Privacy Policy

This Privacy Notice explains how we collect, use, share and protect personal data when you visit our website, create an account, or buy and download our games.

1. Who we are

Marselok Games (the "Studio", "we", "us") is an independent game studio based in Nicosia, Cyprus. We are the data controller for the personal data described in this notice. Our full legal entity details and contact addresses are published at the bottom of this page and on our Contact page.

2. Personal data we collect

• Account data: email address, display name, avatar, password hash (or Google sign-in identifier), account creation date.

• Purchase data: order records, the games you own, order status, invoice records, download entitlements. Card details are never collected or stored by us.

• Content you submit: reviews, comments, wishlist entries, support and contact messages, newsletter sign-ups.

• Technical data: IP address, device and browser type, pages visited, referring page, and basic usage/telemetry needed to run and secure the service.

• Communications: emails we send you (receipts, release notifications, support replies) and your responses.

3. Why we use it and our legal basis

• To create and operate your account, deliver purchased games and provide download access — performance of a contract.

• To process orders, issue receipts and invoices, and handle refunds — performance of a contract and legal obligation.

• To provide customer support and respond to your messages — performance of a contract and legitimate interests.

• To prevent fraud, abuse and unauthorised access, and to secure our service — legitimate interests.

• To improve our games and website through aggregated usage analysis — legitimate interests.

• To send newsletters and marketing emails — consent, which you can withdraw at any time.

• To comply with tax, accounting and other legal requirements — legal obligation.

4. Payments and Merchant of Record

Our order process is conducted by our online reseller Paddle.com. Paddle.com is the Merchant of Record for all our orders and acts as an independent controller for payment, billing, tax and fraud-prevention data. When you pay, your billing and card data is collected and processed by Paddle, not by us. We receive only the order outcome, the products purchased, the amounts, and the country used for tax purposes. Paddle's privacy notice is available at https://www.paddle.com/legal/privacy.

5. Who we share data with

• Hosting, database, storage and email infrastructure providers who process data on our behalf under written agreements.

• Paddle.com, as Merchant of Record, for the sale of our products, subscription management where applicable, payments, tax compliance and invoicing.

• Analytics providers, where enabled, using aggregated or pseudonymised data.

• Professional advisers (legal, accounting) where necessary.

• Public authorities where we are legally required to disclose.

We never sell your personal data.

6. International transfers

Some of our providers operate outside the European Economic Area. Where personal data leaves the EEA or the UK, we rely on adequacy decisions or the European Commission's Standard Contractual Clauses, together with appropriate technical safeguards.

7. Retention

• Account data: for as long as your account exists, then deleted or anonymised within 90 days of account closure.

• Order, invoice and tax records: retained for the period required by Cypriot and EU tax law (currently 7 years).

• Support messages: up to 24 months after the case is closed.

• Newsletter data: until you unsubscribe.

• Technical logs: up to 12 months.

8. Your rights

Under the GDPR you have the right to access your data, correct inaccurate data, request erasure, restrict or object to processing, request portability, and withdraw consent at any time. You can exercise most of these directly from your Account page, or by emailing our privacy contact below. We respond within one month. You also have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus, or with your local supervisory authority.

9. Security

We apply appropriate technical and organisational measures, including encryption in transit, hashed credentials, row-level database access controls, expiring signed download links, and least-privilege administrative access. No system is perfectly secure, but we review these controls regularly.

10. Cookies

We use a small number of strictly necessary cookies and local storage entries to keep you signed in and remember your cart, plus optional analytics cookies where enabled. Full details, including how to manage your preferences, are in our Cookie Policy.

11. Children

Our store is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

12. Changes

We may update this notice. The effective date is shown at the top of the page after each revision, and material changes are announced on the site.

13. Contact

For any privacy question or to exercise your rights, use the contact details published below.