PRIVACY POLICY



Last updated: 09/28/2022


Introduction


In this and the following section summaries, we have placed the legal information in a more accessible and abbreviated form. For complete information, please read the text in the section to the right.


This Policy is intended to help you understand:


Leleka is located in Ukraine.


This Privacy Policy (“Policy”) describes the different ways individual entrepreneur Rikhtarych Oleksandr Yuriyovych (“we”, “us”, “our”, “Company”, “Leleka”) may collect, use, and share information obtained when you interact with the website https://leleka.games (the “Site”), social media sites such as Facebook, Twitter, Instagram, LinkedIn and YouTube, and use the Company services (the “Services”), including, but not limited to, accessing and playing our “Sliding Puzzle LELEKA” game or other similar games (the “Game”) available via the Site or game platforms such as Google Play, App Store, and Facebook Instant Games, or provide us with information about yourself in other ways. Such treatment may include, but is not limited to, the following:


You can be our visitor or client (collectively “users”):


When you submit your personal data via our Site or when you play our Game, you may be asked to consent to our processing of the personal data you provide as explained in this Policy to enable us to provide you with the information or service requested, if no other legal ground can be used.


Definitions


To facilitate your understanding of this Policy, we explain the usage of the definitions listed here in accordance with the GDPR and CCPA.


We use the following definitions in this Policy:


“data controller” means the natural or legal person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data is processed.


“data processor” means the natural or legal person who processes personal data on behalf of the data controller.


“data subject” is any living individual who is using our Site and/or Services.


“personal data” means any information relating to you and helping identify you (directly or indirectly) such as your name, last name, email, location data, etc.


“processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.


“joint controllers” means two or more controllers jointly determining the purposes and means of processing.


The definitions of terms used within this Policy are taken from the GDPR in consideration of the definitions established in the CCPA. The pair of definitions “personal data” and “personal information”; “controller” and “business”; “processor” and “service provider”; “data subject” and “consumer” may be used interchangeably unless another meaning is mentioned.


Data Collection


We collect and process the information about you or obtained from you in accordance with this Policy. In this section, you can learn more about what personal data may be collected when you visit the Site or play our Game.


We collect information about you in connection with our Site and Services in two main ways: visitor data (obtained via the Site) and client data (obtained through the Game). In particular, we collect:


(a) Contact Information. We can collect some personal data when you submit your personal data via the Site’s form to contact us, social media sites, provide feedback on our Site and Game, or subscribe to a newsletter to receive the news and updates on our Game. Such data may include name, email address, message, and other information you may provide us via available contact options.


(b) Cookies Information. On our Site, we may use cookies and other tracking technologies for a variety of purposes: for analytics, marketing activities, remembering your preferences, and other purposes. Such use may involve the transmission of information from us to you and from you to a third party website or us. To learn more regarding our use of cookies please see our Cookie Policy.


(c) Automatically Collected Information. When you use our Site or Game, we collect certain information about you and your device automatically, including device model, operational system, and IP-address.


(d) Authentication Token Information. When you sign in to the Game with the ‘Sign In with Facebook’ button, we collect encrypted Facebook authentication token obtained from Meta Platforms, Inc. We can obtain the following information about you via such a token: email address.


(e) Payment Information. If you make in-app purchases in the Game for the purpose of disabling interstitial advertising or obtaining virtual items, you will need to provide certain banking information, so the order can be fulfilled. You may read the payment processor’s (Apple, Google, Facebook, etc.) privacy policy to learn more about their privacy practices. We do not collect nor have access to your sensitive payment data (card number, PIN, expiry date, CVV, etc.).


Please note that we use third-party payment processors to collect this information from you and process your payment. Such a third-party payment processor is responsible for all collection, processing, and storage of your financial information and we do not have direct access to or possession of your payment card information or banking information.


(f) In-game Information. We collect some information about your in-game activity, such as the Game session time, your Game settings, how many coins you get in the Game, what skin you buy, what puzzle combination has been generated, etc.


We use the personal data we collected and the personal data you provided us with or requested us to collect only for the purposes listed in this Policy. We may share your personal data with third parties solely for the purposes listed herein.


We DO NOT sell your data. We DO NOT use automated decision-making and profiling.


We DO NOT intentionally collect and process any sensitive personal data. Please, refrain from sharing your or third-party sensitive personal data with us.


We DO NOT target or knowingly collect personal data of children and minors.


Grounds for processing


Our grounds for processing your personal data are:



We do NOT intentionally collect and process sensitive personal information. Please, refrain from sharing your sensitive personal data when you provide information to us through Site, Game, or our social media accounts.


We collect and process your personal data in accordance with the provisions of the GDPR.


GDPR provides an exclusive list of lawful bases allowing us to process your personal data. During personal data processing we rely only on four of them, namely:


Article 6.1(a): consent


We collect the information you choose to give us, and we process it under your consent. You may withdraw your consent to the processing of your personal data at any time.


Please remember that the withdrawal of consent does NOT automatically mean that the processing before the withdrawal is considered unlawful. You may withdraw the consent to the processing of your personal data by sending us an email at [email protected], or by contacting us in any other way convenient for you.


Article 6.1(f): legitimate interests


We process your personal data to prevent any fraudulent actions and to provide you with the desired services. Also, we need some data to enable our Site and Game to run smoothly and give you a pleasant user experience. We use only strictly necessary data under this legal ground.


Article 6.1(b): performance of a contract


When you provide a third-party payment processor with the personal data with requested banking information to purchase services, this can be deemed as your request to form a contract or to perform a contract between you and us. However, we may ask you to give us clear consent in case of doubt.


Article 6.1(c): legal obligation


We process your personal data to fulfill the applicable legal obligations arising mainly from the GDPR. In the event of you sending us the request to fulfill the rights granted by the GDPR, we may ask you for some personal data we already have to identify you and achieve compliance with the applicable law.


Use of Your Personal Data


As a data controller, we use your personal data for the purposes listed in the table below where we also detail the type of personal data processed, legal bases we rely on to do so and third parties with whom we may share your personal data:


Purposes Type of personal data Legal grounds Third Parties recipients
Providing access to the Game and its features (c) Automatically Collected Information
(d) Authentication Token Information
(f) In-game Information		 Performance of a contract (Article 6(1)(b)) MaxMind GeoIP2, Contractors
Communication with visitors and clients (a) Contact Information
(d) Authentication Token Information		 Your consent (Article 6(1)(a)) Zoho Campaigns, Contractors
Marketing (to suggest and notify about news of Site, Game and conduct other marketing activities, such as personalized advertising) (a) Contact Information
(b) Cookies Information		 Your consent (Article 6(1)(a))
Our legitimate interest (Article 6(1)(f))		 Zoho Campaigns, Google AdMob, Google Interactive Media Ads, Contractors
Analytics and developing (for optimizing and improving our Site and Game) (b) Cookies Information
(c) Automatically Collected Information
(f) In-game Information		 Your consent (Article 6(1)(a))
Our legitimate interest (Article 6(1)(f))		 Google Analytics, Google Tag Manager, Meta Pixel, Contractors
Processing of Payments (e) Payment Information Performance of a contract (Article 6(1)(b)) Apple Pay, Google Pay, Facebook Pay, Contractors
Complying with the law or legal process (a) Contact Information
(b) Cookies Information
(c) Automatically Collected Information
(d) Authentication Token Information
(e) Payment Information
(f) In-game Information		 Legal obligation (Article 6(1)(c)) Google Analytics, Google Tag Manager, MaxMind GeoIP2, Zoho Campaigns, Google AdMob, Google Interactive Media Ads, Apple Pay, Google Pay, Facebook Pay, Contractors

Please, note that upon processing of payments using services of a payment processor, such payment processor may collect certain personal data it considers as necessary for provision of services. Such collection of personal data is regulated under the rules and policies of payment processors. We advise you to access the payment processors’ websites carefully and always check their policies and rules regarding the collection of your personal data.


Data Security, Integrity and Retention


We will store and process your personal data for as long as needed to provide you or other clients with the services.


Also, you may request erasing of your personal data by contacting us in any way convenient for you.


We store and process your personal data until we do not need it for any of the purposes defined in this Policy unless longer storage is required or expressly permitted by law.


We may not delete or anonymize your data if we are compelled to keep it to comply with the law or legal process.


Notwithstanding any of the aforementioned periods of data storage, you may request to delete your personal data by sending us an email at [email protected] or contacting us via another way convenient for you.


We have implemented appropriate organizational, technical, administrative, and physical security measures that are designed to protect your personal data from unauthorized access, disclosure, use, and modification. We regularly review our security procedures and policies to consider appropriate new technology and methods.


Data Sharing and Disclosure


We only transfer your personal data to third parties according to the requirements of GDPR.


Where possible, we always enter into data processing agreements (DPAs) and Non-Disclosure Agreements (NDAs) with our third parties.


We may disclose the personal data to third parties, including those located outside the EU and EEA, provided that proper safeguards are put in place and the applicable local laws do not put your rights at risk.


We may share your personal data as a data controller to joint controllers and data processors in accordance with provisions specified hereafter.


Sharing data with joint controllers (other controllers)


In some cases we may act as a joint controller jointly with other joint controllers, for example, while using Meta (Facebook) pixel. In respect to this case of personal data processing, we are the party to the Meta (Facebook) Joint Controllership Addendum. In such a case, a data subject may exercise their rights under the GDPR in respect of and against both other joint controllers and us.


Sharing data with data processors


There are many features necessary to provide you with our services that we cannot complete ourselves, thus we seek help from third parties. We may grant some service providers access to your personal data, in whole or in part, to provide the necessary services.


Usually, we may share and disclose your personal data to the following data processors:



During our business activities we may engage different specialists which may receive your personal data, including technical, sales and marketing specialists, to provide you with better client service. Also, we may disclose some of your personal data to our outsource legal professionals to make our business accurate and transparent. The abovementioned specialists are collectively referred to as Contractors.


We may transfer your personal data to countries outside the EU and EEA (primarily the USA, Ukraine, etc.) that are not considered the countries that offer an adequate level of data protection on the basis of article 45 of GDPR (adequacy decision) with appropriate safeguards as determined under the GDPR (you may check the current list of adequacy decisions here).


We only transfer your personal data to third parties within requirements under the GDPR. Where possible, we always enter into Data Processing Agreements (DPAs), including those based on the Standard Contractual Clauses (SCCs), and Non-Disclosure Agreements (NDAs) with them and treat personal data transfer seriously. Where the Contractor has an appropriate data processing agreement in place, we may adjoin such data processing agreement. If so, we and the Contractor may regulate the transfer of the personal data to such Contractor by means of this data processing agreement.


Transferring your personal data outside of the European Economic Area


We may transfer your personal data to third countries outside the EU and the EEA under Article 46 of the GDPR on the appropriate safeguards, including the standard contractual clauses (SCC).


For transfers to countries that do not fall under requirements of Article 45 of the GDPR on the adequacy of the level of protection, we may transfer your personal data to the third countries outside the EU and the EEA, including the onward transfers of the personal data from the third countries to another third countries, under Article 46 of the GDPR with the appropriate safeguards, including the SCC.


We disclose your personal data to the countries outside the EU and the EEA, in compliance with our internal International Transfer Procedure in order to adduce adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of natural and legal persons.


We put supplementary technical and organizational measures in place when transferring data outside the EU and the EEA. e.g. prior assessment of the service supplier’s reliability and personal data protection practices, encryption of the transferred personal data, prompt reacting to any threats to confidentiality, integrity and availability of the personal data, conducting transfer impact assessments (TIA) when necessary, etc.


Your Rights under the GDPR


You may exercise the following rights under the General Data Protection Act (GDPR):



You may exercise the following rights by submitting your request at [email protected].


When we act as a joint controller with regard to particular processing of personal data, you may exercise your rights under the GDPR in respect of and against both advertising platform and us.


Rights under the GDPR



Please, note that we may need to confirm your identity to process your requests to exercise your rights under the GDPR. Thus, we may not be able to satisfy your request if you do not provide us with sufficient detail to allow us to verify your identity and respond to your request.


Data Protection Authority under the GDPR


We kindly ask you to contact us directly so that we can quickly answer your question.


We kindly invite you to share your concerns with us in the first place regarding any issue related to your personal data processing. You may contact us to address your inquiries: [email protected].


Supervisory Authorities under GDPR: In case of any questions regarding data protection, you can apply to the supervisory authority. We will cooperate with the appropriate governmental authorities to resolve any privacy-related complaints that cannot be amicably resolved between you and us. You can find the full list of EU supervisory authorities through the link.


California Residents: Your Rights under the CCPA


This section applies to the processing of the personal information of the California residents.


Under the California Consumer Privacy Act (the “CCPA”), California residents have certain rights regarding our collection, use, and sharing of their personal information.


We may collect various categories of personal information when you use and/or access our Services and Game, In particular, depending on actual circumstances, we may collect the following categories of personal information specified in the CCPA when you use and/or access our Services and Game:



You can find a detailed description of the personal information that we may collect from you above in the ‘Data Collection’ section of this Policy. Note that in the ‘Data Sharing and Disclosure’ section of this Policy you can review the categories of third parties with whom we may share your personal information. The terms used within those sections of this Policy are taken from the GDPR in consideration of the definitions established in the CCPA.


If you are a California resident, to the extent provided for by the CCPA and subject to applicable exception, you have the following rights in relation to the personal information we have about you:



We do not sell your personal information to third parties for monetary or other valuable consideration. Additionally, we do not offer any financial incentives associated with our collection, sharing, or retention of your personal information.


We take the protection of your privacy seriously, so in no way will we discriminate against you for exercising any of your rights granted by the CCPA.


You can exercise your rights under the CCPA by sending us an email by any other means of communications convenient for you, including those listed in the ‘How to Contact Us’ section of this Policy.


Please, note that we may need to confirm your identity to process your requests to exercise your rights under the CCPA. Thus, we may not be able to satisfy your request if you do not provide us with sufficient detail to allow us to verify your identity and respond to your request.


Children’s Privacy


In case we process children’s personal data, we perform it only in compliance with COPPA and other applicable laws and regulations.


Generally, our Site and Game are intended for general audiences and are not directed to children under 13. We do not knowingly collect any personal information from children under the age of thirteen without seeking any required parental approval in accordance with applicable legal and regulatory obligations, such as the U.S. Children’s Online Privacy Protection Act (“COPPA”).


Platforms we use to distribute our Game permit to register an account only from the age of 13 subject to certain exceptions, i.e., a higher age of consent to the processing of personal data established by the country or opportunity to create an account with a parental or guardian permission. Accordingly, we strongly advise you, if you are a child under the EU law, never to provide any personal data to us without your legal guardian’s consent.


If we become aware that a child has provided us with personal information without a parent’s permission, we will promptly delete this information. If you become aware that a child has provided us with personal information without parental consent, please contact us by email at [email protected].


Changes to the Privacy Policy


We may change this policy from time to time due to the different purposes.


We will notify you on such material changes through means available to us.


This Policy may be changed from time to time due to the implementation of new updates, technologies, laws’ requirements or for other purposes. We will send notice to you if these changes are dramatic and where required by applicable laws, we will obtain your consent for the subsequent processing. In any case, we encourage you to regularly review this Policy to check for any changes.


Such notification may be provided via your email address, announcement published in our Game and/or by other means, consistent with applicable law.


How to Contact Us


Please contact us if you have any questions about our processing activities, this Privacy Policy, or your rights.


If you have a question related to this Privacy Policy, our processing activities, or your data subject rights under GDPR, CCPA, and other applicable laws, you can contact us directly using the following details: