PRIVACY POLICY

Last Updated: October 11, 2022

Camouflaj, Inc. (“Camouflaj”, “we”, “our” and/or “us”) values the privacy of individuals who play our games.  This Privacy Policy describes our practices for handling your personal information when you play Iron Man VR (the “Game”) on Meta Quest.  If you are playing Marvel’s Iron Man VR on Sony PlayStation VR, please see Sony’s Privacy Policy at

https://www.playstation.com/en-us/legal/privacy-policy/.  

In this policy, we explain how we collect, use, share, retain and transfer your personal data. You will also learn what your rights are in relation to the processing of your personal data.

1. WHAT KIND OF INFORMATION DO WE COLLECT?

Information You Provide To Us:Such as your name, email address, and any other information you provide to us. For example, you provide us with this kind of information when you communicate with us.We also collect personal information you provide for any contests or promotions that we offer.

Information We Collect Automatically:  When you play the Game, we automatically collect certain information, such as: 

• Certain identifiers that are unique to you.  These identifiers include your display name or username.
• Gameplay activity and statistics, such as how successfully you play a game (for example, score, fights, time spent in game, etc.), actions in the game, and associated metadata.
• Information about the content, and experiences you interact with in the Game. 
• Information about how you access the Game, including information about the type of device you're using (such as the headset, PC, or other connected device) and Internet Protocol ("IP") address.
• Location-related information, which can be derived from information such as your device’s IP address.
• Technical system information such as crash logs which may contain your user ID, device ID, IP address, local computer file path, feature quality, amount of time it takes to load a feature, and whether you use a certain feature.

Information We Collect from Third-Parties:We receive information about you from the Meta Quest platform and other third parties.  For example, we receive user IDs from the Meta Quest platform.To  learn more about how the platform collects, uses, and shares your information https://store.facebook.com/legal/quest/privacy-policy.

2. HOW DO WE USE THIS INFORMATION?

We use the information we collect when you use the Game to:

• Provide the Game to you.  For example, we use this information to enable the functioning of the Game, to communicate with you about the Game, and to provide customer support.
• Understand how you use the Game, and how to develop and improve the Game.  For example, we use the information to identify and address technical issues in the Game, and to potentially develop new features and functionality.  
• Promote security and safety
• Prevent  and address breaches of policies or terms.
• To market and advertise our services including via email campaigns, targeted online advertisements on social media, trade shows, contests and promotions.
• To comply with our legal obligations. We may process personal information as needed to comply with our legal obligations, including if we have a good faith belief that the law requires us to do so.

To the extent we store the information we collect, it is either stored on your device or on secure electronic servers, in various locations around the world (which may be outside the country where you live) for the purposes described in this Policy.

3. HOW IS INFORMATION SHARED?

There are certain circumstances in which we share your information with the Meta Quest platform and certain third parties as set forth below: 

• Certain information you provide will be public.  For example, your player display name is publicly visible on a leaderboard. 
• We share your information with vendors and service providers who support the delivery and improvement of, provide functionality on, or help to enhance the security of the Game. 
• We share information we collect with the Meta Quest platform.  Please visit the Meta Quest platform’s privacy policy to learn more about how the platform collects, uses, and shares your information https://store.facebook.com/legal/quest/privacy-policy.
• We share information with law enforcement or in response to legal requests when we have a good faith belief that (a) the response is required by law in the applicable jurisdiction, affects users in that jurisdiction and is consistent with internationally recognized standards; or (b) it is necessary to detect, prevent, or address fraud or other illegal activity, to protect us (including our rights, or property), our parent or affiliates, you or others, including as part of investigations or to prevent death or immediate harm.
• We share information we collect in connection with a substantial corporate transaction, such as a merger, consolidation, asset sale, or in the unlikely event of bankruptcy.
• We share your information for any other purpose you choose.

We share information globally, in accordance with this Privacy Policy. Information controlled by us will be transferred or transmitted to, or stored and processed in, the United States or other countries outside of where you live for the purposes as described in this Privacy Policy. These data transfers are necessary to provide the services set forth in the Game terms of service (https://camouflaj.com/tos/) and to globally operate and provide the Game to you. We use standard contractual clauses approved by the European Commission (and the equivalent for the UK where appropriate) and rely on the European Commission’s adequacy decisions about certain countries, as applicable, for data transfers from the European Economic Area (“EEA”) to the United States and other countries.

4. HOW LONG DO YOU KEEP THIS INFORMATION?

We store Game data that identifies you until it is no longer necessary to fulfill the purposes for which it was collected as described above (e.g., to provide the Game to you) or until we are notified that you have deleted your Meta Quest user account, whichever comes first, unless retention of the data for a longer period is justified in order to comply with law or recordkeeping obligations, to respond to a legal request, prevent harm, or to improve our safety and security features. This is a case-by-case determination that depends on certain criteria such as the nature of the data, why it is collected and processed, and relevant legal, integrity or operational retention needs.  

Once we no longer need to retain your data, we will destroy it using methods that ensure the data can no longer be retrieved.

5. WHAT RIGHTS DO I HAVE?

Because we process information concerning you, you may assert certain rights about which we want to inform you in this section. The nature and scope of these rights will vary depending on the laws that apply in the jurisdiction where you are based, and not all rights will be available in all jurisdictions. Subject to applicable law, you may assert your rights in writing at the postal address below (Section 11) or by email at whatsup@camouflaj.com.  Before fulfilling your request, we may ask you to provide reasonable information to verify your identity.

Right to Access: You have the right to access (and in some cases, request a copy of) the processed personal data concerning you.

Right to Correction: We only need to process your accurate personal data. You may have the right to the rectification of your personal data which is inaccurate, incomplete, or outdated.

Right to Delete: You may have the right, on certain grounds, to request that we delete your personal data.  For example, if you think that your personal data are no longer needed for the purpose for which they have been processed or if you believe that your personal data are processed by us illegally, you may demand that we delete your personal data.  However, it is not always possible to delete the personal data provided by you, for instance, because of the fact that if we deleted them, you would no longer be able to play the Game.

Right to Suspend Processing: You may have the right, on certain grounds, to request that we suspend processing your data. 

Right to Data Portability: Another right you may assert is the right to data portability based on which we will hand over the personal data provided by you in a commonly used, structured, and machine-readable format or, if you require, we will transfer them to another controller of your own choice, where such transfer is technically feasible.

Right to object to processing on the basis of legitimate interest: If you are an EU or UK resident and we are processing your personal data on the basis of our legitimate interest, you may have the right to object to this processing. Based on the objection, we will consider whether it really is in our interest to process your personal data for the given purpose. If we conclude that we do not have any significant legitimate reasons that prevail over your interests, rights, or freedoms, we will terminate the processing of and delete such personal data.  However, it needs to be stressed that such objections should be well-founded. Therefore, we recommend you to firstly obtain all the necessary information at the above-mentioned email address. If you are under the age of majority in your country and have a limited ability to enter an enforceable contract, we will take particular account of the fact that you are below the age of majority and adjust our assessment of our legitimate interests and the balancing of your interests and rights accordingly.

Right to complain: To make a complaint about our handling of your information, please contact us in writing as described in Section 11 below, including emailing us at whatsup@camouflaj.com.  You may also raise the matter with your local data protection regulator.  Additional information for filing complaints can be found at Sections 7 and 8 below.  

6. HOW WILL WE NOTIFY YOU OF CHANGES TO THIS POLICY?

We'll notify you before we make material changes to this Policy. You’ll have the opportunity to review the revised Policy before you choose to continue using our Products.

7. ADDITIONAL PRIVACY NOTICE FOR CALIFORNIA RESIDENTS

If you are a California resident, you can learn more about your consumer privacy rights by reviewing the California Privacy Notice (https://www.camouflaj.com/ccpa).   

8. ADDITIONAL PRIVACY NOTICE FOR EUROPEAN AND UK RESIDENTS

If you are a resident of one of the countries in the European Economic Area (“EEA”) or the United Kingdom (“UK”), we only process your personal information when we have a valid legal basis under the EU General Data Protection Regulation or related UK privacy laws (“GDPR"). 

The data controller responsible for your information is Camouflaj, Inc., you can contact us by email or post as set out in Section 11 below or contact our representative:

DataRep

12 Northbrook Road

Dublin, Ireland

We collect, use and share the data that we have, as follows:

Contractual Necessity: The provision of certain personal data is necessary to use the Game. You do not have an obligation to provide the personal data, but if you do not provide the data, you will not be able to use the Game. For all people who have the legal capacity to enter into an enforceable contract, we process data as necessary to perform our contracts with you (the Terms of Service for the Game).  The core data uses necessary to provide our contractual services are:

• To understand how you use the game, how to develop and improve the game;
• To market and advertise our services including via email campaigns, targeted online advertisements on social media, tradeshows, contests or promotions;
• To promote safety, integrity and security;
• To transfer, transmit, store or process your data outside the EEA or the UK, including to within the United States and other countries; and
• To communicate with you, for example, regarding product-related issues.

Our legitimate interests or the legitimate interests of a third party, where not outweighed by your interests or fundamental rights and freedoms, including the following:

• To share information with others including law enforcement and to respond to legal requests. The legitimate interests we rely on for this processing are: to prevent and address fraud, unauthorized use of the Game, breaches and violations of our terms and policies or other harmful or illegal activity; to protect ourselves (including our rights, property, and the Game), our users or others, including as part of investigations or regulatory inquiries; or to prevent death or imminent bodily harm.

• To provide marketing communications to you: depending on your settings, we’ll share marketing communications with you. We’ll collect and store your information and use it to send marketing communications to you, like an e-mail. The legitimate interests we rely on for this processing is to promote our products and send our direct marketing.

• For people under the age of majority (under 18 years in most EU countries) who have a limited ability to enter into an enforceable contract, we may be unable to process personal data on the grounds of contractual necessity. Nevertheless, when such a person uses the Games, it is in our legitimate interests to: (a) provide and improve Game for people under their country’s age of consent; (b) promote safety and security; and (c) provide non-marketing communications for the Game or customer service-related issues.  The legitimate interests we rely on for this processing are:

o   To create, provide, support and maintain innovative products and features that enable people under the age of majority to express themselves, play, communicate, discover and engage with information and communities relevant to their interests, build a community and utilize tools and features that promote their well-being.

o   To secure our platform and network, maintain information security and keep the Game free of harmful or inappropriate content; and to protect the safety of people under the age of majority, including to prevent exploitation or other harms to which such individuals may be particularly vulnerable. 

Consent:In certain instances, when we process data that you provide to us based on your consent, you have the right to withdraw your consent at any time with effect for the future, and to port that data you provide to us, under the GDPR. The withdrawal of your consent will not affect the lawfulness of processing based on consent before its withdrawal. If you do decide to withdraw your consent we will stop processing your personal data for that purpose unless there is another lawful basis we continue to rely on for that processing, and this may mean that certain features and services would no longer be available to you. 

We may from time to time ask for your consent to use your personal data for any additional purposes or for a specific purpose. In these circumstances, you are able to withdraw your consent as set out above. 

Compliance with a legal obligation: In certain instances, we process data to comply with certain legal obligations, including processing data when the law requires it, or if there is a valid legal request for certain data (as described in Section 3 above). 

Protection of your vital interests or those of another person:The vital interests that we rely on for this processing include protection of your life or physical integrity or that of others, and we rely on it to combat harmful conduct and promote safety and security.

You also have the right to lodge a complaint with our lead supervisory authority, the Irish Data Protection Commissioner or with your local supervisory authority.

9. ADDITIONAL PRIVACY NOTICE KOREAN RESIDENTS

Camouflaj, Inc. is responsible for your information and has designated Privacy Agent Korea Co., Ltd as our Local Agent in Korea for questions relating to our processing of Korean users’ privacy-related complaints. The foregoing rights may be exercised through your agent or legal representative. You can contact our Local Agent online or by phone or mail at:

Privacy Agent Korea Co., Ltd.

ATTN: Representative director Chun Hee Park

28, Saemunan-ro 5ga-gil, Jongno-gu, Seoul

Phone: 02-737-0455

Email: korealocalagent@support.facebook.com

Measures to ensure the security of your information: We take all reasonable measures to ensure the security of your information, by implementing managerial and technical measures, including:

• We have established and implemented internal policies for our management of personal information, including appointment of executives responsible for privacy and training requirements for employees and contractors responsible for processing personal information.

• We take measures to control and restrict access to personal information, including implementation of access controls and logging access to personal information.

• We use other appropriate measures to help protect your information from loss, theft, misuse, and unauthorized access. These measures include computer safeguards, such as intrusion prevention and detection systems, anti-virus software and firewalls, as well as physical access controls to our buildings and files.

Delegation of processing personal data and overseas transfer of personal data: As set out above, we share personal data with Meta Quest platform, service providers and third parties. These parties may be located outside Korea.

Entities who receive personal data which may relate to people in Korea include those set out in the table below. The table also includes a summary of certain aspects of the arrangements between us and such parties. This table is static and will be updated periodically.

Name: META PLATFORMS TECHNOLOGIES, LLC

Contact information: privacy@support.oculus.com         

Items of personal information to be transferred: User Data   

Recipient’s purpose of use:  Provide measurement, analytics, marketing, advertising and other business services

Destination country: United States      

Transfer date and method: Transferred through telecommunications networks from time to time as needed.

Recipient’s period of retention and use: For as long as necessary to provide the services or as otherwise agreed in a service contract.

10. ADDITIONAL PRIVACY NOTICE FOR JAPAN RESIDENTS

If you are located in Japan, your personal information may be transferred to the United States.  Information regarding such cross-border data transfer is as follows:

• The legislative framework on the protection of personal information is the U.S. Federal Data Privacy System as described athttps://www.ppc.go.jp/files/pdf/USA_report.pdf. 

• Third parties receiving data from us are taking measures in compliance with the eight (8) principles under the OECD Privacy Guidelines.   

11. CONTACTING US

If you have questions, concerns, or complaints about our data processing activities or about this Privacy Policy, please contact us by email at whatsup@camouflaj.com or by post at:

Camouflaj, Inc.

10655 NE 4th, Suite 400

Bellevue, WA 98004

USA

If you have raised a complaint, we will investigate and aim to respond in writing within 30 days. If you are not satisfied with our response to a complaint, you may raise the matter with your local data protection regulator.