If you are located in the European Union (EU) or European Economic Area (EEA), you have specific rights under the General Data Protection Regulation (GDPR). This page explains your rights and how to exercise them.
1. Lawful Basis for Processing
We process your personal data based on the following lawful bases:
1.1 Contract Performance
When you create an account and use our service, we process your data to perform our contract with you - specifically, to analyze your DNA and generate your character profile.
1.2 Legitimate Interests
We process certain data based on our legitimate interests, including:
- Improving and optimizing our services
- Ensuring the security of our platform
- Preventing fraud and abuse
- Understanding how users interact with our service
1.3 Consent
For certain processing activities, we rely on your explicit consent, such as:
- Marketing communications
- Sharing your character profile publicly
- Non-essential cookies
1.4 Legal Obligation
We may process data to comply with legal requirements, such as tax obligations, regulatory requests, or court orders.
2. Your GDPR Rights
Under GDPR, you have the following rights:
2.1 Right to Access (Article 15)
You have the right to obtain confirmation of whether we process your personal data and, if so, access to that data along with information about:
- The purposes of processing
- The categories of data we hold
- Recipients of your data
- Retention periods
- Your rights regarding the data
How to exercise: Email gdpr@dnarcade.com with the subject "Data Access Request" or use your account settings.
2.2 Right to Rectification (Article 16)
You have the right to have inaccurate personal data corrected without undue delay. You can update most information directly in your account settings.
How to exercise: Update your profile in account settings or email gdpr@dnarcade.com.
2.3 Right to Erasure / "Right to be Forgotten" (Article 17)
You have the right to request deletion of your personal data when:
- The data is no longer necessary for its original purpose
- You withdraw consent (where consent was the basis)
- You object to processing and there are no overriding legitimate grounds
- The data was unlawfully processed
- Deletion is required by law
How to exercise: Delete your account in settings or email gdpr@dnarcade.com.
2.4 Right to Restriction of Processing (Article 18)
You can request that we restrict processing of your data when:
- You contest the accuracy of the data (while we verify)
- Processing is unlawful but you oppose erasure
- We no longer need the data but you need it for legal claims
- You have objected to processing (pending verification)
2.5 Right to Data Portability (Article 20)
You have the right to receive your personal data in a structured, commonly used, machine-readable format (such as JSON) and to transmit it to another controller.
How to exercise: Use the "Export Data" feature in your account settings or email gdpr@dnarcade.com.
2.6 Right to Object (Article 21)
You have the right to object to processing based on legitimate interests or for direct marketing purposes. We will stop processing unless we can demonstrate compelling legitimate grounds.
2.7 Rights Related to Automated Decision-Making (Article 22)
You have the right not to be subject to decisions based solely on automated processing that significantly affect you. Our character generation is automated but is for entertainment purposes only and does not make decisions that legally or significantly affect you.
2.8 Right to Withdraw Consent (Article 7)
Where we process data based on your consent, you have the right to withdraw that consent at any time. This does not affect the lawfulness of processing before withdrawal.
3. Special Categories of Data
Genetic data is considered a "special category" of personal data under GDPR Article 9, which requires additional protections.
3.1 How We Handle Genetic Data
- Processing: We process your DNA file to generate character stats
- Storage: Raw DNA is NEVER stored - only derived statistics
- Legal basis: Your explicit consent when you upload DNA data
- Security: Encrypted processing with immediate deletion
3.2 Additional Safeguards
- 256-bit TLS encryption for data transmission
- AES-256 encryption for any stored data
- Isolated processing environment
- No third-party access to genetic data
- Regular security audits
4. International Data Transfers
Your data may be transferred to and processed in the United States, where our servers are located. We ensure adequate protection through:
- Standard Contractual Clauses (SCCs): We use EU-approved contractual terms with our service providers
- Data Processing Agreements: All processors sign agreements ensuring GDPR-level protection
- Technical Measures: Encryption and security controls regardless of location
5. Data Retention
| Data Type | Retention Period |
|---|---|
| Raw DNA files | Immediately deleted after processing (never stored) |
| Character profiles | Until you delete them or your account |
| Account information | Until account deletion |
| Payment records | 7 years (legal requirement) |
| Usage analytics | 26 months (anonymized after) |
| Support communications | 3 years after resolution |
6. How to Exercise Your Rights
6.1 Contact Information
To exercise any of your GDPR rights, contact us:
- GDPR Requests: gdpr@dnarcade.com
- Data Protection Officer: dpo@dnarcade.com
6.2 Verification
To protect your data, we may need to verify your identity before processing your request. This typically involves confirming your email address.
6.3 Response Time
We will respond to your request within 30 days. If your request is complex, we may extend this by up to 60 days, but we will notify you of any extension.
6.4 No Fee
Exercising your GDPR rights is free of charge. However, we may charge a reasonable fee for manifestly unfounded or excessive requests.
7. Right to Lodge a Complaint
If you believe we have not handled your data correctly, you have the right to lodge a complaint with a supervisory authority. You can contact the authority in:
- Your country of residence
- Your place of work
- The country where the alleged infringement occurred
A list of EU supervisory authorities is available at: European Data Protection Board
8. Data Protection Officer
We have appointed a Data Protection Officer (DPO) who is responsible for overseeing our data protection strategy and ensuring GDPR compliance.
Contact our DPO:
Email: dpo@dnarcade.com
Address: DNArcade Data Protection Officer, [Address]
9. Updates to This Page
We may update this GDPR information page to reflect changes in our practices or in response to regulatory guidance. Check this page periodically for the latest information about your data rights.