Your privacy and security are of great importance to us. We are focused on giving you the best possible experience, while showing consideration to the information you are sharing with us by using our games, which we collectively call “Services”. This policy is meant to give you a detailed description of how we handle your data and how you can manage it.

This Privacy Policy (“Policy”) is applicable for the games developed and supported by XS Software. You can always contact us at privacy@xs-software.com or through our support channels if you have any questions about this Policy, how we treat your data or the exercise of your legal rights regarding said data. This Policy is fully compliant with General Data Protection Regulation (EC) 2016/679 and any other applicable legislation related to personal data processing.

Our Company reviews its Privacy Policy regularly to ensure full compliance with the legislative requirements. Each time you play our games, the current version of the Policy shall apply. Any updates shall be notified with you beforehand. The new version of the Privacy Policy becomes effective from the day it is announced publicly on the official website of XS Software: https://www.xs-software.com/privacy/, the corresponding official websites of the games developed and supported by XS Software and it is updated in the applications accessible for download through Google Play and App Store, unless stated otherwise. Please bear in mind that you should check the effective date of the Policy which appears at the top. If you continue to use the games after the changes have been enforced, we shall consider this acceptance to the modified content. In case you do not agree with the new amendments in the Policy, please contact us for further assistance via email address privacy@xs-software.com.

2. Definitions

For the purpose of the Privacy Policy, the terms shall have the following meaning:

  • „Data Controller“ means XS SOFTWARE JSCo - the legal person which, alone or jointly with others, determines the purposes and means of the processing of personal data;
  • „Personal Data“ means any information relating to an identified or identifiable natural person – data subject (“You” or “User/s”);
  • „Processing“ means any operation or set of operations which is performed on personal data;
  • „Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
  • „Recipient“ means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not;
  • „Personal data breach“ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.

3. Data that we collect

XS Software collects the following data:

  • Information collected for registration – each game provides three possibilities for registration – registration and account set-up on the Game through the XS Software platform, through Facebook or through Google Play / App Store;
    - With the first option we collect email, username, password;
    - With the second option “Facebook Login” we obtain access to Facebook used name, profile picture and email in accordance with the authorization procedures of Facebook.
    - When the game is downloaded through Google Play using “Google Sign-In” and “Google Play Games Services” or App Store using “iOS Game Center”, we obtain access to the user’s device operating system, operating system version and application version in accordance with the authorization procedures of Google Play and App Store;
  • Basic profile information available to other users - username and/or character name, country as well as additional information you explicitly provide yourself for sharing with other users;
  • Payment identification information when purchasing premium items in our service - country, IP address, billing address, msidns, transaction ids, telephone numbers and dates of payments;
  • Game activity information –profile pictures or avatars;
  • Customer support information – name, email address, further contact details, screenshots containing personal data and any additional information which the user has decided to disclose to XS Software for customer support;
  • Information about your progress in the game - experience gained, items purchased, content unlocked, upgrades made, services used, daily rewards, quests, statistics and interactions with other users (voting, duels, fights and any other similar interaction functions on the game) which are linked to the progress in the game;
  • Device information collected during playing - IP address, device data such as device name, unique device identifiers, operating system, browser type, language and country, hardware versions, connection speed, pages visited;
  • Information processed in relation to push notifications – Device operating system and Device IDFA.
  • We use cookies and web beacons (for more information on how they work and what they are used for, please refer to art. 5 of the present Policy);

4. Methods of collection and purposes for the data processing. Lawfulness of processing

We use your information to provide you access to our services, to ensure their proper function, to enrich your user experience and deliver the best quality we are capable of, as well as improving our marketing efforts and business model.

Users directly provide XS Software with most of the data that the controller collects.

We collect the data so that we can:

  • Information collected for registration:
    - to create your account and provide access to our services – the games; the email address is used for account recovery purposes;
    - the processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
  • Basic profile information:
    - feature on the services with which a basic profile is created so that other users can identify the corresponding user and so that the user’s rankings, points, experience, items can be shared with other users viewing the profile;
    - the processing is necessary for the performance of a contract to which the data subject is party;
  • Payment identification information:
    - to comply with tax regulations in different countries; to verify and confirm payment transaction of premium items; to ensure fairness and prevent frauds with premium items purchase; we do not collect and process payment information such as credit/debit card information – this information is collected by the corresponding payment service provider depending on the payment method of choice and therefore, different third-party policies apply for this personal data;
    - the processing is necessary for compliance with a legal obligation to which XS Software is subject and the processing is necessary for the performance of a contract to which the data subject is party;
  • Game activity information:
    – to provide functionalities within the service with which users can communicate with each other in our games;
    - the processing is necessary for the performance of a contract to which the data subject is party;
  • Customer support information:
    - to provide user support;
    - the processing is necessary for the performance of a contract to which the data subject is party and for the purposes of the legitimate interests pursued by XS Software – provision of support and responses to Users questions with the purpose of ensuring the correct provision and improvement of our service;
  • Information about your progress in the game:
    - to provide functionalities within the service with which users can unlock new levels, features, participate in competitions, etc.;
    - the processing is necessary for the performance of a contract to which the data subject is party;
  • Device information collected during playing:
    - to provide a stable, secure and pleasant experience for users on our games; to ensure the performance, correctness, security and reliability of our services;
    - the processing is necessary for the performance of a contract to which the data subject is party;
  • Information processed in relation to push notifications:
    - to send push notifications to your device in order to provide service activity information, service updates, promotional communications and other related messages;
    - the data subject has given consent to the processing of his or her personal data for the above-mentioned purposes through an opt-in; the consent can be withdrawn at any time through your profile settings or contacting our support.

XS Software may also receive your data indirectly from the following sources:

  • from Facebook or Google Play / App Store - to create your account and provide access to our services – the games;
  • from Apple App Store, AppsFlyer - a tracking platfrom, we can get information such as device id, payments and so forth but we can’t connect none of these to a person.
  • from payment service providers in relation to payment identification information;

The above-mentioned personal data are collected and processed only for the purposes for which they are originally collected. In case of change in the purposes or means of their processing, we will contact you by providing you with additional information about the legal basis, purposes and means of processing your personal data.

5. Retention period

We retain your data for as long as your account is active or is needed for providing you with our services.

In order to comply with tax regulations your payment data is retained for 5 years according to the Tax and Insurance Procedure Code of the Republic of Bulgaria.

Once the time period has expired, we will delete all personal data and existing copies unless Union or Member State law requires storage of the personal data. We may hold on to your data for extended periods of time in order to comply with laws, legal requests, governmental investigations, or investigations of possible violations of our terms and policies, or otherwise prevent harm.

We take all necessary steps to delete the personal data from all production information systems and all backup systems according to our retention schedule and technical mechanisms available. We delete personal data associated with gaming accounts that are defined as inactive. Inactive accounts are accounts that have not recorded a single login for a period of six months or longer.

6. Cookies and web beacons

6.1. Cookies

Cookies are under the form of text files, representing small pieces of data that are stored on your device. They allow recognition of the browser and storage of certain information. You can receive more information about the types of cookies we use in the table below.

There are four main groups of cookies we use in our services according to their purpose:

  • Strictly necessary cookies - they are compulsory for the maintenance and right operation of our services;
  • Functional cookies – they are collected with the purpose of personalizing the user experience with our services;
  • Analytics cookies – collection of information for the interaction of users with our services including number of visits on our platform, where do the users come from to our platform, the number of users on the platform, etc. for the purpose of improving the performance, marketing efforts and quality of our services;
  • Advertising and marketing cookies.

According to their duration, Session cookies - we use session cookies to identify you temporary. These are a specific type of cookies only stored during the active usage and once you stop using our service by logging out, closing your browser or closing the mobile application the data is being erased;

Persistent cookies – these cookies remain on your hard drive until you erase them or your browser erases them depending on the cookie’s retention period and expiration date.

Strictly necessary cookies
Type of cookies Purposes First-party or third-party cookies Session or persistent Retention period
PHPSESSID to store user information that allows a user to play First-party Session Until termination of the session
Functional cookies
Type of cookies Purposes First-party or third-party cookies Session or persistent Retention period
valid_user autologin last_game_domain gateUrl access cookie_mail cookie_world KNW_LLW to provide a “Remember Me” feature, which allows you to login to our services without providing your username or password First-party Persistent 1 month
lp_custom_lang to store preferences inside our services as of language choices First-party Persistent 12 months
chatLastHeightValue chatLastWidthValue to store preferences inside our services as of menu positions First-party Persistent 10 days
new-lady-events to store preferences inside our services as of content personalization First-party Persistent 1 day
cookieconsent_dismissed to store preferences inside our services as of menu positions First-party Persistent 12 months
Analytics cookies
Type of cookies Purposes First-party or third-party cookies Session or persistent Retention period
__utma, __utmb, __utmc, ..., __utmz how people interact with the certain game -_utmz records where the visitor came from (a search engine, a link, etc.) -_utma stores the amount of the user’s visits -_utmb and _utmc are used to check the retention period on the game Third-party cookie - Google Analytics Persistent Third-party cookie
Advertising and marketing cookies
Type of cookies Purposes First-party or third-party cookies Session or persistent Retention period
Only applicable for the mobile versions through Google Play / Apple App Store/ Huawei App Gallery Serving personalized ads, frequency capping, aggregated ad reporting, and to combat fraud and abuse. Third-party cookies via Google AdMob Session Third-party cookie

The strictly necessary cookies are not an object of consent by users because they are required for the normal operation of our services. You can provide your consent for the use of the other types of cookies with a click on the button “I accept and agree” in the cookie banner which is situated at the bottom of the screen.

For more information regarding Google AdMob please review Google’s Privacy and Terms at https://policies.google.com/technologies/partner-sites.

All of the third-party solutions adhere to the latest data protection laws and best practices.

Every visitor can control/ restrict and even delete the cookies, stored on their technical devices by following the necessary steps according to the settings to the devices. You can install different programs for the browsers you use to block cookies. In case you make any of these actions, it is possible that you may have to manually adjust them to your preferences. Please note that the restriction or refusal to use cookies may affect the full potential and use of our service. Please bear in mind that by blocking cookies, you may not be able to use certain features on the service, which is not recommended.

6.2. Web beacons

Web beacons, also known as “tracking pixels” are small images which show the journey of the user, the virtual path the user passes through. We use web beacons to determine the link through which you got to our service and to, therefore, measure our marketing campaign usage and effectiveness, count visits, as well as tracking whether an email has been opened.

We collect the following non-identifiable information through web beacons: a statistical number of users that have arrived to our services from other portals.

7. Social sharing features

Our services may offer social sharing features and other tools such as the “Facebook Like” button, which lets you share data generated by using our services in “Facebook”. The use of such features and how they handle your data depends on the privacy policies of the social network in question.

8. Storage of personal data

We collect and store your personal data on the territory of the European Economic Area (EEA). In case the personal data is transferred to a country outside the EEA, We shall enforce all necessary measures to protect and guarantee the personal data’s safety.

9. Your rights and how you can exercise them

You have the right to:

  • Withdraw your consent for the personalized ads and/or the push notifications;
  • Request access to the personal data that we hold about you in a portable format;
  • Request correction of any collected personal data when the data is inaccurate;
  • Receive a copy of your personal data in electronic format;
  • You have the right to request the deletion of your data – “the right to be forgotten”, which right, however, is not absolute (exceptions – the personal data holds is needed to exercise the right of freedom of expression; there is a legal obligation to keep that data; for reasons of public interest);
  • Receive information from us about our activities in connection to your personal data, including the purposes of collection and storage, the period of time for storage, the methods of collecting, the presence of automated processing, etc.;
  • Receive your data and transfer them to another controller;
  • You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that there is personal data breach.

To exercise your rights you can always contact us at privacy@xs-software.com or through the support channels of the service you are using. You can also send us a letter to 78 Alexander Malinov Blvd., Sofia 1799, Bulgaria.

For managing your account information you can use the profile settings feature in our services.

We will respond to all privacy related requests in a timely fashion. If you have an unresolved privacy or data use concern you may contact your local data protection authority.

10. How is this data shared?

10.1. Information shared with the purpose of providing the services

When you register for our services, we create a basic profile which is available to other users. Information shared may include your username and/or character name, country as well as additional information you explicitly provide yourself for sharing with other users. Additionally with the usage of our services data such as rankings, points, experience, items and similar may be shared with other users viewing your profile.

In addition, we share your personal data with third parties - recipients with the purpose of providing the services. We share your personal data with our partners, including third-party gaming platforms on which our games are available with the purpose of complying with contractual obligations with the partners, monitoring and verifying the usage of our services and evaluate the marketing efforts from our and our partner’s sides.

For more information on our partners, their privacy policies and the undertaken obligations according to GDPR, please contact us at privacy@xs-software.com.

10.2. Information that is shared to protect our services and comply with the laws

We reserve the right to share your data when we have a good-faith believe that the law requires us to do so, when it is necessary to prevent, detect and address fraud, unauthorized use of our services, violations of our terms and conditions or other harmful illegal activity, to protect our users.

In this connection, we may share your personal data with third parties – recipients, under the following special circumstances:

  • With the purpose of complying with a legal requirement, judicial proceeding, court order or legal process served on XS Software or its affiliates;
  • With the purpose of investigating a possible crime, such as fraud or identity theft;
  • to Public Authorities in accordance with their legal obligation for the exercise of their official mission, such as tax and customs authorities, financial investigation units, independent administrative authorities, etc.;
  • in connection with the sale, purchase, business transition under any form, merger, dissolution, reorganization, liquidation of XS Software; we may have to disclose the information you have given us to the successor who is part of the transition;
  • when we believe it is necessary to protect the rights, property or safety of XS Software or other persons; or
  • as otherwise required or permitted by law, including any contractual obligations of XS Software.

      • 11. Measures

      We undertake all necessary technological, technical and organizational measures to protect your personal data. Your personal data is stored on protected servers with a strictly controlled access. Only strictly defined people have access to your personal data in connection to the provision of our services.

      Our services have SSL certificates which represent Internet security protocols and they provide additional guarantee for the safe use of our services.

      We implement other appropriate technical and organizational measures to ensure a level of security appropriate to the risk such as pseudonymisation and encryption of personal data, we ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services and we regularly test and evaluate the effectiveness of the measures.

      Some of the above-mentioned information is stored in such a form that could not be used to identify you directly.

      In case of breach, we will undertake every possible action according to the applicable legislation in an appropriate and timely manner, to avoid any material or non-material damage to users and to protect the personal data of users. We have undertaken measures to ensure the ability to restore the availability and access to personal data in a timely manner in the event of physical or technical incident.

      12. Children and our services

      Our services are not directed towards children and you may not use them if you are under the age of 18 for the territory of Bulgaria and for any other country – if you have not reached full legal capacity in accordance with the legislation applicable for the corresponding country.

      We do not knowingly collect, target or allow the use of our services to persons under the above-mentioned age of full legal capacity.

      If you are under the age of full legal capacity, please do not use our services and do not send us any personal data. If you believe that we might have any data from or about a child under the age of 18, please contact us.

      We will delete all personal data of the above-mentioned persons for which we become aware that they do not have the necessary legal capacity.

      We shall not be held liable for providing incorrect and false data for the completed years.

      13. Supervisory authority

      The local supervisory authority on the territory of the Republic of Bulgaria regarding personal data questions is:

      Commission for personal data protection, address: Sofia, 1592, 2 Tsvetan Lazarov boulevard, tel.: +359 2 915 3580 Fax +359 2 915 3525, e-mail: kzld@cpdp.bg, website: http://www.cpdp.bg/.

      If you have any questions regarding the present Policy, please connect to us through email address: privacy@xs-software.com.

      ENJOY OUR SERVICES AS MUCH AS WE DO!