Privacy

1. Who answers for this

Personal data handled through arcadeviking.com is the responsibility of:

Anything touching privacy arrives fastest by letter with the word Privacy at the head of the subject, or through the word-sending page under "Privacy, or my records".

2. What is covered

This covers the Arcade Viking site and its eight benches. Arcade Viking is a social arcade for people of eighteen and over: no stake is taken in currency and no prize is handed out. It was built on purpose without accounts, which is why there is so little here to write about.

3. What you hand over

• Through the word-sending form, or by letter. A name, an address for the answer, the errand taken from the list, the message itself, the moment it arrived and the originating IP address — that last one only to keep spam and abuse off the form.
• Through the till, once it opens. An order reference, the bundle taken, the sum, the currency, the country, and the address given at the till. Card numbers go straight to the payment provider and never come into our view.

4. What the server writes down

• Host logs. Every request leaves an IP address, a browser string, the page asked for, whatever page referred it, and a timestamp. This is how web servers behave everywhere; here it is read for security and for tracing faults, and nothing else.

5. What stays on your machine

• Six items sit in your own browser: the hoard, the moment the daily gift was last taken, the record that age was confirmed, the storage choice you settled, and two timers behind the rest reminder. None of it travels to us and none of it is readable by us. Every key is named under Storage.

6. Reasons, and legal bases

7. What is never done

• Nothing is sold. Nothing is passed on for advertising that trails people between sites.
• No counting package runs here, no advertising cookie is written, and no tracking pixel sits on any page.
• Nobody is profiled, and no decision about anybody is reached by machine alone.
• No marketing mail goes out. There is no list to end up on.

8. Who else sees it

• The company hosting the Hall, which holds the files and the logs.
• The company carrying our mail, which moves messages in both directions.
• A payment provider, once the till opens, working to its own privacy terms where cards are concerned.
• An accountant or a lawyer, in the rare case a matter truly calls for one.
• A public authority, where a law obliges us to hand something over.

Each of them works to our written instruction, under a contract covering confidentiality and data protection.

9. Handling beyond your country

A provider may handle something outside the country you are in, the European Economic Area and the United Kingdom among the places that may be left. Where that happens we lean on an adequacy decision, or else on the Standard Contractual Clauses published by the European Commission, with the UK addendum attached wherever British data is involved.

10. How long each thing is held

• An exchange of letters: two years from the last message, then it goes.
• Host logs: ninety days, held longer only while a security incident is being looked into.
• Order records: as long as tax and accounting rules demand, which usually means a decade.
• Whatever sits on your machine: until it expires, or until you clear it yourself.

11. What you may ask for

Depending on where you live, you are entitled to ask us to:

• say what is held about you, and hand over a copy;
• put right anything wrong, or fill in anything half-written;
• erase it;
• pause what we do with it, or object outright, legitimate interests included;
• send it on in a shape another service can read;
• take back a consent whenever you like, leaving everything done beforehand standing.

An answer takes a month, stretched further only where a law permits. We may first have to establish that you are who you say. None of it costs anything, unless a request is plainly baseless or repeated to excess.

12. Notes by region

• European Economic Area, and Switzerland. A grievance may go to the supervisory authority where you live or where you work.
• United Kingdom. Grievances are heard by the Information Commissioner's Office.
• United States. Where a state statute applies — California's being the best known — you may find out what is held, see it, correct it and have it erased, and you may opt out of any sale or sharing. Neither happens here, and no sensitive category is touched. Nobody is treated worse for asking, and an authorised agent may ask on your behalf.
• Canada, Australia, New Zealand, Japan, Brazil, South Africa, and elsewhere. Whatever rights of access, correction and erasure your own statute grants, we honour, and your national regulator stays open to you.

13. Grown people only

Arcade Viking admits nobody under eighteen, and personal data is not knowingly taken from anyone below that age. Where you suspect a minor has written in or paid for a bundle, tell us: the data goes and the money comes back.

14. Keeping it safe

Everything travels over HTTPS. Messages from the form are written into a place that cannot be fetched over the web, and only the people who need them can open them. No arrangement is flawless, but the measures here sit in proportion to how little data there is to begin with.

15. Grievances, and contact

Arcade Viking ehf. company no. 20421-0160, Víkurbraut 20, 780 Höfn, Iceland. Letters: contact@arcadeviking.com. We would far rather hear a grievance straight from you, and settle it, than read it in a letter from a regulator — so please give us first refusal. This page is rewritten whenever the practice behind it changes, the opening of the till included, and the date at the head always names the standing version.