Privacy Policy

Privacy Policy Last updated: 09.09.2024 

Fortuna Play Loyalty Program Privacy Policy  

Introduction  

Thank you for choosing Fortuna Play. We kindly ask you to thoroughly review this Privacy Policy (“Policy”), as it explains how PLAY FORTUNA YAZILIM ANONİM ŞİRKETİ, a joint stock company registered under the laws of the Republic of Turkiye (“Fortuna Play,” “we,” “us,” “our,” or the “Owner”), collects, processes, shares, and protects your personal information related to our website, mobile app, products, and services (collectively referred to as the “Services,” “Application,” or “Platform”). By accessing or using our website, mobile app, products, or services (jointly called “Services”), you consent to this Policy. This Policy is a part of and incorporated within our Terms of Use. Please note, this Policy does not apply to the use of third-party games accessed through our Services. For such third-party games, data processing is governed by the game developer’s privacy policy, which we advise you to review before using their game and exercising any related rights. It is essential to read and understand our Privacy Policy before using the application. If you disagree with any part of this Privacy Policy, you must immediately cease using our Services. 

Please be aware that Fortuna Play is the data controller responsible for collecting, using, and safeguarding your personal data under this Privacy Policy. You can find the official details and contact information for Fortuna Play below: 

Title: PLAY FORTUNA YAZILIM ANONİM ŞİRKETİ 
Address: TEKKE MAH. 18 MART CAD. Kapı No:7 Daire No : Z12 LAPSEKİ / ÇANAKKALE 

 
Email: [email protected] (please include “Privacy” in the subject line) 

Consent and Age Restrictions  

By selecting the “ACCEPT & CONTINUE” button during the account creation process, you confirm that you have read, understood, and agreed to these terms, at which point you will be referred to as the “User.” If you are under 18 years old or do not agree with these terms, you are not permitted to register or use Fortuna Play. 

Terms Of Use   

This Privacy Policy is integrated into our Terms of Use. By utilizing our Services, you agree to adhere to these terms, which can be found at the bottom of most pages on the Fortuna Play website. 

Updates to This Policy  

We reserve the right to update this Policy at our discretion. Any modifications will be reflected in the “Last Updated” date, and an alert will be displayed in our mobile app. To remain informed, please check this page regularly. If you find any changes unacceptable, you should discontinue the use of our Services. 

It’s crucial to note that Fortuna Play collects and processes your data solely for the purposes clearly defined in this Policy and as permitted by applicable laws. This legal structure protects your privacy and ensures that your data is managed responsibly. 

Fortuna Play provides a clear and detailed overview of its data collection practices to promote transparency and help you navigate the platform with confidence. If you have any questions or need further clarification, feel free to contact us using the information provided in this Policy. 

A. PERSONAL DATA WE COLLECT  

1. Types of Data Collected Directly by Fortuna Play 

“Personal Data,” as referenced in this Privacy Policy, refers to any personally identifiable information about Users of the Platform that is gathered through the Platform and maintained by us in an accessible format. This may include personal identifiers such as first and last names, physical addresses, email addresses, phone numbers, Social Security numbers, or any other information that enables physical or online contact with the User. It also covers any other details about the User that are collected and stored in a personally identifiable format in combination with any of the identifiers mentioned above. 

a. Account Data Collection: 

When you actively engage with Fortuna Play, you provide certain information directly. This includes details shared during the account creation process, such as your name, email address, phone number, account preferences, and other communication-related information. Additionally, we may collect data indirectly from your interaction with our Services, including your IP address, device location when downloading our app, mobile device identifiers, and advertising identifiers. 

For information collected from third-party service providers, please refer to section 4, titled “Service Providers Processing Personal Data on Our Behalf,” within this Privacy Policy. This section clarifies the exact data points we gather from your direct interactions or when you participate in our promotional activities. By understanding this data, you can make informed decisions about your privacy on the platform. 

• Name: We collect both your first and last name when you create a Fortuna Play account. 

• Age: Providing your age helps us ensure that you meet the age requirements and allows us to customize platform features accordingly. 

• Gender (Optional): Sharing your gender information is voluntary, but it helps us personalize your user experience and make relevant recommendations. You can decide whether to provide this information and, if you change your mind, you can opt out at any time through your account settings. 

• Google or Facebook Account: Your Google or Facebook account serves as your primary login credential and communication channel for updates, promotions, and support. When you sign up using these accounts, we collect data such as your email address from these platforms. 

• Profile Picture: If you choose to use your profile picture from Google or Facebook, or upload a new one, it may include personal details such as your image, which can be visible to other users in areas like leaderboards. You have the option to opt-out by removing your profile picture or replacing it with a non-personal image, like an avatar. 

• Phone Number: Your phone number is used for security verification via SMS. With your explicit consent, it may also be used to send you promotional messages. 

• FaceID: Fortuna Play places high importance on the security and integrity of the platform, particularly when it comes to redeeming rewards. To prevent fraud and ensure that rewards are issued legitimately, we use a “video selfie” verification during the redemption process. 

• Account Preferences: Your account settings, such as language preferences or notification options, are collected to tailor and enhance your user experience. 

• Direct Communication: Any information shared with Fortuna Play during email exchanges, support requests, or survey feedback is collected to better understand your needs and improve our customer service. 

• Participation in Promotions: If you choose to participate in Fortuna Play-organized promotions or contests, additional information may be collected, including your username, email address, and other relevant details, as per the specific promotion’s terms and conditions. 

b. Device Data Collection: 

This section of the Fortuna Play User Privacy Policy provides a detailed explanation of the personal data we collect, offering transparency and helping you understand the breadth of information used within the platform. 

• IP Address: We collect your IP address, which helps us identify an approximate location (at the city or country level) and gather other network-related details. 

• Geolocation Data: With your explicit consent, we may collect precise geolocation data, such as longitude and latitude, to offer location-specific services or features. It’s important to note that this data is not continuously tracked, meaning we cannot consistently determine your location. 

• Mobile Device Identifier: We collect unique identifiers linked to your mobile device, such as the International Mobile Equipment Identity (IMEI) or Android advertising ID, for purposes related to device identification and security. 

• Advertising Identifier: Advertising identifiers, like the Google Advertising ID, are used to tailor advertisements and evaluate their performance. You can opt-out of this by adjusting your device settings. 

• Device Information: We gather details about your operating system, device model, and language settings to optimize the platform for your specific device. 

c. User Activity and Interaction Data 

• Log Data: Information about your network connection type, applications connected to the platform, and web pages accessed within the platform is collected for service improvement and security purposes. 

• Gameplay Data: We collect gameplay data, including your progress, playtime, and in-game activity. With your consent, and in accordance with Game Partner policies, we may also collect details on in-game purchases, achievements, and any bugs encountered. The specific data collected may vary by game. We adhere to data protection regulations and recommend reviewing the privacy policies of Game Partners for further details. Additionally, if a friend invites you to use Fortuna Play’s services, they may view limited information about your gameplay for the sole purpose of verifying whether they qualify for invitation benefits. 

• Storage Permission: This allows access to shared external storage for reading and adding items. 

• User Audience Segments: We utilize the data we collect (Log Data, Gameplay Data, Geolocation Data, Account Preferences, Device Information) to create User Audience segments. This enables us to improve services, enhance the app experience, and deliver personalized recommendations and offers that align with user preferences. 

B. WHERE WE STORE PERSONAL DATA  

Based in Germany: 

Your personal data is securely stored on servers provided by Amazon AWS in Germany. However, it may be transferred, stored, or used in other jurisdictions, such as the United States, where some of our service providers are based. 

Protections and Risks: 

While we take care to choose trusted service providers and implement contractual safeguards, the privacy laws in other jurisdictions may differ and provide less protection compared to those in Germany, the United States, or the EEA & UK. Additionally, foreign governments may have access to your information in certain situations. 

GDPR Compliance: 

For data collected in the EEA & UK, we securely transfer and store it in Germany, in compliance with GDPR adequacy standards. Transfers to third countries are carried out using specific legal mechanisms, such as “model clauses.” 

C. Use of Personal Data: 

Data protection laws mandate that we meet specific conditions before processing your personal data in the manner described in this Privacy Policy. Depending on the activities, we will rely on one of the following legal grounds for processing your personal data: 

• You have given us consent. 

• Processing is necessary for our legitimate business interests or those of a third party, provided it does not override your interests or rights. 

• Processing is necessary for compliance with our legal obligations. 

• Processing is required for legal claims. 

• Processing is necessary for reasons of substantial public interest. 

Below, you’ll find more detailed information about how we collect and use your personal data. If we intend to use your personal data for any purposes not covered by this Privacy Policy, we will notify you of the proposed new purposes before using your data in that manner. 

1. Consent 

We request that you provide clear and informed consent for the use of your personal data as outlined in this Privacy Policy when you access the Platform and engage with the Services. If you do not give such consent, please stop using the Services. 

We do not collect or sell personal data in a manner that specifically identifies individuals (i.e., we do not sell Member information). 

With your consent, we may send you marketing information related to our services or products. This can include communication via mail, email, phone, or electronic notifications (based on the communication methods you’ve approved) regarding the services or products you have requested. Additionally, we may send you details about special offers, promotions, research, or similar products and services. If you have provided consent, we may also share your information with our group companies for marketing purposes. You can adjust your marketing preferences at any time through your account settings. 

If our processing of your personal data relies solely on your consent, you can withdraw this consent at any time. However, withdrawing consent may result in restricted access to some or all of the Services on the Platform. It’s important to note that the withdrawal of consent does not affect the legality of any processing that occurred prior to withdrawal, nor does it impact the processing of your personal data based on other lawful grounds. For more details on withdrawing consent, please refer to the “Withdrawal of Consent to Collect Personal Information” section of this Privacy Policy. 

2. Legitimate Interest 

In certain situations, our collection and use of your personal data may not rely on your explicit consent but rather on our legitimate interests. We have a legitimate interest in collecting your personal data because it provides essential information for us to deliver our Services to you and to keep our Platform operational. 

To ensure fairness, we conduct a balancing test to weigh our legitimate interests (such as providing access to the Platform) against your personal rights and interests under applicable data protection laws, such as the Delaware Online Privacy and Protection Act. This includes your right to not have your personal data sold to third-party marketing companies without your consent. The result of this balancing test determines whether we are justified in using your personal data in the ways outlined in this Privacy Policy. We always take your interests seriously and carefully consider them during this process. 

Our primary legitimate interests include: 

• Tailored Experiences: Using the data we collect, Fortuna Play personalizes your experience by recommending games and features that match your preferences. 

• Rewarding Engagement: Active use of game partner applications within the platform results in rewards that are provided through the Fortuna Play program. 

• Service Enhancement: Data is essential for monitoring game installations, managing in-app gift card redemptions, and improving the overall user experience. 

• Strategic Marketing: Fortuna Play utilizes collected data to effectively promote its services across various platforms. 

• Engaging Events: Personalization extends to participation in contests, sweepstakes, and other digital events, culminating in winner selection. 

• Operational Efficiency: Accurate data collection enables game install attribution and effective management of the reward program. 

• Security and Fraud Prevention: To ensure platform safety and prevent fraudulent activities, we utilize relevant data points. 

• Face Verification for Security and Fraud Prevention: This process captures a short video of your face using our trusted third-party face verification technology. The video generates a mathematical representation of your facial features, creating a unique identifier linked to your account. This video selfie is encrypted on your device and securely transmitted to our servers for processing. This step ensures: 

• User Registration Uniqueness: We prevent duplicate accounts and verify legitimate participation. 

• Fraud Prevention: It deters the use of bots, automated processes, or unauthorized software from exploiting the rewards system. 

• Reward Security: By verifying users, we ensure that rewards are issued only to legitimate participants. 

This verification aligns with Fortuna Play’s goal of providing a secure and fair platform. Understanding this process allows you to engage confidently and enjoy the rewards you’ve earned. 

• Product Development and Innovation: Data insights help us develop new products and improve existing services. 

• Data-Driven Reporting: Aggregated and anonymized data allows us to generate valuable reports that drive optimization across the platform. 

• Effective Communication: Understanding user preferences helps Fortuna Play customize communication channels and enhance their relevance. 

• Machine Learning for Personalization: Data supports the creation of machine learning models that offer a personalized content experience for each user. 

3. Contractual Performance 

When you become a User of the Platform, you enter into a contractual relationship with us through the Terms of Use, which you accept by using our Platform. This relationship requires us to process, use, and store your personal data in order to fulfill our contractual obligations and to exercise our contractual rights. Therefore, the contractual relationship itself serves as the legal basis for processing your personal data at this stage. 

4. Legal Obligations and Legal Claims 

We are authorized to process your personal data when it is necessary to comply with our legal obligations. Additionally, we are permitted to process your data if it is necessary to establish, pursue, or defend a legal claim. 

We may disclose your personal data to third parties without your consent if we believe it is necessary to identify, contact, or take legal action against someone causing harm or interference with our rights or property, other users of the Services, or others (including the rights or property of others) that may be affected by such activities. We may also disclose personal data when we believe, in good faith, that such disclosure is required by law. 

5. Substantial Public Interest 

We are allowed to process your personal data when it is necessary for reasons of substantial public interest, as outlined by data protection laws. 

a. Automatic Collection: 

Please note that certain information, as mentioned in section 1 titled “Personal Data We Collect,” is automatically gathered when you access and use our Services. This includes: 

• Aggregated usage information 

• Session ID 

• Access time and date 

• Device data 

b. Push Notifications: 

Our Services may send push notifications to you to fulfill the purposes outlined in this Privacy Policy. In most cases, you can opt-out of receiving push notifications by adjusting your device settings, such as the notification settings for mobile devices. Please be aware that disabling push notifications may affect the functionality of the Application. 

c. Children’s Data Privacy Protection: 

Fortuna Play prioritizes safeguarding the privacy of children. We do not knowingly collect personal data from individuals under the age of 18. By using the Platform, you confirm that you are at least 18 years old. If it comes to our attention that personal data from users under 18 has been collected due to misrepresentation of age, we will deactivate the account and take appropriate actions to delete the data from our records. If you become aware that we have collected information from a child under 18, please contact us at [email protected]. 

Important notes: 

• This Policy does not cover the data practices of third-party games accessed via Fortuna Play. 

• Children under 18 are not allowed to use the Platform. 

• Fortuna Play retains data as required by law, for as long as you actively use the service, or for its originally intended purposes. 

• More information on the use of cookies and other tracking technologies can be found in the separate Cookie Notice. 

d. External Links: 

Our Services may contain links to external websites or apps, such as the Google Play Store, which are managed by third parties. These third-party sites have independent privacy practices. Please review their privacy policies to understand how they manage your personal data. 

e. Withdrawal of Consent to Collect Personal Information: 

If you wish to withdraw your consent for us to collect your personal information, you can submit a written request to [email protected]. Once we receive your request, we will: 

• Stop Processing: Cease processing your personal information within a reasonable timeframe. 

• Effects of Withdrawal: Be aware that withdrawing consent may affect your ability to use the Services, including the potential loss of benefits such as loyalty points. Withdrawal of consent will not impact the legality of prior processing based on consent, nor will it affect the processing of your personal data on other lawful grounds besides consent. 

• Account Deletion: You may also request the deletion of your account. If you choose to do so, any unredeemed loyalty points will be erased, and we will send an email to confirm your account deletion (please refer to the Data Retention section above). 

f. Promotional Communications: 

If you have provided explicit and separate consent, we may send you promotional communications. You can opt out of receiving these messages at any time by following the unsubscribe instructions provided. Please note that even if you opt out of promotional communications, you may still receive non-promotional messages related to your account, requested Services, or ongoing business with Fortuna Play. 

E. SERVICE PROVIDERS PROCESSING PERSONAL DATA ON OUR BEHALF 

We may employ contractors and service providers to process personal data on our behalf, as described in this Privacy Policy. These service providers are contractually obligated to maintain the confidentiality and security of your data, and they are not permitted to disclose it without our authorization or use it for their own purposes. However, if you have a separate relationship with these providers, their privacy policies will govern that relationship. 

a. Advertising: 

These services allow user data to be used for advertising purposes. Advertisements, such as banners, may be displayed on the platform based on user interests. Not all personal data is used for these purposes. Some services may use trackers or behavioral retargeting, meaning ads are shown based on user activities inside and outside of this application. You can opt-out via the Network Advertising Initiative’s opt-out page or through device settings. 

AdMob (Google Ireland Limited): 

• Data processed: Tracker; usage data 

• Place of processing: Ireland 

• Google’s Partner Policy 

• Privacy Policy | Opt Out 

Adgem: 

• Data collected: Cookies, web server logs, device information, SDK information. 

• Place of processing: United States 

• Privacy Policy 

Facebook Audience Network (Facebook Ireland Ltd): 

• Data processed: Tracker, unique device identifiers for advertising (e.g., Google Advertiser ID or IDFA); usage data. 

• Place of processing: Ireland 

• Facebook Data Policy 

• Privacy Policy | Opt Out 

Adjust (Adjust GmbH): 

• Data processed: Tracker; usage data. 

• Place of processing: Germany 

• Privacy Policy | Opt Out 

AdColony (AdColony, Inc.): 

• Data processed: Tracker; usage data. 

• Place of processing: United States 

• Privacy Policy | Opt Out 

Tapjoy (Tapjoy, Inc.): 

• Data processed: Tracker; usage data. 

• Place of processing: United States 

• Privacy Policy | Opt Out 

Liftoff (Liftoff Mobile, Inc.): 

• Data processed: Tracker; usage data. 

• Place of processing: United States 

• Privacy Policy | Opt Out 

PubMatic (PubMatic, Inc.): 

• Data processed: Tracker; usage data. 

• Place of processing: United States 

• Privacy Policy | Opt Out 

Smaato (Smaato, Inc.): 

• Data processed: Tracker; usage data. 

• Place of processing: United States 

• Privacy Policy | Opt Out 

TripleLift (TripleLift, Inc.): 

• Data processed: Tracker; usage data. 

• Place of processing: United States 

• Privacy Policy | Opt Out 

Unruly (Unruly Group Ltd): 

• Data processed: Tracker; usage data. 

• Place of processing: United Kingdom 

• Privacy Policy | Opt Out 

InMobi: 

• Data processed: Tracker; usage data. 

• Place of processing: India 

• Privacy Policy | Opt Out 

Mintegral (Mintegral International Ltd.): 

• Data processed: Tracker; usage data. 

• Place of processing: China 

• Privacy Policy | Opt Out 

AppLovin (AppLovin Corporation): 

• Data processed: Tracker; usage data. 

• Place of processing: United States 

• Privacy Policy | Opt Out 

myTarget (MGL MY.COM (CYPRUS) LIMITED): 

• Data processed: Tracker; usage data. 

• Place of processing: Russia 

• Privacy Policy | Opt Out 

DT Exchange (Digital Turbine Inc.): 

• Data processed: Tracker; usage data. 

• Place of processing: United States 

• Privacy Policy | Opt Out 

Pangle (Bytedance Pte. Ltd.): 

• Data processed: Tracker; usage data. 

• Place of processing: Singapore 

• Privacy Policy | Opt Out 

Google Ad Manager (Google Ireland Limited): 

• Data processed: Tracker; usage data. 

• Place of processing: Ireland 

• Privacy Policy |  

Google AdSense (Google Ireland Limited): 

• Data processed: Tracker; usage data. 

• Place of processing: Ireland 

• Privacy Policy | Opt Out 

Unity Ads (Unity Technologies ApS): 

• Data processed: Tracker; usage data. 

• Place of processing: Denmark 

• Privacy Policy | Opt Out 

Aarki (Aarki Inc.): 

• Data processed: Tracker; usage data. 

• Place of processing: United States 

• Privacy Policy | Opt Out 

Fluct (Fluct Inc.): 

• Data processed: Tracker; usage data. 

• Place of processing: Japan 

• Privacy Policy | Opt Out 

Vungle: 

• Data processed: Tracker; usage data. 

• Place of processing: United States 

• Privacy Policy | Opt Out 

Chartboost (Chartboost Inc.): 

• Data processed: Tracker; usage data. 

• Place of processing: United States 

• Privacy Policy | Opt Out 

Ironsource (Ironsource Mobile Ltd.): 

• Data processed: Tracker; usage data. 

• Place of processing: Israel 

• Privacy Policy | Opt Out 

This completes the section on service providers processing personal data on our behalf for advertising purposes. 

b. Analytics 

The services in this section allow the Owner to monitor and analyze web traffic and track User behavior. 

Google Analytics for Firebase (Google Ireland Limited): Google Analytics for Firebase (also known as Firebase Analytics) is an analytics service provided by Google Ireland Limited. Firebase Analytics may share data with other Firebase tools such as Crash Reporting, Authentication, Remote Config, or Notifications. Users can opt out of certain Firebase features via device settings (e.g., device advertising settings). 

• Personal Data processed: Application opens; application updates; device information; geography/region; in-app purchases; launches; number of sessions; number of Users; operating systems; session duration; tracker; unique device identifiers for advertising (Google Advertiser ID or IDFA); usage data. 

• Place of processing: Ireland 

• Privacy Policy 

Flurry Analytics (Flurry, Inc.): Flurry Analytics, provided by Yahoo! Inc., is a mobile app analytics service that collects various information about your device. Users may opt out by providing their MAC address or device identifier, stopping Flurry from tracking data across all applications in its network. 

• Personal Data processed: Tracker; usage data; various types of data as specified in the privacy policy. 

• Place of processing: United States 

• Privacy Policy | Opt Out 

Facebook Analytics for Apps (Facebook Ireland Ltd): Facebook Analytics for Apps is a service provided by Facebook Ireland Ltd. 

• Personal Data processed: Usage data; various types of data as specified in the privacy policy. 

• Place of processing: Ireland 

• Privacy Policy 

Unity Analytics (Unity Technologies ApS): Unity Analytics is an analytics service for mobile games provided by Unity Technologies ApS. 

• Personal Data processed: Usage data; various types of data as specified in the privacy policy. 

• Place of processing: Denmark 

• Privacy Policy 

Yandex Metrica (YANDEX, LLC): Yandex Metrica is an analytics and heat mapping service by YANDEX, LLC that shows which areas of the app users interact with most. 

• Personal Data processed: Tracker; usage data. 

• Place of processing: Russian Federation 

• Privacy Policy 

Facebook Ads Conversion Tracking (Facebook pixel) (Facebook Ireland Ltd): Facebook Ads conversion tracking (Facebook pixel) is an analytics service by Facebook Ireland Ltd, connecting data from the Facebook advertising network with actions taken on this Application. It tracks conversions from Facebook, Instagram, and Audience Network ads. 

• Personal Data processed: Tracker; usage data. 

• Place of processing: Ireland 

• Privacy Policy 

Beta Testing 

This service allows the Owner to manage user access to the app for testing purposes. Providers may automatically collect crash data and usage statistics. 

Google Play Beta Testing (Google Ireland Limited): Google Play Beta Testing is a service that manages beta testing for Android apps. 

• Personal Data processed: Country; device information; device logs; tracker; usage data; various types of data as specified in the privacy policy. 

• Place of processing: Ireland 

• Privacy Policy 

TestFlight (Apple Inc.): TestFlight is a beta testing service for iOS apps, provided by Apple Inc. 

• Personal Data processed: App information; country; device logs; tracker; usage data; various types of data as specified in the privacy policy. 

• Place of processing: United States 

• Privacy Policy 

c. Content Performance and Features Testing (A/B Testing) 

These services allow the Owner to track and analyze user responses to changes in the app’s structure, text, or other components. 

Firebase Remote Config (Google Ireland Limited): Firebase Remote Config is an A/B testing and configuration service provided by Google Ireland Limited. 

• Personal Data processed: Various types of data as specified in the privacy policy. 

• Place of processing: Ireland 

• Privacy Policy 

AppLovin (AppLovin Corporation): AppLovin is an analytics and marketing service that collects data related to app usage. 

• Personal Data processed: Country; device information; device logs; tracker; usage data; various types of data as specified in the privacy policy. 

• Place of processing: United States 

• Privacy Policy 

Appsflyer (AppsFlyer Limited): Appsflyer is an analytics and marketing service provided by AppsFlyer Limited. 

• Personal Data processed: Country; device information; device logs; tracker; usage data; various types of data as specified in the privacy policy. 

• Place of processing: United States 

• Privacy Policy 

d. Handling Payments: 

Unless otherwise specified, this Application processes payments via external payment service providers (such as credit card or bank transfers). Users typically provide their payment details directly to these service providers, and this Application does not collect or process that payment information. The Application is only notified by the relevant payment service provider whether the payment was successfully completed. 

• RevenueCat (RevenueCat, Inc.): 
  RevenueCat is a payment service used to monitor and analyze user purchase history, as well as track user behavior. 

• Personal Data processed: Application opens; device information; tracker; unique device identifiers for advertising (e.g., Google Advertiser ID or IDFA); usage data. 

• Place of processing: United States – Privacy Policy | Opt Out 

• Payments via Apple App Store (Apple Inc.): 
  Apple App Store processes payments related to app purchases or in-app purchases. Apple handles personal data required for completing the payment. 

• Personal Data processed: Payment information. 

• Place of processing: United States – Privacy Policy 

• Payments via Google Play Store (Google Ireland Limited): 
  Google Play Store processes payments for app purchases or in-app purchases. Google manages the personal data required for completing the payment. 

• Personal Data processed: Payment information. 

• Place of processing: Ireland – Privacy Policy 

• Payments via Paypal (Paypal Holdings, Inc.): 
  Paypal handles in-app purchases for the platform. 

• Personal Data processed: Payment information. 

• Place of processing: United States – Privacy Policy 

e. Hosting and Backend Infrastructure: 

This type of service hosts data and files necessary for the application to run, distribute, and provide infrastructure support for specific features. Some services may operate on geographically distributed servers, making it difficult to determine where data is stored. 

• Amazon Web Services (AWS) (Amazon Web Services, Inc.): 
  AWS provides hosting and backend services for the Application. 

• Personal Data processed: Various types of data as specified in the privacy policy of the service. 

• Place of processing: United States – Privacy Policy 

f. Infrastructure Monitoring: 

These services enable the Application to monitor its performance, operation, maintenance, and troubleshoot issues. The data processed depends on the mode of implementation of the service and its function in filtering activities within the Application. 

• Firebase Performance Monitoring (Google Ireland Limited): 
  Firebase Performance Monitoring is a service that tracks performance and operational data. 

• Personal Data processed: Various types of data as specified in the privacy policy of the service. 

• Place of processing: Ireland – Privacy Policy 

• Crashlytics (Google Ireland Limited): 
  Crashlytics is a monitoring service that helps track and resolve crashes in the Application. 

• Personal Data processed: Crash data; device information; universally unique identifier (UUID). 

• Place of processing: Ireland – Privacy Policy 

g. Managing Contacts and Sending Messages: 

This service allows the Owner to manage a database of email, phone contacts, or other contact information to communicate with Users. These services may also collect data related to when messages were viewed or interacted with, such as link clicks. 

• Firebase Notifications (Google Ireland Limited): 
  Firebase Notifications is a message-sending service integrated with Firebase Analytics to target audience segments based on analytics and track message opens and conversion events. 

• Personal Data processed: Various types of data as specified in the privacy policy. 

• Place of processing: Ireland 

• Privacy Policy 

h. Platform Services and Hosting: 

These services provide key infrastructure for hosting and running the main components of the Application, allowing it to function as a unified platform. They include various tools for analytics, user registration, commenting, database management, e-commerce, and payment processing, all of which involve the collection and processing of Personal Data. Some services may operate through geographically distributed servers, making it difficult to determine where the data is stored. 

• Apple App Store (Apple Inc.): 
  The Application is distributed through the Apple App Store, and Apple collects basic analytics and reporting data on app performance and usage. Users can opt out of analytics tracking through their device settings. 

• Personal Data processed: Usage data. 

• Place of processing: United States 

• Privacy Policy 

• Google Play Store (Google Ireland Limited): 
  The Application is also distributed through the Google Play Store, where Google collects usage and diagnostics data and shares aggregated data with the Owner. Users can opt out of this feature through device settings. 

• Personal Data processed: Usage data. 

• Place of processing: Ireland 

• Privacy Policy 

i. Social Features: 

• Firebase Dynamic Links (Google Ireland Limited): 
  Firebase Dynamic Links is a social feature that tracks user journeys to and within the Application, informing the Owner of the user’s interactions. 

• Personal Data processed: Various types of data as specified in the privacy policy. 

• Place of processing: Ireland 

• Privacy Policy 

• Firebase Invites (Google Ireland Limited): 
  Firebase Invites allows Users to share the Application through referral codes, emails, or SMS. The sharing activity is tracked via Google Analytics for Firebase. 

• Personal Data processed: Various types of data as specified in the privacy policy. 

• Place of processing: Ireland 

• Privacy Policy 

Further Information About Personal Data: 

Push Notifications: 
This Application may send push notifications to Users to fulfill the purposes described in this Privacy Policy. Users can typically opt out of receiving these notifications by changing their device’s notification settings. However, disabling push notifications may affect the Application’s functionality. 

F. DELETION AND RETENTION 

We retain your personal data for as long as necessary to fulfill the purposes for which it was collected and for a reasonable period thereafter, in compliance with legal, audit, or contractual obligations. Additionally, we retain data where we have a legitimate interest, such as for legal or business purposes. We will use your information as necessary to comply with legal requirements, resolve disputes, and enforce agreements. 

• Deletion: We securely delete your data by shredding physical documents and irreversibly deleting electronic files. Inactive accounts may be terminated after one year, and the associated data will be destroyed. 

• Retention: Fortuna Play will retain personal data only as long as required by law, for as long as you use the Services, or as long as necessary for the purposes for which the data was collected. After an account deletion, we may retain data for an additional twelve (12) months for administrative purposes. We may also anonymize data and use it for legitimate business purposes, such as compliance with tax laws. 

• Request to Delete: You can request your account to be deleted by contacting us through the communication channels provided in this Privacy Policy. Upon account deletion, any accumulated loyalty points or similar benefits will also be deleted. If we retain de-identified information, it will remain anonymized, and we will not attempt to re-identify you. For data held by Game Partners, you must contact them as outlined in their respective privacy policies. 

G. DISCLOSURE OF YOUR PERSONAL DATA 

While Fortuna Play handles your data with care, there are circumstances where data sharing is necessary. Please review the “Use of Personal Data” section for more information. These scenarios include: 

• Corporate Affiliates and Transaction Parties: We may share data with subsidiaries, affiliates, or parties involved in corporate transactions, in accordance with legal agreements and data protection regulations. 

• Legal and Security Considerations: Fortuna Play may disclose personal data to protect legal rights, prevent fraud, manage risks, or comply with legal obligations. Such disclosures will be made responsibly and in accordance with the law. 

• Service Providers: We work with trusted service providers for various functions, including customer support, technical infrastructure, reward management, system security, and marketing. These providers are contractually obligated to uphold Fortuna Play’s data protection standards. They may combine the data we provide with other data they collect about you, including data from your independent use of their services. 

• Advertising and Marketing: We collaborate with advertising platforms to display targeted ads, conduct advertising analytics, and manage our advertising on other platforms. To tailor ads and limit their frequency, we may share personal data, such as device IDs and IP addresses, with these platforms. 

• Marketing Vendors: We partner with marketing vendors to carry out campaigns, surveys, events, and tests. If you participate, your data may be shared with these vendors, subject to applicable laws. You maintain the right to opt out. 

• Analytics Insights: By partnering with analytics providers, we gain valuable insights into user trends and behavior, aiding in sales optimization, service enhancement, and product development. 

• Game Partners: Fortuna Play shares certain data with partnering game developers and their measurement partners for purposes like personalized content, marketing, business growth, game install attribution, and reporting. When accessing games via Fortuna Play, your data may be shared with the respective Game Partner in accordance with their privacy policy. 

H. DATA SECURITY 

We prioritize the security of your personal data and use commercially reasonable measures to store and maintain it in a secure environment. Our security practices include technical, contractual, administrative, and physical steps designed to protect the data you provide. We have implemented procedures to ensure that only authorized personnel have access to your personal data, limited to those necessary to carry out the purposes outlined in this Privacy Policy. 

You also play a role in securing your personal data. For example, never share your login credentials and ensure that any devices you use to access the Services are secure. We are not responsible for the disclosure of your data due to errors in transmission, unauthorized access, third-party actions, or other factors beyond our control. While we strive to maintain high security standards, we cannot guarantee that breaches may not occur. 

In the event of a security breach that could result in unauthorized disclosure of your personal data, we will notify you via email or other communication channels and post a notice on the Platform where appropriate. 

We have implemented the following security measures: 

Database servers can only be accessed via our trusted network. 

Only authorized personnel can access personal data, and non-disclosure agreements apply even after employees leave the company. 

Mobile devices (e.g., laptops, USB sticks, portable HDs) are password-protected. 

Web and database servers are firewall-protected. 

All data within the Platform is stored securely and encrypted when possible. 

Data is transmitted using the highest level of encryption supported. 

We prevent multiple logins from the same browser for different users. 

Content is stored on AWS S3, protected by private access controls. 

Only authorized personnel can view specific details initiated by a Member. 

PostgreSQL database access is controlled using row-level security policies, limiting data access to authorized individuals. 

We limit the number of requests from the same IP address. 

External security providers conduct regular penetration tests to ensure protection against unauthorized access. 

I. YOUR RIGHTS REGARDING YOUR PERSONAL DATA 

As a User, you have several rights that empower you to control your personal data: 

Opting Out of Marketing Communications: You have the right to opt-out of receiving marketing messages from Fortuna Play. 

Withdrawing Consent: You can withdraw your consent for data collection and processing at any time, but this applies only to data processed based on your consent (e.g., gender information). Withdrawing consent will not affect the lawfulness of data processing that occurred prior to the withdrawal, nor will it impact data processing that relies on lawful grounds other than consent. 

Request Information on Data Processing: You have the right to request information on whether specific data is being processed and further details on any data processing activities described in this Privacy Policy. 

Deletion of Your Data: You may request the deletion of your personal data or the closure of your account. However, we may be legally obligated to retain some data, which may prevent full compliance with this request. 

Correction of Your Data: You may request the correction of any inaccurate, incomplete, or incorrect personal data. 

Objecting to Data Processing: You have the right to object to the processing of your personal data for specific purposes or to automated processing results. 

For any inquiries or requests related to your personal data, you can contact us using the information provided in this Privacy Policy. This contact is intended for addressing concerns about data privacy in compliance with applicable data protection laws. 

J. SUPPLEMENTAL PROVISIONS FOR RESIDENTS OF THE EUROPEAN ECONOMIC AREA AND THE UNITED KINGDOM (EEA & UK) 

1. Data Transfer Outside the EU 

Fortuna Play uses servers located in Germany to store personal data within the EU. For more details, see the “Where Do We Store Personal Data” section of this Privacy Policy. Fortuna Play may transfer personal data collected within the EU to third countries (i.e., countries outside the EU) only based on specific legal grounds. These legal grounds for data transfer include: 

• Adequacy Decision: Data can be transferred to countries declared by the European Commission to provide an adequate level of protection. This means that data transfers to such third countries are treated similarly to transfers within the EU, without the need for additional safeguards. 

• Standard Contractual Clauses: If an Adequacy Decision does not apply, Fortuna Play relies on standard contractual clauses as the legal basis for data transfers to third countries. These clauses ensure that recipients of the data commit to processing personal data in compliance with EU data protection standards. For more information, contact us using the details provided in this Privacy Policy. 

• Code of Conduct or Certification Mechanism: Data transfers outside the EU may also occur based on adherence to an approved code of conduct or certification mechanism, along with enforceable commitments from the recipient to provide adequate safeguards. 

• Explicit Consent: In certain cases, data transfers outside the EU may occur based on your explicit consent, provided you have been informed about the risks. By accepting this Privacy Policy, you are deemed to have been informed about the risks and have given your explicit consent to such transfers. 

2. Your Rights Under the GDPR 

Fortuna Play is committed to respecting your privacy and ensuring that you can exercise your rights under the GDPR, the Swiss Federal Act on Data Protection, and UK data protection laws. We process your data to fulfill contracts (e.g., creating your account), based on legitimate interests (e.g., fraud prevention), or to comply with legal obligations (e.g., tax requirements). If you are within the EEA or the UK, you have the following rights: 

• Right to Access: You can request access to the personal data we hold about you, update it, or request its deletion. You can do this directly via your account settings, or you can contact us if you need assistance. You are also entitled to receive a copy of the personal data we hold about you. 

• Right to Request Correction: If any of the personal data we hold about you is incomplete or inaccurate, you have the right to request its correction. 

• Right to Object: If we are processing your personal data based on legitimate interests, you have the right to object if there is something specific about your situation that makes you want to stop the processing. You can also object to our processing of your personal data for direct marketing purposes. 

• Right to Erasure: You can request that we delete or remove your personal data when there is no valid reason for us to continue processing it. 

• Right to Data Portability: You have the right to request the transfer of your personal data to a third party in a structured, commonly used, machine-readable format. This right applies when the data is processed based on your consent or by automated means. Upon request, we will provide your personal data in a machine-readable format to you or the third-party you designate. 

• Right to Withdraw Consent: If we rely on your consent for processing your personal data, you have the right to withdraw that consent at any time. However, withdrawing your consent may affect your access to certain functionalities of the Service. 

For any inquiries or requests regarding your personal data, you can contact us using the details provided in this Privacy Policy. 

3. Exercising Your GDPR Data Protection Rights 

You can exercise your rights to access, rectify, cancel, or object to the processing of your data by contacting us directly. We may request identity verification to ensure the protection of your personal data before addressing your request. We will do our best to respond as quickly as possible. Additionally, if you believe our collection and use of your data violates GDPR, you have the right to file a complaint with your local Data Protection Authority within the European Economic Area (EEA). 

K. SUPPLEMENTAL PROVISIONS FOR RESIDENTS OF THE STATE OF CALIFORNIA, USA 

Under the California Consumer Privacy Act (CCPA), California residents have enhanced control over their personal information. These rights include: 

1. Right to Know and Delete: 

We are committed to transparency about the sharing of your personal data with third parties. California residents have the right to know specific details about personal data we have shared or sold and can request this information twice a year at no cost. This includes: 

• Information on personal data shared with third parties, including the identities of those third parties and the reasons for sharing. 

• A clear and easily understandable description of how we process your personal data. 

You also have the right to request the deletion of your personal data. Based on your request, we will either remove your information entirely or add you to a “do not contact” list for a specified period. 

2. Requests Timeline: 

We aim to respond to requests for information or deletion within 45 days. If additional time is required, we will notify you. 

3. Authorized Agents: 

You can appoint an authorized agent to act on your behalf for requests under the CCPA. The agent must be registered with the California Secretary of State. To process such a request, we will need written authorization from you and verification of both your identity and the agent’s proof of authorization. 

4. Collection, Usage, and Disclosure Chart:   

• The following chart details the categories, sources, and purposes of the personal information we may handle (as described in CCPA Sec. 1798.140(o)):   

• Note that although we have collected and disclosed personal information within the last year for business purposes, we do not sell your personal information.   

5. Data Use and Disclosure 

We may share your personal information with third parties for business purposes outlined in this Privacy Policy. Although we do not sell personal data (except anonymized data), certain sharing may be classified as a “sale” under California law. We do not collect or share data from users under 16 years of age. 

6. Data Retention 

We retain personal data only for as long as it is needed to fulfill service usage, meet legal requirements, or serve its intended purpose. Inactive accounts with no usage for one year may be automatically terminated, and data will be destroyed in accordance with our Terms of Use. 

7. California Incentive and Your Rights 

Fortuna Play’s Rewards Program qualifies as a financial incentive under California law, offering benefits in exchange for insights derived from data analysis and user activity. Participation in the program is voluntary, and you may opt-out at any time (refer to the Terms of Use). 

8. Your Data Privacy Rights at Fortuna Play 

Under the California Consumer Privacy Act (CCPA), you have the following rights regarding your personal data: 

• Right to Know: Understand what data we collect, why we collect it, and to whom it is shared. 

• Right to Delete: Request the deletion of your personal data, subject to legal exceptions. 

• Right to Correct: Request corrections to any inaccurate personal data. 

• Right to Opt Out: Opt out of the sale or sharing of personal data and cross-context behavioral advertising. 

• Right to Limit Use/Disclosure: Limit the use and disclosure of your sensitive information for specific purposes. 

• Right to Non-discrimination: You will not be discriminated against for exercising your CCPA rights. 

To opt out of data sales or sharing, or to limit the use of sensitive data, you can email us at [email protected]. We also honor opt-out requests through privacy signals like the Global Privacy Control (GPC). To submit requests to know, delete, or correct data, follow the instructions outlined in this Privacy Policy. Be sure to include “Personal Information Privacy Request” in the subject line, and provide your name, address, and email, along with the service you are inquiring about. Specify whether you are requesting deletion or a “do not contact” listing. Note that, if we acquire your data again in the future, we cannot guarantee you will not be contacted. Responses to such requests will be made within 45 days, with potential extensions if needed. 

California users may appoint authorized agents to submit CCPA requests on their behalf. We will verify your identity and the agent’s authorization before processing any requests. 

9. Non-Discrimination Assurance 

Fortuna Play will not discriminate against you for exercising your rights under the CCPA. 

10. Do Not Track Signals 

Most web browsers offer a “Do Not Track” (DNT) feature, which allows users to indicate that they do not wish to have their online activities tracked. Under the California Online Privacy Protection Act (CalOPPA), we inform you that, like most websites, we do not respond to DNT signals set by web browsers. 

L. SUPPLEMENTAL PROVISIONS FOR RESIDENTS OF THE STATES OF COLORADO, CONNECTICUT, AND VIRGINIA IN USA 

Residents of Colorado, Connecticut, and Virginia should note that this section supplements the main Privacy Policy. For details on data collection, usage, sharing, and disclosures to third parties, please refer to the sections titled “Use of Personal Data,” “Disclosure of Your Personal Data,” and “Types of Data Collected.” Sharing for marketing or advertising purposes may be considered “sales” or “targeted advertising.” 

Depending on your location, you may have the following rights regarding your data: 

• Access: Request confirmation and access to your data. 

• Data Portability: Request a copy of your data in a readily usable format. 

• Correction: Request correction of any inaccuracies in your data. 

• Deletion: Request the deletion of your data. 

• Opt Out of Sales/Targeted Advertising: Opt out of data processing for sales or targeted advertising. 

• Opt Out of Profiling: Opt out of data processing for profiling that impacts your legal rights. 

To exercise these rights, follow the methods described in this Policy. Be sure to include “Personal Information Privacy Request” in the subject line, specify the service you are inquiring about, and provide your name, address, and email. If you are requesting data deletion, specify whether you want your data completely removed or placed on a “do not contact” list. You also have the right to appeal a refusal to comply with your request, as described in the Policy. 

Additionally, residents in these states may appoint an authorized agent to submit requests on their behalf, provided they follow the verification process outlined in this Policy. 

M. SUPPLEMENTAL PROVISIONS FOR RESIDENTS OF KOREA 

If you are accessing our Services from Korea, please be aware that your personal information may need to be transferred overseas. When this occurs, we ensure that the transfer is conducted in compliance with the Korean Personal Information Protection Act (PIPA) and the Network Act. This includes using secure information communication networks. Your personal information will be retained and used only until the original purpose for which it was collected has been fulfilled. 

N. SUPPLEMENTAL PROVISIONS FOR RESIDENTS OF BRAZIL 

This section applies to all Users in Brazil under the Lei Geral de Proteção de Dados (LGPD) and supersedes any conflicting information in this Privacy Policy. The term “personal information” is used as defined by the LGPD. 

1. Grounds for Processing Personal Information 

We process your personal information only when there is a legal basis under the LGPD, such as your consent. For more details, you may contact us using the information provided in this Privacy Policy. 

2. Categories of Personal Information Processed 

To understand what categories of your personal information are processed, refer to the “Types of Data Collected” section in this Privacy Policy. 

3. Disclosure of Your Personal Information 

For details about with whom your personal information is shared and for what purposes, refer to the “Disclosure of Your Personal Data” and “Use of Personal Data” sections in this Privacy Policy. 

4. Purpose of Processing Personal Information 

To understand why we process your personal information, refer to the “Use of Personal Data” section in this Privacy Policy. 

5. Your Data Privacy Rights 

Under the LGPD, you have the following rights regarding your personal data: 

• Confirmation of Processing Activities: Obtain confirmation on whether your personal information is being processed. 

• Access to Personal Information: Access the personal information we hold about you. 

• Rectification: Have incomplete, inaccurate, or outdated personal information corrected. 

• Anonymization, Blocking, or Deletion: Request the anonymization, blocking, or deletion of unnecessary, excessive, or non-compliant personal information. 

• Consent Information: Obtain information on the possibility of providing or denying consent and understand the consequences. 

• Third-party Information: Learn about third parties with whom your personal information is shared. 

• Portability: Request the portability of your personal data to another service or product provider, while safeguarding commercial and industrial secrets. 

• Deletion of Data: Request the deletion of personal data processed based on your consent, unless exceptions outlined in Article 16 of the LGPD apply. 

• Revocation of Consent: Revoke your consent at any time. 

• Complaints: File a complaint with the ANPD (National Data Protection Authority) or consumer protection bodies. 

• Opposition to Non-compliant Processing: Oppose processing activities that are not in accordance with the law. 

• Automated Decisions: Request clear information on criteria and procedures used in automated decision-making. 

• Review of Automated Decisions: Request a review of decisions made solely through automated processing that affect your interests, including those defining your personal, professional, consumer, or credit profile, or aspects of your personality. 

You will not be discriminated against or face any detriment for exercising your rights under the LGPD. 

6. How to File a Request 

You or your legal representative can file a request to exercise your rights free of charge by using the contact information provided in this Privacy Policy. We aim to respond promptly to all requests. If we are unable to respond immediately, we will inform you of the reasons. If we are not processing your personal information, we will try to direct you to the relevant entity. 

For requests concerning access or processing confirmation, please specify whether you prefer your personal information delivered electronically or in print, and indicate whether you require an immediate simplified response or a complete disclosure. For complete disclosures, we will respond within 15 days, providing information about the origin of your personal information, confirmation of records, criteria used for processing, and purposes, while maintaining the confidentiality of our commercial and industrial secrets. 

For requests involving rectification, deletion, anonymization, or blocking, we will inform third parties with whom your data has been shared, unless it is impossible or would require disproportionate effort. 

7. Transfer of Personal Information Outside of Brazil 

We may transfer your personal information outside Brazil in compliance with the LGPD. For more details, please contact us using the information provided in this Privacy Policy. 

O. SUPPLEMENTAL PROVISIONS FOR RESIDENTS OF TURKIYE: LEGAL BASIS FOR PROCESSING PERSONAL DATA UNDER KVKK 

If you are a resident of Turkey, the following provisions apply in addition to the main Privacy Policy, as per the Law on the Protection of Personal Data (KVKK). 

1. What Kind of Personal Information Do We Collect? 

The personal data we collect includes: 

• Contact Information: Your email address, first name, last name (if your username contains your name). 

• User Picture or Avatar: If it contains personally identifiable information. 

• Correspondence Details: Information about your communication with us. 

• Technical Information: Your IP address, login information, browser type and version, screen resolution, flash version, time zone setting, browser plug-in types and versions, operating system, platform, traffic data, cookies data, web logs, and other communication data. This also includes details of the resources you access and session records collected when you use the Platform. 

• Additional Information: Any other information you provide to us. 

Please review the sections “Types of Data Collected Directly by Fortuna Play,” “Types of Data Collected from Third-Party Social Networks,” and “Service Providers Processing Personal Data on Our Behalf” for further details on the personal data we collect. 

2. What Lawful Reasons Do We Have to Process Personal Data? 

We process your personal data based on one or more of the following lawful reasons: 

• Contract: We process personal data to fulfill our contractual obligations with you or your employer. 

• Consent: We rely on your freely given consent at the time you provide your personal data to us. 

• Legitimate Interests: We may process personal data based on our legitimate interests, ensuring that the processing is fair, reasonable, and balanced. 

• Legal Obligations and Public Interest: We process personal data to comply with legal obligations or to fulfill public interest requirements.