CaveOTS.net – Privacy Policy

The controller of your personal data is:

All questions and requests concerning personal data can be sent to the e-mail address above.

Depending on how you use the Website, we may process in particular:

• CaveOTS account data, including the login / account identifiers and character names,
• your e-mail address,
• your IP address and basic technical data about your device and browser,
• order data: the selected package, amount, time and status of the transaction,
• records of the acceptance of the Terms of Service and the Privacy Policy and of the statements made before payment (date, IP address, browser identifier),
• transaction identifiers provided by the payment operator,
• data you voluntarily provide when corresponding with us.

CaveOTS.net does not store full payment card details; they are provided directly to the payment operator.

Data may be processed for the following purposes:

• creating and maintaining your account and providing the services of the Website and the Game – to perform the contract (Art. 6(1)(b) GDPR),
• fulfilling Premium Points orders and handling payments – to perform the contract (Art. 6(1)(b) GDPR),
• keeping the required accounting and tax records – to comply with legal obligations (Art. 6(1)(c) GDPR),
• handling complaints and communicating with you – to perform the contract, to comply with legal obligations or on the basis of the Controller's legitimate interest (Art. 6(1)(b), (c) or (f) GDPR),
• preventing abuse, ensuring security and establishing, pursuing or defending legal claims – on the basis of the Controller's legitimate interest (Art. 6(1)(f) GDPR).

Online payments in the Point Shop are processed by Stripe Payments Europe, Ltd. (Ireland). When you pay, the data necessary to carry out the transaction is provided to Stripe, which processes it in accordance with its own information obligations and privacy policy (available at stripe.com).

The data transferred may include in particular: the order identifier, the amount and currency of the transaction, your e-mail address, your IP address and the technical data needed to process and secure the payment. Payment details you enter on the Stripe payment page (e.g. card number or BLIK code) are collected directly by Stripe.

Data may also be entrusted to providers of hosting, infrastructure, IT services and e-mail, and to entities providing accounting or legal services – only to the extent necessary for them to perform their tasks.

Some service providers (including Stripe) may process data outside the European Economic Area. In such cases, the transfer is based on the safeguards provided for by the GDPR, such as an adequacy decision of the European Commission or standard contractual clauses.

Data may be disclosed to public authorities where required by law.

Data is stored for as long as you use your Account and the services are provided, and then for the period necessary to handle claims and complaints and to fulfil obligations under tax, accounting and other applicable laws.

Security-related technical data may be stored for the period necessary to detect and investigate abuse.

Under the conditions set out in the GDPR, you may have the right to:

• access your data,
• rectify your data,
• have your data erased,
• restrict processing,
• data portability,
• object to processing based on legitimate interest,
• lodge a complaint with the supervisory authority – in Poland, the President of the Personal Data Protection Office (Prezes UODO), or the supervisory authority in your EU country of residence.

Requests concerning your data can be sent to pgamestudiopolska@gmail.com.

The Website may use cookies and similar technologies that are necessary to maintain your session, log you in, ensure security and make the website work properly. If the Website starts using optional tools that require consent, consent will be obtained to the extent required by law.

When you are redirected to the Stripe payment page, Stripe may use its own cookies to process the payment and prevent fraud, in accordance with Stripe's cookie policy.

The Controller applies appropriate organisational and technical measures to protect data against unauthorised access, loss or alteration.

This Privacy Policy may be updated in connection with changes to the Website, the law or the way data is processed. The current version is always published on CaveOTS.net.

Document version: 21 September 2026.