TradeChronicles
Privacy Notice
Last updated: 24 October 2026
1. Who is responsible for your data?
Milios Panagiotis Nektarios, 14 Kimolou Street, Kipseli 11362, Athens, Greece, is the controller of personal data processed to operate TradeChronicles at trade-chronicles.com. Contact: [email protected].
We use service providers, including brainCloud operated by bitHeads Inc., to perform functions such as authentication and hosting. Where they process player data on our behalf, they act as processors under our instructions and applicable data-processing agreements. We remain responsible for our controller obligations even when we do not directly receive particular data, such as a password.
Some providers also process certain information as independent controllers for their own purposes, such as legal compliance or payment-fraud prevention. Their roles depend on the particular activity. Section 5 explains the recipients and provider categories. Those independent activities do not remove our responsibility for processing carried out on our behalf.
2. Personal data we process and its sources
2.1 Registration and authentication
When you register or sign in, your email address and authentication credentials are processed through brainCloud. We do not receive your password; it is handled and stored in protected form by the Backend Service Provider. We use the provider's authentication result to give you access to the Game.
We process your profile identifier, session identifier, merchant/player name, login times, and country and language information reported for your session. Data comes from you, the authentication service and your device. Password protection and account recovery are handled through the configured authentication service; we do not ask you to email us your password.
2.2 Connection, security and diagnostics
When you connect, our website, Game Servers and relevant infrastructure providers process your IP address, timestamps, connection and error logs, and browser type, operating system and session/device identifiers. We derive approximate country information from IP addresses.
These records support connection delivery, security, troubleshooting and abuse investigations.
2.3 Gameplay, purchases and balances
We store your Account-linked game state, including Worlds, trading offices, ships, buildings, resources, trades, routes and settings. We also store purchased Virtual Currency balances and changes, purchase dates, amounts, currency, purchased benefits, payment/refund status and transaction references.
Payments are handled by a third-party payment provider. We do not receive or store your card or bank details. We process the purchase records described above.
We record gameplay actions, such as trades, route changes and building actions, and their timestamps for running the Game, investigating cheating, resolving transaction disputes and diagnosing faults. We do not treat every possible telemetry event as necessary merely because it could be useful.
2.4 Communications and player-visible information
Your merchant name and the gameplay information exposed by the Game, such as trades, ships or buildings, are visible to other players in the same World.
Where messages or chat are available, we process their content, sender/recipient identifiers and timestamps to deliver them and, where necessary, moderate abuse. Authorised personnel may review relevant content when investigating reports or security incidents. Public chat is visible to its audience; direct messages are delivered to the selected recipients and may be accessed for the stated operational or moderation purposes.
2.5 Support, permissions and legal records
If you contact us, we process your contact details, message and the information needed to resolve your request. Where required, we retain records of Terms acceptance, purchase confirmations, withdrawal requests and optional consents. Where parental authorisation is required, we process the contact details and authorisation information provided by the parent or guardian and the minimum information needed to link that authorisation to the child’s Account and verify it.
3. Purposes and legal bases
| Purpose | Main data involved | Legal basis |
|---|---|---|
| Create and authenticate the Account; provide requested gameplay and communications | Account, authentication, connection and necessary game/communication data | Performance of the contract, Article 6(1)(b) GDPR, insofar as objectively necessary |
| Deliver purchases, maintain balances and handle purchase-related requests | Account, balance, payment confirmation and transaction records | Contract, Article 6(1)(b); legal obligation, Article 6(1)(c), where applicable |
| Meet tax, accounting and other specific legal requirements | Required transaction, invoice and compliance records | Legal obligation, Article 6(1)(c) under applicable tax and accounting laws |
| Protect servers and players; prevent fraud, cheating and abuse | Relevant security logs, identifiers, transactions and reported activity/content | Legitimate interests, Article 6(1)(f): operating a secure and fair Game and protecting players and our business, subject to balancing against your rights |
| Diagnose errors and improve reliability | Limited error and performance records | Legitimate interests, Article 6(1)(f): maintaining a reliable service; optional analytics requiring consent are treated separately |
| Respond to support requests | Contact and relevant Account/game data | Contract, Article 6(1)(b), for contractual assistance; legitimate interests, Article 6(1)(f), for responding to other enquiries |
| Establish, exercise or defend legal claims | Records relevant to a particular claim | Legitimate interests, Article 6(1)(f), and legal obligation where applicable |
| Optional communications or other optional processing for which we request consent | The information described in the relevant consent request | Consent, Article 6(1)(a); you may withdraw it at any time |
We do not rely on consent for processing genuinely necessary to perform the Game contract merely because you accepted the Terms. Service notices concerning your Account, security or purchases are distinguished from optional marketing. We assess legitimate-interest processing, including its effect on children, and provide further information on request.
4. Required information and optional choices
Account credentials and necessary identifiers are required to create and authenticate your Account. Necessary connection and gameplay data are required to provide the online Game. Required payment and invoice information is needed to complete a purchase or meet legal obligations. If you do not provide required information, we may be unable to provide that feature or purchase; the relevant form identifies what is required.
Optional marketing or tracking choices are voluntary. Refusing them does not prevent access to the basic Game. You can withdraw optional consent by contacting us or using any withdrawal mechanism included in the relevant communication or consent request. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
5. Who receives data?
We disclose data only as needed for the purposes described here, including to the following providers and recipient categories:
- brainCloud, operated by bitHeads Inc.: account authentication and related services. It acts as a processor for player data processed on our behalf. Its independent activities are described in its Privacy Policy.
- Hosting providers: operate the website, Game Servers and associated infrastructure on our behalf.
- Payment providers: process purchases of Virtual Currency. Depending on the activity, they may process data on our behalf or as independent controllers, including for their own payment-security or legal obligations. The provider handling a payment and its privacy information are identified in the payment process.
- Email and communication providers: transmit and store communications needed to answer enquiries and provide operational support.
- Other players: receive only the gameplay and communications information made visible through the relevant Game features, as described in section 2.4.
- Authorities, courts and legal advisers: receive relevant information where required by law or necessary to establish, exercise or defend legal claims.
Providers acting as processors are subject to Article 28 GDPR arrangements and may use authorised subprocessors subject to applicable requirements. We limit access by personnel to what their responsibilities require.
We do not sell personal data and do not share it with advertising networks, data brokers or social-media platforms. The Game contains no third-party advertising or social-media SDKs.
6. Where data is processed and international transfers
The Game Servers may be located in the European Economic Area (EEA) or in other countries. Authentication, website hosting, backups, support access and payment processing may also involve processing outside the EEA. A provider’s country of incorporation does not necessarily identify all places where it processes data.
Where a transfer is covered by an applicable European Commission adequacy decision, we rely on that decision within its scope. Canada's adequacy coverage is limited to relevant commercial organisations. The EU–US Data Privacy Framework route applies only to participating organisations and covered transfers. Where there is no applicable adequacy decision, we use a valid transfer mechanism such as the Commission's Standard Contractual Clauses and any additional measures required for that transfer.
You may ask us for information about the safeguards applicable to your data and a copy of the relevant safeguards by contacting us. We may redact information where necessary to protect others' rights or confidential information, while providing the information required by law.
7. How long we retain data
We keep identifiable data only for as long as necessary for its specified purpose. We determine retention using the following criteria:
| Data category | Retention criteria |
|---|---|
| Active Account and necessary game state | Retained while the Account is active to provide access, preserve progress and maintain balances. |
| Closed Account and ordinary game state | Deleted or irreversibly anonymised after closure once the closure request and related processing have been completed, except for the specific legal, transaction and security records described below. Relevant deletion instructions also apply to processors. |
| Purchase, refund and accounting records | Retained for the periods required by applicable tax and accounting law, measured from the relevant transaction or accounting period. Records needed for an unresolved refund, reconciliation, fraud investigation or legal claim are retained until that matter is resolved and any applicable legal retention or claim period has ended. |
| Routine connection, security and diagnostic logs | Retained only while needed to identify connection faults, assess security alerts and complete the corresponding troubleshooting or incident review. Relevant extracts connected with an identified incident are retained while the investigation or resulting dispute remains open. |
| Detailed gameplay events | Retained while needed to operate and reconcile game actions, resolve related player enquiries or investigate a specific suspected exploit, fraud or cheating incident. Current game state is retained separately as Account data. |
| Messages and chat | Retained for delivery and for the moderation review needed to assess reported or detected abuse. Relevant messages may be retained while a resulting investigation or dispute remains unresolved. |
| Support correspondence | Deleted once the request and any follow-up have been handled, unless particular records are needed for an ongoing dispute or legal obligation. |
| Acceptance, consent and parental-authorisation evidence | Retained while needed to demonstrate the relevant authorisation or agreement and for applicable compliance and claim periods. Minimal opt-out information may be retained as needed to honour the opt-out. |
| Backups | Deleted data may remain in restricted backup copies until those copies are overwritten or deleted through backup rotation. Backup copies are not used for ordinary gameplay, and applicable deletion requests are reapplied if data is restored. |
Where a specific legal obligation or dispute requires longer retention, we retain only relevant information, restrict its use and delete it when that need ends. Replacing your name with an identifier is not necessarily anonymisation; data remains protected where it can still be linked to you.
8. Cookies, browser storage and similar technologies
Where cookies, local storage, session storage or similar technologies are used to maintain a requested login session or provide another strictly necessary Game function, we use them only for that function and for the period needed to provide it. Browser settings allow you to inspect, clear or block stored information. Blocking storage necessary for authentication may prevent sign-in or other requested features.
We obtain consent before activating any optional storage or access technology for which consent is required. Where such optional technologies are offered, the consent request explains their provider, purpose and duration and provides controls for accepting, rejecting and withdrawing consent. Rejecting optional technologies does not prevent access to the basic Game. You may also contact us about your choices.
9. Your rights and requests
Subject to the GDPR's conditions and exceptions, you may request access and a copy of your data, correction, erasure, restriction, and portability of eligible data. You may object to processing based on legitimate interests for reasons relating to your particular situation. We then stop unless we demonstrate qualifying overriding grounds or need the data for legal claims. You may object to direct marketing at any time, and we will stop that processing.
You may withdraw consent at any time where processing relies on it. Erasure is not absolute: for example, some transaction records may have to be retained by law.
Contact [email protected] or the postal address in section 1. We may request proportionate information to verify your identity, but do not routinely require excessive identification. Requests are generally free. We respond without undue delay and within one month; if a lawful extension of up to two further months is necessary, we tell you within the first month and explain why. We explain any refusal and your available remedies.
You may complain to a supervisory authority, particularly in the EU/EEA country where you live, work or believe an infringement occurred. In Greece, contact the Hellenic Data Protection Authority.
10. Children and parental authorisation
The Game is intended for ages 13 and over. Children under 13 must not create an Account. If we discover an under-13 Account, we restrict it and delete the data that we have no lawful reason to retain, handling any necessary transaction records or refunds appropriately.
For minors aged 13 and over, contractual authorisation and permission for purchases are addressed in the Terms of Use. Where we rely on consent for an online service offered directly to a child, we apply the relevant national consent threshold. In Greece, a child can provide that consent from age 15; below 15, authorisation from the legal representative is required for that consent-based processing.
Where authorisation is required, the parent or guardian must contact us at the email address in section 1 before the relevant processing begins. We obtain the required authorisation and take reasonable steps to verify it, taking account of the available technology and the risks involved. We request only information proportionate to that purpose. We do not claim that accepting the Terms alone constitutes verified parental consent. Other legal bases are assessed separately and are not used simply to circumvent children's protections.
A parent or guardian may contact us about a child's Account. We verify authority where appropriate and consider the child's own rights under applicable law.
11. Security and automated decisions
We use technical and organisational safeguards appropriate to the personal data and the risks involved. No online system can guarantee absolute security. We assess incidents and notify affected individuals and authorities where required by law.
You may contest an Account restriction or suspension by contacting us, as explained in the Terms of Use, and request review of the decision. Where the GDPR gives you rights concerning a decision based solely on automated processing, including the right to human intervention, to express your view or to contest the decision, we respect those rights. We provide the information and safeguards required by law before introducing any processing subject to those requirements.
12. Changes to this Notice
We may update this Notice to reflect changes in the Game, providers or law. We display the current version and update date at trade-chronicles.com/privacy.html and actively notify you of material changes as appropriate, before new processing where required. Updating the Notice does not itself create a legal basis for new processing or substitute for consent where consent is needed.
13. Contact
Milios Panagiotis Nektarios
14 Kimolou Street, Kipseli 11362, Athens, Greece
Email: [email protected]
© 2026 Milios Panagiotis Nektarios. All rights reserved. Third-party trademarks belong to their respective owners.