1. Introduction and Scope

1.1 This privacy notice (the “Notice”) describes how Ceqio AS processes personal data in connection with the online card game platform available at ceqio.games (the “Service”), currently offered in a beta version.

1.2 Personal data is processed in accordance with Regulation (EU) 2016/679 (the “GDPR”), as incorporated into Norwegian law by the Personal Data Act of 15 June 2018 No. 38 (personopplysningsloven), and other applicable data protection legislation (together, the “Data Protection Legislation”).

1.3 Terms defined in the Data Protection Legislation, including “personal data”, “processing”, “controller” and “processor”, have the same meaning in this Notice.

1.4 The Service does not currently offer paid subscriptions or other payment functionality. No payment or billing data is collected. This Notice will be revised before any such functionality is introduced.

2. Controller

2.1 Ceqio AS, a private limited company registered in the Norwegian Register of Business Enterprises (Foretaksregisteret) under organisation number 938 253 617, with its registered address at Kongens gate 53B, 4608 Kristiansand S, Norway (the “Company”, “we”, “us”), is the controller of the personal data described in this Notice.

2.2 Enquiries concerning this Notice or the Company’s processing of personal data may be directed to privacy@ceqio.games, or by post to the address stated in clause 2.1.

3. Categories of Personal Data Processed

3.1 Account data. Username, display name, email address and password. Passwords are stored exclusively as salted cryptographic hashes and are at no point stored in plain text. The email address is used solely for the account-security messages described in clause 4.1(d). The Company also records which version of the Terms of Service and of this Notice the user accepted, and when. Provision of the account data in this clause 3.1 is a contractual requirement: an account cannot be created without it.

3.2 Gameplay data. Boards played, bids, card plays, scores, ratings and rating history, match and tournament history, and statistics derived from them.

3.3 Session data. An authentication cookie and a per-window session token used to maintain the user’s signed-in state and to enforce a single active session per account. Each login record includes the network (IP) address and browser user-agent string from which it was created.

3.4 Server logs.

• (a) A technical record of each request handled by the Company’s servers, comprising the time of the request, the address requested, the result and processing duration, the browser user-agent string, and a truncated form of the originating network address. Truncation is applied before the entry is written, such that the entry indicates the approximate network origin of a request but not the individual connection. Authentication cookies, the address of the referring page and single-use codes contained in links sent by email (password reset, address verification) are removed before the entry is written.
• (b) Where the web server records an error concerning a request, that entry may contain the full network address and the full address requested.

3.5 Diagnostics. Where a fault occurs, a technical error report comprising the error and stack trace, the page on which it occurred, the browser type, the release version, a record of the user’s recent actions in the Service preceding the fault (such as pages visited, requests made and game actions) and, where available, a pseudonymous account identifier. In addition, the Service reports whether each visit ended without a fault, and performance measurements (such as page load timings) for a sample of visits. Diagnostics are configured to exclude the username, email address, network address, session cookie and single-use codes contained in links sent by email.

3.6 Correspondence. Where a user or visitor contacts the Company by email — for example with a support request, a request for beta access or a request concerning personal data — the sender’s email address, the content of the correspondence and any information provided in it.

3.7 Moderation records. Where the Company acts on a breach of the Terms of Service, such as by suspending an account or requiring a change of display name, a record of the action, its date and the reason for it.

3.8 Aggregate demo counters. For public demonstrations playable without an account, the Company maintains aggregate counters only (visits commenced, hands completed, approximate duration band). No account, identifier, network address or record of any individual visit is stored, and such counters do not constitute personal data.

4. Purposes of Processing and Legal Bases

4.1 The Company processes personal data for the following purposes and on the following legal bases:

• (a) Provision of the Service — administration of user accounts (including the record of acceptance of the Terms of Service), matchmaking, ratings, leaderboards, history and results, and the display of results to other players as described in clause 5.2. Legal basis: performance of a contract to which the data subject is party, cf. GDPR Article 6(1)(b).
• (b) Security and integrity of the Service — protection of accounts, enforcement of a single active session per account, moderation, and prevention of cheating, fraud and abuse. Legal basis: the Company’s legitimate interest in maintaining a secure and fair service, cf. GDPR Article 6(1)(f).
• (c) Fault detection and correction — error diagnostics, performance measurement and operational logging. Legal basis: the Company’s legitimate interest in the technical operation of the Service, cf. GDPR Article 6(1)(f).
• (d) Account-related communication — transactional messages concerning the security of the user’s account (password reset and address verification), the email address being the account’s verification and recovery channel. Legal basis: performance of a contract to which the data subject is party, cf. GDPR Article 6(1)(b). No marketing email is sent.
• (e) Development of the Service — analysis of gameplay records to develop and improve the game, including its rating system and computer opponents. Legal basis: the Company’s legitimate interest in developing and improving the Service, cf. GDPR Article 6(1)(f).
• (f) Handling of correspondence — responding to enquiries and requests sent to the Company. Legal basis: the Company’s legitimate interest in responding to those who contact it, cf. GDPR Article 6(1)(f), and, for requests to exercise the rights described in clause 9, compliance with a legal obligation, cf. GDPR Article 6(1)(c).

4.2 The Company does not carry out automated decision-making producing legal or similarly significant effects within the meaning of GDPR Article 22, and does not process personal data for marketing purposes.

5. Recipients and Visibility

5.1 The Company does not sell personal data and does not disclose personal data for advertising purposes.

5.2 Other players and the public. The Service is a multiplayer game, and:

• (a) the user’s display name is shown to other players wherever the user plays and wherever results are shown;
• (b) the leaderboard (display name, rating, rank tier, number of matches played and record of wins, draws and losses) and tournament results (display name, rank tier and, for each board, the contract, result and score) are published and can be viewed without an account;
• (c) players in the same match, tournament or table can see the user’s bids, card plays and results, and, once a board is finished, other participants who have finished it can replay the complete deal, including the cards the user held;
• (d) signed-in players can view a summary of a player’s rated play: display name, rating, rank tier, number of boards played and average results by phase of the game;
• (e) recorded games of a player featured in the “Challenge a Master” mode are replayed to other players, under that player’s display name, as the mode’s opponent; and
• (f) the username, email address and other account data are not shown to other players.

5.3 Processors. The Company engages the following processors, each of which processes personal data solely on the Company’s documented instructions and subject to a data processing agreement:

• (a) Google Cloud EMEA Limited (Ireland) — hosting of the application, database and backups (Google Cloud Platform);
• (b) Functional Software, Inc. (Sentry) (United States) — error monitoring, limited to the diagnostics described in clause 3.5 and configured as described there, with session replay disabled;
• (c) Google Cloud EMEA Limited (Ireland) — Google Workspace, used to send transactional email (password reset and address verification) and for the Company’s own mailboxes, including the correspondence described in clause 3.6.

5.4 The Company may disclose personal data where required to do so by law or by order of a competent authority.

5.5 Communications directed to the Company through third-party platforms (such as Discord) are subject to the privacy terms of the platform concerned, for which the Company accepts no responsibility. Enquiries concerning personal data should be directed to the address stated in clause 2.2.

6. Storage Location and Transfers Outside the EEA

6.1 Storage. The application, database and backups are stored in Google Cloud’s Stockholm region in Sweden, and recent backup copies are also kept on the Company’s own equipment in Norway. Error diagnostics are stored in Sentry’s European region in Frankfurt, Germany.

6.2 Access and processing outside the EEA. The processors named in clause 5.3, and their subprocessors, may access or process personal data from countries outside the European Economic Area, including the United States, in the course of maintenance, security and technical support. Email sent or received through Google Workspace may in addition be stored and processed outside the European Economic Area, as the edition used by the Company does not allow the storage region to be chosen.

6.3 Safeguards. Such transfers are made on the following bases:

• (a) transfers to Google LLC and to Functional Software, Inc. in the United States rely on the European Commission’s adequacy decision for the EU–U.S. Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), which applies in Norway under the EEA Agreement and under which both companies are certified (see the Data Privacy Framework list); and
• (b) transfers to other countries that do not benefit from an adequacy decision rely on the standard contractual clauses adopted by the European Commission (Commission Implementing Decision (EU) 2021/914), as incorporated in the processors’ data processing terms: Google’s Cloud Data Processing Addendum and Sentry’s Data Processing Addendum, the latter of which also applies those clauses to transfers to Sentry should the Data Privacy Framework cease to apply.

6.4 Apart from the processing described in this clause 6, the Company does not transfer personal data outside the European Economic Area. A copy of the applicable safeguards may be requested via the address stated in clause 2.2.

7. Cookies and Local Storage

7.1 The Service sets a single cookie, which keeps the user signed in, and keeps a sign-in marker for each browser tab in the browser’s session storage. Both are strictly necessary for providing the Service at the user’s request within the meaning of the applicable rules on cookies and similar technologies, and consent is accordingly not required.

7.2 To provide functions the user makes use of, the Service also stores the following in the browser’s local storage on the user’s own device: (a) the username or email address entered at sign-in, only where the user selects “Remember my username”; (b) the user’s gameplay settings, such as card highlighting and sounds; and (c) a reference to the user’s tournament game in progress, so that it can be resumed. These items are not shared with any third party and can be removed through the browser’s settings.

7.3 The Service does not use advertising cookies, analytics cookies or third-party tracking technologies, and loads no content from third-party servers.

8. Retention

8.1 Personal data is retained no longer than necessary for the purposes for which it is processed, and in accordance with the following periods:

• (a) Account and gameplay data — for the duration of the account. When the account is deleted, the account data and the associated gameplay data are deleted without delay, except that (i) the record of the user’s participation in a ranked match is kept as part of that match, with the username removed, and (ii) recorded games of a player featured in the “Challenge a Master” mode are kept for that mode until the player asks for their removal;
• (b) Login sessions — while the session remains in use, and no longer than 60 days after last use; deleted immediately upon sign-out;
• (c) Server logs — up to 30 days;
• (d) Backups — up to 30 days. Data deleted from the Service may persist in a backup until that backup expires;
• (e) Diagnostics — 30 days;
• (f) Correspondence — for as long as needed to deal with the enquiry and any follow-up, and no longer than 12 months after it has been concluded, unless needed to establish, exercise or defend a legal claim;
• (g) Moderation records — for the duration of the account;
• (h) Aggregate demo counters — retained indefinitely, as they contain no personal data.

9. Rights of the Data Subject

9.1 Subject to the conditions and limitations set out in the Data Protection Legislation, the data subject has the right to request access to, rectification or erasure of personal data, restriction of processing, the right to object to processing (including processing based on the Company’s legitimate interests), and the right to data portability. Where processing is based on consent, consent may be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal.

9.2 An account may be deleted at any time through the account settings, with the effect described in clause 8.1(a). Other requests may be directed to the address stated in clause 2.2.

9.3 Requests are answered without undue delay and in any event within one month of receipt, which may be extended where GDPR Article 12(3) permits. To protect the account, the Company may ask that a request concerning an account be sent from the email address registered to it.

9.4 The data subject has the right to lodge a complaint with a supervisory authority. The competent supervisory authority for the Company is Datatilsynet (the Norwegian Data Protection Authority).

10. Children

10.1 Users must be at least 13 years old, or older where the law of the user’s jurisdiction sets a higher minimum age (Terms of Service clause 2.1), and the Service is not directed to children below that age. Where the Company becomes aware that personal data has been collected from a child below the applicable age, such data will be erased. Notification may be given to the address stated in clause 2.2.

11. Amendments

11.1 The Company may amend this Notice from time to time, in particular as the Service develops during the beta period. The version and effective date stated above will be updated accordingly, and prior versions are retained on record. Material changes will be presented in the Service.