Data Protection and Privacy Policy

Throne of Dust

White Colony Kft. | Company No. 07-09-457208 | Last updated: 11 September 2026

1. Overview

This Data Protection and Privacy Policy ("Policy") describes how White Colony Kft. collects, uses, stores, discloses, and protects personal data in connection with the game Throne of Dust, the website throneofdustgame.com, the game service at play.throneofdustgame.com, and all related accounts, gameplay features, the Relic Market, purchase and payout flows, and support channels (the "Platform").

We process personal data in accordance with Regulation (EU) 2016/679 ("GDPR"), applicable Hungarian data protection law, and other applicable privacy requirements.

We do not sell your personal data, and we do not use it for third-party advertising.

2. Data Controller

The controller responsible for your personal data is:

White Colony Kft. Company registration number: 07-09-457208 Registered address: 1132 Budapest, Váci út 16. Fsz. 12. ajtó, Hungary Website: https://throneofdustgame.com Email: support@throneofdustgame.com

3. Categories of Personal Data We Collect

Depending on how you use the Platform, we may process:

(a) Account data — email address, nickname, user ID, login and authentication data, account settings, account status, and registration date.

(b) Gameplay data — game progress, defeated enemies, equipment, masks, consumables, Relics, arena rank and league, battle results, and your Silver, Gold, and Aurum balances.

(d) Transaction data — records of Gold and Aurum purchases, payout requests and their statuses, refunds, chargebacks, payment status, invoices, billing identifiers, and transaction history.

(e) Payment data — payment method identifiers, partial card details, payment confirmations, failed payment records, and fraud-prevention signals received from our payment providers. We do not store full card numbers; card data is handled by compliant payment providers.

(f) Payout data — where you use the payout function: the cardholder name you provide, masked card details (the first six and last four digits only), payment-ownership signals, sanctions screening results, payout request history and statuses, and related records. The full card number you enter to receive a payout is used once to send the payment and is never stored by us.

(g) Verification data — where we ask you to verify your identity or card ownership before a payout: the information and documents you provide for that check and the verification result.

(h) Support data — messages you send us, complaints, refund and payout enquiries, and our responses.

(i) Device and technical data — IP address, browser type and version, operating system, language, time zone, request logs, error and crash data, cookies, and local storage identifiers.

(j) Security and anti-fraud data — login attempts, suspicious-activity and bot-detection signals, market abuse indicators, account risk indicators, chargeback risk data, and fraud-prevention logs.

(k) Preference data — settings such as communication preferences and opt-in/opt-out status where marketing is offered.

(l) Legal and compliance records — data we must keep for accounting, tax, consumer protection, sanctions, dispute, and other regulatory purposes.

4. How We Collect Personal Data

Directly from you — when you register, play, make a purchase, use the Relic Market, request or receive a payout, complete verification, or contact support.

Automatically — technical, gameplay, market, and transaction data generated while you use the Platform, including through cookies and similar technologies.

From third parties — such as payment and payout processors, fraud-prevention and sanctions screening providers, hosting providers, banks and card networks, and public authorities, where relevant to the purposes below.

5. Purposes and Legal Bases

We process personal data only with a lawful basis under Article 6 GDPR:

(a) Account and game provision — registering and authenticating you, saving your progress, operating gameplay features, rankings, and balances. Basis: contract performance.

(b) Purchases — processing Gold and Aurum purchases, receipts, invoices, and transaction records. Basis: contract performance; legal obligation; legitimate interests. Card payments may additionally be protected with 3D Secure authentication where supported.

(c) Relic Market — processing listings, purchases, sales, and balance updates between users, and checking transactions for fraud and manipulation. Basis: contract performance; legitimate interests.

(d) Payouts and reverse conversion — assessing payout eligibility, reviewing and approving requests, verifying identity and payment ownership where required, sending approved payments to the card you provide, and keeping required records. Basis: contract performance; legal obligation; legitimate interests.

(e) Sanctions screening and fraud prevention — screening transactions and payout requests, preventing misuse, chargeback abuse, market manipulation, and unlawful activity. Basis: legal obligation; legitimate interests.

(f) Support and dispute handling — responding to enquiries, resolving complaints, processing refunds. Basis: contract performance; legitimate interests; legal obligation.

(g) Security and platform integrity — protecting accounts, detecting bots and cheating, monitoring faults, securing the Platform. Basis: legitimate interests; contract performance.

(h) Service improvement — analysing technical logs and aggregated gameplay data to fix issues, balance the game, and develop features. We do not use third-party advertising or cross-site tracking. Basis: legitimate interests; consent where required for cookies or similar technologies.

(i) Communications — sending service messages (receipts, invoices, payout status updates, security notices, policy updates); optional marketing only with your consent or as otherwise permitted by law. Basis: contract performance; consent; legitimate interests.

(j) Legal compliance and claims — accounting, tax, regulatory, and legal-claim obligations. Basis: legal obligation; legitimate interests.

6. Required and Optional Data

Some data is necessary to provide the Platform: without account data we cannot operate your account; without payment data we cannot process purchases; without the card details you enter in the payout flow we cannot send an approved payout; without verification data, where requested, we cannot approve a payout; without records required by law we cannot complete certain transactions. Optional data (such as marketing preferences) can be changed or withdrawn at any time.

7. Cookies and Similar Technologies

We use cookies and local storage as described in our Cookie Policy. Strictly necessary technologies are always used — supporting login, session security, payment flows, and basic operation. Any optional cookies are used only where permitted by law and, where required, after your consent.

8. Disclosure of Personal Data

We may share personal data, where necessary, with the following categories of recipients:

(a) hosting, database, infrastructure, and cloud service providers; (b) payment and payout processors, payment service providers, banks, and card networks; (c) identity verification, sanctions screening, and fraud-prevention providers; (d) email delivery and communication providers; (e) technical monitoring and error-tracking providers; (f) professional advisers — legal, tax, accounting, audit, and compliance; (g) courts, regulators, tax authorities, law enforcement, and other public authorities where required or permitted by law; (h) business successors in connection with a merger, acquisition, restructuring, or transfer of business.

Other users can see the information you make public on the Platform, such as your nickname, mask, arena rank, and Relic Market listings.

All service providers process personal data on our documented instructions under data processing agreements with appropriate confidentiality and security obligations.

9. International Transfers

Personal data is processed primarily in the European Economic Area. Where a provider processes data outside the EEA, we rely on appropriate safeguards: an adequacy decision of the European Commission, Standard Contractual Clauses with supplementary measures where needed, or another lawful transfer mechanism under Chapter V GDPR.

10. Data Retention

We keep personal data only as long as necessary for the purposes above:

(a) account and gameplay data — while your account is active, and for a limited period after closure for security, dispute, and legal purposes; (b) purchase, market, payout, accounting, and tax records — 8 years, as required by Hungarian accounting law; (c) verification, sanctions, and compliance records — for the retention period required by applicable compliance law, which may extend several years after the relevant transaction; (d) support correspondence — as long as needed to resolve the matter and keep a record of it; (e) security and server logs — for a limited period, unless needed for an investigation or legal claim.

Full card numbers entered in the payout flow are not retained at all: they are used once to send the payment and then discarded, with only a masked number (the first six and last four digits) and the cardholder name kept in payout records.

When data is no longer required, we delete or anonymise it, or securely archive it where the law requires continued retention.

11. Security

We apply appropriate technical and organisational measures: encrypted connections (HTTPS), access controls, role-based permissions, server-side processing of balance changes, logging and monitoring, secure development practices, and due diligence of service providers. Payout requests are reviewed from a separate administrator account, and administrators never see the full card numbers entered by players. No online service is completely secure — keep your credentials confidential and tell us immediately at support@throneofdustgame.com if you suspect your account is compromised.

12. Your GDPR Rights

Subject to legal conditions and exemptions, you have the right to: access your data; rectify inaccurate data; erase your data; restrict processing; object to processing based on legitimate interests (including any direct marketing); data portability; and withdraw consent where processing is based on consent.

To exercise your rights, contact support@throneofdustgame.com. We may need to verify your identity, and we respond within the timeframes set by the GDPR (normally one month).

13. Automated Processing

We may use automated tools to detect fraud, bots, market manipulation, payment risk, sanctions risk, and suspicious account behaviour, and to diagnose technical issues. We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you, unless permitted by law and accompanied by appropriate safeguards, including the right to human review. In particular, every payout request is reviewed and approved or declined individually by a human administrator.

14. Children

The Platform is intended only for users aged 18 and over. We do not knowingly process personal data of minors. If we learn that a person under 18 has created an account, we will restrict the account and delete the data, subject to legal retention requirements.

15. Communications and Marketing

We send service communications necessary to operate the Platform: purchase receipts and invoices, payout status updates, security notices, and policy updates. Marketing messages, if offered, are sent only where permitted by law, and you can opt out at any time via the unsubscribe link or by emailing support@throneofdustgame.com.

16. Supervisory Authority

If you are not satisfied with how we handle your personal data, you may lodge a complaint with the Hungarian supervisory authority:

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) 1055 Budapest, Falk Miksa utca 9–11, Hungary https://www.naih.hu/

You may also contact the supervisory authority of your EU country of residence or workplace.

17. Changes to This Policy

We may update this Policy to reflect changes in our practices, features, providers, or legal requirements. The current version is always available on the Platform; material changes will be announced on the Platform or by email where appropriate.