Privacy Policy
PRIVACY POLICY
CityCode – urban adventure game platform
https://citycode.hu
1. Introduction
1.1. This Privacy Policy (hereinafter: Policy) describes what personal data the operator of the CityCode online platform (hereinafter: Platform) processes, for what purpose, on what legal basis, for how long, and what rights data subjects have. 1.2. The Policy covers data processed while using the Platform, registering, purchasing, playing, getting in touch and subscribing to the newsletter. 1.3. The Platform is available at https://citycode.hu.
2. Details of the controller
Name of the controller: Zelles Botond, sole proprietor (egyéni vállalkozó) Registered office: 9700 Szombathely, Niké utca 2., Hungary Registration number: 62746436 Tax number: 92328095-1-38 Email / data protection contact: contact@citycode.hu Phone: +36203322089 Web: https://citycode.hu The controller is a VAT-exempt (KATA) taxpayer.
3. Definitions
Personal data: data relating to an identified or identifiable natural person. Processing: any operation performed on personal data (e.g. collection, storage, use, erasure). Data subject: the natural person the personal data relates to. Processor: a service provider processing data on behalf of the controller (e.g. hosting, payment, email).
4. What data do we process?
4.1. Registration and account Signing in and purchasing require registration. The password is stored by the authentication provider in a non-readable form. Data Source Email address You provide it Password (encrypted) You provide it Display name (optional) You provide it Profile picture / avatar (optional) You choose or upload it Time the account was created and signed in to System
4.2. Purchase and invoicing The Platform does not store card details. Payment is handled on Barion's secure interface; card details are handled by Barion directly. Data Source Email address Account / payment process Buyer's name (optional) You provide it Mission(s) purchased, price, discount Transaction Coupon or gift card code (if used) You provide it Purchase identifiers, game code, spectator link token System Acceptance of the GTC and the Privacy Policy (time, version) You tick it Barion payment transaction identifier Barion Billing name and address (country, postal code, settlement, street, house number) – only if you request an invoice You provide it Type and serial number of the document issued System
4.3. Gameplay and statistics During play we record the progress of the game (current station, hints, start/finish time), solve times, active play time (ms), and, when someone joins as a spectator, the spectator's data.
4.4. Device data – location, camera, microphone Some features of a Mission (GPS navigation, puzzles) may ask permission for location, camera or microphone. The Platform neither transmits nor stores these on the server; processing happens solely on the device, with your permission.
4.5. Barion Pixel and fraud prevention To ensure secure card payment and to prevent abuse, the Platform embeds the base version of the Barion Pixel. Purpose: Solely the prevention of fraud and abuse (Barion does not use this data for marketing purposes). Data processed: Device and browser identifiers, and data about the pages viewed on the Platform before and during a purchase. Processor: Barion Payment Zrt. Legal basis: The controller's legitimate interest in guaranteeing secure electronic payment (GDPR 6(1)(f)). Further information about Barion's data processing practice is available in Barion's Privacy Policy. The Platform embeds the base version only. We do not use the full (Full) version of the Barion Pixel – which would collect data for marketing purposes beyond fraud prevention; were it introduced, it would be subject to your consent and this Policy would be amended accordingly.
4.6. Analytics (only with consent) If you consent on the cookie banner, we use our own (internal) analytics (page views, mission events, checkout) and external analytics (Google Analytics 4, Plausible Analytics). This data is not collected if you accept only the Necessary cookies.
4.7. Cookies and local storage Type Content / Provider Legal basis Necessary Sign-in session, operation of the Platform Service / legitimate interest Necessary Cookie preference (vk_cookie_consent) Necessary Security Barion Pixel (fraud prevention, device identifier, browsing data) Legitimate interest Analytics GA4 / Plausible (only with consent) Consent
4.8. Contact, newsletter and other data Contact: Name, email address, subject, message text. Spam protection keeps the IP address in memory for about 10 minutes. Newsletter (with consent): Email address, source of the sign-up, time of confirmation/unsubscription. Feedback: Text, category, page context, user identifier. Gift card: Buyer's and recipient's email address, message, card code and balance.
4.9. Billing data By default a receipt is issued, which does NOT carry your name or address; the electronic receipt contains only the email address needed for its delivery. If you request an invoice at checkout, providing the billing name and address is mandatory, as these are content elements of an invoice required by law (Section 169 of the VAT Act). We store this data attached to the given payment and forward it to the invoicing provider for the purpose of issuing the invoice. At checkout you can ask us, via a separate checkbox that is EMPTY by default, to save your billing data to your account and offer it pre-filled at your next purchase. Saved data can be changed or deleted at any time at checkout and in your profile, and nobody other than the account owner can access it. We do not ask for or process a tax number: we sell exclusively to private individuals. We are required to retain the issued invoice for 8 years under Section 169 of Act C of 2000 on Accounting. This is a legal obligation: deleting the account does not extend to it, and it cannot be ended by withdrawing consent.
5. Purpose and legal basis of processing
Performance of a contract (GDPR 6(1)(b)): Creating an account, selling a mission, gameplay, transactional emails. Legal obligation (GDPR 6(1)(c)): Invoicing, accounting. Legitimate interest (GDPR 6(1)(f)): Preventing abuse and fraud (e.g. the Barion Pixel), improving the platform, enforcing legal claims. Consent (GDPR 6(1)(a)): Newsletter, web analytics (withdrawable at any time).
6. Processors (who do we pass data to?)
The controller uses the following processors (we do not sell data to third parties for marketing purposes): Supabase, Inc.: Database, authentication, backend Barion Payment Zrt.: Online payment (payment data, transaction) and fraud prevention (Barion Pixel) Resend, Inc.: Sending email Vercel, Inc.: Website hosting (technical logs, IP) Google LLC: Web analytics (with consent) Plausible Insights OÜ: Web analytics (with consent) Billingo Technologies Zrt.: Invoicing; under a statutory obligation it also forwards the data of the issued invoice to the NAV Online Invoice system (the name and address of a private individual buyer are not included in that data reporting)
7. Retention (how long do we keep it?)
Account and profile data: For the lifetime of the account (anonymised on deletion). Purchase data: 8 years, due to accounting obligations. Gameplay, analytics: At most 3 years, or until the account is deleted. Contact messages: 2 years from the reply. Newsletter: 30 days after unsubscribing (log), then erasure.
8. Rights of the data subject
You have the right of access, rectification, erasure, restriction of processing, data portability and objection. You may withdraw your consent at any time. To exercise your rights or to delete your account, write to contact@citycode.hu (response deadline: max. 30 days).
9. Complaints, supervisory authority
We recommend contacting us first with a complaint. If you believe our processing infringes the law, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) (1055 Budapest, Falk Miksa utca 9-11., https://www.naih.hu).
10. Minors
The Platform is intended primarily for adults. We process the data of persons under 16 only under parental supervision; data provided without authorisation is deleted without delay.
11. Data security
We apply appropriate technical measures: HTTPS connection, hashed passwords (Supabase), access control, outsourcing payment to Barion's system, and admin restrictions. We do not use automated decision-making.
12. Amendment of this Policy and contact
The controller is entitled to amend this Policy and will give notice of it on the Platform. The version in force at any time is available at https://citycode.hu/legal/adatkezeles.pdf. Data protection questions, contact: Zelles Botond, sole proprietor 9700 Szombathely, Niké utca 2., Hungary Email: contact@citycode.hu Phone: +36203322089
Zelles Botond, sole proprietor
CityCode