1.Introduction
This Privacy Policy explains how personal data is collected, used, stored, and otherwise processed in connection with the use of the Tiny Minds mobile application (the “Application”).
The Data Controller is committed to ensuring that the processing of personal data complies with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation – GDPR) and all other applicable data protection laws.
By accessing or using the Application, the User acknowledges that they have read and understood this Privacy Policy.
2.Data Controller
Data Controller:
Csaba Baráth, Sole Proprietor Registered Address:
Hegyalja utca 1.
Dorog, Hungary E-mail: tinymindsquiz@gmail.com Tax Identification Number:
56467545-1-31 The Data Controller is responsible for ensuring that all processing of personal data is carried out lawfully and in accordance with applicable data protection legislation.
3.Principles of Data Processing
The Data Controller processes personal data in accordance with the principles set out in the GDPR, including:
- lawfulness;
- fairness;
- transparency;
- purpose limitation;
- data minimisation;
- accuracy;
- storage limitation;
- integrity and confidentiality; and
- accountability.
4.Purpose of the Application
Tiny Minds is a knowledge-based mobile quiz game.
The Application enables Users, among other things, to:
- answer quiz questions;
- earn points;
- participate in public leaderboards;
- purchase and use subscriptions;
- make in-app purchases;
- view rewarded advertisements; and
- track gameplay statistics.
5.Categories of Personal Data Processed
In connection with the operation of the Application, the following categories of personal data may be processed:
- username;
- email address;
- the name of the secondary school or higher education institution voluntarily provided by the User;
- game scores;
- leaderboard data;
- gameplay statistics;
- IP address;
- device identifier;
- technical information relating to subscriptions and purchases; and
- application usage logs.
The Data Controller processes only such personal data as is necessary for the proper operation and provision of the Application and its services.
6.Purposes of Data Processing
Personal data is processed for the following purposes:
- providing and operating the Application;
- maintaining Users’ game progress;
- managing leaderboards;
- calculating scores;
- generating gameplay statistics;
- managing subscriptions;
- processing in-app purchases;
- troubleshooting and resolving technical issues;
- preventing fraud and abuse;
- investigating security incidents;
- providing customer support; and
- complying with applicable legal obligations.
7.Legal Bases for Processing
Depending on the purpose of the processing, the legal basis for processing personal data may include:
- the performance of a contract between the User and the Data Controller;
- the legitimate interests pursued by the Data Controller;
- compliance with a legal obligation to which the Data Controller is subject; or
- the User’s consent, where consent is required under applicable law.
The Data Controller ensures that each processing activity is carried out on the appropriate legal basis in accordance with the GDPR and applicable data protection laws.
8.Data Processors and Third-Party Service Providers
In connection with the operation of the Application, the Data Controller may engage data processors or third-party service providers acting as independent data controllers to perform certain processing activities.
The Data Controller only engages service providers that implement appropriate technical and organisational measures to ensure the protection of personal data.
8.1.Own Server Infrastructure
User data required for the operation of Tiny Minds is stored on servers operated by the Data Controller.
The stored data may include:
- username;
- email address;
- the name of the User’s secondary school or higher education institution (where voluntarily provided);
- scores;
- leaderboard data;
- gameplay statistics;
- IP address;
- device identifier; and
- system operation and server log data.
The Data Controller implements appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, loss, or destruction.
8.2.RevenueCat
The Application uses the RevenueCat service to manage in-app subscriptions and purchases.
RevenueCat verifies purchase validity, manages subscriptions, and performs the related technical processing required for subscription management.
The Data Controller transfers only the personal data that is necessary for the operation of these services.
8.3.Google AdMob
The Application uses Google AdMob to display non-personalised advertisements.
Advertisements displayed within the Application are not based on the User’s interests or behavioural profile.
In connection with the provision of advertising services, Google may process certain technical information, such as device information, IP address, or advertising identifiers, in accordance with Google’s own Privacy Policy.
8.4.Google Play Games
On Android devices, user authentication and player identification may be provided through Google Play Games.
The processing of personal data by Google Play Games is governed by Google’s own Privacy Policy.
8.5.Apple Game Center
On iOS devices, player authentication may be provided through Apple Game Center.
Any processing of personal data by Apple Game Center is governed by Apple’s own Privacy Policy.
9.International Data Transfers
Because the Application relies on certain third-party service providers, some personal data may be transferred to or processed in countries outside the European Economic Area (EEA).
Where such transfers occur, the Data Controller ensures that they are carried out only where appropriate safeguards have been implemented, including those recognised by the European Commission or otherwise permitted under applicable data protection legislation.
10.Data Retention
Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected or as otherwise required by applicable law.
Accordingly:
- gameplay-related data is retained for the duration of the User Account;
- subscription and purchase records are retained for the period required by applicable legal and accounting obligations;
- log files are retained for as long as necessary for security and operational purposes; and
- personal data that must be retained under applicable law will be retained for the legally prescribed retention period.
The User may request the deletion of their User Account at any time. Following deletion, the Data Controller will, without undue delay, erase or anonymise any personal data for which there is no longer a lawful basis for continued processing.
11.Data Subject Rights
Under the GDPR, Users are entitled to exercise the following rights, where applicable:
- the right to be informed;
- the right of access;
- the right to rectification;
- the right to erasure (“right to be forgotten”);
- the right to restriction of processing;
- the right to data portability;
- the right to object to processing; and
- the right to withdraw consent at any time where processing is based on consent.
The Data Controller shall respond to all requests without undue delay and, in any event, within the time limits prescribed by the GDPR.
12.Account Deletion
Users may request the deletion of their Tiny Minds User Account at any time.
Upon deletion of the User Account, personal data stored within the Application will be deleted or irreversibly anonymised, except where continued retention is required by applicable law or is necessary for the establishment, exercise, or defence of legal claims.
Deletion of the User Account does not automatically result in the deletion of personal data processed independently by third-party service providers, including Google Play Games, Apple Game Center, or other external services. Such processing remains subject to the respective privacy policies of those providers.
13.Data Security
The Data Controller implements appropriate technical and organisational measures designed to ensure the security of personal data and to protect it against unauthorised access, disclosure, alteration, transmission, destruction, or accidental loss.
Such measures may include, without limitation:
- encrypted communications using HTTPS/TLS;
- access control and permission management;
- logging and monitoring of security events;
- regular data backups;
- server-side access protection;
- regular security updates; and
- restricting access to personal data solely to individuals who require such access in order to perform their duties.
While the Data Controller takes all measures that may reasonably be expected to safeguard personal data, no method of data transmission over the Internet or electronic storage can be guaranteed to be completely secure.
14.Children’s Privacy
The Data Controller places particular importance on protecting the personal data of children.
Users under the age of sixteen (16) may use the Service only with the consent of their parent or other legal representative where required by applicable law.
Upon first launching the Application, Users may be asked to declare their age. A User under the age of sixteen (16) represents and warrants that, where required by applicable law, they have obtained the necessary consent from their parent or legal representative to use the Service.
Where the Data Controller obtains credible evidence that a child’s personal data has been processed unlawfully, it reserves the right to restrict or delete the relevant User Account.
15.Complaints and Legal Remedies
If a User believes that the processing of their personal data infringes applicable data protection laws, they may contact the Data Controller at:
E-mail: tinymindsquiz@gmail.com The Data Controller will use reasonable efforts to investigate and respond to all requests without undue delay.
If the User is not satisfied with the Data Controller’s response, they may lodge a complaint with the competent supervisory authority in the Member State of their habitual residence, place of work, or place of the alleged infringement. Where the Data Controller is established in Hungary, complaints may also be submitted to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH).
Nothing in this Privacy Policy affects the User’s right to seek an effective judicial remedy under the GDPR or applicable law.
16.Amendments to this Privacy Policy
The Data Controller reserves the right to amend this Privacy Policy where necessary, including in the following circumstances:
- changes in applicable legislation;
- introduction of new services or features;
- implementation of new processing purposes;
- changes affecting data processors or technological solutions; or
- organisational or operational changes affecting the processing of personal data.
Any updated version of this Privacy Policy will be published within the Application or through another communication channel designated by the Data Controller.
Where amendments materially affect Users’ rights or obligations, appropriate notice will be provided within the Application.
17.Contact
If you have any questions regarding this Privacy Policy or the processing of your personal data, you may contact the Data Controller at:
E-mail: tinymindsquiz@gmail.com
18.Effective Date
This Privacy Policy enters into force on the Effective Date specified at the beginning of this document and shall remain in effect until amended or withdrawn.
By accessing or using the Application, the User acknowledges that they have read and understood this Privacy Policy.
Personal Data Breaches The Data Controller implements appropriate technical and organisational measures to safeguard the security of personal data.
Where a personal data breach is likely to result in a risk to the rights and freedoms of natural persons, the Data Controller shall act in accordance with the GDPR and other applicable legislation, including, where required, notifying the competent supervisory authority and affected data subjects.
Automated Decision-Making and Profiling The Data Controller does not carry out automated decision-making, including profiling, within the meaning of Article 22 of the GDPR when processing personal data.