Data Protection and Privacy Policy

Fantasy Duel

White Colony Kft. | Company No. 01-09-457208 | Last updated: 20 October 2026

1. Overview

This Data Protection and Privacy Policy ("Policy") describes how White Colony Kft. collects, uses, stores, discloses, and protects personal data in connection with the game Fantasy Duel, the website fantasyduelgame.com, the game service at play.fantasyduelgame.com, and all related accounts, gameplay features, the Legendary Market, purchase flows, and support channels (the "Platform").

We process personal data in accordance with Regulation (EU) 2016/679 ("GDPR"), applicable Hungarian data protection law, and other applicable privacy requirements.

We do not sell your personal data, and we do not use it for third-party advertising.

2. Data Controller

The controller responsible for your personal data is:

White Colony Kft. Company registration number: 01-09-457208 Registered address: 1132 Budapest, Váci út 16. Fsz. 12. ajtó, Hungary Website: https://fantasyduelgame.com Email: support@fantasyduelgame.com

3. Categories of Personal Data We Collect

Depending on how you use the Platform, we may process:

(a) Account data — email address, nickname, user ID, login and authentication data, account settings, account status, and registration date.

(b) Gameplay data — game progress, defeated enemies, equipment, masks, consumables, Legendary Items, arena rank and league, battle results, and your Silver, Gold, and Aurum balances.

(c) Legendary Market data — the Legendary Items you acquire on the Legendary Market, their prices, and the resulting changes to your Aurum balance.

(d) Transaction data — records of Gold and Aurum purchases, refunds, chargebacks, payment status, invoices, billing identifiers, and transaction history.

(e) Payment data — payment method identifiers, partial card details, payment confirmations, failed payment records, and fraud-prevention signals received from our payment providers. We do not store full card numbers; card data is handled by compliant payment providers.

(f) Support data — messages you send us, complaints, refund enquiries, and our responses.

(g) Device and technical data — IP address, browser type and version, operating system, language, time zone, request logs, error and crash data, cookies, and local storage identifiers; and, only if you accept analytics cookies, Google Analytics usage data — pages viewed, session length, device and browser type, approximate location derived from your IP address, and the Google Analytics cookie identifiers.

(h) Security and anti-fraud data — login attempts, suspicious-activity and bot-detection signals, abuse indicators, account risk indicators, chargeback risk data, and fraud-prevention logs.

(i) Preference data — settings such as communication preferences and opt-in/opt-out status where marketing is offered.

(j) Legal and compliance records — data we must keep for accounting, tax, consumer protection, sanctions, dispute, and other regulatory purposes.

4. How We Collect Personal Data

Directly from you — when you register, play, make a purchase, use the Legendary Market, or contact support.

Automatically — technical, gameplay, and transaction data generated while you use the Platform, including through cookies and similar technologies.

From third parties — such as payment processors, fraud-prevention and sanctions screening providers, hosting providers, banks and card networks, and public authorities, where relevant to the purposes below.

5. Purposes and Legal Bases

We process personal data only with a lawful basis under Article 6 GDPR:

(a) Account and game provision — registering and authenticating you, saving your progress, operating gameplay features, rankings, and balances. Basis: contract performance.

(b) Purchases — processing Gold and Aurum purchases, receipts, invoices, and transaction records. Basis: contract performance; legal obligation; legitimate interests. Card payments may additionally be protected with 3D Secure authentication where supported.

(c) Legendary Market — processing your purchases of Legendary Items and the resulting balance updates, and checking transactions for fraud and abuse. Basis: contract performance; legitimate interests.

(d) Sanctions screening and fraud prevention — screening transactions, preventing misuse, chargeback abuse, and unlawful activity. Basis: legal obligation; legitimate interests.

(e) Support and dispute handling — responding to enquiries, resolving complaints, processing refunds. Basis: contract performance; legitimate interests; legal obligation.

(f) Security and platform integrity — protecting accounts, detecting bots and cheating, monitoring faults, securing the Platform. Basis: legitimate interests; contract performance.

(g) Service improvement — analysing technical logs and aggregated gameplay data to fix issues, balance the game, and develop features. Basis: legitimate interests.

(h) Usage analytics — measuring how visitors use the website and the game with Google Analytics, only if you click "Accept" in the cookie banner. We do not use third-party advertising or cross-site tracking. Basis: consent (Article 6(1)(a) GDPR), which you can withdraw at any time through "Cookie Settings".

(i) Communications — sending service messages (receipts, invoices, security notices, policy updates); optional marketing only with your consent or as otherwise permitted by law. Basis: contract performance; consent; legitimate interests.

(j) Legal compliance and claims — accounting, tax, regulatory, and legal-claim obligations. Basis: legal obligation; legitimate interests.

6. Required and Optional Data

Some data is necessary to provide the Platform: without account data we cannot operate your account; without payment data we cannot process purchases; without records required by law we cannot complete certain transactions. Optional data (such as marketing preferences) can be changed or withdrawn at any time.

7. Cookies and Similar Technologies

We use cookies and local storage as described in our Cookie Policy. Strictly necessary technologies are always used — supporting login, session security, payment flows, and basic operation. The only optional cookies we use are Google Analytics cookies, which are set only after you click "Accept" in the cookie banner; until then the Google Analytics script is not loaded.

8. Disclosure of Personal Data

We may share personal data, where necessary, with the following categories of recipients:

(a) hosting, database, infrastructure, and cloud service providers; (b) payment processors, payment service providers, banks, and card networks; (c) sanctions screening and fraud-prevention providers; (d) email delivery and communication providers; (e) technical monitoring and error-tracking providers; (f) web analytics provider — Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Analytics), only if you accept analytics cookies; (g) professional advisers — legal, tax, accounting, audit, and compliance; (h) courts, regulators, tax authorities, law enforcement, and other public authorities where required or permitted by law; (i) business successors in connection with a merger, acquisition, restructuring, or transfer of business.

Other users can see the information you make public on the Platform, such as your nickname, mask, and arena rank.

All service providers process personal data on our documented instructions under data processing agreements with appropriate confidentiality and security obligations.

9. International Transfers

Personal data is processed primarily in the European Economic Area. Where a provider processes data outside the EEA, we rely on appropriate safeguards: an adequacy decision of the European Commission, Standard Contractual Clauses with supplementary measures where needed, or another lawful transfer mechanism under Chapter V GDPR.

If you accept analytics cookies, Google Analytics data may be transferred to Google LLC in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, which is covered by an adequacy decision of the European Commission; Google additionally uses Standard Contractual Clauses.

10. Data Retention

We keep personal data only as long as necessary for the purposes above:

(a) account and gameplay data — while your account is active, and for a limited period after closure for security, dispute, and legal purposes; (b) purchase, accounting, and tax records — 8 years, as required by Hungarian accounting law; (c) sanctions and compliance records — for the retention period required by applicable compliance law, which may extend several years after the relevant transaction; (d) support correspondence — as long as needed to resolve the matter and keep a record of it; (e) security and server logs — for a limited period, unless needed for an investigation or legal claim; (f) Google Analytics data — no longer than 14 months, after which Google deletes it automatically; Google Analytics cookies expire after 2 years or when you withdraw consent.

When data is no longer required, we delete or anonymise it, or securely archive it where the law requires continued retention.

11. Security

We apply appropriate technical and organisational measures: encrypted connections (HTTPS), access controls, role-based permissions, server-side processing of balance changes, logging and monitoring, secure development practices, and due diligence of service providers. No online service is completely secure — keep your credentials confidential and tell us immediately at support@fantasyduelgame.com if you suspect your account is compromised.

12. Your GDPR Rights

Subject to legal conditions and exemptions, you have the right to: access your data; rectify inaccurate data; erase your data; restrict processing; object to processing based on legitimate interests (including any direct marketing); data portability; and withdraw consent where processing is based on consent.

To exercise your rights, contact support@fantasyduelgame.com. We may need to verify your identity, and we respond within the timeframes set by the GDPR (normally one month).

13. Automated Processing

We may use automated tools to detect fraud, bots, abuse of Platform features, payment risk, sanctions risk, and suspicious account behaviour, and to diagnose technical issues. We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you, unless permitted by law and accompanied by appropriate safeguards, including the right to human review.

14. Children

The Platform is intended only for users aged 18 and over. We do not knowingly process personal data of minors. If we learn that a person under 18 has created an account, we will restrict the account and delete the data, subject to legal retention requirements.

15. Communications and Marketing

We send service communications necessary to operate the Platform: purchase receipts and invoices, security notices, and policy updates. Marketing messages, if offered, are sent only where permitted by law, and you can opt out at any time via the unsubscribe link or by emailing support@fantasyduelgame.com.

16. Supervisory Authority

If you are not satisfied with how we handle your personal data, you may lodge a complaint with the Hungarian supervisory authority:

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) 1055 Budapest, Falk Miksa utca 9–11, Hungary https://www.naih.hu/

You may also contact the supervisory authority of your EU country of residence or workplace.

17. Changes to This Policy

We may update this Policy to reflect changes in our practices, features, providers, or legal requirements. The current version is always available on the Platform; material changes will be announced on the Platform or by email where appropriate.