Privacy Policy — ATLANTHEOS

1. Overview 2. Identity of the Data Controller 3. Personal Data We Collect 4. How We Collect Personal Data 5. Purposes and Legal Bases 6. Required and Optional Data 7. Cookies and Similar Technologies 8. Disclosure of Personal Data 9. International Transfers 10. Data Retention 11. Security 12. Your GDPR Rights 13. Automated Processing and Profiling 14. Children 15. Marketing Communications 16. Supervisory Authority 17. Changes to This Policy 18. Contact

1.Overview

This Data Protection and Privacy Policy (“Policy”) explains how Grimy KFT collects, uses, stores, shares, and protects personal data in connection with the Atlantheos platform available at https://atlantheos.com/ and all related services, accounts, gameplay features, payment flows, market features, payout functions, and support channels operated by us (the “Platform”).

We process personal data in accordance with Regulation (EU) 2016/679 (the “GDPR”), applicable Hungarian data protection law, and other applicable privacy and consumer protection requirements.

We do not sell your personal data.

2.Identity of the Data Controller

The data controller responsible for your personal data is:

Grimy KFT
Company Registration No.: 01-09-457104
Registered Address: 1141 Budapest, Szugló utca 82., Hungary
Website: https://atlantheos.com/
Email: support@atlantheos.com

In this Policy, Grimy KFT is referred to as “we”, “us”, “our”, or the “Company”.

3.Personal Data We Collect

Depending on how you use the Platform, we may collect and process the following categories of personal data:

(a) Account Data: username, user ID, email address, login credentials, account settings, account status, registration date, and authentication data.
(b) Profile and Gameplay Data: clan name, champion and class selection, Atlanteans owned and their ranks, game progress, gods defeated, battle record, Arena activity, Ascent and league standing, equipment and its durability, consumables and inventory, Artifacts held and equipped, market listings, in-game balances, Vitality, and other game-related account information.
(c) Contact and Support Data: email address, support messages, complaints, refund requests, payout requests, correspondence, technical issue reports, and our responses.
(d) Transaction Data: purchase records, Pearls purchases, Essence purchases, order numbers, invoices and receipts, Artifact Market transactions, commissions, payout requests, reverse conversion records, refunds, chargebacks, payment status, billing identifiers, and transaction history.
(e) Payment and Card Data: payment method details, payment provider identifiers, payment confirmations, failed payment data, chargeback data, and fraud prevention signals. We do not store full payment card numbers, and we do not store card security codes (CVC). For a purchase we retain the cardholder name and the last four digits of the card as part of the transaction record. For a payout we retain the cardholder name, the last four digits of the card and the card expiry date as part of the payout record.
(f) Identity and Verification Data: full legal name, date of birth, country, address, identity document details, verification status, sanctions screening results, source of funds information, payment ownership verification, and other KYC/AML data where required or appropriate.
(g) Device and Technical Data: IP address, device identifiers, browser type, operating system, device type, language settings, time zone, log data, crash data, cookies, browser local storage used to keep your game session and progress on your device, and other technical data.
(h) Security and Anti-Fraud Data: login attempts, suspicious activity signals, bot detection signals, account risk indicators, market abuse indicators, chargeback risk data, sanctions screening data, and fraud prevention logs.
(i) Marketing and Preference Data: communication preferences, cookie preferences, marketing opt-in or opt-out status, campaign attribution, and interaction with promotional content.
(j) Legal and Compliance Data: records required for legal, tax, accounting, consumer protection, payment, AML, sanctions, dispute, and regulatory compliance purposes.

4.How We Collect Personal Data

We collect personal data directly from you when you create an account, make a purchase, submit a support request, request a payout, complete verification, participate in the Artifact Market, or otherwise interact with the Platform.

We also collect data automatically when you use the Platform, including device data, log data, gameplay data, transaction data, cookies, and similar technologies.

We may receive data from third parties, including payment processors, identity verification providers, fraud prevention providers, hosting providers, analytics providers, email delivery providers, customer support providers, banks, card networks, and competent authorities.

5.Purposes and Legal Bases for Processing

We process personal data only where we have a lawful basis under the GDPR. The main purposes and legal bases are:

(a) Account creation and management: to register, authenticate, maintain, and secure your account. Legal basis: contract performance; legitimate interests.
(b) Provision of the Game and Services: to provide Atlantheos, gameplay, saved progress, Virtual Items, balances, duels against gods, the Arena, rankings, leagues, Atlanteans, and equipment. Legal basis: contract performance.
(c) Payments and purchases: to process Pearls and Essence purchases, payment confirmations, invoices and receipts sent to your email address, chargebacks, and transaction records. Legal basis: contract performance; legal obligation; legitimate interests.
(d) Artifact Market operation: to process listings, purchases, sales, commissions, settlement, disputes, fraud checks, and account balance updates. Legal basis: contract performance; legitimate interests; legal obligation where applicable.
(e) Payout and reverse conversion handling: to assess payout eligibility, process eligible Essence reverse conversion requests, verify payment ownership, prevent fraud, and keep required records. Legal basis: contract performance; legal obligation; legitimate interests.
(f) KYC, AML, sanctions, and fraud prevention: to verify identity, prevent misuse, detect suspicious activity, prevent chargeback abuse, comply with payment provider requirements, and meet legal obligations. Legal basis: legal obligation; legitimate interests.
(g) Customer support and dispute handling: to respond to enquiries, investigate issues, resolve complaints, handle refunds, and maintain records. Legal basis: contract performance; legitimate interests; legal obligation.
(h) Security and platform integrity: to protect accounts, detect bots, prevent cheating, secure the Platform, monitor technical faults, and prevent abuse. Legal basis: legitimate interests; contract performance; legal obligation.
(i) Analytics and improvement: to understand usage, diagnose issues, improve game balance, develop new features, and measure Platform performance. Legal basis: legitimate interests; consent where required for cookies or similar technologies.
(j) Marketing and communications: to send service communications, optional marketing, updates, and promotional materials where permitted. Legal basis: consent; legitimate interests where permitted by law.
(k) Legal compliance and claims: to comply with accounting, tax, consumer protection, regulatory, law enforcement, and legal claim obligations. Legal basis: legal obligation; legitimate interests.

6.Required and Optional Data

Some data is necessary to provide the Platform. If you do not provide required account, payment, verification, or transaction information, we may be unable to provide certain features, save your progress, process purchases, operate the Artifact Market, process payouts, handle disputes, or comply with legal obligations.

Optional data, such as certain profile or marketing preferences, may be changed or withdrawn where applicable.

7.Cookies and Similar Technologies

We use cookies and similar technologies as described in our Cookie Policy. Strictly necessary cookies and equivalent browser storage support account access, security, gameplay continuity, payment flows, and basic Platform operation. Optional cookies, such as analytics or advertising cookies, are used only where permitted by law and, where required, after consent.

You may manage cookie choices through the cookie settings available on the Platform or through your browser settings.

8.Disclosure of Personal Data

We may share personal data with the following categories of recipients where necessary:

(a) hosting, infrastructure, database, and cloud service providers;
(b) payment processors, banks, card networks, and payment service providers;
(c) identity verification, KYC, AML, sanctions screening, and fraud prevention providers;
(d) analytics, performance, and technical monitoring providers;
(e) email delivery, customer support, and communication providers;
(f) professional advisers, including legal, tax, accounting, audit, and compliance advisers;
(g) competent courts, regulators, tax authorities, law enforcement, consumer protection bodies, data protection authorities, or other public authorities where required or permitted by law;
(h) business successors in connection with a merger, acquisition, restructuring, financing, sale of assets, or transfer of business.

We require service providers to process personal data only under appropriate contractual and security obligations.

9.International Transfers

Your personal data may be processed in the European Economic Area and, where necessary, outside the European Economic Area.

Where we transfer personal data outside the EEA, we use appropriate safeguards, such as adequacy decisions, Standard Contractual Clauses approved by the European Commission, supplementary measures where needed, or another lawful transfer mechanism under the GDPR.

10.Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including to provide the Platform, comply with legal obligations, resolve disputes, prevent fraud, enforce agreements, and maintain security.

Typical retention periods include:

(a) Account and game progress data: for as long as your account remains active and for a reasonable period after closure where needed for legal, security, dispute, or accounting purposes.
(b) Transaction, purchase, payout, accounting, and tax records: for the period required by applicable accounting, tax, payment, and legal obligations.
(c) KYC, AML, sanctions, and fraud prevention records: for the period required by applicable legal and compliance obligations, which may extend for several years after the end of the relevant relationship or transaction.
(d) Support records: for as long as needed to resolve the issue and maintain a record of the interaction.
(e) Security logs: for a limited period unless needed for investigation, fraud prevention, legal claims, or security reasons.

When personal data is no longer required, we delete it, anonymise it, or securely archive it where continued retention is required by law.

11.Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, disclosure, or destruction. Measures may include encryption, access controls, logging, monitoring, secure development practices, fraud detection, role-based permissions, and provider due diligence.

No online service can be guaranteed to be completely secure. You are responsible for keeping your account credentials confidential and for promptly informing us of suspected account compromise.

12.Your GDPR Rights

Subject to applicable conditions and exemptions, you may have the following rights:

(a) Right of access: to request confirmation and a copy of your personal data.
(b) Right to rectification: to request correction of inaccurate or incomplete data.
(c) Right to erasure: to request deletion of personal data in certain circumstances.
(d) Right to restriction: to request limitation of processing in certain circumstances.
(e) Right to object: to object to processing based on legitimate interests or direct marketing.
(f) Right to data portability: to receive certain data in a structured, commonly used, machine-readable format.
(g) Right to withdraw consent: where processing is based on consent.
(h) Right to lodge a complaint with a supervisory authority.

To exercise your rights, contact us at support@atlantheos.com. We may need to verify your identity before responding.

Please note that deleting your account data will also delete your game progress, Atlanteans, equipment, Artifacts, and in-game balances, and that this cannot be undone.

13.Automated Processing and Profiling

We may use automated tools to detect fraud, bot activity, market abuse, payment risk, sanctions risk, security threats, and suspicious account behaviour. We may also use automated systems to match opponents in the Arena, balance the Platform, or detect technical issues.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you unless permitted by law and subject to appropriate safeguards. Payout requests are reviewed manually by an administrator.

14.Children

The Platform is not intended for users under 18. We do not knowingly collect personal data from minors. If we become aware that a person under 18 has provided personal data, we will take appropriate steps to delete the data and restrict the account, subject to legal requirements.

15.Marketing Communications

We may send service-related communications, including security notices, purchase confirmations, invoices and receipts, payout updates, account notices, policy updates, and support messages.

We send marketing communications only where permitted by law. You may opt out of marketing communications at any time by using the unsubscribe link or contacting us at support@atlantheos.com.

16.Supervisory Authority

If you are not satisfied with how we handle your personal data, you may lodge a complaint with the Hungarian data protection supervisory authority:

Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Website: https://www.naih.hu/
Postal address: 1055 Budapest, Falk Miksa utca 9-11, Hungary

You may also have the right to contact the supervisory authority in your EU Member State of residence, place of work, or place of the alleged infringement.

17.Changes to This Policy

We may update this Policy from time to time to reflect changes in our data practices, Platform features, legal requirements, service providers, or security measures. The current version will be available on the Platform. Material changes may be notified through the Platform or by email where appropriate.

18.Contact

For privacy questions, data subject rights requests, or complaints, contact: