Privacy Policy

This privacy policy offers information to the user in relation to the processing of their personal data as required by the European Data Protection Regulation 679/2016, of April 27th, regarding the protection of natural persons with regard to the treatment of personal data and the free circulation of these data and Organic Law 3/2018, of December 5th, on the Protection of Personal Data and guarantee of digital rights. Thus, we proceed to provide all the information required in relation to the processing of personal data carried out through the use of our Services (download and use of the games).

1. Responsible for the Treatment

The data controller is IndieFist, S.R.L., with VAT B40546731, registered office at Calle Sueca 17 (Valencia – Spain) and contact email address media@indiefist.com.

2.- Personal data collected

All personal data processed by IndieFist S.R.L. come from the user himself. When a user downloads one of our games and uses its Services, the data that is collected is as follows: Device ID. User ID, in case of linking with the services of the App Store Game Services. The data that IndieFist S.R.L. will have access to will depend on the data that the user has entered in their Game Services account. In cases where the user has authorized it, the email may also be processed. Device operating system version. Country of origin. Type of internet connection used to play.

3. Purposes and bases of legitimation

We process data as necessary to provide and operate our games and their features, including account or Game Services features chosen by the user; to understand game usage, diagnose crashes and technical problems, measure performance and improve our games; and, where applicable, to deliver and measure advertising and prevent advertising fraud.

Where a game offers a Google-connected feature and you choose to authorize it, Google OAuth and Google account data are used only to provide the connected functionality you requested. IndieFist does not sell Google user data.

The legal basis depends on the processing activity and applicable law. The main bases we rely on are:

Analytics and diagnostic information may include app-instance or device identifiers, gameplay events, sessions, crashes and performance information. The exact information depends on the services enabled in each game and your privacy choices.

For advertising, advertising networks and mediation providers may process mobile advertising identifiers and ad-interaction information where permitted. You can use your device and in-app privacy controls to limit personalized advertising where available.

4. Recipients

IndieFist S.R.L. uses third-party service providers and SDKs to operate, analyze and monetize its games. Providers used can differ between games and versions. They may include:

• Google LLC / Google Firebase and Google Analytics, for analytics, app-instance and event measurement, diagnostics and performance services, as applicable.
• Google AdMob, for advertising delivery, measurement and fraud prevention.
• Yodo1 / MAS, for advertising mediation and monetization in games where those services are integrated.

As necessary to provide these services, these providers may process device or app identifiers, advertising identifiers where permitted, approximate location derived from IP address, interactions and events, diagnostics, performance information or advertising interaction data. Their processing is also subject to their own privacy terms and to applicable consent and device settings. IndieFist does not disclose personal data to third parties for unrelated purposes unless authorized by the user or required by law.

Google OAuth and Google user data

Some IndieFist games may allow users to connect Google services. The Google OAuth consent screen displays the permissions requested. IndieFist accesses only the Google account information and scopes that you authorize and uses that information solely to provide the connected feature you requested. Google user data is not sold or used for unrelated advertising. It is shared only with service providers when necessary to operate the requested functionality, or where disclosure is legally required. You may revoke an application's access through your Google Account permissions. You may also contact media@indiefist.com to request deletion of personal data controlled by IndieFist.

5. International Data Transfers

Where personal data is transferred outside the European Economic Area, IndieFist S.R.L. and/or its service providers use applicable safeguards required by data protection law, which may include adequacy decisions, Standard Contractual Clauses approved by the European Commission, or other lawful transfer mechanisms as applicable.

6. Conservation periods

The personal data of the users will be kept for the time necessary to provide the requested services, so the user data will be kept for as long as they are active in our Services.

If a user remains inactive continuously for a period of 3 years, the data will be deleted, but will remain blocked for the maximum period of prescription of personal actions established in art. 1964 of the Civil Code of Spain, established in 5 years. This means that the data will be kept for 5 years but will not be used for any purpose. After this period, the data will be permanently deleted from our databases.

7.- Rights

In accordance with (EU) 2016/679 Regulation, the interested parties may exercise the following rights regarding data protection:

• Right of access. You can request the person responsible for access to your data to check what personal data they are treating, for what purpose and the conservation period, among other information.
• Right of rectification. You can urge them to rectify your data when they are no longer accurate.
• Right of deletion or elimination. You may request that your data stop being processed and be deleted. In this case, your data will probably be blocked, but not deleted, since they must be kept for the limitation periods of actions indicated above. However, you will be duly informed, if applicable.
• Right of limitation. They will be kept for legitimate interest or the exercise or defense of possible claims.
• Right of opposition. You can object to the controller continuing to process your data, in which case you can only keep your data for legitimate interest or the exercise or defense of possible claims.
• Right of portability. If you want your data to be processed by another data controller.

Models, forms and more information on the referred rights: Spanish Agency for Data Protection. Rights may be exercised by email to media@indiefist.com. In order to prove your identity, you will be required to provide us with some additional information to verify that you are the owner of the data.

Possibility of withdrawing consent: in the event that consent has been granted for a specific purpose, the interested party has the right to withdraw consent at any time, without affecting the legality of the treatment based on the consent prior to its withdrawal. .

Claim before the Control Authority: You also have within your reach the possibility of claiming before the Control Authority if you consider that the Responsible does not carry out an adequate treatment, being able to claim before the Spanish Agency for Data Protection (AEPD).

In relation to automated decision-making, you are informed that data processing will not have the purpose of making decisions about your information based solely on automated processing, including profiling. So your data will not be processed to create profiles in an automated way and without human intervention to evaluate personal aspects related to your person, such as analyzing or predicting aspects related to economic situations, health, preferences or personal interests, reliability or behavior, the situation of the interested party, all this to the extent that it has legal consequences for you or significantly affects you as a result. In any case, it would only apply when a law requires it, is necessary for the execution of a contract or when you have expressly consented. In these cases, you will be informed in advance and said treatment will be subject to the appropriate guarantees, including the right to obtain human intervention; to express their point of view; to receive an explanation of the decision made after such evaluation and to challenge the decision.

8.- Accuracy of the data

Users guarantee and respond, in any case, to the accuracy, validity and authenticity of the personal data provided, and undertake to keep them duly updated. To update the data, they can do so directly by contacting the IndieFist team.

9.- Age certification

In order to access or use our Services, it is necessary for the user to be of legal age in each jurisdiction. At a minimum, you must be over 13 years of age, as indicated in Regulation (EU) 679/2016. However, by way of example, there are countries that raise that age of majority, such as Germany (16 years), France (15 years) and Italy (14 years). The user guarantees and responds to the fulfillment of this requirement.

10.- Modification of this privacy policy

IndieFist reserves the right to modify this policy to adapt it to future legislative developments, as well as future uses that it plans to make of your personal data.

11.- Security measures

At IndieFist we adopt all the necessary security measures to guarantee the confidentiality, integrity and availability of your data, adopting the technical, organizational and legal measures necessary to protect them against third parties.