Effective as of: December 10, 2018
The Information we collect from Children, how we use it, and how and when we Communicate with Parents
SwapBots is primarily targeted at children, but is also intended for users of all ages and their families – as such it is GDPR compliant. Our Application may collect information from children. Below we summarize potential instances of collection and outline how and when we will provide parental notice and/or seek parental consent. In any instance that we collect personal information from a child, we will retain that information only so long as reasonably necessary to allow the child to continue to participate in the Application, and ensure the security of our users and our services, or as required by law. In the event we discover we have collected information from a child in a manner inconsistent with GDPR-K or COPPA’s requirements, we will either delete the information or immediately seek the parent’s consent for that collection. The only personally identifiable information collected via the SwapBots application is the email address of the parent or guardian using the app. This is only used for the consent process to allow this application to be used by all ages and in order to be able to recover the account in the event that the user cannot recall their login details. The email will be kept on record with a third-party service (Amazon Web Services GameSparks).
Usage data of the app itself such as session duration.
Country app is used in.
Device model app is used on.
Email associated with Application.
The email address submitted by the user will be discarded within a reasonable amount of time upon request.
Children can register an account in order to play the SwapBots application, track progress and save data, amongst other things. During the registration process, we may ask the child to provide certain information for notification and security purposes, including a parent or guardian’s email address. We also may ask for birth dates from children to validate their ages. Children are not able to provide any personal information in their usernames, as they are generated by the Application. The username generated by the application will not be a readily identifiable term drawn from the name or email address of the player in order to help maintain anonymity for the player. A random and arbitrarily issued ‘friend code’ may be generated by the game to allow players to locate each other within the online multiplayer application. This will not be transmitted within the app, the responsibility of distributing the friend code will lie solely with the player. Players may not be able to access certain features if required information has not been provided. We will not require a child to provide more information than is reasonably necessary in order to participate in an online activity.
Consistent with the requirements of COPPA and GDPR-K, on any child-targeted site or application, or in any instance where we ask for age and determine the user is age 12 or under (or 16 or under in the relevant territories), we will ask for a parent or guardian email address before we collect any personal information from the child. If you believe your child is participating in an activity that collects personal information and you or another parent/guardian have NOT received an email providing notice or seeking your consent, please feel free to contact us at email@example.com. We will not use parent emails provided for parental consent purposes to market to the parent, unless the parent has expressly opted in to email marketing or has separately participated in an activity that allows for such email contact.
In the event SwapBots wishes to collect personal information from a child, COPPA and GDPR-K requires that we first seek a parent or guardian’s consent by email. In the email we will explain what information we are collecting, how we plan to use it, how the parent can provide consent, and how the parent can revoke consent. If we do not receive parental consent within a reasonable time, the account will remain active as there is no other personally identifiable data used by the Application. Some features may be limited for the user in this scenario. This type of email consent is often called email plus and is compliant with COPPA best practice.
With regard to school-based activities, COPPA allows teachers and school administrators to act in the stead of parents to provide consent for the collection of personal information from children. Schools should always notify parents about these activities.
When Information collected from Children is available to Others
In extremely rare instances, we also may share or disclose personal information collected from children in a limited number of instances, including the following:
We may share information with our service providers if necessary for them to perform a business, professional, or technology support function for us.
We may disclose personal information if permitted or required by law, for example, in response to a court order or a subpoena. To the extent permitted by applicable law, we also may disclose personal information collected from children (i) in response to a law enforcement or public agencies (including schools or children services) request; (ii) if we believe disclosure may prevent the instigation of a crime, facilitate an investigation related to public safety or protect the safety of a child using our sites or applications; (iii) to protect the security or integrity of our sites, applications, and other technology, as well as the technology of our service providers; or (iv) enable us to take precautions against liability.
At any time, parents can refuse to permit us to collect further personal information from their children in association with a particular account, and can request that we delete from our records the personal information we may have collected in connection with that account. Please keep in mind that a request to delete records may lead to a termination of an account or other service. Parents can request this by contacting firstname.lastname@example.org.
Among the types of Personal Data that this Application collects, by itself or through third parties, there are: usage data, data formed by use of this service such as high scores, email address, date of birth, country, device logs and device model information.
Users are responsible for any third-party Personal Data obtained, published or shared through this Application and confirm that they have the third party’s consent to provide the Data to the Owner.
The Owner takes appropriate security measures to prevent unauthorized access, disclosure, modification, or unauthorized destruction of the Data.
The Data processing is carried out using computers and/or IT enabled tools, following organizational procedures and modes strictly related to the purposes indicated. In addition to the Owner, in some cases, the Data may be accessible to certain types of persons in charge, involved with the operation of this Application (administration, sales, marketing, legal, system administration) or external parties (such as third-party technical service providers, mail carriers, hosting providers, IT companies, communications agencies) appointed, if necessary, as Data Processors by the Owner. The updated list of these parties may be requested from the Owner at any time.
The Owner may process Personal Data relating to Users if one of the following applies:
– Users have given their consent for one or more specific purposes. Note: Under some legislations the Owner may be allowed to process Personal Data until the User objects to such processing (“opt-out”), without having to rely on consent or any other of the following legal bases. This, however, does not apply, whenever the processing of Personal – Data is subject to European data protection law;
– provision of Data is necessary for the performance of an agreement with the User and/or for any pre-contractual obligations thereof;
– processing is necessary for compliance with a legal obligation to which the Owner is subject;
– processing is related to a task that is carried out in the public interest or in the exercise of official authority vested in the Owner;
– processing is necessary for the purposes of the legitimate interests pursued by the Owner or by a third party.
In any case, the Owner will gladly help to clarify the specific legal basis that applies to the processing, and in particular whether the provision of Personal Data is a statutory or contractual requirement, or a requirement necessary to enter into a contract.
The Data is processed at the Owner’s operating offices and in any other places where the parties involved in the processing are located.
Depending on the User’s location, data transfers may involve transferring the User’s Data to a country other than their own. To find out more about the place of processing of such transferred Data, Users can check the section containing details about the processing of Personal Data.
Users are also entitled to learn about the legal basis of Data transfers to a country outside the European Union or to any international organization governed by public international law or set up by two or more countries, such as the UN, and about the security measures taken by the Owner to safeguard their Data.
If any such transfer takes place, Users can find out more by checking the relevant sections of this document or inquire with the Owner using the information provided in the contact section.
Personal Data shall be processed and stored for as long as required by the purpose they have been collected for. Therefore:
– Personal Data collected for purposes related to the performance of a contract between the Owner and the User shall be retained until such contract has been fully performed.
– Personal Data collected for the purposes of the Owner’s legitimate interests shall be retained as long as needed to fulfill such purposes. Users may find specific information regarding the legitimate interests pursued by the Owner within the relevant sections of this document or by contacting the Owner.
The Owner may be allowed to retain Personal Data for a longer period whenever the User has given consent to such processing, as long as such consent is not withdrawn. Furthermore, the Owner may be obliged to retain Personal Data for a longer period whenever required to do so for the performance of a legal obligation or upon order of an authority.
Once the retention period expires, Personal Data shall be deleted. Therefore, the right to access, the right to erasure, the right to rectification and the right to data portability cannot be enforced after expiration of the retention period.
The Data concerning the User is collected to allow the Owner to provide its Services, as well as for the following purposes: Hosting and backend infrastructure, Analytics and Beta Testing.
Users can find further detailed information about such purposes of processing and about the specific Personal Data used for each purpose in the respective sections of this document.
All personal data collected via the application is held by the third party providers listed in this document.
Detailed information on the processing of Personal Data
Personal Data is collected for the following purposes and using the following services:
The services contained in this section enable the Owner to monitor and analyze web traffic and can be used to keep track of User behavior.
Unity Analytics (Unity Technologies ApS)
Unity Analytics is an analytics service provided by Unity Technologies ApS.
This type of service makes it possible to manage User access to this Application, or parts of it, for the purpose of testing a certain feature or the entire Application. The service provider may automatically collect data related to crashes and statistics related to the User’s use of this Application in a personally identifiable form.
TestFlight (Apple Inc.)
TestFlight is a beta testing service provided by Apple Inc..
Personal Data collected: app information, Cookies, country, Data communicated while using the service, date of birth, device information, device logs, email address and Usage Data.
This type of service has the purpose of hosting Data and files that enable this Application to run and be distributed as well as to provide a ready-made infrastructure to run specific features or parts of this Application. Some of these services work through geographically distributed servers, making it difficult to determine the actual location where the Personal Data are stored.
GameSparks (Amazon Web Services)
GameSparks is a game backend infrastructure solution. Personal data collected by GameSparks may include: country app is used in, device model app is used on, email associated with Application.
Place of processing: United States
Vuforia (Qualcomm Connected Experiences, Inc.)
Vuforia is a hosting and backend service provided by Qualcomm Connected Experiences, Inc.
This Application may track Users by storing a unique identifier of their device and/or account, for analytics purposes or for storing Users’ preferences.
For any additional queries regarding the handling of data by these third party services to SwapBots:
24 Hardman Street