Politika privatnosti

1. Controller

The controller of personal data connected with ocheGO is Bartłomiej Wawrzyniak, address: ul. Poznańska 37, 63-005 Kleszczewo, Poland, e-mail: [email protected], hereinafter the ‘Controller’.

2. Information processed

Local data

The Website stores the player profile, preferences, game settings and participants, local identifiers, game state, scores, throws, history and statistics in localStorage and IndexedDB. The selected language is stored in an essential cookie. A service worker may cache pages and resources needed for offline operation. Gameplay and profile data remain on the device and are not sent to the Controller’s database.

Technical data

The server or hosting provider may automatically record the IP address, request date and time, requested address, response code, browser and device information, referrer, diagnostics and security data.

Contact

When a user contacts the Controller, the message data are processed, particularly the e-mail address, correspondence and details needed to reply.

Google Analytics 4

After technical activation and any required consent, the Website may use Google Analytics 4 for statistics, traffic measurement and improvement. Processing may include online and cookie identifiers, IP address, approximate location, device, operating system and browser information, visit source, pages viewed and usage events. The Controller does not intend to send player names, correspondence or other information allowing Google to identify a user directly.

Google AdSense

After advertising is technically activated and depending on user choices, the Website may use Google AdSense to display and measure ads, prevent abuse and — only with appropriate consent — personalise ads. Google and its partners may use cookies, device storage, online and advertising identifiers and process IP address, device and browser information, approximate location, content viewed and ad interactions.

Consent management

The Website may use a certified consent management platform (CMP), including a Google solution compliant with the IAB Europe Transparency & Consent Framework. The CMP may store the user’s choice, decision date and time, message version, accepted purposes and vendors and the technical TCF consent string to apply and demonstrate the choice.

3. Purposes and legal bases

• providing the Website — performance of a contract, Article 6(1)(b) GDPR;
• security, diagnostics, abuse prevention and claims — legitimate interests, Article 6(1)(f) GDPR;
• contact and complaints — Article 6(1)(b), (c) or (f) GDPR, depending on the matter;
• Google Analytics 4 and optional access to or storage of information on a device — consent, Article 6(1)(a) GDPR and applicable electronic communications privacy law;
• displaying, measuring and personalising ads through optional identifiers or device storage — consent, Article 6(1)(a) GDPR and applicable electronic communications privacy law;
• recording and demonstrating consent choices — legal obligation or legitimate interest in accountability, Article 6(1)(c) or (f) GDPR.

Refusing analytics or advertising consent does not restrict basic functions. Consent is not required for technologies technically necessary to provide functions requested by the user.

4. Providers and recipients

Data may be processed by cloud infrastructure, e-mail, IT and security providers and disclosed to authorities where required by law.

Once the relevant functions are enabled, the recipient of data related to Google Analytics, Google AdSense and consent management may be Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, Google group companies and vendors shown in the CMP. The current vendor list, purposes and legal bases will be available under ‘Privacy and cookie settings’. Information is available at How Google uses information from sites and apps.

5. Transfers outside the EEA

Providers may transfer data to the United States or other countries outside the EEA. Transfers rely on a GDPR mechanism, particularly an adequacy decision, including the EU–U.S. Data Privacy Framework for covered recipients, or European Commission Standard Contractual Clauses with supplementary safeguards where required.

6. Retention

• local game, profile and preference data — until deleted by the user, Website or browser;
• essential language cookie — up to 12 months;
• offline copies — until replaced or deleted by the Website, user or browser;
• technical logs — for the provider’s period, no longer than needed for operation, diagnostics and security;
• correspondence — while handling the matter and then until limitation periods expire or law requires otherwise;
• Google Analytics data — once enabled, under the Controller’s configuration, no longer than 14 months for user-level and event data unless earlier deletion or longer retention is legally required;
• consent information — as needed to apply and demonstrate the choice, generally no longer than five years from the choice or latest change;
• advertising data — for periods set by Google and vendors disclosed in the CMP, depending on purpose and identifier type.

7. Cookies and privacy settings

The Website uses essential technologies for language, preferences, profiles, games and offline operation. Once Analytics or AdSense is implemented, optional cookies and similar technologies will be used only after any required consent. Categories may include analytics, advertising, ad measurement, advertising user data and ad personalisation.

Users will be able to accept, reject or configure purposes and vendors in the CMP and later reopen ‘Privacy and cookie settings’ to change or withdraw consent at any time. Withdrawal does not affect prior lawful processing. Browser settings may also be used to delete data, which can remove the local profile, history, settings and offline capability.

8. User rights

Where provided by the GDPR, users may request access, rectification, erasure, restriction and portability, object to processing based on legitimate interests and withdraw consent.

Requests may be sent to [email protected]. Users may also lodge a complaint with the President of the Polish Personal Data Protection Office or their competent supervisory authority.

9. Voluntary data, profiling and automated decisions

Providing correspondence data is voluntary, but without contact details a reply may be impossible. Refusing optional analytics and advertising does not restrict basic functions. If a user consents to personalised advertising, Google and advertising partners may create or use an interest profile to select ads. The Controller does not make decisions producing legal or similarly significant effects based solely on automated processing.

10. Security and changes

The Controller applies technical and organisational measures appropriate to risk. The optional Google services described above will begin processing only after technical activation and, where required, consent. This Policy may change following changes to functions, configuration, providers or law. The current version and effective date will be published here.