Privacy policy

1. Controller and contact

NekoTec Prosta S.A., identified above, is the controller for game-related data. Contact for the controller and data protection officer (DPO): dimenshon@nekotec.pl. The owner confirmed this DPO contact on 6 October 2026. Privacy enquiries can also be submitted through Support or a private message to an official administration account. The company’s postal address remains available.

2. Data and sources

Data comes from you, gameplay, your device and the payment provider. It includes login, nickname, email, authentication data, account identifier, characters, quest progress, inventory, PP, rewards, settings, chat/correspondence, reports, orders, payment status and required accounting details. IP addresses, activity times, user-agent, screen/platform parameters, device identifiers and security events may be recorded. Do not send passwords or special-category personal data through chat or support messages.

3. Purposes and legal grounds

Accounts, gameplay, requested correspondence and purchases: performance of a contract or pre-contractual steps (GDPR Article 6(1)(b)). Accounting, taxes and legal complaint-handling obligations: legal obligation (c). Abuse prevention, security, legal claims and proportionate moderation: legitimate interests of the operator or entitled persons (f), taking users’ rights into account. Marketing and optional tracking, if introduced: separate freely given consent (a) and applicable Electronic Communications Law requirements. Registration is not marketing consent.

4. Required data and visibility

Account/order data is required for the requested service; without it registration, recovery or purchase may not be possible. Additional content is voluntary. Nicknames, selected character information and chat content may be visible to other players using that feature. Private messages are intended for sender/recipient; justified authorised administrative access does not authorise public disclosure.

5. Recipients and external services

Authorised employees and contractors and providers acting on the company’s behalf may access data. OVH and Hetzner provide hosting, backups and email; according to the owner, these services process data in Poland and Germany. Infrastructure providers act within their commissioned services; contracting entities, subprocessors and processing arrangements must match the actual contracts. Advisers and authorities legally entitled to receive data may also be recipients. PayU, PayPal and Przelewy24 act in the roles described in the payment sections. Google reCAPTCHA on registration and password-recovery forms processes technical and interaction data; information: policies.google.com/privacy. Not all Google cookies are presented as necessary game cookies.

6. Transfers outside the EEA

Poland and Germany, identified for OVH and Hetzner infrastructure, are in the EEA. This does not mean every external provider operation takes place solely within the EEA. Google and payment services may involve transfers outside the EEA; actual recipients, countries and legal grounds, such as a current adequacy decision or standard contractual clauses with required safeguards, must be verified. A provider publishing a privacy policy does not establish a valid transfer basis by itself. Information and a copy of safeguards actually used can be requested from the DPO contact. Verification of these details remains a pre-publication requirement.

7. Retention

Operational account data is needed during the contract. Afterwards, only data with another valid basis is retained, such as accounting records or unexpired claims. Tax records are kept for the statutory period, generally five years from the end of the year in which the tax-payment deadline expired, subject to events affecting that period. Claims data is kept until the applicable limitation period, not indefinitely. Exact retention/deletion rules for security logs, chat, messages, unactivated accounts and backups must be approved and implemented before publication. We do not claim a deletion deadline that the system does not enforce.

8. Your rights

Subject to GDPR conditions, you can access and obtain copies, rectify, erase or restrict data, receive portability of automatically processed contract/consent-based data and object to legitimate-interest processing. Objection to direct marketing is unconditional. Consent can be withdrawn as easily as given without affecting the lawfulness of earlier processing. Erasure does not extend to records we must still lawfully retain.

9. Requests and complaints

Send requests to dimenshon@nekotec.pl. We may seek proportionate identity verification, but not your password. The usual response period is one month; complexity or request volume may justify a statutory extension of two further months, with notice and reasons within the first month. A first data copy is generally free. You can complain to Poland’s President of the Personal Data Protection Office (uodo.gov.pl), or particularly to the competent authority in your habitual-residence, workplace or alleged-infringement country.

10. Automated security signals

The client records signals associated with developer tools, window/device parameters and suspicious events. These heuristics can be wrong and must not be described as conclusive evidence of cheating. The effects of automated restrictions and applicability of GDPR Article 22 need an audit. Report incorrect flags and request human review through the GDPR contact.

11. Cookies, apps and changes

The separate Cookies page explains browser/WebView storage. Disabling asset caching does not disable sessions, cookies or settings storage. PC and Android clients are also covered by privacy rules. Material changes affecting purposes, recipients or rights must be communicated before application; a privacy policy is not itself a legal basis for processing.

12. Payments — roles of NekoTec and providers

NekoTec processes order and settlement data to perform the contract, handle complaints and meet accounting and tax obligations, under GDPR Article 6(1)(b) and (c), as applicable. Fraud prevention and establishing or defending claims may rely on Article 6(1)(f). Separate marketing consent is not required to purchase. Providers act as separate controllers for their payment services and their own legal obligations; they must not be regarded solely as NekoTec’s processors.

13. PayU — data shared

The controller for the PayU service is PayU S.A., ul. Grunwaldzka 186, 60-166 Poznań. The current integration sends the buyer’s email address, IP address, order identifier and description, amount, currency and purchased line-item details to PayU. PayU processes information for transactions, status notifications, complaints and legal obligations. Its privacy information describes legal grounds, recipients, retention, transfers and how to exercise rights.

• PayU privacy information

14. PayPal — data shared

The current integration sends the order identifier and description, amount and currency to PayPal. Dimenshon does not send the game account email address or IP address in the order-creation request; PayPal may nevertheless collect payer, device and connection data directly on its website. In the EEA, the controller is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Outside the EEA, the controller depends on the payer’s country. PayPal operates globally; data may be processed outside the EEA under the conditions and safeguards described by the provider.

• PayPal Privacy Statement

15. Przelewy24 — data shared

The controller for Przelewy24 is PayPro S.A., ul. Pastelowa 8, 60-198 Poznań. The current integration sends the buyer’s email address, order identifier and description, amount and currency. The provider may collect payer and connection information directly on its website. Its payer privacy notice explains processing purposes and grounds, recipients, retention, transfers and payer rights.

• Przelewy24 privacy information for payers

16. Confirmations, security and payer rights

NekoTec receives transaction identifiers and verified payment status to settle orders and credit purchases. With the current hosted-redirect integration, card details and banking authentication are entered in the appropriate provider or bank service, not a Dimenshon form. Contact dimenshon@nekotec.pl about data processed by NekoTec; contact the provider identified in its privacy notice about the provider’s processing. Provider documents may be available in a language different from the selected game language.

17. Support request data and in-game contact

Contact us through Support, a private message to administration or dimenshon@nekotec.pl. An in-game request includes the account and request identifiers, sender, selected recipient, category, subject, body, date and read status. Data is used for assistance, complaints, privacy matters and abuse prevention under the appropriate grounds described above. Requests go to the selected administration account and are not published to other players. Authorised access for handling, security or legal obligations does not make a request public. Marketing consent is not required. Limit the information to what the matter needs. Correspondence retention remains part of the schedule requiring approval; we do not promise automatic deletion after an undefined period.

18. Evidence disclosures to affected persons and authorities

For violations we may preserve and process necessary evidence and, after a separate assessment, disclose it to an entitled recipient. A basis may be a legal obligation under GDPR Article 6(1)(c) or a legitimate interest in protecting and pursuing rights under Article 6(1)(f), with necessity and balancing tests; Articles 9–10 and transfer rules apply where relevant. Control of an account-linked email does not suffice to obtain another player’s data. An affected person may receive a limited extract of related messages and events with unnecessary data redacted. The author’s email, IP and technical identifiers are not routinely disclosed to a private requester. A verified competent authority may receive account identifiers, login/nickname/email, times and IPs, relevant device data, related correspondence, logs, reports and decisions and, in payment matters, necessary order and transaction data actually held. The Sanctions and safety policy describes scope, exclusions, evidence retention, recipient rights and foreign-request requirements. DPO contact: dimenshon@nekotec.pl.