ENGARDE
Realms of Aetheria
A debt unpaid by sunset becomes the sky's debt by midnight.
Legal · Privacy & Legal
Privacy & Legal
EnGarde Games takes privacy seriously. This policy explains what personal data we collect about you when you use engarde.lt, the EnGarde CCG, the tabletop boxed game, and the connected online services — and what your rights are under the GDPR, the UK GDPR, and the California Consumer Privacy Act.
01 Who we are
EnGarde Games, UAB ("EnGarde", "we", "us") is the data controller for personal data processed via engarde.lt and the connected Services. Registered office: Vilnius, Lithuania. Contact our Data Protection Officer at dpo@engarde.lt.
02 What personal data we collect
We collect only what we need to run the Services and improve them:
| Category | Examples | Source |
|---|---|---|
| Account | username, email, password hash, role, language | You, at sign-up |
| Profile | avatar, display name, character names, guild membership | You, in-product |
| Game state | decks, characters, inventory, match history, achievements | Generated by play |
| Transactions | order ID, items purchased, billing country, VAT receipt | You + payment provider |
| Technical | IP, device type, browser, error logs, request IDs | Server logs |
| Communications | support tickets, in-game chat, moderation reports | You + community |
| Cookies | see Cookies Policy for the full list | Your browser |
We do not sell or rent personal data. We do not buy data brokers' profiles.
03 Why we process it & legal basis
- To run the Services — account creation, authentication, gameplay, leaderboards. Legal basis: contract (Art. 6(1)(b) GDPR).
- To process payments & tax — accept payments, issue invoices, refunds, comply with VAT/CIT rules. Legal basis: contract + legal obligation.
- To keep the Services safe — anti-cheat, anti-fraud, moderation, abuse reports. Legal basis: legitimate interest (Art. 6(1)(f)).
- To improve the Services — anonymous, aggregated analytics. Legal basis: consent for analytics cookies; legitimate interest for server-side aggregates.
- To send service messages — password resets, security alerts, terms updates. Legal basis: contract / legitimate interest.
- Marketing — product news, expansion launches. Legal basis: consent. You can unsubscribe with one click.
- Legal claims — defend, exercise, or establish legal claims. Legal basis: legitimate interest / legal obligation.
05 International transfers
Most processing happens in the EEA. Where data is transferred outside the EEA we rely on (a) an adequacy decision of the European Commission, or (b) Standard Contractual Clauses combined with supplementary measures (encryption in transit and at rest, access controls, transfer impact assessments). You can request a copy of the safeguards in place.
06 How long we keep data
| What | How long |
|---|---|
| Active account & game state | While your account exists |
| Deleted account | 30 days soft-delete window, then anonymised |
| Transaction records | 10 years (accounting law) |
| Server & security logs | 90 days rolling |
| Support tickets | 24 months after closure |
| Marketing consent record | Until withdrawn + 3 years |
07 Your rights
Under the GDPR / UK GDPR you have the right to:
- Access a copy of your personal data.
- Rectify inaccurate data.
- Erase ("right to be forgotten").
- Restrict our processing while we consider an objection.
- Object — including a free, unconditional right to object to direct marketing.
- Port your data to another provider in a machine-readable format.
- Withdraw consent at any time, without affecting earlier processing.
- Lodge a complaint with your local data-protection authority — for Lithuanian users that's VDAI.
Exercise your rights by emailing privacy@engarde.lt. We will respond within 30 days; we may extend by 60 more in complex cases.
08 Security
We protect personal data with industry-standard measures:
- TLS 1.2+ in transit; AES-256 at rest for sensitive stores.
- Passwords stored as bcrypt hashes; no plaintext.
- Role-based access control with audit logs for every admin action.
- Quarterly penetration tests and a public responsible-disclosure policy at /trust.
- Backups every 24h, encrypted, with monthly restore drills.
If a breach occurs that is likely to put your rights at risk, we will notify the relevant supervisory authority within 72 hours and tell affected users without undue delay.
09 Minors
EnGarde is intended for players aged 13 and older. We do not knowingly collect personal data from children under 13. If you are a parent and believe your child has provided us with personal data, contact privacy@engarde.lt and we will delete it.
10 Contact & DPO
- Privacy team — privacy@engarde.lt
- Data Protection Officer — dpo@engarde.lt
- Lithuanian DPA — vdai.lrv.lt
EnGarde Games, UAB · Vilnius, Lithuania · See also the Cookies Policy and Terms & Conditions.