General Data Protection Regulation (GDPR)

1. Data Controller

The controller of your personal data within the meaning of the GDPR is the operator of the Gameson.site portal (hereinafter referred to as the "Operator").

For communication regarding the processing of personal data, exercising the right to erasure (right to be forgotten), or other privacy-related inquiries, please use exclusively the official contact email: [ gamesonadmin@gmail.com ].

2. What Data We Collect and Why

• Registration Data and Player Profile (Performance of Contract): Email, username, profile picture, and unique identifiers of the login provider (e.g., Google User ID and OAuth tokens) for the purpose of creating, maintaining, and managing your player profile.
• User Content and Private Messages (Performance of Contract): To provide you with the core features of the portal, such as writing comments, rating, uploading profile pictures (UGC), and sending direct messages (DMs) to other players, we must process the content you create, including the metadata of these messages.
• IP Address for Security (Legitimate Interest): We process your IP address at the level of our network infrastructure to protect against DDoS attacks, malicious bots, and spammers.
  Notice of Right to Object: You have the right to object to this processing based on our legitimate interest at any time, free of charge, by sending an email to [ gamesonadmin@gmail.com ]. Processing the IP address is a necessary technical condition for the functioning of the security infrastructure (WAF). If you object to this processing, we are technically unable to continue providing access to our services.
• Analytics and Marketing Data (Consent): We use third-party tools (especially Google Analytics and advertising systems) to analyze traffic, website behavior, and personalize advertisements. These scripts and data collection are triggered exclusively based on your explicit consent in the Cookie Banner.
  Advanced Analytics and Remarketing (Google Signals): If you consent to marketing purposes, we may activate advanced features (e.g., Google Signals). Google may then associate data about your behavior on our portal with your Google account (if you are logged in and have ad personalization enabled) for more accurate cross-device tracking and ad targeting. You can adjust your preferences at any time in your Google Ad Center and view or delete the collected data in the My Activity section.
  Anonymity Guarantee: We never send personally identifiable information (PII) in readable form (e.g., your email or name) to third-party analytics or marketing tools. Your IP address is automatically anonymized before being stored on Google's servers.Data Processing by Google: For more information on how Google collects and processes data when you use our portal, please read the document How Google uses data when you use our partners' sites or apps.
• Personalization and Game Recommendations (Legitimate Interest): We analyze your gaming history, earned XP, and interactions on the platform to customize content and recommend games that might interest you (profiling).
  Notice of Right to Object: You have the right to object to this processing for content personalization at any time via the contact email.

3. Processors, Data Recipients, and Transfers Outside the EU

To ensure global speed and reliability of the portal, we use modern Edge infrastructure. Your data may be processed by these partners (Processors), some of whom are based outside the European Economic Area (EEA). Due to the use of a global Edge network, your IP addresses and technical metadata may be temporarily processed on servers closest to your physical location, even outside the EU.

Third-Party Games (User-Instructed Processing): Our site is technically designed so that until you actively click the "Play" button, no external game content is loaded, and no data transfer occurs. By clicking "Play", you, as the user, give a direct and explicit instruction to your web browser to establish a connection with an external third-party game server and display the game in an isolated frame (iframe). At this point, your browser transmits your IP address and technical parameters directly to the game operator, who becomes an independent controller of this data. The operator of Gameson.site does not technically execute or influence this transfer; it only provides the interface for launching at your instruction.

4. Data Security, Private Messages, and Retention Periods

We apply a strict data minimization policy and do not collect data beyond our technical and legal needs.

• Account and Profile Data: We process data for the duration of the account's active existence. Upon account deletion (at your request or due to a violation of terms), your user data is immediately and irreversibly deleted from our active production database. The account cannot be restored subsequently.
  Technical Backups: To ensure business continuity (Disaster Recovery) and infrastructure security, fragments of your deleted data may reside in encrypted database security backups. These backups are automatically rotated and permanently destroyed within a maximum of 30 days. Data is not retroactively restored for users from these backups.
• Security Logs (IP Addresses and WAF): Automatically purged from our Edge infrastructure no later than 90 days, unless retained as evidence of a cyberattack or ToS violation (permanent ban).
• Analytics and Marketing Data: Data about users and their events (e.g., website interactions) collected via Google Analytics is retained for a maximum of 14 months. After this period, the data is automatically and permanently deleted on the analytics provider's servers.
• Private Messages (DMs) and User Content: Communication between users is not end-to-end (E2E) encrypted. The Operator does not conduct blanket and proactive monitoring of your message content. As soon as a user account is deleted, its complete message history is immediately and irreversibly removed.
  
  You acknowledge that if you decide to share your personal data (e.g., email, contacts on other platforms) in private messages or comments, you do so entirely at your own risk. We process this data solely for the purpose of technical message transmission. An authorized administrator has access to the content of messages exclusively if a specific conversation or user is reported for violating rules (cyberbullying, spam, illegal content) to investigate the incident in accordance with the DSA regulation.

5. Your Rights

You have the right to access your data, data portability, erasure (right to be forgotten), restriction of processing, and the right to object to processing based on legitimate interest. You can withdraw your cookie consent at any time in the website footer.

If you believe that we are handling your data unlawfully, you have the right to file a complaint with the Office for Personal Data Protection or with the supervisory authority in the state of your habitual residence within the EU.