1. Data controller
The controller responsible for personal data processed through arcadeviking.com is:
- Controller
- Arcade Viking ehf. company no. 20421-0160
- Address
- Víkurbraut 20, 780 Höfn, Iceland
- contact@arcadeviking.com
- Website
- arcadeviking.com
For privacy questions, email us with "Privacy" in the subject line, or use our contact page and choose "Privacy and my data".
2. Scope of this policy
This policy covers the Arcade Viking website and its 8 free social casino games. Arcade Viking is a social casino games website for people aged 18 and over. No real money bets are accepted and no prizes are awarded. The site has no user accounts, so we process very little personal data.
3. Data you give us
- Contact form or email. Your name, email address, the topic you choose, your message, the time it was sent and your IP address. The IP address is only used to protect the form against spam and abuse.
- Coin pack purchases, once payments are available. Order number, the coin pack purchased, amount, currency, country and the email address given at checkout. Card details are sent directly to the payment provider and are never visible to us.
4. Server logs
- Hosting logs. Each request records an IP address, browser type, the page requested, the referring page and a timestamp. This is standard for all web servers. We use these logs only for security and troubleshooting.
5. Data stored in your browser
- Six items are stored in your own browser: your coin balance, when you last collected free daily coins, your age confirmation, your cookie choice, and two timers for the break reminder. None of this is sent to us and we cannot read it. All items are listed in our Cookie Policy.
6. Purposes and legal bases
| Purpose | Data | Legal basis under GDPR and UK GDPR |
|---|---|---|
| Replying to your messages | Data from the contact form or your email | Our legitimate interest in answering people who contact us |
| Protecting the website against spam, fraud and abuse | IP address, form timing, server logs | Our legitimate interest in a secure, working website |
| Delivering coin packs and processing refunds | Order details | Performance of a contract with you |
| Accounting and tax | Order details | Legal obligation |
| Remembering your cookie choice | Cookie choice cookie | Legal obligation |
| Handling data requests and legal claims | The request and related correspondence | Legal obligation; our legitimate interest |
7. What we never do
- We do not sell personal data or share it for cross-site advertising.
- We do not use analytics, advertising cookies or tracking pixels.
- We do not create profiles or make automated decisions about anyone.
- We do not send marketing emails and have no mailing list.
8. Who we share data with
- Our hosting provider, which stores the website files and server logs.
- Our email provider, which delivers messages in both directions.
- A payment provider, once payments are available, under its own privacy terms for card data.
- An accountant or lawyer, only where truly necessary.
- Public authorities, where required by law.
All providers act on our written instructions under contracts that cover confidentiality and data protection.
9. International transfers
A provider may process data outside your country, including outside the European Economic Area and the United Kingdom. In that case we rely on an adequacy decision or on the Standard Contractual Clauses of the European Commission, with the UK addendum where UK data is involved.
10. How long we keep data
- Messages and correspondence: two years after the last message.
- Server logs: 90 days, longer only while a security incident is being investigated.
- Order records: as long as tax and accounting laws require, usually ten years.
- Data in your browser: until it expires or you delete it.
11. Your rights
Depending on where you live, you have the right to:
- know what data we hold about you and get a copy;
- have incorrect or incomplete data corrected;
- have your data deleted;
- restrict or object to processing, including processing based on legitimate interests;
- receive your data in a machine-readable format;
- withdraw consent at any time, without affecting earlier processing.
We answer within one month, or longer only where the law allows. We may need to confirm your identity first. Requests are free unless they are clearly unfounded or excessive.
12. Regional information
- European Economic Area and Switzerland. You can complain to the data protection authority where you live or work.
- United Kingdom. Complaints are handled by the Information Commissioner's Office.
- United States. Where a state privacy law applies, such as in California, you have the right to know, access, correct and delete your data and to opt out of its sale or sharing. We do not sell or share personal data and do not process sensitive data. We will not treat you differently for using your rights, and an authorised agent may make a request for you.
- Canada, Australia, New Zealand, Japan, Brazil, South Africa and other countries. We respect the access, correction and deletion rights given by your local law, and you can contact your national regulator.
13. Adults only
Arcade Viking is only for people aged 18 and over, and we do not knowingly collect personal data from anyone under 18. If you think a minor has contacted us or bought a coin pack, let us know: we will delete the data and refund the purchase.
14. Security
All data is sent over HTTPS. Contact form messages are stored in a location that cannot be accessed over the web, and only authorised people can read them. No system is perfectly secure, but our measures are appropriate to the small amount of data we process.
15. Complaints and contact
Arcade Viking ehf. company no. 20421-0160, Víkurbraut 20, 780 Höfn, Iceland. Email: contact@arcadeviking.com. If you have a complaint, please contact us first so we can try to resolve it. We update this policy whenever our practices change, including when payments become available. The date at the top shows the current version.