1) WHO WE ARE (CONTROLLER)
Sold Out Sales & Marketing Limited trading as Fireshine Games (“Fireshine”, “we”, “us”). Registered office: 3 Dorset Rise, London, EC4Y 8EN
Company number: 06989121.
Privacy contact: privacy@fireshinegames.co.uk
Postal contact for privacy: Privacy Team, Fireshine Games, 3 Dorset Rise, London, EC4Y 8EN
2) WHAT THIS POLICY COVERS
This Policy explains what personal data we collect via our games, websites and online services (collectively, Services), why we collect it, how we use and share it, how long we keep it, international transfers, and your rights.
This Policy does not cover third‐party platforms (e.g., Steam, PlayStation, Xbox, Nintendo, Epic, GOG) or social networks (e.g., TikTok, YouTube, X/Twitter, Reddit, Discord). Please review their privacy notices.
3) PERSONAL DATA WE COLLECT
We collect personal data in these categories:
Account & identifiers: display/name or username, platform IDs (e.g., SteamID), email (if you give it to us), country/region, language, IP address, device identifiers.
Gameplay & telemetry: playtime, region, game items, progression, achievements, crash/ error logs, diagnostics, anti‐cheat/abuse signals, chat logs where moderation is necessary.
Support & community: correspondence, tickets, bug reports, moderation decisions, forum or community submissions.
Marketing & contests (optional): newsletter preferences, campaign participation, survey answers, prize delivery details (name, email, postal address where required by law/logistics).
Cookies/SDKs: identifiers, device and browser details, analytics/measurement, consent preferences. See Cookie Notice.
We never collect or store your third‐party platform passwords. Authentication happens with the platform; we receive only the identifiers/tokens needed to provide the Services.
4) WHERE WE GET YOUR DATA
Directly from you: when you play, contact support, sign up for newsletters, enter contests, or submit surveys.
From platforms/partners (Art. 14): platform IDs, entitlements/licences, region/country, and (if you opt in) display name and friends list needed for game features.
Automatically: via our games/websites (telemetry, diagnostics, security logs) and cookies/SDKs (with consent where required).
5) WHY WE USE YOUR DATA AND LEGAL BASES
Purpose: Provide and operate the Services.
Examples: account linking, entitlements, cross‐save, core gameplay. Legal Basis: Contract (Art. 6(1)(b)).
Purpose: Maintenance, safety & integrity.
Examples: diagnostics, crash reporting, performance, anti‐cheat/abuse prevention, security. Legal Basis: Legitimate interests; (service reliability and safety) (Art. 6(1)(f)).
Purpose: Customer support.
Examples: handling requests, troubleshooting. Legal Basis: Legitimate interests; Contract where applicable.
Purpose: Community & moderation.
Examples: enforcing rules, investigating abuse reports. Legal Basis: Legitimate interests (protecting users and Services).
Purpose: Analytics & improvement.
Examples: feature usage, balancing, quality. Legal Basis: Legitimate interests; Consent for non‐essential cookies/SDKs.
Purpose: Marketing.
Examples: newsletters, promotions. Legal Basis: Consent (you can withdraw at any time).
Purpose: Contests & surveys.
Examples: running and fulfilling contests, research. Legal Basis: Legitimate interests (service variety/quality); Consent where required.
Purpose: Compliance.
Examples: tax, legal requests, fraud prevention. Legal Basis: Legal obligation (Art. 6(1)(c)).
Legitimate interests test: We only rely on legitimate interests where our processing is necessary and balanced against your rights and expectations. You can object to processing based on legitimate interests (see Section 11).
Automated decisions/profiling: We use automated signals to flag suspected cheating or abuse for human review. We do not make decisions with legal or similarly significant effects solely by automated means.
6) Children
We do not knowingly collect personal data from children under 13 or higher local ages where applicable. Where required, we use age‐gating and obtain parental consent. If we discover we have collected data from a child without proper consent, we will delete it.
7) COOKIES AND SDKs
We use a Consent Management Platform. Non‐essential cookies/SDKs (analytics, ads, social media) load only with your opt‐in. You can change choices anytime via Cookie Settings. See our separate Cookie Notice for a full list of providers, purposes, and lifetimes.
7.1 Advertising signal data (TikTok, Meta, Reddit, Google)
If you opt in, we use tags/SDKs and server‐to‐server event APIs provided by TikTok, Meta (Facebook/ Instagram), Reddit, and Google Ads to send pseudonymous event data (e.g., page views, purchases, click IDs, device info, IP address, user‐agent, timestamps) to: measure campaign performance and conversions; cap ad frequency; attribute installs/purchases; and create or exclude audiences (retargeting and lookalikes) where permitted.
We may also use conversion matching features (e.g., Meta CAPI, TikTok Events API, Google Enhanced Conversions) that compare hashed contact details you’ve provided to us (e.g., email) with platform records to improve measurement/audiences. We only send these signals with your consent and in accordance with the platforms’ terms. These platforms typically act as independent controllers of the signal data they receive; they will use it per their privacy notices.
7.2 Custom audiences & matching
With your consent (or where permitted for existing customers), we may upload hashed customer contact data to advertising platforms to include you in, or exclude you from, certain campaigns and to build lookalike audiences. You can opt out at any time by contacting privacy@fireshinegames.co.uk or using the unsubscribe link in our emails. We will maintain a suppression list to honour your choice.
7.3 Managing your choices
Change or withdraw consent at any time via our Cookie Settings (this stops further non‐essential tracking on our Services). You can also use platform controls (Google Ads My Ad Center, Meta Ads Preferences, TikTok ad personalisation settings, Reddit advertising preferences). These are in addition to, not instead of, our cookie controls.
8) WHO WE SHARE DATA WITH
We share personal data only as needed with:
Service providers (processors): hosting (e.g., AWS/Hetzner), crash/diagnostics (e.g., Unity Cloud Diagnostics), email delivery, support tooling, analytics (where consented), anti‐cheat, and security vendors. Contracts require confidentiality, security, and processing only on our instructions.
Advertising & measurement platforms (independent controllers for their tools): when you consent to our tags/SDKs or server‐to‐server events we share signal data with Meta Platforms (Facebook/Instagram), Google (Ads/Analytics), TikTok, and Reddit to measure and deliver advertising, per Section 7. They process that data under their own privacy notices and settings.
Group companies: selected Enad Global 7 companies for administrative, technical, and operational support under intra‐group agreements.
Partner developers/publishers: where necessary to operate a title or feature; typically as processors. Any joint controllership will be disclosed.
Legal/compliance: law enforcement or regulators where required, fraud/integrity investigations, or to protect rights and safety.
Corporate transactions: disclosed as permitted during mergers/acquisitions.
9) INTERNATIONAL TRANSFERS
We may transfer personal data outside the UK/EEA. Where a destination is not covered by an adequacy decision, we use Standard Contractual Clauses and conduct a transfer risk assessment, applying supplementary measures where appropriate. For transfers to the United States we rely on recipients’ EU–US Data Privacy Framework/UK–US Data Bridge certification where applicable, or SCCs.
10) RETENTION
We keep personal data only as long as necessary for each purpose, then delete or anonymise it. Illustrative periods:
Account & platform identifiers: while your account is active + 24 months of inactivity, then deletion/anonymisation.
Telemetry/diagnostics: 12–24 months (aggregate thereafter).
Customer support records: up to 6 years (to establish/defend legal claims).
Marketing preferences & logs of consent/withdrawal: until you opt out; preference logs kept up to 6 years.
Contest fulfilment: 12 months after prize delivery (longer if tax/record‐keeping law applies).
Security/abuse investigation data: for the duration of investigation + up to 36 months where necessary to prevent recidivism/establish claims.
11) YOUR RIGHTS
You have the right to access, rectify, erase, restrict, object (especially to processing based on legitimate interests or direct marketing), and data portability (for data you provided and processing based on consent/contract). You may withdraw consent at any time without affecting prior processing.
How to exercise: email privacy@fireshinegames.co.uk. We may request information to verify your identity. We normally respond within one month.
You can also unsubscribe from marketing via the link in our emails.
Complaints: If you are in the UK, you can contact the Information Commissioner’s Office (ICO). We encourage you to contact us first so we can try to resolve your concern.
YOUR RIGHTS
Your data protection rights
- Your right of access: you have the right to ask us if we are using or storing your personal data. You can also ask us for copies of such personal data.
- Your right to rectification: you have the right to ask us to rectify information you think is inaccurate and to complete information you consider is incomplete.
- Your right to erasure: you have the right to request from us erasure of your personal data when:
- We no longer need your personal data;
- You initially consented to the use of your personal data, but have now withdrawn your consent;
- You have objected to the use of your personal data and your interests outweigh those of Fireshine Games,
- We have collected or used your personal data unlawfully; and/or
- We have a legal obligation to erase your personal data.
- Your right to restriction of processing: you have the right to request from us the restriction of the processing of your personal data as follows:
- Temporarily limit when you have challenged the accuracy of your personal data; or you have objected to the use of your personal data; and /or
- Limit if we processed your personal data unlawfully without you wishing to delete it; and we no longer need your personal data, but you wish us to keep it in order to defend or exercise legal claims.
- Your right to object to processing: you have the right to object to the processing of your personal data if we are using your personal data for (a) a task carried out in the public interest, (b) our legitimate interests, (c) scientific or historical research or statistical purposes; or (d) direct marketing.
- Your right to data portability: this right applies to personal data you have provided to us and where the processing is automated and based on your consent or made under a contract. You have the right to ask us, if technically feasible, to transfer your personal data to a third party or directly provide it to you in a way accessible and machine-readable.
- You also have the right to withdraw consent at any time where the processing is based on your consent (e.g., cookies, marketing communications), without affecting the lawfulness of processing based on consent before such withdrawal. In particular, you may withdraw your consent for the receiving of commercial communications and marketing offers by clicking on the “Unsubscribe” link included in each marketing communication or by contacting Fireshine Games through the procedures described.
- You have the right to lodge a complaint before a supervisory authority – In United Kingdom, the Information Commissioner’s Office.
Where French data protection law is applicable, you also have the right to set guidelines for the retention and communication of your personal information after your death.
12) SECURITY
We use administrative, technical, and physical measures designed to protect personal data, including access controls, encryption in transit and at rest where appropriate, segregation of environments, vulnerability management, and security assessments. No system is 100% secure; you are responsible for keeping credentials confidential.
13) LINKS TO THIRD PARTIES
Our Services may link to third‐party sites/services we do not control. Their privacy practices govern your use of those services.
14) CHANGES TO THIS POLICY
We may update this Policy. For material changes, we will provide notice (e.g., in‐game or on‐site banner and, where we have your email and local law requires, by email) at least 30 days before changes take effect.