Privacy Policy — ATLANTHEOS

1. Overview 2. Identity of the Data Controller 3. Personal Data We Collect 4. How We Collect Personal Data 5. Purposes and Legal Bases 6. Required and Optional Data 7. Cookies and Similar Technologies 8. Disclosure of Personal Data 9. International Transfers 10. Data Retention 11. Security 12. Your GDPR Rights 13. Automated Processing and Profiling 14. Children 15. Marketing Communications 16. Supervisory Authority 17. Changes to This Policy 18. Contact

1.Overview

This Data Protection and Privacy Policy (“Policy”) explains how Grimy KFT collects, uses, stores, shares, and protects personal data in connection with the Atlantheos platform available at https://atlantheos.com/ and all related services, accounts, gameplay features, payment flows, market features, and support channels operated by us (the “Platform”).

We process personal data in accordance with Regulation (EU) 2016/679 (the “GDPR”), applicable Hungarian data protection law, and other applicable privacy and consumer protection requirements.

We do not sell your personal data, and we do not use it for third-party advertising.

2.Identity of the Data Controller

The data controller responsible for your personal data is:

Grimy KFT
Company Registration No.: 01-09-457104
Registered Address: 1141 Budapest, Szugló utca 82., Hungary
Website: https://atlantheos.com/
Email: support@atlantheos.com

In this Policy, Grimy KFT is referred to as “we”, “us”, “our”, or the “Company”.

3.Personal Data We Collect

Depending on how you use the Platform, we may collect and process the following categories of personal data:

(a) Account Data: username, user ID, email address, login credentials, account settings, account status, registration date, and authentication data.
(b) Profile and Gameplay Data: clan name, champion and class selection, Atlanteans owned and their ranks, game progress, gods defeated, battle record, Rivals activity, Ascent and league standing, equipment and its durability, consumables and inventory, Artifacts held and equipped, in-game balances, Vitality, and other game-related account information.
(c) Contact and Support Data: email address, support messages, complaints, refund requests, correspondence, technical issue reports, and our responses.
(d) Transaction Data: purchase records, Pearls purchases, Essence purchases, order numbers, invoices and receipts, Artifact Market purchases and exchanges, refunds, chargebacks, payment status, billing identifiers, and transaction history.
(e) Payment and Card Data: payment method details, payment provider identifiers, payment confirmations, failed payment data, chargeback data, and fraud prevention signals. We do not store full payment card numbers, and we do not store card security codes (CVC). For a purchase we retain the cardholder name and the last four digits of the card as part of the transaction record.
(f) Verification Data: we do not ask you for identity documents in order to use the Platform. Where the law or a payment provider requires a payment or its owner to be verified, we process only the information needed for that check.
(g) Device and Technical Data: IP address, device identifiers, browser type, operating system, device type, language settings, time zone, log data, crash data, cookies, browser local storage used to keep your game session and progress on your device, and other technical data; and, only if you accept analytics cookies, Google Analytics usage data — pages and screens viewed, session length, device and browser type, approximate location derived from your IP address, and the Google Analytics cookie identifiers.
(h) Security and Anti-Fraud Data: login attempts, suspicious activity signals, bot detection signals, account risk indicators, chargeback risk data, and fraud prevention logs.
(i) Marketing and Preference Data: communication preferences, cookie preferences, marketing opt-in or opt-out status, campaign attribution, and interaction with promotional content.
(j) Legal and Compliance Data: records required for legal, tax, accounting, consumer protection, payment, dispute, and regulatory compliance purposes.

4.How We Collect Personal Data

We collect personal data directly from you when you create an account, make a purchase, submit a support request, complete verification, use the Artifact Market, or otherwise interact with the Platform.

We also collect data automatically when you use the Platform, including device data, log data, gameplay data, transaction data, cookies, and similar technologies.

We may receive data from third parties, including payment processors, fraud prevention providers, hosting providers, analytics providers, email delivery providers, customer support providers, banks, card networks, and competent authorities.

5.Purposes and Legal Bases for Processing

We process personal data only where we have a lawful basis under the GDPR. The main purposes and legal bases are:

(a) Account creation and management: to register, authenticate, maintain, and secure your account. Legal basis: contract performance; legitimate interests.
(b) Provision of the Game and Services: to provide Atlantheos, gameplay, saved progress, Virtual Items, balances, duels against gods, Rivals, rankings, leagues, Atlanteans, and equipment. Legal basis: contract performance.
(c) Payments and purchases: to process Pearls and Essence purchases, payment confirmations, invoices and receipts sent to your email address, chargebacks, and transaction records. Legal basis: contract performance; legal obligation; legitimate interests.
(d) Artifact Market operation: to process purchases of Artifacts from the Platform, exchanges of spare Artifacts for Essence, disputes, fraud checks, and account balance updates. Legal basis: contract performance; legitimate interests; legal obligation where applicable.
(e) Legal record keeping: to keep transaction and accounting records for the periods the law requires. Legal basis: legal obligation; legitimate interests.
(f) Fraud prevention and payment security: to prevent misuse, detect suspicious activity, prevent chargeback abuse, comply with payment provider requirements, and meet legal obligations. Legal basis: legal obligation; legitimate interests.
(g) Customer support and dispute handling: to respond to enquiries, investigate issues, resolve complaints, handle refunds, and maintain records. Legal basis: contract performance; legitimate interests; legal obligation.
(h) Security and platform integrity: to protect accounts, detect bots, prevent cheating, secure the Platform, monitor technical faults, and prevent abuse. Legal basis: legitimate interests; contract performance; legal obligation.
(i) Analytics and improvement: to understand usage, diagnose issues, improve game balance, develop new features, and measure Platform performance. Legal basis: legitimate interests; consent where required for cookies or similar technologies. For Google Analytics, described in Section 7, the legal basis is your consent alone (Article 6(1)(a) GDPR), which you can withdraw at any time through “Cookie Settings”. Withdrawal does not affect processing carried out before it.
(j) Marketing and communications: to send service communications, optional marketing, updates, and promotional materials where permitted. Legal basis: consent; legitimate interests where permitted by law.
(k) Legal compliance and claims: to comply with accounting, tax, consumer protection, regulatory, law enforcement, and legal claim obligations. Legal basis: legal obligation; legitimate interests.

6.Required and Optional Data

Some data is necessary to provide the Platform. If you do not provide required account, payment, verification, or transaction information, we may be unable to provide certain features, save your progress, process purchases, operate the Artifact Market, handle disputes, or comply with legal obligations.

Optional data, such as certain profile or marketing preferences, may be changed or withdrawn where applicable.

7.Cookies and Similar Technologies

We use cookies and similar technologies as described in our Cookie Policy. Strictly necessary cookies and equivalent browser storage support account access, security, gameplay continuity, payment flows, and basic Platform operation. The only optional cookies we use are Google Analytics cookies; we do not use advertising cookies.

The website atlantheos.com and the game at play.atlantheos.com use Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to produce visit statistics. Google Analytics cookies are set only after you click Accept in the cookie banner. Until then, and if you click Decline, the Google tag on the page runs with all storage switched off: it sets no cookie and stores no identifier on your device. It may still send Google a basic request when a page is viewed, without any cookie or identifier (Google’s “Consent Mode”); Google uses such requests only to produce aggregated statistics. The cookies used and their duration are listed in the Cookie Policy.

You may change your choice at any time through the Cookie Settings link in the website footer or the Cookie Settings button in the game’s Settings, or through your browser settings.

8.Disclosure of Personal Data

We may share personal data with the following categories of recipients where necessary:

(a) hosting, infrastructure, database, and cloud service providers;
(b) payment processors, banks, card networks, and payment service providers;
(c) fraud prevention and payment security providers;
(d) analytics, performance, and technical monitoring providers, including Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Analytics), as described in Section 7 — cookie-based analytics only if you accept analytics cookies;
(e) email delivery, customer support, and communication providers;
(f) professional advisers, including legal, tax, accounting, audit, and compliance advisers;
(g) competent courts, regulators, tax authorities, law enforcement, consumer protection bodies, data protection authorities, or other public authorities where required or permitted by law;
(h) business successors in connection with a merger, acquisition, restructuring, financing, sale of assets, or transfer of business.

Other players can see the information you make public in the game, such as your clan name, your Atlanteans, and your league and Ascent in Rivals.

All service providers process personal data on our documented instructions under data processing agreements with appropriate confidentiality and security obligations.

9.International Transfers

Your personal data may be processed in the European Economic Area and, where necessary, outside the European Economic Area.

Where we transfer personal data outside the EEA, we use appropriate safeguards, such as adequacy decisions, Standard Contractual Clauses approved by the European Commission, supplementary measures where needed, or another lawful transfer mechanism under the GDPR.

Google Analytics data may be transferred to Google LLC in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, which is covered by an adequacy decision of the European Commission; Google additionally uses Standard Contractual Clauses.

10.Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including to provide the Platform, comply with legal obligations, resolve disputes, prevent fraud, enforce agreements, and maintain security.

Typical retention periods include:

(a) Account and game progress data: for as long as your account remains active and for a reasonable period after closure where needed for legal, security, dispute, or accounting purposes.
(b) Transaction, purchase, accounting, and tax records: 8 years, as required by Hungarian accounting law, or longer where another law requires it.
(c) Fraud prevention and payment security records: for the period required by applicable legal and compliance obligations, which may extend for several years after the end of the relevant relationship or transaction.
(d) Support records: for as long as needed to resolve the issue and maintain a record of the interaction.
(e) Security logs: for a limited period unless needed for investigation, fraud prevention, legal claims, or security reasons.
(f) Google Analytics data: no longer than 14 months, after which Google deletes it automatically; Google Analytics cookies expire after 2 years or when you withdraw consent.

When personal data is no longer required, we delete it, anonymise it, or securely archive it where continued retention is required by law.

11.Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, disclosure, or destruction. Measures may include encryption, access controls, logging, monitoring, secure development practices, fraud detection, role-based permissions, and provider due diligence.

No online service can be guaranteed to be completely secure. You are responsible for keeping your account credentials confidential and for promptly informing us of suspected account compromise.

12.Your GDPR Rights

Subject to applicable conditions and exemptions, you may have the following rights:

(a) Right of access: to request confirmation and a copy of your personal data.
(b) Right to rectification: to request correction of inaccurate or incomplete data.
(c) Right to erasure: to request deletion of personal data in certain circumstances.
(d) Right to restriction: to request limitation of processing in certain circumstances.
(e) Right to object: to object to processing based on legitimate interests or direct marketing.
(f) Right to data portability: to receive certain data in a structured, commonly used, machine-readable format.
(g) Right to withdraw consent: where processing is based on consent.
(h) Right to lodge a complaint with a supervisory authority.

To exercise your rights, contact us at support@atlantheos.com. We may need to verify your identity before responding. We respond within the time limits set by the GDPR, normally within one month.

Please note that deleting your account data will also delete your game progress, Atlanteans, equipment, Artifacts, and in-game balances, and that this cannot be undone.

13.Automated Processing and Profiling

We may use automated tools to detect fraud, bot activity, abuse of the Artifact Market, payment risk, security threats, and suspicious account behaviour. We may also use automated systems to match opponents in Rivals, balance the Platform, or detect technical issues.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you unless permitted by law and subject to appropriate safeguards, including your right to have such a decision reviewed by a person.

14.Children

The Platform is not intended for users under 18. We do not knowingly collect personal data from minors. If we become aware that a person under 18 has provided personal data, we will take appropriate steps to delete the data and restrict the account, subject to legal requirements.

15.Marketing Communications

We may send service-related communications, including security notices, purchase confirmations, invoices and receipts, account notices, policy updates, and support messages.

We send marketing communications only where permitted by law. You may opt out of marketing communications at any time by using the unsubscribe link or contacting us at support@atlantheos.com.

16.Supervisory Authority

If you are not satisfied with how we handle your personal data, you may lodge a complaint with the Hungarian data protection supervisory authority:

Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Website: https://www.naih.hu/
Postal address: 1055 Budapest, Falk Miksa utca 9-11, Hungary

You may also have the right to contact the supervisory authority in your EU Member State of residence, place of work, or place of the alleged infringement.

17.Changes to This Policy

We may update this Policy from time to time to reflect changes in our data practices, Platform features, legal requirements, service providers, or security measures. The current version will be available on the Platform. Material changes may be notified through the Platform or by email where appropriate.

18.Contact

For privacy questions, data subject rights requests, or complaints, contact: