Privacy Policy

This Privacy Policy explains how Black Banner Studios s.r.o., Company ID No. 24537403, VAT ID CZ24537403, with its registered office at Heinemannova 2698/11, Dejvice, 160 00 Prague 6, Czech Republic (“Black Banner Studios”, “we”, “us”, “our”), processes personal data in connection with Legacy of Valor Online (“LoVO”), Legacy Accounts, our websites, Pledge Store, launcher, game services, customer support and related services (together, the “Services”).

For the processing described in this Policy, Black Banner Studios is generally the data controller.

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), applicable Czech data-protection law and other applicable privacy legislation.

This Policy should be read together with our Terms of Service and, where applicable, our Cookie Policy.

1.Who We Are

Data Controller

Black Banner Studios s.r.o.
Company ID: 24537403
VAT ID: CZ24537403
Registered office: Heinemannova 2698/11, Dejvice, 160 00 Prague 6, Czech Republic

Privacy contact: invoices@blackbannerstudios.games
Website: https://online.legacyofvalorgame.com/

If we appoint a Data Protection Officer in the future, the DPO's contact details will be published here.

2.Scope of This Policy

This Policy applies to personal data processed through or in connection with Legacy Account registration and management, the LoVO website, the Pledge Store, Founder Pledges and other purchases, Store Credit and entitlement records, the LoVO launcher and game clients, online and multiplayer services, security, fraud prevention and anti-abuse systems, customer support, transactional communications, optional marketing communications, and community or testing features operated directly by us.

Third-party websites, platforms and services are governed by their own privacy policies where they act as independent controllers.

3.Data-Protection Principles

We aim to process personal data in accordance with the GDPR principles of lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.

We seek to collect only the personal data reasonably necessary for the stated purposes.

4.Personal Data We Collect

4.1Legacy Account Data

This may include account email address, display name and account identifier, country or region, year of birth or age-verification result, account creation date, language and regional preferences, account status, accepted Terms and Privacy Policy version numbers, date and timestamp of acceptance, and security and authentication settings.

4.2Purchase, Pledge and Entitlement Data

This may include order identifiers, order date and time, items or Founder Pledges purchased, price, currency and tax information, transaction status, payment-provider transaction identifiers, entitlement history, Store Credit balance and transaction history, pledge exchange / reclaim history, refund, dispute and chargeback records, and limited billing information necessary for tax, fraud-prevention or accounting purposes.

4.3Payment Information

Payments may be processed by Stripe or another payment provider identified at checkout.

Black Banner Studios does not intentionally store full payment-card numbers or card security codes (CVC/CVV). Card-payment credentials are handled by the payment provider through its secure payment infrastructure.

We may receive limited payment information from the provider, such as transaction identifier, payment status, payment method type, limited card metadata such as brand and last four digits where supplied by the provider, billing country, fraud or risk signals, and refund or dispute information.

Payment providers may process additional information under their own privacy notices and legal obligations.

4.4Technical and Security Data

When you use the Services, we may process IP address, date and time of access, device and operating-system information, browser or launcher version, game-client version, session and authentication logs, approximate region derived from network information, crash and diagnostic information, security events, anti-abuse and fraud signals, failed login attempts and identifiers reasonably necessary to protect accounts and the integrity of the Services.

Where technically feasible, we minimise or pseudonymise diagnostic data that does not need to identify a particular User.

4.5Gameplay and Service Data

Where necessary to provide LoVO, we may process character and gameplay identifiers, progression, inventory and entitlement references, game-state information, multiplayer and server events, matchmaking and session data, moderation events, economy and anti-exploit records, and testing and telemetry information reasonably necessary to operate, secure, balance and improve the game.

4.6Customer Support Data

If you contact us, we may process your name, display name or account identifier, email address, support-ticket content, attachments you choose to provide, relevant account, order, entitlement or technical information, and correspondence and support history.

Please do not send sensitive personal data unless it is genuinely necessary for your support request.

4.7Community and User-Generated Content

If we operate forums, chat, feedback systems or similar features, we may process posts and messages submitted to those Services, display name, moderation history, reports, timestamps and related technical information.

4.8Marketing Data

If you separately opt in to marketing, we may process email address, marketing preferences, consent date and source, records showing withdrawal of consent, and limited delivery and engagement data where lawfully used.

Marketing consent is separate, optional and is not bundled into acceptance of the Terms of Service.

4.9Cookies and Similar Technologies

Our website and Services may use cookies or similar technologies.

Strictly necessary technologies may be used where required to provide authentication, security, shopping-cart, language, account or other requested functionality.

Analytics, advertising or other non-essential technologies will be used only where permitted by applicable law and, where required, after obtaining the appropriate consent.

Further details may be provided in a separate Cookie Policy or consent interface.

5.Why We Process Personal Data and Our Legal Bases

5.1Legacy Account Operation

Purpose: registration, login, authentication, account management, entitlements and settings.
Legal basis: Article 6(1)(b) GDPR — performance of a contract or steps taken at your request before entering into a contract.

5.2Orders and Purchased Entitlements

Purpose: process Founder Pledges and other transactions, assign entitlements, maintain Store Credit and transaction records, fulfil purchases and process refunds.
Legal basis: Article 6(1)(b) GDPR.

5.3Accounting, Tax and Legal Records

Purpose: invoices, tax records, statutory bookkeeping, compliance and lawful requests.
Legal basis: Article 6(1)(c) GDPR — compliance with a legal obligation.

5.4Security and Fraud Prevention

Purpose: protect accounts, detect abuse, prevent fraud, investigate unauthorised access, secure infrastructure and protect the game economy.
Legal basis: Article 6(1)(f) GDPR — our legitimate interests in secure and reliable Services, and where applicable Article 6(1)(c).

5.5Operating and Improving LoVO

Purpose: diagnose crashes, maintain servers, analyse performance, prevent exploits, balance systems and improve the Services.
Legal basis: Articles 6(1)(b) and 6(1)(f) GDPR as applicable. Where a particular analytics technology requires consent, we will request consent.

5.6Customer Support

Purpose: answer questions, resolve issues, process complaints and investigate transactions.
Legal basis: Article 6(1)(b), Article 6(1)(c) and/or Article 6(1)(f), depending on the request.

5.7Transactional Communications

Purpose: account verification, password resets, security alerts, receipts, order confirmations, material service notices and legally required notices.
Legal basis: Article 6(1)(b) and/or Article 6(1)(c).

5.8Marketing

Purpose: newsletters, promotional announcements and marketing communications.
Legal basis: Article 6(1)(a) GDPR — consent, where consent is required.

You may withdraw consent at any time without affecting processing carried out before withdrawal.

6.Data We Deliberately Minimise

We design the Legacy Account and Pledge Store with data minimisation in mind.

In particular, we do not require a full date of birth where a year of birth or age result is sufficient; we do not intentionally store full payment-card numbers or CVC/CVV codes; we do not ask for government identification as part of ordinary account creation; we do not require marketing consent to create an account or make a purchase; and we do not collect sensitive personal data merely because it may be technically possible to do so.

In specific security, legal or account-recovery situations, we may request additional information where reasonably necessary.

7.Who Receives Personal Data

7.1Payment Providers

We use or may use Stripe to process payments, refunds, disputes, fraud signals and related payment functions.

Stripe may act as our processor for some activities and as an independent controller for certain payment, fraud-prevention, compliance or legal activities, depending on the context.

7.2Hosting and Infrastructure Providers

We may use cloud hosting, content-delivery, database, security and infrastructure providers to operate the website, account system, launcher and online game services.

7.3Transactional Email Providers

We may use specialist email providers to send account verification messages, password resets, receipts, security alerts and other transactional communications.

7.4Customer Support and Operational Providers

Where used, customer-support, error-monitoring, security or operational providers may process limited data necessary to provide their services.

7.5Professional Advisers and Authorities

We may disclose data where reasonably necessary to lawyers, accountants, auditors or professional advisers, and to courts, regulators, tax authorities, law enforcement or other public authorities where legally required.

7.6Corporate Transactions

If Black Banner Studios undergoes a merger, acquisition, restructuring, financing or transfer of relevant business assets, personal data may be disclosed or transferred as part of that transaction, subject to applicable law and appropriate safeguards.

8.Processors and Subprocessors

Where a service provider processes personal data on our behalf, we require appropriate contractual and security safeguards as required by Article 28 GDPR.

The categories of processors currently expected to support the Services include payment processing — including Stripe; hosting and cloud infrastructure; transactional email; security and fraud prevention; error monitoring and technical diagnostics; and customer support tools.

As our infrastructure develops, individual providers may change. Material changes affecting this Policy will be reflected in an updated version.

9.International Data Transfers

Some service providers may process personal data outside the European Economic Area (“EEA”).

Where personal data is transferred to a country that has not been recognised by the European Commission as providing an adequate level of protection, we will use an appropriate lawful transfer mechanism where required, such as the European Commission's Standard Contractual Clauses, together with supplementary safeguards where appropriate.

You may contact us for further information about safeguards relevant to your personal data.

10.How Long We Keep Personal Data

We keep personal data only for as long as necessary for the purpose for which it was collected, taking into account legal, accounting, tax, security, fraud-prevention and dispute-resolution requirements.

Account data: while the Legacy Account remains active and for a limited period after closure where reasonably necessary to complete deletion, resolve disputes, prevent fraud or comply with legal obligations.

Order, payment, tax and accounting records: for the period required by applicable tax, accounting and commercial law and, where relevant, for the period necessary to establish, exercise or defend legal claims.

Entitlement and Store Credit records: while necessary to establish and provide contractual entitlements and maintain an accurate transaction history.

Security logs: for a proportionate period based on the security purpose, severity of the event and likelihood of abuse or legal claims.

Support records: for as long as reasonably necessary to resolve the request and for a limited period afterwards for continuity, dispute handling, security and legal claims.

Marketing data: until consent is withdrawn or the data is no longer needed. We may retain a minimal suppression record after opt-out so that we can honour the request.

Consent and policy-acceptance records: for as long as reasonably necessary to demonstrate compliance and the contractual terms applicable to an account or transaction.

Where data is no longer required, we delete or anonymise it unless further retention is required or permitted by law.

11.Account Deletion and Anonymisation

You may request deletion of your Legacy Account using the available account or support process.

Account deletion may result in permanent loss of access to purchased or granted digital entitlements. We will provide an appropriate warning before completing an irreversible deletion.

Deletion of an account does not necessarily mean that every record can be immediately erased. We may retain limited information where required or permitted for tax and accounting obligations, fraud and security prevention, dispute resolution, enforcement or defence of legal claims, and demonstrating contractual entitlements or legal-document acceptance.

Where identifying data is no longer necessary, we may anonymise records so that they no longer relate to an identifiable person.

12.Marketing Consent

Marketing is optional.

We do not make marketing consent a condition of creating a Legacy Account, accepting the Terms of Service, purchasing a Founder Pledge or accessing purchased entitlements.

Where consent is required, it will be requested through a separate, clearly identifiable choice.

You may withdraw your consent at any time.

13.Your GDPR Rights

Subject to the conditions and limitations established by law, you may have the right to:

• access your personal data;
• rectify inaccurate or incomplete data;
• erase data where the legal conditions are met;
• restrict processing in circumstances provided by the GDPR;
• data portability where applicable;
• object to processing based on legitimate interests;
• object at any time to direct marketing;
• withdraw consent where processing is based on consent;
• exercise applicable rights concerning automated decision-making and profiling.

These rights are not absolute and may be subject to statutory exceptions.

14.How to Exercise Your Rights

To exercise a data-protection right, contact:

invoices@blackbannerstudios.games

or write to:

Black Banner Studios s.r.o.
Heinemannova 2698/11
Dejvice, 160 00 Prague 6
Czech Republic

To protect Users from account takeover and unauthorised disclosure, we may request reasonable information necessary to verify identity.

We will respond without undue delay and within the time limits required by applicable law. Under the GDPR, this is generally within one month, subject to permitted extensions for complex or numerous requests.

15.Complaints to the Supervisory Authority

If you believe that your personal data has been processed unlawfully, you have the right to lodge a complaint with a competent data-protection supervisory authority.

Our Czech supervisory authority is:

Office for Personal Data Protection
(Úřad pro ochranu osobních údajů)
Pplk. Sochora 27
170 00 Prague 7
Czech Republic
Email: posta@uoou.gov.cz

You may also have the right to complain to the supervisory authority in the EU or EEA country where you habitually reside, work or where the alleged infringement occurred.

16.Security

We use technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration, disclosure or destruction.

Depending on the system, measures may include access controls, authentication safeguards, encryption in transit, appropriate protections for stored data, logging and security monitoring, least-privilege access, secure development practices, backups and vendor-security controls.

No online system can be guaranteed to be completely secure.

If we become aware of a personal-data breach, we will assess it and make notifications to supervisory authorities and affected individuals where required by law.

17.Automated Fraud and Security Processing

We or our service providers may use automated signals to identify suspicious transactions, account takeovers, payment fraud, bots, cheating or other abuse.

These systems may consider technical, transaction, account or behavioural signals relevant to security.

Where a decision with legal or similarly significant effects would be based solely on automated processing, we will provide the safeguards required by applicable law.

Third-party payment providers may independently operate their own fraud-prevention systems under their own privacy notices.

18.Children and Young Users

The minimum age applicable to Legacy Account creation will be presented during registration and may vary according to applicable law or final game classification.

Where parental or guardian authorisation is required, we may take proportionate steps to obtain or verify that authorisation.

We do not intentionally seek to collect unnecessary personal data from children.

If you believe that a child has provided personal data in circumstances where required authorisation was not obtained, please contact us.

19.Policy Acceptance and Version Records

Each published version of this Privacy Policy will have a version number and effective date.

Where acknowledgement or acceptance is requested through the Legacy Account, we may record the policy version, account identifier, date and timestamp, and technical evidence reasonably necessary to demonstrate the acknowledgement or acceptance.

Where the legal basis for processing is consent, the consent will be recorded separately and will identify what the User consented to.

Acceptance of this Privacy Policy is not the same as consent to marketing.

20.Changes to This Privacy Policy

We may update this Privacy Policy when our Services, processing activities, providers or legal obligations change.

The current version will be published on the LoVO website with its version number and effective date.

Where a change materially affects how we process personal data, we will provide additional notice where required by law.

Where a new processing activity requires consent, we will request that consent separately rather than relying on acceptance of an updated Privacy Policy.

21.Relationship to the Terms of Service

This Privacy Policy explains how personal data is processed.

The Terms of Service govern the contractual use of LoVO and related Services.

If there is a conflict concerning data-protection rights or obligations, applicable data-protection law prevails.

22.Contact Us

Black Banner Studios s.r.o.
Company ID: 24537403
VAT ID: CZ24537403
Heinemannova 2698/11
Dejvice, 160 00 Prague 6
Czech Republic

Privacy contact: invoices@blackbannerstudios.games
Website: https://online.legacyofvalorgame.com/