LEGAL
PRIVACY POLICY
We take your privacy seriously. In this statement we explain clearly and transparently what we do with your data, why, and how you remain in control.
TABLE OF CONTENTS
01 Introduction & contact details
Crimora.nl (hereafter: "we", "us") is an online browser MMORPG based in the Netherlands. We are the data controller within the meaning of the General Data Protection Regulation (GDPR, Regulation 2016/679) and the Dutch UAVG.
Do you have questions about this privacy statement or how we handle your data? Please contact us:
| Email (privacy) | privacy@crimora.nl |
| Email (general) | info@crimora.nl |
| Contact form | crimora.nl/contact |
| Country | Netherlands |
| Supervisory authority | Dutch Data Protection Authority - autoriteitpersoonsgegevens.nl |
02 What data do we process?
2.1 Data you provide to us
- Username: Alias chosen by you. You are not required to use your real name.
- Email address: Required for login, password recovery and important communication.
- Password: Stored as an encrypted Bcrypt hash. We never see your plaintext password.
- Contact messages: Content of messages you send via the contact form.
- IBAN: Only for prize payouts, in your own name, used once for bank transfer.
2.2 Automatically generated data
- IP address: Logged during registration, login and security-relevant actions. Stored for 90 days.
- User-Agent: Browser type and operating system for compatibility monitoring.
- Session data: Temporary session cookies that expire on logout.
- Online timestamps: When you are active, for leaderboard and gameplay purposes.
2.3 In-game activity data
Everything you do in the game is stored because it forms the core of gameplay: XP, cash, actions, purchases, attacks and crime logs. This is game-related data inseparably linked to your account.
2.4 What we do not collect
- Copies of identity documents (no KYC)
- BSN numbers
- Biometric data
- Full payment card data (credit card numbers are never stored)
- Location data other than your chosen in-game "city"
- Personal data of minors under 16 years old (in line with UAVG)
03 Cookies and tracking
Crimora.nl uses cookies in line with Dutch telecom law and GDPR:
| Cookie | Type | Purpose | Retention period |
|---|---|---|---|
PHPSESSID | Functional (required) | Session management, login status | Session (expires on browser close / logout) |
| CSRF-token | Functional (required) | Protection against cross-site request forgery | Session |
| Preference cookies | Functional | Remember UI preferences | 30 days |
| Analytics cookies | Optional (consent) | Anonymous usage statistics for improvements | 12 months |
Functional cookies are required for the site to work and do not require consent. Optional analytics cookies are only set after your explicit consent through the cookie banner.
You can remove cookies via your browser settings. Note: deleting the session cookie logs you out.
04 Why do we process your data?
We process data only for specific, explicit and legitimate purposes (Art. 5(1)(b) GDPR):
| Purpose | Legal basis |
|---|---|
| Account creation and authentication | Performance of a contract (Art. 6(1)(b)) |
| Gameplay progress, leaderboard and action storage | Performance of a contract (Art. 6(1)(b)) |
| Customer support and contact handling | Legitimate interest (Art. 6(1)(f)) |
| Premium payment processing | Performance of a contract (Art. 6(1)(b)) |
| Prize pool payout (IBAN processing) | Performance of a contract (Art. 6(1)(b)) |
| Statutory retention duty (tax administration) | Legal obligation (Art. 6(1)(c) - Art. 52 AWR) |
| Fraud detection, security, anti-cheat | Legitimate interest (Art. 6(1)(f)) |
| Anonymous product development and analysis | Legitimate interest (Art. 6(1)(f) - anonymized) |
| Newsletter (if subscribed) | Consent (Art. 6(1)(a)) |
| Disclosure to justice / police | Legal obligation (Art. 6(1)(c)) |
We never use your data for automated decision-making with significant effects (Art. 22 GDPR).
05 How long do we keep your data?
We do not keep data longer than necessary for the purpose for which it was collected (storage limitation principle, Art. 5(1)(e) GDPR):
| Data type | Retention period |
|---|---|
| Account (active) | As long as the account is active |
| Account after voluntary deletion | 180 days (for dispute handling), then permanently deleted |
| IP addresses / security logs | 90 days |
| In-game action log | Active round + 1 year |
| Premium transaction records | 7 years (tax law, Art. 52 AWR) |
| IBAN data (prize payout) | 7 years (financial administration) |
| Contact messages | 2 years |
| Backup data | Maximum 90-day rotation |
06 Who do we share your data with?
We share personal data only with trusted parties and only where necessary. A data processing agreement (Art. 28 GDPR) is in place with all processors:
- Hosting provider: Servers and database storage within the EEA.
- Payment provider: Processing of premium payments (Stripe / iDEAL). We only receive transaction ID, amount and status - never full card data.
- Bank: Only for prize payout transfer.
If legally required (for example by order of justice or police), we provide only the minimum required data after verifying the legal basis.
We never sell, rent or trade personal data.
07 Transfers outside the EEA
In principle, we process and store all data within the European Economic Area (EEA). If service providers process data outside the EEA, this only happens under appropriate safeguards:
- EU adequacy decision (Art. 45 GDPR); or
- Standard Contractual Clauses (SCC's) of the European Commission (Art. 46 GDPR).
Upon request, we inform you about the specific safeguards per provider.
08 Your rights
Under GDPR and UAVG you have the following rights. See our Player Rights page for full details and how to exercise them:
- Access (Art. 15 GDPR) - Request which data we hold about you.
- Rectification (Art. 16 GDPR) - Correct inaccurate data.
- Erasure (Art. 17 GDPR) - Full deletion of your account and data.
- Restriction (Art. 18 GDPR) - Temporarily stop processing.
- Objection (Art. 21 GDPR) - Object to processing based on legitimate interest.
- Data portability (Art. 20 GDPR) - Receive your data in a machine-readable format.
- Withdraw consent (Art. 7(3) GDPR) - Withdraw consent without negative consequences.
All requests are handled via the contact form or privacy@crimora.nl. Response time: 30 days.
Not satisfied? You can always file a complaint with the Dutch Data Protection Authority: autoriteitpersoonsgegevens.nl.
09 Security
We apply appropriate technical and organizational security measures in accordance with Art. 32 GDPR:
- TLS/HTTPS: All connections are encrypted.
- Bcrypt password hashing: Passwords are never stored in plaintext.
- Minimal data storage: We only keep what is necessary.
- Access control: Production data is only accessible to authorized staff.
- Data breach procedure: In case of a breach we notify the authority under Art. 33-34 GDPR (within 72 hours) and affected users as soon as possible.
10 Changes to this statement
Crimora.nl reserves the right to change this privacy statement. The version date at the top of this page indicates the date of the latest update. For substantial changes you will receive a notice by email or in-game message. Continued use of the platform after the effective date implies acceptance of the updated statement.
Previous versions are available on request via privacy@crimora.nl.
PRIVACY QUESTIONS?
Email: privacy@crimora.nl - Contact form: crimora.nl/contact (subject: "Privacy request") - Response within 5 business days.