Data Protection and Privacy Policy

White Colony Korlatolt Felelossegu Tarsasag | Company No. 07-09-457208 | Last updated: 19 June 2026

1. Overview

This Data Protection and Privacy Policy ("Policy") explains how White Colony Korlatolt Felelossegu Tarsasag collects, uses, stores, shares, and protects personal data in connection with the Fantasy Duel platform available at https://fantasyduelgame.com/ and all related services, accounts, gameplay features, payment flows, marketplace features, payout functions, and support channels operated by us (the "Platform").

We process personal data in accordance with Regulation (EU) 2016/679 (the "GDPR"), applicable Hungarian data protection law, and other applicable privacy and consumer protection requirements.

We do not sell your personal data.

2. Identity of the Data Controller

The data controller responsible for your personal data is:

White Colony Korlatolt Felelossegu Tarsasag Company Registration No.: 07-09-457208 Date of Registration: 2026/06/01 Registered Address: 1132 Budapest, Vaci ut 16. Fsz. 12. ajto, Hungary Director: Bodo Levente Website: https://fantasyduelgame.com/ Email: support@fantasyduelgame.com

In this Policy, White Colony Korlatolt Felelossegu Tarsasag is referred to as "we", "us", "our", or the "Company".

3. Personal Data We Collect

Depending on how you use the Platform, we may collect and process the following categories of personal data:

(a) Account Data: username, user ID, email address, login credentials, account settings, account status, registration date, and authentication data.

(b) Profile and Gameplay Data: avatar, nickname, game progress, PvE activity, PvP activity, rankings, leagues, masks, equipment, Virtual Items, battle history, marketplace listings, balances, achievements, rewards, and other game-related account information.

(c) Contact and Support Data: email address, support messages, complaints, refund requests, payout requests, correspondence, technical issue reports, and our responses.

(d) Transaction Data: purchase records, Gold purchases, Aurum purchases, marketplace transactions, commissions, payout requests, reverse conversion records, refunds, chargebacks, payment status, billing identifiers, and transaction history.

(e) Payment Data: payment method details, payment provider identifiers, partial card details, payment confirmations, failed payment data, chargeback data, and fraud prevention signals. We do not store full payment card details unless handled through a compliant payment provider.

(f) Identity and Verification Data: full legal name, date of birth, country, address, identity document details, verification status, sanctions screening results, source of funds information, payment ownership verification, and other KYC/AML data where required or appropriate.

(g) Device and Technical Data: IP address, device identifiers, browser type, operating system, device type, language settings, time zone, log data, crash data, cookies, local storage identifiers, and other technical data.

(h) Security and Anti-Fraud Data: login attempts, suspicious activity signals, bot detection signals, account risk indicators, marketplace abuse indicators, chargeback risk data, sanctions screening data, and fraud prevention logs.

(i) Marketing and Preference Data: communication preferences, cookie preferences, marketing opt-in or opt-out status, campaign attribution, and interaction with promotional content.

(j) Legal and Compliance Data: records required for legal, tax, accounting, consumer protection, payment, AML, sanctions, dispute, and regulatory compliance purposes.

4. How We Collect Personal Data

We collect personal data directly from you when you create an account, make a purchase, submit a support request, request a payout, complete verification, participate in the Legendary Market, or otherwise interact with the Platform.

We also collect data automatically when you use the Platform, including device data, log data, gameplay data, transaction data, cookies, and similar technologies.

We may receive data from third parties, including payment processors, identity verification providers, fraud prevention providers, hosting providers, analytics providers, customer support providers, advertising partners, banks, card networks, and competent authorities.

5. Purposes and Legal Bases for Processing

We process personal data only where we have a lawful basis under the GDPR. The main purposes and legal bases are:

(a) Account creation and management: to register, authenticate, maintain, and secure your account. Legal basis: contract performance; legitimate interests.

(b) Provision of the Game and Services: to provide Fantasy Duel, gameplay, Virtual Items, balances, PvE, PvP, rankings, leagues, masks, equipment, and related features. Legal basis: contract performance.

(c) Payments and purchases: to process Gold and Aurum purchases, payment confirmations, invoices, chargebacks, and transaction records. Legal basis: contract performance; legal obligation; legitimate interests.

(d) Legendary Market operation: to process listings, purchases, sales, commissions, settlement, disputes, fraud checks, and account balance updates. Legal basis: contract performance; legitimate interests; legal obligation where applicable.

(e) Payout and reverse conversion handling: to assess payout eligibility, process eligible Aurum reverse conversion requests, verify payment ownership, prevent fraud, and keep required records. Legal basis: contract performance; legal obligation; legitimate interests.

(f) KYC, AML, sanctions, and fraud prevention: to verify identity, prevent misuse, detect suspicious activity, prevent chargeback abuse, comply with payment provider requirements, and meet legal obligations. Legal basis: legal obligation; legitimate interests.

(g) Customer support and dispute handling: to respond to enquiries, investigate issues, resolve complaints, handle refunds, and maintain records. Legal basis: contract performance; legitimate interests; legal obligation.

(h) Security and platform integrity: to protect accounts, detect bots, prevent cheating, secure the Platform, monitor technical faults, and prevent abuse. Legal basis: legitimate interests; contract performance; legal obligation.

(i) Analytics and improvement: to understand usage, diagnose issues, improve game balance, develop new features, and measure Platform performance. Legal basis: legitimate interests; consent where required for cookies or similar technologies.

(j) Marketing and communications: to send service communications, optional marketing, updates, and promotional materials where permitted. Legal basis: consent; legitimate interests where permitted by law.

(k) Legal compliance and claims: to comply with accounting, tax, consumer protection, regulatory, law enforcement, and legal claim obligations. Legal basis: legal obligation; legitimate interests.

6. Required and Optional Data

Some data is necessary to provide the Platform. If you do not provide required account, payment, verification, or transaction information, we may be unable to provide certain features, process purchases, operate the Legendary Market, process payouts, handle disputes, or comply with legal obligations.

Optional data, such as certain profile or marketing preferences, may be changed or withdrawn where applicable.

7. Cookies and Similar Technologies

We use cookies and similar technologies as described in our Cookie Policy. Strictly necessary cookies support account access, security, gameplay continuity, payment flows, and basic Platform operation. Optional cookies, such as analytics or advertising cookies, are used only where permitted by law and, where required, after consent.

You may manage cookie choices through the cookie settings tool on the Platform or through your browser settings.

8. Disclosure of Personal Data

We may share personal data with the following categories of recipients where necessary:

(a) hosting, infrastructure, and cloud service providers;

(b) payment processors, banks, card networks, and payment service providers;

(d) analytics, performance, and technical monitoring providers;

(e) customer support and communication providers;

(f) professional advisers, including legal, tax, accounting, audit, and compliance advisers;

(g) competent courts, regulators, tax authorities, law enforcement, consumer protection bodies, data protection authorities, or other public authorities where required or permitted by law;

(h) business successors in connection with a merger, acquisition, restructuring, financing, sale of assets, or transfer of business.

We require service providers to process personal data only under appropriate contractual and security obligations.

9. International Transfers

Your personal data may be processed in the European Economic Area and, where necessary, outside the European Economic Area.

Where we transfer personal data outside the EEA, we use appropriate safeguards, such as adequacy decisions, Standard Contractual Clauses approved by the European Commission, supplementary measures where needed, or another lawful transfer mechanism under the GDPR.

10. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including to provide the Platform, comply with legal obligations, resolve disputes, prevent fraud, enforce agreements, and maintain security.

Typical retention periods include:

(a) Account data: for as long as your account remains active and for a reasonable period after closure where needed for legal, security, dispute, or accounting purposes.

(b) Transaction, purchase, payout, accounting, and tax records: for the period required by applicable accounting, tax, payment, and legal obligations.

(c) KYC, AML, sanctions, and fraud prevention records: for the period required by applicable legal and compliance obligations, which may extend for several years after the end of the relevant relationship or transaction.

(d) Support records: for as long as needed to resolve the issue and maintain a record of the interaction.

(e) Security logs: for a limited period unless needed for investigation, fraud prevention, legal claims, or security reasons.

When personal data is no longer required, we delete it, anonymise it, or securely archive it where continued retention is required by law.

11. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, disclosure, or destruction. Measures may include encryption, access controls, logging, monitoring, secure development practices, fraud detection, role-based permissions, and provider due diligence.

No online service can be guaranteed to be completely secure. You are responsible for keeping your account credentials confidential and for promptly informing us of suspected account compromise.

12. Your GDPR Rights

Subject to applicable conditions and exemptions, you may have the following rights:

(a) Right of access: to request confirmation and a copy of your personal data.

(b) Right to rectification: to request correction of inaccurate or incomplete data.

(d) Right to restriction: to request limitation of processing in certain circumstances.

(e) Right to object: to object to processing based on legitimate interests or direct marketing.

(f) Right to data portability: to receive certain data in a structured, commonly used, machine-readable format.

(g) Right to withdraw consent: where processing is based on consent.

(h) Right to lodge a complaint with a supervisory authority.

To exercise your rights, contact us at support@fantasyduelgame.com. We may need to verify your identity before responding.

13. Automated Processing and Profiling

We may use automated tools to detect fraud, bot activity, market abuse, payment risk, sanctions risk, security threats, and suspicious account behaviour. We may also use automated systems to personalise gameplay, recommend features, balance the Platform, or detect technical issues.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you unless permitted by law and subject to appropriate safeguards.

14. Children

The Platform is not intended for users under 18. We do not knowingly collect personal data from minors. If we become aware that a person under 18 has provided personal data, we will take appropriate steps to delete the data and restrict the account, subject to legal requirements.

15. Marketing Communications

We may send service-related communications, including security notices, purchase confirmations, payout updates, account notices, policy updates, and support messages.

We send marketing communications only where permitted by law. You may opt out of marketing communications at any time by using the unsubscribe link or contacting us at support@fantasyduelgame.com.

16. Supervisory Authority

If you are not satisfied with how we handle your personal data, you may lodge a complaint with the Hungarian data protection supervisory authority:

Hungarian National Authority for Data Protection and Freedom of Information (NAIH) Website: https://www.naih.hu/ Postal address: 1055 Budapest, Falk Miksa utca 9-11, Hungary

You may also have the right to contact the supervisory authority in your EU Member State of residence, place of work, or place of the alleged infringement.

17. Changes to This Policy

We may update this Policy from time to time to reflect changes in our data practices, Platform features, legal requirements, service providers, or security measures. The current version will be available on the Platform. Material changes may be notified through the Platform or by email where appropriate.

18. Contact

For privacy questions, data subject rights requests, or complaints, contact:

White Colony Korlatolt Felelossegu Tarsasag Company Registration No.: 07-09-457208 Registered Address: 1132 Budapest, Vaci ut 16. Fsz. 12. ajto, Hungary Director: Bodo Levente Website: https://fantasyduelgame.com/ Email: support@fantasyduelgame.com