GDPR & Your Data Rights
Last updated: 9 August 2026
If you are in the UK, the EU, or the EEA, the GDPR gives you specific rights over your personal data. Our Privacy Policy explains what we collect; this page explains what you can do about it, and exactly how.
1. Who is responsible for your data
ZetaGames is the data controller for the personal data described in our Privacy Policy. That means we decide what is collected and why, and we are accountable for it.
Our service providers — Supabase, Vercel, Railway, Sentry and Google — act as processors: they handle data on our instructions and under contract, and may not use it for their own purposes.
We have not appointed a Data Protection Officer, as we are not required to under Article 37. Data-protection enquiries go to support@zetagames.net, which is monitored for exactly this purpose.
2. Legal bases we rely on
Under Article 6 we must have a lawful basis for every use of your data. Ours are:
| What we do | Legal basis | Article |
|---|---|---|
| Run your account, save progress, show leaderboards | Performance of a contract — you asked us to provide the service | 6(1)(b) |
| Diagnose crashes, prevent cheating and abuse, keep the site secure | Legitimate interests — keeping a free service working and fair | 6(1)(f) |
| Non-essential cookies, gameplay analytics, session replay | Consent — freely given, and withdrawable at any time | 6(1)(a) |
| Responding to legal requests and retaining transaction records | Legal obligation | 6(1)(c) |
Where we rely on legitimate interests, we have weighed our interest against your rights and freedoms. You can object to that processing at any time — see section 3.
3. Your rights in full
| Right | What it means in practice |
|---|---|
| Access (Art. 15) | Get a copy of the personal data we hold about you, plus an explanation of why we hold it. |
| Rectification (Art. 16) | Have inaccurate data corrected. Most profile fields you can edit yourself. |
| Erasure (Art. 17) | Have your account and associated data deleted — the “right to be forgotten”. |
| Restriction (Art. 18) | Have us pause processing while a dispute about accuracy or legitimacy is resolved. |
| Portability (Art. 20) | Receive the data you gave us in a structured, machine-readable format you can take elsewhere. |
| Object (Art. 21) | Object to processing based on legitimate interests. We stop unless we can show compelling grounds that override your rights. |
| Withdraw consent (Art. 7(3)) | Withdraw consent for cookies, analytics or session replay. Withdrawal does not affect processing already carried out lawfully. |
| Automated decisions (Art. 22) | Not be subject to solely automated decisions with legal or similarly significant effects. We make none. |
4. How to exercise a right
Email support@zetagames.net with the subject "GDPR request", and tell us which right you are exercising. To help us respond quickly, include:
- The email address on your ZetaGames account.
- Which right you want to exercise, and any detail that narrows it down.
- Whether you want the response by email or another means.
Send it from the account email where you can. A request from the registered address is the simplest proof of identity. If you cannot, we may ask for something else to verify you — we are required to be confident we are not disclosing your data to someone else.
We respond within one month of receiving a valid request, free of charge. If a request is unusually complex we may extend by up to two further months, and we will tell you within the first month if that happens. We only refuse requests that are manifestly unfounded or excessive, and we will explain our reasoning if we do.
On erasure: we remove your profile, comments, friendships, favourites, collections, ratings and saved progress within 30 days. Anonymised statistics that can no longer identify you — such as total plays for a game — are retained, which Recital 26 permits because they are no longer personal data.
5. International transfers
Our providers operate data centres in the United States and the European Union, so your data may be processed outside the UK or EEA. Where that happens, those transfers rely on recognised safeguards — principally the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum where UK data is involved.
You may request more detail about the safeguards applying to a specific transfer by emailing us.
6. How to complain
If you are unhappy with how we have handled your data or your request, please tell us first — most issues are quicker to fix directly. You also have the right to complain to a supervisory authority at any time, and you do not need to come to us first.
- United Kingdom — Information Commissioner's Office (ICO), ico.org.uk.
- EU / EEA — the data protection authority in the country where you live or work. The European Data Protection Board maintains the full list at edpb.europa.eu.
Californian residents have separate rights under the CCPA/CPRA — see section 7 of our Privacy Policy.