The binding version is the Hungarian one. This text is an informative translation; in case of any difference, the Hungarian text prevails. Hungarian version
Version 0.6 · Effective from: 2026-10-06
Privacy Notice
Version: 0.6 · Effective from 6 October 2026. Text under legal review. This is a courtesy translation; the Hungarian version is binding. Hungarian version
1. The controller
- Roland Attila Szegi, sole trader (egyéni vállalkozó)
- Registered seat: 5000 Szolnok, Városmajor út 59/B, Building B, 2nd floor 24, Hungary.
- Registration no.: 61835722 · Tax no.: 91754804-1-36
- E-mail (also for data protection matters): hello@dropsite.hu · Phone: +36 30 798 2618
- Data protection officer: not appointed (not mandatory).
Processing is governed by Regulation (EU) 2016/679 (GDPR) and Hungarian Act CXII of 2011 on informational self-determination.
2. What data, for what, on what basis, for how long
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Creating the account and providing the game | account name, e-mail address, password (only as an irreversible hash), the declaration of being at least 16, the version, language and time of the accepted documents (Terms, Game Rules, Privacy Notice) | performance of contract (GDPR Art. 6(1)(b)) | until the account is closed, then 30 days |
| Running the game | characters, in-game items, progress, friend list, guild membership, in-game messages (messages sent on the "Call" channel are logged by the server; normal speech, whispers, party and guild chat are not) | performance of contract | until the account is closed; the "Call" channel log is kept for 90 days |
| Security, fraud prevention | IP address, login times, device type and app version, log of suspected fraud events | legitimate interest (GDPR Art. 6(1)(f)): protecting the service and other players | 90 days; in case of a rule violation, until the procedure is closed |
| Error log | the end of the app's technical log (network address, device type, version, events before the error) – sent automatically after an abnormal exit, or when the player sends it in Settings | legitimate interest: fixing errors | the oldest logs are deleted once all logs together reach 300 MB (typically a few weeks) |
| Player reports (moderation) | names of the reporting and the reported character, reason, place and time of the report, and at most 8 messages of the reported player from the 10 minutes before the report – only those the reporter could see (speech, call, whisper addressed to them, shared party or guild message). Reports are reviewed by a human; the list of players blocked in the game is stored only on the player's own device and is not sent to the server. | legitimate interest (GDPR Art. 6(1)(f)): protecting players and enforcing the Game Rules | 90 days from the report |
| Purchases | order data (package, amount, time), payment ID, log of crediting and spending; time of the withdrawal and 18+/parental declarations; card data is handled by the payment provider and never reaches us | performance of contract | 5 years after the contract ends (limitation period) |
| Invoicing | billing name, country, postcode, city, address, e-mail address, payment ID, amount and currency | legal obligation (VAT Act, Accounting Act) | invoices: 8 years |
| Saving billing data for the next purchase | the same data saved to your account | performance of contract (convenience feature) | until the account is closed or you change it |
| Accounting records | issued invoices, Stripe payout and fee statements, order data | legal obligation (Accounting Act) | 8 years |
| Contact, complaints | name, e-mail, content of correspondence | legal obligation (complaints), or legitimate interest | complaints: 3 years; other correspondence: 1 year |
| Rankings | character name, level, class, empire, guild – publicly | legitimate interest: a usual community feature of the game; you may ask to hide a character | while the character exists |
| Newsletter (only if you subscribe) | e-mail address, time of consent and withdrawal | consent (GDPR Art. 6(1)(a)) | until you unsubscribe; proof of consent for 5 years |
| System e-mails | e-mail address, sending log | performance of contract | 30 days |
We do not build advertising profiles and make no solely automated decisions with legal effect. Signals of the automatic anti-fraud filter are reviewed by a human before any account is restricted.
3. Children
Registration is allowed from age 16. If we learn that a person under 16 registered without the consent of the holder of parental responsibility, we delete the account.
4. Who receives the data (processors and recipients)
| Who | Purpose | Where |
|---|---|---|
| Hetzner Online GmbH | hosting of the game server and backups | Germany (EU) |
| Cloudflare, Inc. | network protection, DNS, traffic forwarding | EU and USA – transfers to the USA based on the EU–US Data Privacy Framework or standard contractual clauses |
| Lovable Labs Incorporated (Lovable / Lovable Cloud) and its sub-processors | website hosting, database, web login, order records and sending system e-mails (notify.imperion2.com) | for transfers to the USA, standard contractual clauses |
| Stripe Payments Europe, Ltd. | processing payments (card data, fraud prevention) – an independent controller in this respect | Ireland (EU); according to Stripe's own notice |
| KBOSS.hu Kft. (Számlázz.hu) | issuing, storing and e-mailing invoices to the buyer | Hungary (EU) |
| Accountant | fulfilling accounting obligations | Hungary |
We disclose data to authorities or courts only when required by law.
4/A. Transfers to third countries
Cloudflare, Stripe and some sub-processors of Lovable may also process data in the United States. Transfers are based on the EU–US Data Privacy Framework (if the recipient is certified), otherwise on the European Commission's standard contractual clauses.
5. Data security
Passwords are stored only as irreversible hashes. The game database is not reachable from the internet; the website accesses it over a separate, key-protected connection. App updates are protected by signatures. A daily backup is made and kept for 14 days. Access is limited to the controller.
In case of a personal data breach that poses a high risk, we notify the data subjects without undue delay.
6. Your rights
You may request: information about and a copy of your data; correction of inaccurate data; erasure (unless the law requires retention); restriction of processing; your data in a portable format; you may object to processing based on legitimate interest; you may withdraw your consent (newsletter) at any time.
On the My account page you can instantly download the data stored on the website with "Download my data", request deletion with "Delete my account", and switch the newsletter on and off.
Send requests to hello@dropsite.hu from the e-mail address linked to your account; we reply within one month. Handling requests is free of charge.
6/A. Deleting the account
You can request deletion of your account when signed in on the My account page, or on the public "Delete account" page (/fiok-torles), by entering your website password. After the request you can no longer log in to the game account, and your characters leave the rankings. You can cancel it within 14 days (we send an e-mail about the request and the cancellation). After 14 days we permanently delete the e-mail address, account name, password, character deletion code, website profile, the list of accepted documents and the newsletter subscription; characters and their items become inaccessible and are deleted at the next maintenance. Purchase and invoice data is kept for 8 years under the Accounting Act, but no longer linked to the account. If you cannot sign in, write to us from your registered e-mail address.
7. Remedies
- Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH) – 1055 Budapest, Falk Miksa utca 9–11.; postal address: 1363 Budapest, Pf. 9.; ugyfelszolgalat@naih.hu; naih.hu.
- You may also go to court; you may bring the action before the regional court (törvényszék) of your place of residence.
8. Cookies
We use only cookies and local storage necessary for operation; details in the Cookie Notice.
9. Changes to this notice
Changes are published on the website; registered users are notified of material changes by e-mail.
Versions