Privacy Policy

This Privacy Policy explains how JoyBuggy ApS collects, uses, shares and protects personal data when you:

• visit www.joybuggy.com;

• create or use a JoyBuggy account;

• sign in using a third-party account;

• purchase a Digital Product;

• participate in loyalty, referral or reward features;

• contact Customer Support;

• subscribe to marketing communications; or

• otherwise interact with JoyBuggy.

“Personal data” means information relating to an identified or identifiable individual.

The data controller is:

JoyBuggy ApS Gunderupvej 16 9260 Gistrup Denmark

CVR: 42023906 VAT number: DK42023906 Privacy email: [email protected] Customer Support: [email protected]

JoyBuggy determines why and how the personal data described in this Policy is processed.

Depending on how you use JoyBuggy, we may process the following categories of personal data.

This may include:

• name;

• email address;

• username or display name;

• password in securely hashed form;

• account identifier;

• profile image;

• country, language and currency preferences;

• account creation and last-login dates; and

• account settings and communication preferences.

JoyBuggy does not have access to your original password where passwords are stored using secure one-way hashing.

If you choose to sign in through a supported third-party provider, we may receive:

• the provider’s unique account identifier;

• username or display name;

• email address, where made available and authorized;

• profile image; and

• other limited profile information specifically shown in the provider’s authorization screen.

We do not receive your password for the third-party service.

This may include:

• products ordered;

• order number;

• price, currency, tax and discount information;

• order and delivery status;

• activation key or entitlement associated with the order;

• refund, cancellation and complaint history;

• billing country and, where required, billing address;

• VAT or business information where provided;

• payment method and limited payment details;

• payment-provider transaction identifiers;

• chargeback or payment-dispute information; and

• evidence that required checkout acknowledgements were provided.

Payments are processed by independent payment providers such as Stripe and any other provider displayed at checkout.

Full card details are normally submitted directly to the payment provider and are not received or stored by JoyBuggy. We may receive limited information such as:

• payment status;

• payment token or transaction identifier;

• card brand;

• last digits of the payment card;

• card expiry information;

• payer country;

• fraud or authentication result; and

• refund or chargeback status.

The payment provider processes information under its own privacy notice and, depending on the activity, may act as an independent controller or as JoyBuggy’s processor.

When you use the Website, we may collect:

• IP address;

• browser type and version;

• device type and operating system;

• approximate location derived from IP address;

• language and time zone;

• referral URL and campaign identifiers;

• pages and products viewed;

• session and login activity;

• cart and checkout activity;

• cookie and consent identifiers;

• error, diagnostic and performance information;

• request and security logs; and

• signals associated with fraud, abuse or unauthorized access.

Optional analytics and marketing technologies are used only in accordance with your cookie choices. Further information is available in our Cookie Policy at joybuggy.com/cookies.

If you contact us, we may process:

• your contact details;

• order and account information;

• the content of your message;

• attachments, screenshots and activation errors;

• correspondence history;

• call or chat metadata; and

• the actions taken to resolve your request.

Please do not send identity documents, payment-card details or sensitive personal information unless JoyBuggy has specifically requested the information through an appropriate secure channel.

Where applicable, we may process:

• email address;

• marketing consent and its date, source and wording;

• subscription preferences;

• unsubscribe or objection status;

• campaign and affiliate source;

• email delivery, opening and link-interaction information where tracking is enabled and legally permitted; and

• interests inferred from consented interactions with JoyBuggy.

Where JoyBuggy offers loyalty, points, tier, task, referral or reward features, we may process:

• points balance and tier;

• qualifying purchases and actions;

• completed tasks and achievements;

• referral identifiers and attributed referrals;

• rewards selected or redeemed;

• benefit and expiry history; and

• information used to detect duplicate accounts, manipulation or other program abuse.

The applicable program rules will explain which actions qualify and how points or rewards are calculated.

Where you submit a review, feedback or other content, we may process:

• the content submitted;

• rating;

• display name;

• related product and purchase-verification status; and

• moderation and publication history.

You should not include personal information about another person in public content.

We obtain personal data:

• directly from you;

• automatically from your device and Website activity;

• from your selected social-login provider;

• from payment providers, banks and card networks;

• from marketing or affiliate partners that referred you;

• from security and fraud-prevention providers;

• from delivery, support and infrastructure providers;

• from publishers or distributors where necessary to investigate an activation or entitlement issue; and

• from public or legally accessible sources where necessary for fraud prevention, sanctions compliance or legal claims.

Certain information is required to create an account, process an order, deliver a Digital Product, accept payment or comply with legal requirements.

If you do not provide required information, we may be unable to create the account, accept the order, process payment or provide the requested support.

Information identified as optional does not have to be provided.

Social login is optional. You can use another available registration or login method.

When you select a provider, you are redirected to that provider. The exact information requested from the provider is shown during authorization.

We disclose personal data only where reasonably necessary. Recipients may include:

Providers that supply hosting, databases, content delivery, backups, monitoring and cybersecurity services. This includes Cloudflare for relevant network, performance and security services.

Stripe, other payment methods selected at checkout, banks, card networks and providers involved in authentication, refunds, fraud prevention and chargebacks.

Google, X, Discord, Steam, Kick, Twitch or Epic Games when you choose the corresponding login method.

Providers used for business email, transactional messages, customer support, chat and ticket management. JoyBuggy currently uses Google Workspace for relevant business communications.

Providers used for analytics, campaign measurement, email marketing, advertising and affiliate attribution—but only where the required consent or another lawful basis exists.

Technologies operating on the Website are identified in the current cookie declaration available through our Cookie Policy at joybuggy.com/cookies.

Publishers, authorized distributors and platform providers may receive limited order, product, key or diagnostic information where necessary to:

• supply an entitlement;

• verify a key;

• investigate an activation issue;

• prevent unauthorized resale; or

• resolve a complaint.

JoyBuggy will not provide customer identity information to a supplier where product or order identifiers are sufficient.

Accountants, auditors, legal advisers, insurers, courts, regulators, tax authorities, law-enforcement authorities and other recipients where disclosure is legally required or necessary for legal claims.

If JoyBuggy is reorganized, financed, sold or merged, relevant personal data may be disclosed to professional advisers and prospective or actual participants, subject to appropriate confidentiality and data-protection safeguards.

JoyBuggy does not sell customer personal data as a business model.

Some providers or their group companies may process personal data outside the European Economic Area.

Where GDPR requires a transfer mechanism, JoyBuggy will use an appropriate safeguard, such as:

• an adequacy decision adopted by the European Commission;

• the EU–US Data Privacy Framework where the relevant US recipient is validly certified;

• European Commission Standard Contractual Clauses;

• another legally recognized transfer mechanism; and

• supplementary technical or contractual safeguards where required.

You may contact [email protected] for further information about the safeguards applicable to a particular transfer.

We retain personal data only for as long as reasonably necessary for the relevant purpose, including contractual, accounting, security and legal requirements.

Our normal retention approach is:

JoyBuggy may use automated rules or risk indicators to identify potentially fraudulent, abusive or unauthorized transactions.

Indicators may include:

• payment-provider results;

• IP address and approximate location;

• device and browser characteristics;

• account and order history;

• transaction value and velocity;

• repeated payment failures;

• inconsistent country, payment or account information;

• unusual purchase quantities; and

• known indicators of account takeover, chargebacks or unauthorized resale.

This assessment may result in an order being delayed, referred for manual review, subjected to additional verification, refused or cancelled.

Where applicable law gives you a right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, you may request human review, express your point of view and challenge the decision by contacting [email protected].

We will not ask for disproportionate verification information. Any additional verification data will be access-restricted and deleted when no longer required.

We send promotional email or similar marketing only where:

• you have provided valid consent;

• applicable law expressly permits communication to an existing customer; or

• another lawful basis is available.

Marketing consent is separate from acceptance of our Terms and is not required to purchase a product.

Every promotional email will provide an unsubscribe method. You may also object at any time by contacting [email protected].

Unsubscribing from marketing does not stop essential order, account, security, policy or Customer Support communications.

Information about cookies, local storage, pixels, analytics, affiliate tracking and consent controls is available in our Cookie Policy at joybuggy.com/cookies.

JoyBuggy uses organizational and technical measures intended to protect personal data against unauthorized access, loss, alteration, disclosure or destruction.

Measures may include:

• access controls and least-privilege permissions;

• encryption in transit and where appropriate at rest;

• secure password hashing;

• multi-factor authentication for administrative access;

• network and application monitoring;

• backups and recovery controls;

• security logging;

• vulnerability management;

• separation of production and administrative access; and

• procedures for responding to security incidents.

No system is completely secure. You should use a strong, unique password and contact [email protected] immediately if you suspect unauthorized access to your account or activation keys.

Subject to applicable conditions and exceptions, you may have the right to:

• receive information about our processing;

• request access to your personal data;

• obtain a copy of your personal data;

• correct inaccurate or incomplete information;

• request deletion;

• request restriction of processing;

• object to processing based on legitimate interests;

• object at any time to direct marketing;

• receive certain information in a portable format;

• withdraw consent at any time;

• request safeguards concerning applicable automated decisions; and

• lodge a complaint with a supervisory authority.

Withdrawal of consent does not affect processing performed lawfully before withdrawal.

Some information cannot be deleted immediately where it must be retained for accounting, fraud prevention, legal claims or another legal obligation.

Send your request to [email protected].

Please describe what you are requesting and provide the email address associated with your JoyBuggy account.

We may request additional information where reasonably necessary to confirm your identity. We will not request more information than needed for verification.

We normally respond within one week. Where permitted by law, the period may be extended for a complex request, in which case we will inform you.

You may also manage certain information directly through your JoyBuggy account settings.

We encourage you to contact [email protected] first so that we can investigate your concern.

You also have the right to lodge a complaint with:

Datatilsynet — Danish Data Protection Agency Carl Jacobsens Vej 35 2500 Valby Denmark Website: www.datatilsynet.dk

If you live elsewhere in the EEA, you may also contact the data-protection authority in your country.

The Website is not directed specifically at young children.

If you are not legally able to enter into a purchase or create an account independently, you should use JoyBuggy only with the involvement and valid consent of a parent or legal guardian.

We do not knowingly seek to collect personal data from children below the applicable minimum age without legally valid authorization. If you believe a child has provided personal data improperly, contact [email protected].

The Website may link to independent publishers, activation platforms, payment providers and other websites.

Their processing is governed by their own privacy notices. JoyBuggy is not responsible for independent processing performed entirely by those providers, but remains responsible for personal data that JoyBuggy itself collects, receives or discloses.

We may update this Policy to reflect changes in the Website, providers, processing activities or applicable law.

Material changes will be communicated through an appropriate method, such as an account notice, Website notice or email, where required.

The current version and its effective date will remain available on the Website.