Privacy Policy

Introduction

This Privacy Notice for Quick Action Games ("we," "us," or "our") describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

• Visit www.quickaction.games or any website of ours that links to this Privacy Notice.
• Use Quick Action Games, a small, independent remote board game studio based in Gothenburg, Sweden.
• Engage with us in other related ways, including marketing or events.

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you have questions or concerns, contact us at privacy@quickaction.games.

Summary of key points

This summary provides key points from our Privacy Notice. Use the table of contents to find more detail.

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us, the choices you make, and the products and features you use. Learn more about personal information you disclose to us.

Do we process sensitive personal information? We do not process sensitive personal information.

Do we collect information from third parties? We do not collect information from third parties.

How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, prevent fraud, maintain security, and comply with law. We may also process information for other purposes with your consent. Learn more about how we process your information.

When and with whom do we share personal information? We may share information in specific situations and with specific third parties. Learn more about when and with whom we share your information.

How do we keep your information safe? We use organizational and technical processes designed to protect your information. However, no electronic transmission or storage technology can be guaranteed to be 100% secure. Learn more about how we keep your information safe.

What are your rights? Depending on where you live, privacy law may give you certain rights regarding your personal information. Learn more about your privacy rights.

How do you exercise your rights? Contact us at privacy@quickaction.games. We will consider and act upon requests in accordance with applicable data protection laws.

1. What information do we collect?

Personal information you disclose to us

In short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide when you express an interest in us or our products and Services, participate in activities on the Services, or otherwise contact us.

Personal information provided by you. The information we collect depends on your interactions with us and may include:

• Email addresses
• Contact preferences

Sensitive information. We do not process sensitive information.

All personal information you provide must be true, complete, and accurate, and you must notify us of any changes to it.

2. How do we process your information?

In short: We process your information to provide, improve, and administer our Services, communicate with you, prevent fraud, maintain security, and comply with law. We may process information for other purposes only with your prior explicit consent.

We process your information for reasons that depend on how you interact with our Services, including:

• To send marketing and promotional communications. We may process information you send us for marketing in accordance with your preferences. You may opt out at any time. See What are your privacy rights?
• To measure marketing effectiveness. We may process your information to understand how to provide relevant marketing and promotional campaigns.
• To protect an individual's vital interests. We may process information when necessary to protect someone from harm.
• To communicate product updates. We may use your contact information to share updates about our products and Services.

3. What legal bases do we rely on to process your information?

In short: We process personal information only when we believe it is necessary and have a valid legal basis under applicable law, such as consent, legal compliance, contractual obligations, protection of rights, or legitimate business interests.

If you are located in the EU or UK

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the legal bases on which we rely. These may include:

• Consent. We may process information when you give us permission for a specific purpose. You may withdraw your consent at any time.
• Legitimate interests. We may process information when reasonably necessary for our legitimate business interests, provided those interests do not outweigh your rights and freedoms. This may include sending information about offers and supporting our marketing activities.
• Legal obligations. We may process information to comply with legal obligations, cooperate with authorities, exercise or defend legal rights, or provide evidence in litigation.
• Vital interests. We may process information to protect your vital interests or those of another person.

If you are located in Canada

We may process information with your express or implied consent. You may withdraw your consent at any time. In some exceptional cases, applicable law may permit processing without consent, including:

• When collection is clearly in an individual's interests and consent cannot be obtained in time.
• For investigations and fraud detection and prevention.
• For qualifying business transactions.
• To assess, process, or settle an insurance claim using a witness statement.
• To identify injured, ill, or deceased persons and contact next of kin.
• When we reasonably believe an individual may be a victim of financial abuse.
• When consensual collection would compromise an investigation or the accuracy or availability of information.
• To comply with a subpoena, warrant, court order, or rules for producing records.
• For information produced during employment, business, or a profession, consistent with its original purpose.
• For solely journalistic, artistic, or literary purposes.
• For publicly available information specified by regulations.
• For approved research or statistical projects using de-identified information, subject to ethics and confidentiality safeguards.

4. When and with whom do we share your personal information?

In short: We may share information in the situations described below and/or with the following third parties.

• Business transfers. We may share or transfer information in connection with, or during negotiations for, a merger, sale of company assets, financing, or acquisition of all or part of our business.
• Affiliates. We may share information with affiliates and require them to honor this Privacy Notice. Affiliates include a parent company, subsidiaries, joint ventures, or companies under common control.

5. Is your information transferred internationally?

In short: We may transfer, store, and process your information in countries other than your own.

Our servers are located in South Korea. Regardless of your location, your information may be transferred to, stored by, and processed in our facilities and those of third parties with whom we may share information, including facilities in South Korea and other countries. See When and with whom do we share your personal information?

If you reside in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, these countries may not have data protection laws as comprehensive as those in your country. We take necessary measures to protect your personal information in accordance with this Privacy Notice and applicable law.

European Commission Standard Contractual Clauses

We use the European Commission's Standard Contractual Clauses for certain transfers between our group companies and third-party providers. These clauses require recipients to protect personal information originating in the EEA or UK in accordance with European data protection law. Our clauses and details of similar safeguards with service providers and partners are available upon request.

6. How long do we keep your information?

In short: We retain information only as long as necessary for the purposes in this Privacy Notice, unless law requires otherwise.

We keep personal information only as long as necessary for the purposes set out here, unless a longer period is required or permitted by law, such as for tax, accounting, or other legal requirements.

When we no longer have an ongoing legitimate business need to process your information, we will delete or anonymize it. If that is not possible, for example because it is stored in backup archives, we will securely store and isolate it from further processing until deletion is possible.

7. How do we keep your information safe?

In short: We aim to protect your personal information with organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational measures designed to protect personal information. However, no electronic transmission or storage technology can be guaranteed to be 100% secure. We cannot promise that unauthorized third parties will never defeat our security or improperly collect, access, steal, or modify your information. Transmission to and from our Services is at your own risk, and you should access the Services only in a secure environment.

8. What are your privacy rights?

In short: Depending on your place of residence, including certain US states, the EEA, UK, Switzerland, and Canada, you may have rights that provide greater access to and control over your personal information.

Applicable rights may include requesting access to and a copy of your information, rectification or erasure, restriction of processing, data portability, and protection from solely automated decisions. If a solely automated decision produces legal or similarly significant effects, we will explain the main factors and provide a way to request human review. You may also have the right to object to processing. Contact us using the details in How can you contact us?

We will consider and act upon requests in accordance with applicable data protection laws.

Complaints in the UK

If you are in the UK and are unhappy with how we handled your personal information, you may complain directly to us at privacy@quickaction.games. We will acknowledge your complaint within 30 days, investigate without unjustifiable or excessive delay, keep you informed, and explain the outcome.

If you are dissatisfied with our final response, you can contact the Information Commissioner's Office:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

EEA and UK residents may also complain to their Member State data protection authority or the UK data protection authority. Swiss residents may contact the Federal Data Protection and Information Commissioner.

Withdrawing your consent

If we rely on express or implied consent, you may withdraw it at any time by using the details in How can you contact us? Withdrawal does not affect the lawfulness of earlier processing or, where applicable law allows, processing based on lawful grounds other than consent.

Opting out of marketing

You may unsubscribe from marketing and promotional communications using the unsubscribe link in our emails or by contacting us. We may still send service-related messages, respond to requests, or communicate for other non-marketing purposes.

Questions about your privacy rights may be sent to privacy@quickaction.games.

9. Controls for Do-Not-Track features

Most browsers and some mobile operating systems and applications include a Do-Not-Track ("DNT") setting that can signal a preference not to have browsing activity monitored and collected. No uniform technology standard for recognizing and implementing DNT signals has been finalized. We do not currently respond to DNT browser signals or other automatic tracking preference mechanisms. If a standard we must follow is adopted, we will describe that practice in a revised Privacy Notice.

California law requires us to explain how we respond to DNT signals. Because no industry or legal standard currently exists for recognizing or honoring them, we do not respond to them at this time.

10. Do United States residents have specific privacy rights?

In short: Residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia may have rights to access details about personal information we maintain and process, correct inaccuracies, receive a copy, delete information, or withdraw consent. Applicable law may limit these rights in some circumstances.

Categories of personal information we collect

This table lists categories collected in the past twelve months. Examples are illustrative and do not necessarily reflect information collected from you. See What information do we collect?

We may collect other personal information when you interact with us in person, online, or by phone or mail, including while receiving customer support, participating in surveys or contests, receiving Services, or submitting inquiries. Category A information is retained as long as the user has an account with us.

Sources of personal information

Learn about our sources in What information do we collect?

How we use and share personal information

Learn how we use information in How do we process your information? We may disclose information to service providers under written contracts. See When and with whom do we share your information?

We may use personal information for internal research, technological development, and demonstration. This is not considered a sale of personal information. We have not disclosed, sold, or shared personal information with third parties for a business or commercial purpose in the preceding twelve months, and we will not sell or share personal information belonging to website visitors, users, or other consumers.

Your rights

Rights under US state data protection laws are not absolute, and we may decline a request as permitted by law. They may include:

• The right to know whether we process your personal data.
• The right to access your personal data.
• The right to correct inaccuracies in your personal data.
• The right to request deletion of your personal data.
• The right to obtain a copy of personal data you shared with us.
• The right to non-discrimination for exercising your rights.
• The right to opt out of targeted advertising, sale or sharing of personal data, or profiling that produces legal or similarly significant effects.

Depending on your state, you may also have:

• The right to access categories of personal data being processed.
• The right to obtain categories of third parties to which we disclosed personal data.
• The right to obtain a list of specific third parties to which we disclosed personal data.
• The right to obtain a list of third parties to which we sold personal data.
• The right to review, understand, question, and, where applicable, correct profiling of personal data.
• The right to limit use and disclosure of sensitive personal data.
• The right to opt out of sensitive data collection or data collected through voice or facial recognition features.

How to exercise your rights

Email privacy@quickaction.games or use the contact details at the end of this document. Under certain laws, you may designate an authorized agent. We may deny an agent's request if they do not provide proof of valid authorization.

Request verification

We will verify that you are the person about whom we hold information. We will use information in your request only to verify identity or authority. If existing information is insufficient, we may request additional information for identity verification, security, or fraud prevention. An authorized agent may need to provide your written, signed permission.

Appeals

If we decline your request, certain state laws permit you to appeal by emailing privacy@quickaction.games. We will explain in writing any action taken or not taken. If the appeal is denied, you may complain to your state attorney general.

California "Shine the Light" law

California Civil Code Section 1798.83 permits California residents to request, once a year and free of charge, categories of personal information disclosed to third parties for direct marketing and the names and addresses of those third parties for the preceding calendar year. Submit requests in writing using the details in How can you contact us?

11. Do we make updates to this notice?

In short: Yes. We update this notice as necessary to remain compliant with relevant laws.

The updated version will show a revised date at the top. If we make material changes, we may post a prominent notice or send you a notification. We encourage you to review this notice regularly to stay informed about how we protect your information.

12. How can you contact us about this notice?

If you have questions or comments about this notice, email us at privacy@quickaction.games.

13. How can you review, update, or delete the data we collect from you?

You may have the right to request access to your personal information and details about how we processed it, correct inaccuracies, delete it, or withdraw consent to processing. Applicable law may limit these rights in some circumstances. To submit a request, email privacy@quickaction.games.