Privacy Policy

Privacy information specific to ExoStats

ExoStats is a noncommercial fan project made by Luc Gommans, who can be contacted via lucgommans.nl/email

Personal data processed by ExoStats is:

1.
From:	Exoracer.
What:	Your player ID, public nickname, and accompanying statistics such as your highscores or uploaded level data.
Why:	To provide fun statistics to players and allow them to discover your published content such as any levels you uploaded.
Basis:	The performance of a task carried out in the public interest (GDPR article 6(1)(e)), where the specific public interest is the "historical research purposes or statistical purposes in accordance with Article 89(1) of the GDPR" (via Geoffrey Caesar)

2.
From:	You.
What:	Your email address.
Why:	For the purpose(s) mentioned on the page where you entered the email address.
Note:	Unsubscribed (blocked) email addresses still need to be stored because otherwise I cannot know that no emails must be sent when someone enters it again.
Basis:	You want me to (GDPR article 6(1)(b))

3.
From:	You.
What:	Access logs which contain the originating IP address, date and time of access, which page was visited, and the user agent string that your browser sent with the page request.
Why:	Debugging the service, tracking abuse, and viewing aggregate popularity statistics. Sometimes a page is annoying to maintain or heavy for the server and almost never used, in which case it helps to know that nobody needs it anyway.
Basis:	I want to (GDPR article 6(1)(f)) and it is not overriden by your interests or fundamental rights and freedoms

Logging in works via a cookie, containing a random value linked to your account ID, which is set when you successfully log in via Exoracer.

Recipients of the information are:

The information that is publicly visible on the website can be obtained by anyone, also persons outside of GDPR jurisdiction where there are no adequate privacy safeguards such as on Sealand and the unlawful planet of Mars.
The information that is only visible to you, such as your email address or private level categories, is not transferred to any third party.

The storage period is indefinite. It should be noted that all data is either pseudonymous (such as your player ID), chosen to be public by you (such as your player name), or you actively asked me to store it (such as your email address).

Profiling and automated decision-making happens only in publicly visible ways. For example, if you achieve a good time on a level, you get a better player score and may move up into a higher tier. The logic involved in automated decision making can be viewed by pressing the source code link at the bottom of most pages. The "envisaged consequences of such processing for the data subject" is somewhere between "none" and "encouraging one to get better at the game if one enjoys doing that".

Privacy information that is the same on most websites

GDPR article 13(2)(e) requires me to tell you that you are not obliged to provide any data, as well as that failure to provide personal data has no nonobvious consequences (the purpose simply will not be fulfilled).

Privacy information that needs to be repeated on every website

I hereby encourage every data controller to put this basic, unchanging information in a clearly labeled section such that people who have already read this once do not have to hunt for the interesting bits in between a bunch of already-known information.

Cookies are small pieces of information which are stored in your browser. When you load a page, the browser supplies this value to the server, such that the server can identify the visitor or read other preferences and can provide the functionality for which the cookie is required. You can delete identifying cookies by clicking the logout link on any page as well as through your browser settings. After not visiting the website for a while, any cookies will expire and you will need to set them again (for example, by logging in) to regain the functionality.

You have "the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning [yourself] or to object to processing as well as the right to data portability" (GDPR article 13(2)(b)). You can exercise this right by contacting the data controller as specified above.

You have "the right to lodge a complaint with a supervisory authority" (GDPR article 13(2)(d)). A list can presently be found on the website of the European Commission: http://ec.europa.eu/newsroom/article29/document.cfm?doc_id=50061