We, K5 Factory GmbH, Konradinstrasse 5, 81543 Munich (hereinafter referred to as "K5"), inform you herewith about the processing of personal data for which we are controller within the meaning of the EU General Data Protection Regulation (GDPR). Apart from contacting us per mail, you can also contact us at any time via email to info@k5factory.com.

You can reach our data protection officer by sending an email to leily@k5mediagroup.com or by sending a letter to K5 Factory GmbH, Attn: Data Protection Officer, Konradinstrasse 5, 81543 Munich.

Below, we have compiled the most important information regarding data processing in the context of the "Oktoberfest" game for you. Whenever the term "data" is used in the text, it refers solely to personal data as defined by the GDPR.

1. Data Processing during Registration 

To play the "Oktoberfest" game, users must first log into their Meta Horizon account with their Meta ID. From the Meta ID, a Unity ID is created for users, which is used to identify them within the game.

(i) We process data for the purpose of enabling registration for subsequent use of the game. A change of purpose is not planned.

(ii) The processed data are:

• Meta ID
• Unity ID 

No further data is transmitted from Meta to K5 during registration. K5 does not know the names or other personal data of users.(iii) The legal basis for processing is our legitimate interest in providing the game via the Meta Quest platform (Art. 6(1)(f) GDPR).(iv) The Meta ID is automatically transmitted to us by Meta. Users create their nickname themselves during registration.(v) We use service providers as processors within the framework of a data processing agreement for the provision, maintenance and servicing of IT systems. For the creation of the Unity ID, data is transferred to Unity Technologies GmbH c/o (Design Offices Munich Campus Königsplatz, Brienner Str. 45 a-d, 80333 Munich, Germany, hereinafter referred to as "Unity") as a processor. Data is transferred to so-called third countries such as the USA. To protect your data, we have concluded the EU Standard Contractual Clauses (2021/914; Module 2) with Unity and agreed on additional security measures. You can request a copy of the essential contractual content of the Standard Contractual Clauses at any time.(vi) The data is stored as long as the player's account exists.

(vii) Without providing the data, playing the game is not possible.

2. Data Processing during Gameplay 

(i) During the game, we process data to maintain and improve the functionality of the game. The data for analyzing gameplay behavior is used exclusively to optimize the game. A change of purpose is not planned.

(ii) The processed data are:

• Unity ID
• Nickname
• Profile data (e.g., profile picture, friends list, age group)
• Game data (e.g., avatar, actions, items, leaderboards)
  
  

(iii)  The legal basis for processing is the user agreement with K5 (Art. 6(1)(b) GDPR) as well as our legitimate interest in improving the game (Art. 6(1)(f) GDPR).(iv) The data is provided by the data subjects themselves or automatically transmitted during gameplay.(v) We use service providers as processors within the framework of a data processing agreement for the provision, maintenance and servicing of IT systems. For hosting, we use the service provider Gameye B.V. (Schiedamse Vest 154, Unit 2.05, 3011 BH Rotterdam, Netherlands) as a processor. For player authentication, database usage, and cloud storage, data is transferred to Google Cloud EMEA Limited (Velasco Clanwilliam Place, Dublin 2, Ireland, hereinafter referred to as "Google") as a processor. Google Cloud EMEA Limited uses Google LLC in the USA (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) as a service provider. Google has concluded the EU Standard Contractual Clauses (2021/914; Module 3) with Google LLC and other subcontractors to protect your data and agreed on additional security measures. You can request a copy of the essential contractual content of the Standard Contractual Clauses at any time. Additionally, the Google entities, including Google LLC, are certified under the EU-US Data Privacy Framework (Article 45 GDPR). For player authentication, gameplay behavior analysis, creation of leaderboards and planning of game economy, data is transferred to Unity Technologies GmbH c/o (Design Offices Munich Campus Königsplatz, Brienner Str. 45 a-d, 80333 Munich, Germany, hereinafter referred to as "Unity") as a processor. Data is transferred to so-called third countries such as the USA. To protect your data, we have concluded the EU Standard Contractual Clauses (2021/914; Module 2) with Unity and agreed on additional security measures. You can request a copy of the essential contractual content of the Standard Contractual Clauses at any time.(vi) The data is stored as long as the player's account exists.

(vii) Without providing the data, playing the game is not possible.

3. Data Processing When Purchasing Items 

Within the game, items (e.g., outfits for the avatar) can be purchased. The purchase transaction takes place via the Meta Horizon account. We only receive information from Meta about which Unity ID is authorized for which items and implement this in the game.

(i) We process data for the purpose of providing items within the game. A change of purpose is not planned.

(ii) The processed data are:

• Unity ID
• Purchased items
  
  

(iii) The legal basis for processing is the user agreement with K5 (Art. 6(1)(b) GDPR).(iv) The data is provided to us by Meta. We do not receive any information that allows us to personally identify you.(v) For the assignment of items to Unity IDs, we exchange data with Meta Platforms Ireland Limited (4 Grand Canal Square, Dublin 2, Ireland, hereinafter referred to as "Meta") as the provider of the Meta Quest platform, each acting as an independent controller. We have no knowledge of the details of data processing within Meta's controllership. We have no influence on Meta's data processing. Information about Meta's data processing can be found in the Meta Privacy Policy as well as the Supplemental Meta Platforms Technologies Privacy Policy.

(vi) The data is stored as long as the player's account exists. We have no influence on the duration of data processing within Meta's controllership.

(vii) Without processing the data, purchasing items is not possible.

4. Data Processing in the Context of the Reporting Feature 

(i) We process data for the purpose of forwarding cases to Meta that violate the platform's guidelines. A change of purpose is not planned.

(ii) The processed data are:

• Unity ID
• Content of the violation
  
  

(iii) The legal basis for processing is our legitimate interest in providing a safe and legally compliant gaming environment and forwarding cases to Meta for further action (Art. 6(1)(f) GDPR).(iv) For providing the reporting feature, we exchange data with Meta Platforms Ireland Limited (4 Grand Canal Square, Dublin 2, Ireland, hereinafter referred to as "Meta") as the provider of the Meta Quest platform, each acting as an independent controller. We have no knowledge of the details of data processing within Meta's controllership. We have no influence on Meta's data processing. Information about Meta's data processing can be found in the Meta Privacy Policy as well as the Supplemental Meta Platforms Technologies Privacy Policy Ergänzende Datenschutzrichtlinie von Meta Platforms Technologies | Meta | Meta Store.

(v) The data is stored as long as the player's account exists. We have no influence on the duration of data processing within Meta's controllership.

5. Data Processing in the Context of the Live Voice Chat 

(i) We process data for the purpose of providing a live voice chat within the game. A change of purpose is not planned.

(ii) The processed data are:

• Unity ID
• Nickname
• Voice recording
• IP address
  
  

(iii) The legal basis for processing is the user agreement with K5 (Art. 6(1)(b) GDPR).

(iv) The data is provided by the data subjects themselves.

(v) We use service providers as processors within the framework of a data processing agreement for the provision, maintenance and servicing of IT systems. For implementing the live voice chat (Photon), data is transferred to Exit Games GmbH (Hongkongstr. 7, 20457 Hamburg, Germany, hereinafter referred to as "Exit Games") as a processor. Data is transferred to so-called third countries such as the USA. To protect your data, we have concluded the EU Standard Contractual Clauses (2021/914; Module 2) with Exit Games and agreed on additional security measures. You can request a copy of the essential contractual content of the Standard Contractual Clauses at any time.

(vi) The data is processed only for the duration of the actual voice recording and is not stored permanently.

(vii) Without processing the data, using the live voice chat feature is not possible.

6. Rights of Data Subjects and Additional Information 

(i) We do not use any methods of automated individual decision-making.

(ii) You have the right to request information at any time about all your personal data which we are processing.

(iii) If your personal data is incorrect or incomplete, you have the right to have it rectified and completed.

(iv) You can request the erasure of your personal data at any time, as long as we are not bound by legal obligations that require or allow us to continue processing your data.

(v) If the applicable legal requirements are met, you can request a restriction to the processing of your personal data.

(vi) You have the right to object to the processing, insofar as the data processing is based on profiling or direct marketing purposes.

(vii) If the processing is carried out on the basis of the balancing of interests, you may object to the processing by stating reasons arising from your particular situation.

(viii) If the data processing takes place on the basis of your consent or a contract, you have the right to a transfer of the data provided by you, insofar as the rights and freedoms of others are thereby not impaired.

(ix) If we process your data on the basis of a declaration of consent, you have the right to revoke this consent at any time with future effect. The processing carried out prior to a revocation remains unaffected by the revocation.

(x) Moreover, you have the right to file a complaint at any time with a data protection supervisory authority, if you believe that data processing has been carried out in violation of the applicable law.

Status: September 2024