With this privacy statement, we are informing you about how we handle your personal data when you use online game “Kornhal”, and about your rights according to the European General Data Protection Regulation (GDPR). The party responsible for data processing is Jan Zelinka (hereinafter referred to as “we” or “us”).
If you have any questions or suggestions about this information or would like to contact us regarding the assertion of your rights, please send your request to:
Email: support@kornhal.com
Name: Jan Zelinka
Country: Czech Republic
We process personal data in accordance with the applicable data protection regulations, in particular the European General Data Protection Regulation (GDPR).
Depending on the context in which the data is processed, we rely on the following legal bases:
• Article 6 (1) (a) GDPR – processing based on your consent (e.g., newsletter subscription, marketing tracking);
• Article 6 (1) (b) GDPR – processing necessary for the performance of a contract or to take steps at your request prior to entering into a contract (e.g., creating and maintaining your game account, processing purchases);
• Article 6 (1) (c) GDPR – processing necessary to comply with a legal obligation;
• Article 6 (1) (f) GDPR – processing necessary for our legitimate interests, such as ensuring the security of our services, preventing fraud, analyzing the use of our game, and improving the functionality of our services, provided that such interests are not overridden by your rights and freedoms.
Unless stated otherwise in this privacy statement, we store personal data only for as long as necessary to fulfill the purposes for which it was collected or to comply with legal obligations.
Certain data may need to be retained for longer periods due to legal obligations, such as accounting or tax regulations. In such cases, the data will be retained only for the duration required by applicable law.
Data processed based on your consent will be stored until you withdraw your consent.
Data related to contractual relationships, complaints, or legal claims may be stored for the duration of the applicable limitation periods.
Server log files are generally stored for a limited period necessary to ensure system security and stability.
We use service providers (data processors) to operate and maintain our services. These providers process personal data on our behalf and only in accordance with our instructions.
Such services may include:
• hosting and server infrastructure providers
• content delivery and security providers such as Cloudflare
• payment processing providers such as Xsolla
• email delivery and marketing services such as MailerLite
• analytics and tracking services such as Unity Analytics
• advertising platforms such as Meta Platforms
These processors are contractually obligated to process personal data only on our behalf and to implement appropriate technical and organizational measures to ensure data protection.
Visiting our website may be accompanied by the transfer of certain personal data to third countries, i.e., countries in which the GDPR is not applicable law. This kind of transfer is permissible if the European Commission has determined that an appropriate level of data protection is provided in such a third country. If no such adequacy decision is available from the European Commission, the personal data is only transferred to a third country if appropriate safeguards in accordance with Article 46 GDPR are in place, or if one of the conditions of Article 49 GDPR is met.
Unless stated otherwise below, we use the standard EU contractual clauses for the transfer of personal data to order processors in third countries: https://eur-lex.europa.eu/legal-content/DE/TXT/?uri=CELEX%3A32010D0087.
If you consent to the transfer of personal data to third countries by registering to game „Kornhal“, the transfer is performed on the legal basis of Article 49 (1) (a) GDPR.
If you exercise your rights under Articles 15 to 22 GDPR, we will process the personal data you provide for the purpose of responding to and fulfilling your request.
This processing is carried out on the legal basis of Article 6 (1) (c) GDPR in conjunction with Articles 15–22 GDPR, as it is necessary to comply with our legal obligations under data protection law.
As a data subject, you have the right to assert your data subject rights against us. In particular, you have the following rights:
In accordance with Article 15 GDPR and Article 17 GDPR , you have the right to request information about whether and, if applicable, to what extent we process personal data in relation to you.
You have the right to demand that we correct your data in accordance with Article 16 GDPR.
You have the right to demand that we delete your personal data in accordance with Article 17 GDPR and Section 35 BDSG.
You have the right to demand the restriction of the processing of your personal data in accordance with Article 18 GDPR.
In accordance with Article 20 GDPR, you have the right to obtain the personal data concerning you, which you made available to us, in a structured, common and machine-readable format and to transmit this data to another responsible person.
If you have given us separate consent to data processing, you can revoke this consent at any time in accordance with Article 7 (3) GDPR. This will not affect the lawfulness of any processing performed on the basis of the consent that is carried out previous to such a revocation.
According to Article 77 GDPR, if you believe that the processing of data relating to you violates the regulations of the GDPR, you have the right to lodge a complaint with a supervisory authority.
According to Article 21 (1) GDPR, you have the right to object to data processing performed on the legal basis of Article 6 (1) (e) or (f) GDPR for reasons arising from your particular situation. If we process personal data about you for the purpose of direct marketing, you can object to this processing in accordance with Article 21 (2) and (3) GDPR.
When you use game “Kornhal”, we collect information which you provide to us. During your visit to the website, we also automatically collect certain information about your use of the website. In the Data Protection Act, the IP address is also fundamentally considered to be personal data. An IP address is assigned by the Internet provider to any device connected to the Internet in order for it to send and receive data.
During the purely informative use of our website, general information that your browser transmits to our server is initially stored automatically (meaning, not via a registration). By default, this includes: Browser type/version, operating system, accessed page, previously visited page (referrer URL), IP address, date and time of the server access, and HTTP status code. The processing is performed to protect our legitimate interests and is carried out on the legal basis of Article 6 (1) (f) GDPR. This processing is for the purpose of the technical management and security of the website. The stored data is deleted at regular intervals unless there is a justified suspicion of unlawful use based on specific indications, which would make further examination and processing of the information necessary for this reason. We are unable to identify you as the data subject on the basis of the stored information. Articles 15 to 22 GDPR therefore are not applicable pursuant to Article 11 (2) GDPR unless, in order to exercise your rights stated in these articles, you provide additional information that enables your identification.
We use cookies and similar technologies ("cookies") on our website.
Cookies are small text files stored in your browser when you visit a website. They help ensure the functionality, security, and performance of our services.
Some cookies are technically necessary for the operation of the website and the game. These cookies are processed on the legal basis of our legitimate interest in providing a functioning service (Article 6 (1) (f) GDPR).
Other cookies, such as those used for analytics or marketing purposes, are only used with your consent (Article 6 (1) (a) GDPR). Where required by applicable law, cookies and tracking technologies used for analytics or marketing purposes are only activated after the user has provided consent through our consent mechanism.
You can manage or delete cookies at any time through your browser settings. Disabling cookies may affect the functionality of certain parts of the service.
When you create a user account, we assign your account a unique internal identifier.
During registration we collect and store the following data:
• email address
• hashed password
• nickname chosen by the player for in-game display
The email address serves as the login identifier for your account.
To verify the ownership of the email address, we use a double opt-in procedure. This means you will receive an email containing a confirmation link which must be clicked to activate the account.
We also store the originating IP address and the time of registration as well as the IP address and timestamp of email verification. This information is stored to ensure the security of our systems, prevent abuse, and provide proof of consent where required.
When you use the game, your device communicates with our servers. In this context, we may record login events, logout events, timestamps, and relevant IP addresses to ensure the stability and security of the service and to enforce our terms of service.
The processing of personal data during registration and use of the game is necessary for the performance of a contract and is carried out on the legal basis of Article 6 (1) (b) GDPR.
4 . Data Processing by Payment Providers
Our game is free to play. However, we offer additional paid services and virtual items. If you decide to make a purchase, the transaction is processed by our payment partner, Xsolla (Xsolla Berlin GmbH, Xsolla Inc., or its affiliates) , acting as the authorized reseller.
When you initiate a purchase, you will be redirected to Xsolla's interface. Xsolla is responsible for the technical processing of the payment and the collection of necessary billing information. Depending on the payment method you select (e.g., PayPal, Credit Card), the respective provider (such as PayPal (Europe) S.à r.l. et Cie, S.C.A.) will also process your data.
To facilitate the transaction, we may transfer limited data to Xsolla, such as your user ID (alias), language settings, and the selected item. Any sensitive personal data you provide directly to the payment provider—specifically your full name, physical address, and credit card or bank details—is not shared with us.
Payments for virtual currency and digital items are processed by Xsolla, acting as an authorized reseller.
Confirmation and Fulfillment:
After the payment is processed, we receive a transaction confirmation (callback) from Xsolla. This confirmation allows us to verify the status of the purchase and deliver the digital content to your account. We store this record to provide customer support and fulfill our contractual obligations.
A record of the purchase is stored on our side for customer support and contractual fulfillment purposes.
The processing of this data is necessary for the performance of a contract to which you are a party, in accordance with Article 6 (1) (b) GDPR .
When registering for the game, users may optionally subscribe to our newsletter.
If you subscribe, we will use your email address to send you information about the game, updates, and related announcements.
Newsletter emails are delivered using the service provider MailerLite. Transactional emails are delivered using the service ZeptoMail.
We use a double opt-in procedure to verify that the email address belongs to you. After subscribing, you will receive a confirmation email containing a link which you must click to activate the subscription.
Your email address will be processed on the basis of your consent (Article 6 (1) (a) GDPR). You may withdraw your consent at any time by clicking the unsubscribe link included in every email or by contacting us.
We store proof of your consent (such as confirmation timestamp and IP address) to comply with our legal obligation to document consent.
a. Meta Conversion API
We use the Meta Conversion API provided by Meta Platforms Ireland Limited to measure the effectiveness of our advertising campaigns and understand how users interact with our services.
When certain events occur in our game (such as account registration, reaching specific gameplay milestones, or completing a purchase), limited information may be transmitted to Meta through a secure server-to-server connection.
The transmitted data may include:
• hashed email address
• internal user identifier
• event type (e.g., registration, gameplay progress, purchase)
• technical information about the device or connection
This data is used to measure advertising performance, improve ad targeting, and analyze user behavior related to our marketing campaigns.
The processing and transmission of this data only takes place with your consent in accordance with Article 6 (1) (a) GDPR.
Further information about how Meta processes personal data can be found in Meta’s privacy policy.
We do not use automated decision-making or profiling that produces legal or similarly significant effects for users.
You can access the agreement that we concluded with Facebook Ireland at https://www.facebook.com/legal/controller_addendum.
Facebook Ireland is solely responsible for the processing of the transmitted event data following the transmission. You can find further information on how Facebook Ireland processes personal data, including the legal basis relied on by Facebook Ireland and the options to exercise your rights against Facebook Ireland in the data policy of Facebook Ireland under https://www.facebook.com/about/privacy.
b. Unity Analytics
We use the analytics service Unity Analytics provided by Unity Technologies to understand how players interact with the game and to improve gameplay experience.
Unity Analytics collects technical and gameplay-related information such as:
• device information (e.g., operating system, hardware model)
• IP address
• session activity (such as game start and end)
• gameplay events (such as reaching levels or completing in-game actions)
• information about in-game purchases
The data is processed in aggregated or pseudonymized form to generate statistical reports that help us improve the game and detect technical issues.
The processing is carried out on the basis of our legitimate interest in analyzing and improving our services (Article 6 (1) (f) GDPR).
We use the Cloudflare service from Cloudflare Inc. (USA) on our website to display content. This integration technically requires the processing of your IP address so that content can be sent to your browser. For this reason, your IP address is transmitted to Cloudflare. This data processing is performed to protect our legitimate interests in the optimization and economical operation of our website and is carried out on the legal basis of Article 6 (1) (f) GDPR. You can object to this data processing at any time via the settings in your browser or certain browser extensions. One of these extensions, for example, is the matrix-based firewall uMatrix for the Firefox and Google Chrome browsers. Please note that this may lead to functional limitations on the website.
In this regard, please note the information in the section “Data transfer to third countries”. Additional information on data protection at Cloudflare can be found in Cloudflare’s privacy statement: https://www.cloudflare.com/privacypolicy/.
We are represented by company pages on several social media platforms. We use these to offer additional opportunities to get and exchange information about our company. Our company has company pages on the following social media platforms:
Discord
Twitch
YouTube
When you visit a profile on a social media platform or interact with it, personal data about you may be processed. The information associated with the social media profile you use also regularly consists of personal data. This also captures news and statements made while using the profile. Additionally, certain information is often automatically collected about your visit to a social media profile whenever you use it, which may also constitute personal data.
When you visit our Facebook or Instagram page, which we use to present our company or individual products from our offers, certain information about you is processed. Facebook Ireland Ltd. (Ireland/EU – “Facebook”) is the sole controller of this processing of personal data. You can find more information about the processing of personal data by Facebook at https://www.facebook.com/privacy/explanation. Facebook offers the possibility to opt out of certain data processing; information and opt-out features can be found at https://www.facebook.com/settings?tab=ads.
For our Facebook and Instagram page, Facebook provides statistics and insights in anonymized form, which help us gain information about the type of actions carried out by people on our page (so-called “page insights”). These page insights are created on the basis of certain information about people who have visited our page. This processing of personal data is carried out by Facebook and us as joint controllers. The processing serves our legitimate interest in evaluating the types of actions performed on our page and in improving our page on the basis of these insights. The legal basis for this processing is Article 6 (1) (f) GDPR. We are unable to allocate the information acquired via the page insights to individual user profiles that interact with our Facebook and Instagram pages. As joint controllers, we have entered into a data processing agreement with Facebook which defines the allocation of the data protection obligations between us and Facebook. You can find details about the processing of personal data to create page insights and about the agreement concluded between us and Facebook at https://www.facebook.com/legal/terms/information_about_page_insights_data. In respect to this data processing, you also have the possibility of asserting your data subject rights (see “Your rights”) against Facebook. More information on this can be found in Facebook’s privacy policy at https://www.facebook.com/privacy/explanation.
Please note that, according to Facebook’s privacy policy, user data is also processed in the USA or other third countries. Facebook only transmits user data to countries for which an adequacy decision has been provided by the European Commission according to Article 45 GDPR, or on the basis of appropriate safeguards according to Article 46 GDPR.
Twitch Interactive, Inc. (USA) is the sole controller for processing personal data when visiting our Twitch channel. You can find more information about the processing of personal data by Twitch Interactive, Inc. or Google Ireland Limited at https://www.twitch.tv/p/de-de/legal/privacy-notice/.
Google Ireland Limited (Ireland/EU) is the sole controller for processing personal data when visiting our YouTube channel. You can find more information about the processing of personal data by YouTube or Google Ireland Limited at https://policies.google.com/privacy.
d. Discord
Discord Inc. (444 De Haro Street, Suite 200, San Francisco, CA 94107, USA) is the sole controller for processing personal data when visiting our Discord server or using the Discord application. Please note that when you join our server, your username, avatar, and online status are visible to us and other members. You can find more information about the processing of personal data by Discord at: discord.com.
The processing of data within our server (e.g., managing member lists or responding to support queries) is based on our legitimate interest in communicating with our community and providing user support, in accordance with Article 6 (1) (f) GDPR.
We also process information that you have provided to us via our page on the respective social media platform. This information might include the username, contact information, or a message to us. We are the sole controllers of these processing operations by us. We process the data on the basis of our legitimate interest in establishing contact with inquiring persons. The legal basis for the data processing is Article 6 (1) (f) GDPR. There may be further data processing if you have consented to this (Article 6 (1) (a) GDPR) or if this is required for the fulfillment of a legal obligation (Article 6 (1) (c) GDPR).
Below, we inform you about the additional collection and processing of personal data when using Kornhal.
When you send us a message via the provided contact email, we will process the transmitted data for the purpose of answering your inquiry. We process the data on the basis of our legitimate interest in establishing contact with inquiring persons. The legal basis for the data processing is Article 6 (1) (f) GDPR.
If you have given your consent, we may use your email address to send you information about updates, new features, or related services.
The legal basis for this processing is your consent in accordance with Article 6 (1) (a) GDPR.
You may withdraw your consent at any time by clicking the unsubscribe link included in every email or by contacting us directly.
3. Requirement to provide data
Providing certain personal data, such as your email address, is necessary in order to create and maintain a user account and to use the online features of the game.
If this data is not provided, it may not be possible to use certain services or features of Kornhal.
Current as of: Feb 2026