GDPR INFORMATION

01 Data controller

The data controller within the meaning of Art. 4(7) GDPR is:

02 What personal data do we process?

Data provided during registration

• Username (pseudonym - no obligation to use your real name)
• Email address
• Hashed password (Bcrypt - plaintext passwords are never stored)

Automatically generated data

• IP address during registration, login and significant actions
• Browser type, operating system and language setting (User-Agent)
• Session cookies and session IDs
• Action timestamps (online_at, created_at, etc.)

In-game activity data

• Rank, level, XP, cash, statistics
• Action log (crimes, attacks, transactions)
• Forum and message communication
• Family membership data

Payment data (premium only)

• We never store full payment details such as card numbers.
• Premium transactions are processed through external payment providers (Stripe or iDEAL provider). We only receive a transaction ID, amount and status.
• For prize payout: IBAN account number in the player's name - used only for the specific transfer.

03 Legal bases (Art. 6 GDPR)

04 Processing purposes

We process personal data exclusively for the following purposes:

• Service delivery: Creating and managing accounts, granting access to the game.
• Gameplay: Storing in-game progress, leaderboards and family interactions.
• Communication: Responding to contact requests, sending technical notifications and (with consent) newsletters.
• Security and integrity: Detecting fraud, bots, multi-accounting and other rule violations.
• Prize pool payout: Processing winner information and bank transfers.
• Legal obligations: Financial administration, retention duties and cooperation with authorities in criminal matters.
• Product development: Anonymized gameplay analysis to improve the platform (no individual profiling).

We never sell personal data to third parties and do not use it for external ad profiling.

05 Retention periods

After the retention period expires, data is securely deleted or anonymized.

06 Sharing with third parties

We share personal data with third parties only where necessary and in line with GDPR:

All processors are bound by a data processing agreement in accordance with Art. 28 GDPR. We never sell, rent or trade personal data.

07 Transfers outside the EEA

Crimora.nl aims to process and store all personal data within the European Economic Area (EEA). If a third-party service provider (e.g. payment provider) processes data outside the EEA, this only happens based on:

• An adequacy decision by the European Commission; or
• Standard Contractual Clauses (SCCs) under Art. 46 GDPR.

Upon request, we provide information on the specific safeguards per third party.

08 Security (Art. 32 GDPR)

Crimora.nl applies appropriate technical and organizational measures to protect personal data:

• Encryption: HTTPS / TLS for all traffic; passwords stored as Bcrypt hashes.
• Access control: Least-privilege principle; only authorized personnel can access production data.
• Monitoring: Automated monitoring for suspicious activity and intrusion attempts.
• Backups: Regular encrypted backups with limited retention.
• Dependency management: Regular security updates of software components.

Data breaches (Art. 33-34 GDPR)

In case of a data breach that poses risk to data subjects, we inform the Dutch Data Protection Authority within 72 hours. Data subjects are informed without undue delay if the breach poses a high risk to their rights. Report suspected data breaches to privacy@crimora.nl.

09 Minors

Crimora.nl is not intended for children under 16 years (UAVG art. 16). We do not knowingly collect personal data from persons under 16. If we become aware that an account belongs to someone under 16 without parental consent, the account and related data will be removed.

Parents or guardians who suspect their child created an account can contact us via privacy@crimora.nl.

10 Your rights

Under GDPR you have the following rights: access, rectification, erasure, restriction, objection and portability. See our detailed Player Rights page for full details and how to submit a request.

You can also file a complaint with the Dutch Data Protection Authority:
autoriteitpersoonsgegevens.nl — Postbus 93374, 2509 AJ The Hague — +31 88 180 52 50.