Privacy policy

1. Data controller

The controller of your personal data is Dragon's Diamond Marcin Iwaniec, pl. Kilińskiego 2, 35-005 Rzeszów, Poland, EU VAT ID 8133754191 (hereinafter: the “Controller”, “we”).

Contact with the Controller (all matters, including personal data): .

2. What personal data we process and on what legal basis

To be clear up front: this version of the site runs no analytics, no profiling and no marketing. We use neither Google Analytics nor any similar tools, we embed no advertising pixels and we send data to no data brokers. We collect only the data you give us voluntarily and one necessary cookie described in point 3.

a) E-mail correspondence and phone calls. If you write to or call us, we process your e-mail address (or phone number) and the data you include in the message (e.g. your name). Purpose: handling your enquiry and further contact. Legal basis: art. 6(1)(b) GDPR (steps prior to entering a contract) and art. 6(1)(f) GDPR (our legitimate interest — running the correspondence).

b) Invoice data. For services covered by a VAT invoice we process the data needed to issue and settle it: name, company name, address, VAT ID, e-mail address, optionally phone number and bank account number. Legal basis: art. 6(1)(b) GDPR (contract) and art. 6(1)(c) GDPR (tax obligations).

c) Data from the former contact form. The earlier, WordPress-based version of the site contained a contact form whose submissions reached us by e-mail at . Such messages are covered by the rules in point 2a, including the retention periods (point 5) and rights (point 6). The form has been removed from the site; new submissions via the form are not possible.

3. Cookies, consents and external content

The site sets a single cookie: cc_cookie (origin: our own domain, first-party). It stores the decisions you make in the consent banner (accept all or necessary cookies only, plus optional interface preferences). This cookie does not track you — it only remembers and documents your consent. The consent is stored for a maximum of 182 days, after which the banner appears again. Basis of use: keeping your consent decision (the “strictly necessary” exemption of the e-privacy rules; under GDPR art. 6(1)(c)/(f) as documentation of the obligation). You can change your decision at any time with the “Cookie settings” button in the bottom-left corner of the page; withdrawing consent deletes the file and restores the initial state.

External content. On the Cutscene Planner product page the YouTube video is loaded only after you click (extended privacy mode, youtube-nocookie.com). Until that moment the browser does not connect to YouTube. After the player is loaded, YouTube (Google) may set its own cookies under Google's policy.

Links lead to external services (Unity Asset Store, thenwhat.ai, Facebook, YouTube) — after the redirect, the privacy policies of those services apply, over which we have no control.

The fonts (Lato, Oswald) are stored on our own server — the site makes no requests to Google Fonts or any other external font provider.

4. Data recipients and transfers outside the European Economic Area

• Hostinger International Ltd. — hosting and e-mail provider; the website and mail servers are located in the European Union. Security details: Hostinger's privacy policy.
• An accountancy firm — processes VAT invoice data solely for tax settlement purposes.
• YouTube (Google LLC, USA) — only when you initiate video playback yourself (point 3); Google is certified for the EU–US Data Privacy Framework.
• Authorities authorised by law, should such an obligation arise.

5. Data retention periods

• e-mail and phone correspondence — for the time needed to handle the matter and no longer than 12 months after the last contact in the given matter;
• VAT invoice data — 5 years, in accordance with tax regulations;
• the cookie holding your consent — a maximum of 182 days, or until consent is withdrawn / the files are removed in the browser.

6. Your rights

You have the right of: access to your data and copies of it (art. 15 GDPR), rectification (art. 16), erasure (art. 17), restriction of processing (art. 18), data portability (art. 20), and objection to processing (art. 21).

Where the basis is consent — you may withdraw it at any time (art. 7(3) GDPR); this does not affect the lawfulness of processing carried out before the withdrawal.

We handle requests without undue delay, no later than within a month. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa, Poland) if you believe the processing violates GDPR.

7. Automated decisions and profiling

We do not use automated decision-making or profiling within the meaning of art. 22 GDPR.

8. Security

The connection to the site is encrypted (HTTPS/TLS). The website and e-mail are maintained by a hosting provider in the European Union, obliged to secure the data at the level required by law (point 4).

9. Changes to this policy

This policy may be updated from time to time. The current version is always available at this address; material changes are marked with a new date at the top of the document.