1. Who we are
The controller responsible for your personal data is:
Goldens Cards OÜ
Registry code 17625856 (Estonian Commercial Register)
Harju maakond, Tallinn, Kesklinna linnaosa, Vesivärava tn 50-301, 10152
E-mail: [email protected]
We are a small company and are not legally required to appoint a Data Protection Officer. All privacy questions are handled by our privacy team at [email protected].
2. In short
- We collect only what we need: what you send us, your account details, and minimal technical data to keep the site secure.
- We do not sell your data, use advertising trackers, or build marketing profiles.
- Fonts and scripts are hosted on our own server — visiting our site does not contact Google Fonts or other third parties.
- Optional features (embedded videos, analytics) only run if you agree.
- You can download or delete your data at any time in the Privacy Center or your account.
3. What we process and why
| Activity | Data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Contact form | Name, e-mail, company (optional), topic, message | Answering your enquiry | Art. 6(1)(b) steps before a contract; Art. 6(1)(f) legitimate interest in answering enquiries |
| User account | Display name, e-mail, country (optional), password hash, Support ID, account UUID, optional phone-PIN hash and 2FA secret (encrypted), terms/policy versions accepted, timestamps | Providing your account and its features | Art. 6(1)(b) contract |
| Newsletter | E-mail, consent text, time of sign-up and confirmation | Sending game and studio news | Art. 6(1)(a) consent |
| Phone verification | Support ID, result of PIN check, request type; your PBX call metadata (caller number, time) | Identifying you safely when you call us | Art. 6(1)(b) contract; Art. 6(1)(c) legal obligation when exercising GDPR rights |
| Privacy requests | E-mail, request type, details you provide, dates, outcome | Handling and documenting your GDPR requests | Art. 6(1)(c) legal obligation (Art. 12–22, 5(2) GDPR) |
| Cookie consent | Random consent ID, your choices, policy version, timestamp (no IP address) | Proving that consent was given | Art. 6(1)(c) legal obligation (Art. 7(1) GDPR) |
| Security | Session tokens, failed login counts, audit log of security events | Protecting accounts and our systems from abuse | Art. 6(1)(f) legitimate interest in IT security; Art. 32 GDPR |
4. Contact form
When you contact us, we use your message only to reply and to handle any follow-up. Please do not include special categories of data (such as health information). Messages are deleted automatically after 365 days, unless they become part of a contract or legal claim.
5. User accounts
Creating an account is optional. Your password is never stored in readable form — only a salted scrypt hash. Two-factor secrets are encrypted at rest. Your Support ID (8 digits) and account UUID are random identifiers used to find your account when you contact us, without having to share other details.
You can correct your details, download your data, and delete your account yourself at any time. Accounts that are never verified are deleted after 7 days.
6. Newsletter
We send our newsletter only after you confirm your subscription through a link in a confirmation e-mail (double opt-in). You can withdraw consent at any time via the unsubscribe link in every e-mail, in your account, or in the Privacy Center. Withdrawal does not affect the lawfulness of processing before it. Unconfirmed sign-ups are deleted after 7 days.
7. Phone support & PBX
Our telephone system (a Grandstream UCM PBX) lets account holders verify themselves by keying in their Support ID and a 6-digit phone PIN. The PIN is checked against a one-way hash; staff cannot see it. After 5 wrong attempts phone verification is locked for 30 minutes and we notify you by e-mail.
For your protection, personal data is never read out over the phone: data exports are e-mailed only to your registered address, and deletions requested by phone must also be confirmed through a link sent to that address. Our PBX keeps standard call records (caller number, date, duration). We do not record calls unless we tell you at the start of the call.
8. Privacy requests
To protect you, we verify every request before acting on it — usually by sending a confirmation link to your e-mail address, or through your logged-in account or phone PIN. We keep a record of requests to demonstrate compliance. The e-mail address is removed from a closed request after 90 days (immediately for erasure requests); the remaining anonymised record is deleted after 3 years.
9. Technical data & security
When you visit the site, your browser sends technical information (such as IP address and browser type) that our server needs to deliver the page. Our application does not store IP addresses: rate limiting against abuse is done in memory only. Any infrastructure logs kept by our hosting environment are limited to what is needed for security and are deleted within 14 days.
We protect data with HTTPS/TLS encryption, strict security headers, CSRF protection, salted password hashing, optional two-factor authentication, account lockouts, encrypted secrets, least-privilege admin access with an audit log, and automatic deletion when retention periods end.
10. Cookies & embedded media
We use only strictly necessary cookies by default. Embedded YouTube videos load only after you click play or allow media in your cookie settings; YouTube (Google Ireland Ltd.) then receives your IP address and may set cookies. Analytics, if enabled, is privacy-friendly, self-hosted, and only runs with your consent. Details are in our Cookie Policy.
11. Recipients & processors
We share personal data only with service providers who process it on our behalf under a data processing agreement (Art. 28 GDPR):
- Hosting: Hostinger International Ltd. (VPS server, EU data centre)
- E-mail delivery: Hostinger International Ltd. (e-mail hosting, EU data centre)
- Telephony: our own Grandstream UCM PBX and our telephone line provider
We may disclose data to authorities where we are legally required to. We never sell personal data.
12. International transfers
We store and process your data within the European Economic Area. We do not transfer it to our affiliated company in the United Arab Emirates or to any other country outside the EEA. If that ever becomes necessary, we will use appropriate safeguards such as the European Commission’s Standard Contractual Clauses (Art. 46 GDPR) and update this policy. If you choose to play an embedded YouTube video, Google may process data in the USA under the EU–US Data Privacy Framework.
13. Retention
| Data | Kept for |
|---|---|
| Account | Until you delete it (unverified accounts: 7 days) |
| Contact messages | 365 days |
| Newsletter subscription | Until you unsubscribe (unconfirmed: 7 days) |
| Privacy requests | E-mail removed after 90 days; anonymised record deleted after 3 years; unverified requests after 7 days |
| Data export download links | 7 days |
| Cookie consent records | 3 years |
| Security audit log | 3 years |
| Login sessions | 14 days (admin: 8 hours) |
Deletion runs automatically every hour.
14. Your rights
Under the GDPR you have the right to:
- Access your data and receive a copy (Art. 15)
- Rectification of inaccurate data (Art. 16)
- Erasure (“right to be forgotten”) (Art. 17)
- Restriction of processing (Art. 18)
- Data portability in a machine-readable format (Art. 20)
- Object to processing based on legitimate interests (Art. 21)
- Withdraw consent at any time (Art. 7(3))
- Not be subject to decisions based solely on automated processing (Art. 22) — we do not make such decisions
How: use the Privacy Center, your account, call us and verify with your Support ID and PIN, or e-mail [email protected]. Requests are free. We respond within one month; for complex requests we may extend this by two further months and will tell you why within the first month (Art. 12(3)).
15. Complaints
If you believe we have not handled your data properly, please contact us first so we can put it right. You also have the right to lodge a complaint with a supervisory authority — in Estonia:
Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate)
Tatari 39, 10134 Tallinn, Estonia
[email protected] · www.aki.ee
You may also complain to the authority in the EU country where you live or work.
16. Children
Our website is not directed at children under 13. In Estonia, children under 13 need parental consent for information society services (Personal Data Protection Act § 8). If you believe a child has given us data without consent, contact us and we will delete it.
17. Other information
Providing personal data is voluntary. Without an e-mail address we cannot reply to you or create an account. We do not use your data for profiling or automated decision-making.
18. Changes
We may update this policy when our services or the law change. The version and effective date are shown at the top. If changes are significant, we will notify account holders by e-mail and ask for cookie choices again.