Privacy Policy

Privacy Policy of ardenfall.eu and the Ardenfall game server

In force from 7 October 2026. This policy explains which personal data we process when you use the ardenfall.eu website, the Ardenfall game (PC and Android client) and our e-mails, why, on what legal basis, for how long, and what your rights are. Abbreviations: GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council; Service – the ardenfall.eu website together with the game server.

§1. Controller
1. The controller of your personal data is TECHARCHITECTS, TOMASZ ADAMSKI, Kobierniki 128, 27-600 Kobierniki, Poland, NIP (tax id) 8641965244, REGON 525131939 ("we", the Controller) – the same entity that is the Seller in the Terms of Service.
2. Contact for everything related to personal data: support@ardenfall.eu. We have not appointed a data protection officer.

§2. What data we process, why and on what legal basis

1. Your account. When you create an account you give us your e-mail address, a password, the name of your first character and its sex. We assign a random account number (used to log in). The password is stored only as a cryptographic hash – none of us knows your password. We also store the account creation date, the date of your last website login, the account status (Premium, points), whether your e-mail address is confirmed, your news e-mail setting and the account history (e.g. account created, character created, password or e-mail changed) with the IP address it was done from – you can see it in Account Management. If you registered your account with a recovery key, we store that key too. Older accounts may have a country chosen in the old registration form. Optionally you can enter your real name, location and country under "Public Information" – they are then visible to everyone on your characters' pages (you can remove them at any time).
Purpose and legal basis: creating and running your account, logging in, providing the game – performance of a contract (Art. 6(1)(b) GDPR); account history with IP addresses – account security and investigating abuse, our legitimate interest (Art. 6(1)(f) GDPR). An e-mail address and a password are required to create an account.

2. Signing in with Google. If you create your account or log in with Google (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland), Google gives us your e-mail address, the information that it is verified, your name and the technical identifier of your Google account. We store only the e-mail address and the Google account identifier (plus the dates of connecting and of the last login) – we do not store your name or profile picture. We never receive your Google password. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). You can remove the connection at any time in Account Management or in your Google account settings. Signing in at Google happens on Google's pages under Google's privacy policy.

3. The game. The game server stores the data of your characters: name, sex, vocation, level, skills, items, depots, position in the world, bank balance, guild membership, VIP list, quest progress, deaths and kills, playing time, the last login date and the last IP address the character logged in to the game from. The IP address is used to protect against cheating and abuse (e.g. banning an account or IP address, detecting multiple accounts in "Invite a Friend"). Some game data is public by nature: character name, level, vocation, guild, online status, last login date, deaths, rankings (Highscores, Hall of Fame, weekly competition), the character comment and – unless you tick "Hide account information" – your other characters on the account, the account creation date, Premium status and the data you entered under "Public Information".
In-game chat is not recorded or stored. We only store what you report to us: a report from the game (the report command – character name, position and the text of the report) and – when a penalty is given – the reported statement, the reason and the staff comment in the ban history. Private messages are not stored.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR); IP addresses, bans and reports – our legitimate interest in fair play and security (Art. 6(1)(f) GDPR).

4. Buying points. For a purchase we store the order number, account number, amount, number of points, payment status and date, the payment id at the payment operator and the IP address the order was placed from. We pass the amount, the order description, the account's e-mail address and the IP address to the payment operator. Payments are handled by PayU S.A. (Grunwaldzka 186, 60-166 Poznań, Poland) as a separate controller of the payment data (card, bank account, BLIK) – we do not receive that data. If you ask for an invoice, we process the data you give us for it. Legal basis: performance of a contract (Art. 6(1)(b) GDPR), tax and accounting obligations (Art. 6(1)(c) GDPR), establishing and defending claims and handling complaints (Art. 6(1)(f) GDPR).

5. E-mails.
a) Transactional messages – welcome after registration, confirming and changing the e-mail address, account recovery, the recovery key, confirmations of account changes and information about a reward added to your account (World First, weekly competition, "Invite a Friend"). They are always sent because they are part of the service (Art. 6(1)(b) GDPR). We never send passwords.
b) Game notifications – news and the event calendar (at most once a week), a short note the day before a major event (at most twice a month) and a reminder when nobody has played on your account for at least 7 days (at most one every 14 days). We send them only with your consent (Art. 6(1)(a) GDPR), given with the box at registration or the "E-mails" switch in Account Management. You can withdraw your consent at any time without giving a reason – with one click on the unsubscribe link in each such message or in Account Management; withdrawal does not affect the lawfulness of earlier messages. For this we keep a history of sent messages (kind, date, address) and the date you unsubscribed.
c) Writing to us – if you write to support@ardenfall.eu, we process your address and your message in order to answer (Art. 6(1)(f) GDPR; for purchases also (b) and (c)).

6. Website and security. The web server logs the IP address, date and time, the requested page, the referring page and browser information. Login, registration and Google sign-in have attempt limits tied to the IP address. We make backups of the database. Legal basis: our legitimate interest – security and continuity of the Service, protection against attacks and abuse (Art. 6(1)(f) GDPR). We do not use analytics tools (e.g. Google Analytics), tracking pixels or ads.

7. Forum. Forum posts are public; with each post we also store the author's IP address (abuse prevention, Art. 6(1)(f) GDPR).

8. Facebook page. We publish news on our Facebook page. If you visit or interact with it, the data is also processed by Meta Platforms Ireland Ltd. – for the page statistics jointly with us – under Meta's rules. ardenfall.eu contains only a plain link to the page, no Facebook plugins.

§3. Cookies and browser storage
We use only what the Service needs to work and to remember your choices – no analytics or advertising cookies, so we do not ask for cookie consent.
  – PHPSESSID – session id (login, CSRF protection of forms, the steps of registration and Google sign-in); deleted when you close the browser; HttpOnly, Secure, SameSite=Lax.
  – lang – the chosen website language (pl/en); set when you switch the language; 12 months.
  – menus (browser local storage, not a cookie) – which menu categories are open; until you clear your browser data.
When you go to the payment (PayU) or to Google sign-in, those services may use their own cookies on their pages. You can delete or block cookies in your browser settings – without the session cookie logging in does not work.

§4. Content loaded from other servers
When you view the website, your browser downloads fonts from Google Fonts (Google Ireland Ltd.; servers fonts.googleapis.com and fonts.gstatic.com) and character outfit pictures from outfit-images.ots.me (an external OTS community service, server in France). In doing so your IP address and browser information reach those services. Legal basis: our legitimate interest in displaying the website correctly (Art. 6(1)(f) GDPR).

§5. Recipients
1. Processors acting on our behalf: Hostinger International Ltd. (61 Lordou Vironos Street, 6023 Larnaca, Cyprus) – the VPS in a data centre in the European Union (Lithuania) running the website, the database, the game server and the backups, and the mailbox and mail server we send e-mails through.
2. Separate controllers: PayU S.A. (payments), Google Ireland Ltd. (Google sign-in, Google Fonts), Meta Platforms Ireland Ltd. (Facebook page), the operator of outfit-images.ots.me and your own e-mail provider, which receives our messages.
3. Members of the server staff (e.g. gamemasters) have access to game and account data as far as needed to help players and enforce the rules. We may disclose data to authorities (e.g. courts, prosecutors) when the law requires it.
4. We do not sell data and do not share e-mail addresses with anyone for marketing.

§6. Transfers outside the European Economic Area
Our server is in the EU. Google and Meta may also process data in the USA; Google LLC and Meta Platforms, Inc. are certified under the EU-U.S. Data Privacy Framework, covered by the European Commission's adequacy decision (Art. 45 GDPR), and also use standard contractual clauses (Art. 46 GDPR).

§7. How long we keep data
  – Account, characters and game data, account history, the Google connection, e-mail settings and the history of sent messages – as long as the account exists. A character deleted in Account Management is marked as deleted and hidden; it is removed for good together with the account.
  – We delete an account at your request (write from the account's e-mail address to support@ardenfall.eu). We do not delete accounts for inactivity – if this changes, we will announce it on the website and by e-mail first.
  – Purchase data (orders, payments, invoices) – 5 years from the end of the calendar year of the payment (tax law), and in case of a dispute until it is resolved and the claims are time-barred.
  – Bans and reports – until the penalty expires; the penalty history – as long as the account exists.
  – Web server logs – 14 days (rotated daily). IP-based counters of login and registration attempts – up to 24 hours.
  – Database backups – daily backups for 14 days and 10-minute backups for 48 hours; data deleted from the database disappears from the backups after 14 days at the latest.
  – Correspondence with us – up to 12 months after the matter is closed, for purchases and complaints until the claims are time-barred.
  – Data processed on the basis of consent (game notifications) – until you withdraw consent.

§8. Your rights
You have the right to access your data and get a copy (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), portability of the data you gave us where processing is based on a contract or consent (Art. 20), to object to processing based on our legitimate interest (Art. 21) and to withdraw consent at any time (Art. 7(3)). You can change most data yourself in Account Management; for everything else write to support@ardenfall.eu – we answer without undue delay, within one month at the latest. We may ask you to confirm that you own the account (e.g. a message from the account's e-mail address).
You also have the right to lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl).

§9. Children
The Service is intended for people aged 16 or over. A younger person may create an account and play only with the consent of a parent or legal guardian, and buying points as a minor requires the consent of a parent or guardian. If we learn that a child under 16 created an account without such consent, we will delete it at the request of the parent or guardian.

§10. Automated decisions and profiling
We do not profile users and do not take decisions producing legal effects concerning you or similarly significantly affecting you based solely on automated processing (Art. 22 GDPR). There are only simple technical safeguards – e.g. limits on registrations and login attempts from one IP address, disconnecting a client that floods the server with packets, or no "Invite a Friend" reward when both people play from the same connection. If you think such a safeguard was wrong in your case, write to us – a person will check it. Game notifications (e.g. the reminder after 7 days without playing) follow the simple rules described in §2(5).

§11. Security
The connection to the website is encrypted (HTTPS), the game login is encrypted, passwords are stored as cryptographic hashes, access to the server and the admin panel is restricted, and backups have restricted permissions.

§12. Changes
This policy may change, e.g. when we add a new feature or a new provider. The current version is always on this page; we announce important changes in the news and, when they concern data processed on the basis of consent, also by e-mail.