Privacy Policy

1. General provisions

1.1. This Privacy Policy (the “Policy”) sets out the procedure for processing and protecting the personal data of users of the Sunrise Online Game and Site (the “Administration”).

1.2. The Policy may be amended by the Administration. A new version of the Policy takes effect from the moment it is made publicly available.

1.3. The Administration processes information in accordance with this Policy, the Administration's internal regulations, the General Data Protection Regulation (GDPR), and the legislation of the Russian Federation and the Republic of Kazakhstan.

2. Terms and definitions

2.1. Personal data — any information relating to a directly or indirectly determined or determinable (identified or identifiable) natural person (the data subject).

2.2. Data subject — any natural person.

2.3. Controller (operator) — any natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing personal data.

2.4. Processor — a natural or legal person, public authority, agency or other body which processes personal data on behalf of and on the instructions of the controller (operator). The Administration is the controller (operator) of personal data.

2.5. Processing of personal data — any action (operation) or set of actions (operations) performed on personal data, whether or not by automated means.

3. Sources of data

In the Game:

3.1. From the User's own device (as regards device ID and IP address);

3.2. From linked social network accounts, where the User has authenticated in the Game using accounts held on other platforms (Discord, VKontakte, Apple);

3.3. From the User's account in the Game (as regards information about their behavioural characteristics and purchase history).

On the Site:

3.4. Data provided by the User in person through communication with the Administration by email and through forms completed by the User on the Site;

3.5. From cookies in the User's browser.

4. Purposes of processing personal data

In the Game:

4.1. Purpose: identification of the User in order to perform the Administration's obligations under the User Agreement. Data that contains or may contain personal data: login, information about linked accounts (where linked), device ID, IP address, character first name and surname (nickname), purchase history. Categories of data subjects: Users registered in the Game. Legal ground: processing is carried out with the data subject's consent. Actions performed: collection, recording, systematisation, accumulation, storage, updating (renewal, modification), retrieval, use, transfer (access, provision), blocking, deletion, destruction of personal data. Method of processing: automated. Processing period: until the User's account is deleted or consent to the processing of personal data is withdrawn.

4.2. Purpose: collection of analytics. Data that contains or may contain personal data: the User's behavioural characteristics in the Game. Categories of data subjects: Users of the Game. Legal ground: processing is carried out with the data subject's consent and on the basis of the Administration's legitimate interest. Method of processing: automated. Actions performed: collection, recording, systematisation, accumulation, storage, updating (renewal, modification), retrieval, use, transfer (provision, access), blocking, deletion, destruction of personal data. Processing period: until the account is deleted or consent to the processing of personal data is withdrawn.

4.3. Purpose: receiving and responding to enquiries and complaints, and providing technical support. Data that contains or may contain personal data: character first name and surname (nickname) (when interacting with the Administration through the in-game menu). Categories of data subjects: Users of the Game. Legal ground: processing is carried out with the data subject's consent to the processing of their personal data. Method of processing: both automated and non-automated (mixed). Actions performed: collection, recording, systematisation, accumulation, storage, updating (renewal, modification), retrieval, use, transfer (provision, access), blocking, deletion, destruction of personal data. Processing period: 3 (three) years from the date the enquiry, complaint or claim was received.

4.4. Purpose: sending Users information about changes in the Game, promo codes, promotions and other marketing activities. Data that contains or may contain personal data: character first name and surname (nickname), email address, surname, first name and patronymic (where provided at registration), telephone number. Categories of data subjects: Users of the Game. Legal ground: processing is carried out with the data subject's consent to the processing of their personal data. Method of processing: both automated and non-automated (mixed). Actions performed: collection, recording, systematisation, accumulation, storage, updating (renewal, modification), retrieval, use, transfer (provision, access), blocking, deletion, destruction of personal data. Processing period: until the account is deleted, the subscription to informational and advertising mailings is cancelled, or consent to the processing of personal data is withdrawn.

4.5. Purpose: improving the interface and characteristics of the Game, providing information, and ensuring the technical means to extend the time Users' devices can be used. Data that contains or may contain personal data: device ID, IP address, mobile device battery level. Categories of data subjects: Users of the Game. Legal ground: processing is carried out in accordance with the User Agreement for the Game. Method of processing: automated. Actions performed: collection, recording, systematisation, accumulation, storage, updating (renewal, modification), retrieval, use, transfer (provision, access), blocking, deletion, destruction of personal data. Processing period: until the account is deleted or consent to the processing of personal data is withdrawn.

In pursuit of this purpose, Users' personal data may be transferred to third parties with which the Operator has concluded a civil law contract, on the basis of separately obtained consent from the User setting out the processing and retention periods for the personal data that may be transferred.

4.6. The provision of personal data is necessary in order to conclude a contract on the terms of the user agreement and to be able to use the Game. Possible consequences of failing to provide such data: it will be impossible to conclude a contract on the terms of the user agreement with the data subject, and impossible for the subject to use the Game and to receive the services of the Game Administration in full.

On the Site:

4.7. Purpose: receiving and responding to Users' enquiries, complaints and claims. Data that contains or may contain personal data: email address, surname, first name and patronymic, telephone number (when interacting with the Administration through a form on the Site), postal address (when interacting by paper correspondence). Categories of data subjects: Users of the Site. Legal ground: processing is carried out with the data subject's consent to the processing of their personal data. Method of processing: both automated and non-automated (mixed). Actions performed: collection, recording, systematisation, accumulation, storage, updating (renewal, modification), retrieval, use, transfer (provision, access), blocking, deletion, destruction of personal data. Processing period: 3 (three) years from the date the enquiry, complaint or claim was received.

4.8. Purpose: ensuring the proper functioning and improving the quality of the Site, and collecting analytics. Data that contains or may contain personal data: cookies. Categories of data subjects: Users of the Site. Legal ground: processing is carried out with the data subject's consent and on the basis of the Administration's legitimate interest. Method of processing: automated. Actions performed: collection, recording, systematisation, accumulation, storage, updating (renewal, modification), retrieval, use, transfer (provision, access), blocking, deletion, destruction of personal data. Processing period: until consent to the processing of personal data is withdrawn by means of the corresponding settings in the User's browser.

4.9. Purpose: reviewing proposals for cooperation, and concluding and performing civil law contracts with counterparties. Data that contains or may contain personal data: surname, first name and patronymic; place of work, mobile telephone number; email address, messenger nickname. Categories of data subjects: representatives of counterparties. Legal ground: processing is carried out with the data subject's consent and on the basis of the Administration's legitimate interest. Method of processing: automated. Actions performed: collection, recording, systematisation, accumulation, storage, updating (renewal, modification), retrieval, use, transfer (provision, access), blocking, deletion, destruction of personal data. Processing period: 3 (three) years from the date such a proposal was received, or 3 (three) years from the date the parties' obligations under the contract were performed.

4.10. Purpose: conducting surveys and studying public opinion and social research on matters including, but not limited to, promotions, special offers and other marketing activities run by the Operator. Data that contains or may contain personal data: device ID; IP address; character first name and surname (nickname); mobile telephone number; email address; messenger nickname (Telegram/VKontakte). Categories of data subjects: Users of the Game / Users of the Site. Legal ground: processing is carried out with the data subject's consent and on the basis of the Administration's legitimate interest. Method of processing: automated. Actions performed: collection, recording, systematisation, accumulation, storage, updating (renewal, modification), retrieval, use, transfer (provision, access), blocking, deletion, destruction of personal data. Processing period: 3 (three) years from the date such consent was obtained, or until consent to the processing of personal data is withdrawn.

5. Automated decision-making

The Administration does not use automated decision-making. Nor does the Administration use personal data for the automatic evaluation of aspects of Users' personality (automated profiling).

6. Principles of processing personal data

6.1. The Administration processes personal data on the basis of the following principles:

– personal data is processed on a lawful and fair basis;

– the processing of personal data is limited to the achievement of specific, predetermined and lawful purposes;

– processing of personal data incompatible with the purposes of its collection is not permitted;

– it is not permitted to combine databases containing personal data processed for purposes that are incompatible with one another;

– only personal data that meets the purposes of its processing is subject to processing;

– the content and volume of the personal data processed corresponds to the stated purposes of processing. The personal data processed must not be excessive in relation to the stated purposes of its processing;

– when processing personal data, its accuracy and sufficiency and, where necessary, its currency in relation to the purposes of processing are ensured, and the necessary measures are taken to delete or rectify incomplete or inaccurate personal data;

– personal data is stored in a form that permits identification of the data subject for no longer than the purposes of processing require, unless a retention period is established by law, by the consent to processing, or by a contract to which the data subject is a party, beneficiary or guarantor;

– the personal data processed is destroyed once the purposes of processing have been achieved or where the need to achieve those purposes has been lost, unless otherwise provided by federal law;

– the processing of personal data is not used for the purpose of causing property and/or moral harm to data subjects, or of impeding the exercise of their rights and freedoms;

– personal data is processed in such a way that information concerning the processing is easily accessible, comprehensible and expressed in plain language. The Operator notifies the subject of the processing of their personal data before such processing begins;

– access to subjects' personal data is granted only to employees of the Administration who have acquired specific skills in handling personal data and have been briefed on working with personal data;

– the Administration must be able to demonstrate the lawfulness of the processing of personal data.

7. Rights of data subjects

7.1. Data subjects have the right of access to the following information: (a) the purposes of processing; (b) the categories of personal data concerned; (c) the recipients or categories of recipients to whom the personal data has been or will be disclosed, in particular recipients in third countries or international organisations; (d) where possible, the envisaged period for which the personal data will be stored or, where that is not possible, the criteria used to determine that period; (e) the existence of the right to request from the controller rectification or erasure of the personal data concerned, or restriction of its processing, or to object to such processing; (f) the right to lodge a complaint with a supervisory authority; (g) where the personal data was not obtained from the data subject, any available information as to its source; (h) the existence of automated decision-making, including profiling, and, at least in those cases, meaningful information about the logic involved and the significance and envisaged consequences of such processing for the data subject.

7.2. The data subject has the right to require the Administration to rectify inaccurate personal data concerning them without undue delay. Taking into account the purposes of processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.

7.3. The data subject has the right to require the Administration to erase personal data concerning them without undue delay, and the Administration is obliged to erase the personal data without delay where one of the following grounds applies: (a) the personal data is no longer necessary for the purposes for which it was collected or otherwise processed; (b) the data subject withdraws the consent on which the processing is based, and there is no other legal ground for the processing; (c) the data subject objects to the processing and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing; (d) the personal data has been processed unlawfully; (e) the personal data must be erased in order to comply with a legal obligation under applicable law; (f) the personal data was collected in relation to the offer of information society services.

7.4. The data subject has the right to request that the Administration restrict processing where one of the following applies: (a) the data subject contests the accuracy of the personal data — for a period enabling the controller to verify its accuracy; (b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of its use instead; (c) the controller no longer needs the personal data for the purposes of the processing, but it is required by the data subject for the establishment, exercise or defence of legal claims; (d) the data subject has objected to the processing — pending verification of whether the controller's legitimate grounds override those of the data subject.

7.5. The data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them, including profiling based on those provisions. The Administration may not process the personal data further unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

7.6. The data subject has the right to receive the personal data concerning them which they have provided to the Administration in a structured, commonly used and machine-readable format, and has the right to transmit that data to another controller without hindrance from the controller to which the personal data was provided, where: (a) the processing is based on consent or on a contract; (b) the processing is carried out by automated means.

7.7. Where processing is based on consent, the subject has the right to withdraw their consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

7.8. The data subject has the right to lodge a complaint with a supervisory authority.

8. Cross-border transfer of personal data

8.1. The Administration may carry out cross-border transfers of personal data in compliance with the requirements of the law.

8.2. A transfer of personal data to a third country or an international organisation may take place where the Administration has concluded that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection.

9. Measures to ensure the security of personal data

9.1. The Administration takes all necessary organisational and technical measures to protect subjects' personal data against unlawful or accidental access, destruction, modification, blocking or dissemination, and against other unlawful acts in relation to it.

9.2. The Administration's personal data security measures include, among others, the following:

– keeping a record of the categories and list of personal data processed, the categories of subjects whose personal data is processed, the retention periods and the procedure for destroying such personal data;

– at the design stage of a process or system, describing the nature of the processing of personal data, including the purposes of processing, the legal grounds for processing, the categories and number of data subjects, the list of personal data, the actions performed on personal data, the transfer procedure including cross-border transfer, and details of the third parties to whom personal data is transferred;

– keeping a record of machine-readable media containing personal data and of the information systems in which personal data is processed;

– determining the required level of protection for personal data processed in personal data information systems;

– identifying threats to the security of personal data during its processing in information systems;

– identifying and implementing, before the introduction of new personal data processing operations and new personal data information systems, the technical and organisational measures that ensure the protection of personal data;

– carrying out and documenting an assessment of the harm that may be caused to data subjects, and the relationship between that harm and the measures taken by the Administration;

– establishing rules for access to personal data processed in information systems, and ensuring that actions performed on personal data in information systems are logged and recorded;

– applying information protection tools that have undergone the established conformity assessment procedure;

– detecting instances of unauthorised access to personal data and other incidents, and taking measures to eliminate and mitigate the consequences;

– restoring personal data modified or destroyed as a result of unauthorised access to it;

– keeping a record of the positions of those employees whose access to personal data, processed with or without the use of automated means, is necessary for the performance of their official (employment) duties;

– ensuring that employees of the Administration who directly process personal data acknowledge in writing that they have read the provisions of personal data legislation, and providing training to employees of the Administration;

– monitoring and evaluating the effectiveness of the personal data security measures applied before a personal data information system is put into operation;

– carrying out regular internal monitoring/audit of the compliance of personal data processing and security with the applicable personal data legislation;

– appointing a person responsible for organising the processing of personal data.

10. Use of analytics services and cookies

10.1. Data collected in the Game may also be received and processed by third-party analytics service providers.

10.2. Cookies are small files created and stored by a device when visiting the Site. Cookies are stored on the device for no more than one year and make it possible to adapt the operation of the Site and to ensure it works as effectively as possible on the User's device.

10.3. Visiting and using the Site involves the generation and storage of cookies by default. However, the User may delete cookies from their device at any time through the settings of the browser they use. The User may also refuse to accept cookies, in which case the operation of all functions of the Site is not guaranteed.

10.4. The Site uses technical and functional cookies: these files, generated by the underlying engines, are used to ensure uninterrupted operation and to remember the settings selected by the user.

10.5. The following analytics and advertising measurement services are used on the Site. For each of them the service operator, the country in which data is processed and the consent category under which it loads are set out below:

– Yandex.Metrica (Yandex LLC, Russian Federation) — measurement of traffic and behaviour on the Site. Loads on consent to analytical cookies;

– Google Ads (Google LLC, USA) — advertising conversion measurement. Loads on consent to marketing cookies;

– Meta Pixel (Meta Platforms Ireland Limited, Ireland / USA) — advertising conversion measurement. Loads on consent to marketing cookies;

– TikTok Pixel (TikTok Information Technologies UK Limited and its affiliates, Ireland / Singapore / USA) — advertising conversion measurement. Loads on consent to marketing cookies;

– VK Ads (VK LLC, Russian Federation) — advertising conversion measurement. Loads on consent to marketing cookies.

10.6. Until the corresponding consent has been given by the User, none of the services listed above is loaded on the Site and no data is transferred to them. Consent may be changed or withdrawn at any time through the “Cookie settings” entry at the foot of the Site.

10.7. Transfer of data to services whose operators are located outside the Russian Federation constitutes a cross-border transfer and is carried out in the manner provided for by section 8 of this Policy.

10.8. Where an analytics service is used, the data is also processed in accordance with that service's terms of use and privacy policy.

11. Contacts for personal data processing matters

11.1. Should you have any questions or requests concerning the processing of personal data, in particular to withdraw consent to the processing of personal data, you may write to invest@sunrise-online.com.

11.2. The Operator ensures the rights of data subjects in accordance with paragraph 7 of this Policy and performs its obligations in the manner established by applicable law.

11.3. Information concerning the processing of a subject's data is provided to the data subject or their representative upon receipt of a request from the data subject or their representative within the time limits specified in applicable law or, where no time limits are specified, within 10 (ten) working days.

11.4. The request must contain the number of the principal identity document of the data subject or their representative, information about the date of issue of that document and the authority that issued it, information confirming the data subject's participation in relations with the Operator (contract number, date of conclusion of the contract, a conventional verbal designation and/or other information), or information otherwise confirming the fact that personal data is processed by the Operator, and the signature of the data subject or their representative.

11.5. The Operator undertakes to provide the data subject or their representative, free of charge, with the opportunity to review the personal data relating to that data subject. Within no more than 7 (seven) working days from the day the data subject or their representative provides information confirming that the personal data is incomplete, inaccurate or out of date, the Operator undertakes to make the necessary changes to it. Within no more than 7 (seven) working days from the day the data subject or their representative provides information confirming that such personal data has been obtained unlawfully or is not necessary for the stated purpose of processing, the Operator undertakes to destroy such personal data. The Operator undertakes to notify the data subject or their representative of the changes made and the measures taken, and to take reasonable steps to notify third parties to whom that subject's personal data has been transferred.

12. Procedure for destroying personal data

12.1. Once the purposes of processing have been achieved, or where the need to achieve those purposes has been lost, the personal data processed is subject to destruction, unless otherwise provided by law or separately agreed between the parties.

12.2. The Operator destroys personal data recorded on electronic media using guaranteed-destruction software, and personal data on paper using technical means for complete destruction. The Operator destroys personal data held in information systems by erasing the records in the databases.

12.3. When destroying personal data, the Operator draws up a dedicated destruction certificate.

13. Final provisions

13.1. The requirements of the Policy apply to all data subjects regardless of their citizenship and place of residence.

13.2. This Policy may be amended from time to time in accordance with the requirements of applicable law.