Privacy Policy

This privacy policy applies to the website lumanto.app and our account service. Where individual services process additional data, this is described separately below.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Lumanto UG (haftungsbeschränkt)
Kaiserring 10-16
68161 Mannheim
Germany
impressum@lumanto.app

A data protection officer has not been appointed, as the requirements of Art. 37 GDPR and § 38 BDSG are not met. For all questions regarding data protection you can reach us using the contact details above.

2. Principles

Personal data is processed only to the extent necessary to provide a functioning website and our content and services. Depending on the processing, the legal basis is your consent (Art. 6(1)(a) GDPR), the performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR), a legal obligation (Art. 6(1)(c) GDPR) or our legitimate interest (Art. 6(1)(f) GDPR).

3. Website access and server log files

When you access this website, your browser transmits technically necessary data to our server. This data is stored in so-called log files:

• full IP address of the requesting device
• date and time of access
• name and URL of the retrieved file and the amount of data transferred
• browser type and version, operating system
• previously visited page (referrer), if transmitted

This processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically error-free operation and delivery of the website and in ensuring system security. This data is not merged with other data sources and is not evaluated for marketing purposes. Log files are deleted after 7 days at the latest, unless they are required to investigate a specific security incident.

4. Hosting

This website is operated on a server of netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany. The provider processes the data mentioned above exclusively on our behalf and according to our instructions. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.

5. Cookies and access to your device

This website does not use cookies. If you choose a language using the language switch, that choice is stored in your browser's local storage so that it is kept for your next visit. This happens only upon your explicit action and is strictly necessary for the function you requested (§ 25(2) no. 2 TDDDG); no consent is required and there is no cookie banner. You can delete the entry at any time in your browser settings.

6. Fonts

The fonts Bricolage Grotesque and Instrument Sans are used. They are loaded exclusively from our own server. No connection to third-party servers, in particular Google Fonts, is established and no data is transmitted to third parties.

7. Contact

If you contact us by email, the information you provide (email address, name, content of the message) is processed solely to handle your request. The legal basis is Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR for contract-related requests. The data is deleted once your request has been fully dealt with and no statutory retention periods apply.

Our email mailboxes are operated by netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany, which processes the data exclusively on our behalf. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.

8. User account and game saves (account service)

A user account can be created for individual games and apps. Accounts are managed by our own account service. The service has no website of its own; it is a technical backend for our apps and runs on the same server in Germany as this website (see section 4).

Registration and login. When you register, your email address, your username and your password are processed; the password is stored exclusively as a cryptographic hash. The legal basis is Art. 6(1)(b) GDPR (performance of the user relationship). An account cannot be created without this information.

Sign in with Google or Apple. Alternatively, sign-in with a Google or Apple account is available. If you choose this option, the respective provider transmits the data required for the login to us (an identifier of your account, your email address and, depending on your settings with the provider, your name). Your Google or Apple password is never transmitted to us. The login is triggered only by your active selection. The provider is independently responsible for the processing that takes place on its side: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, or Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland. This may involve a transfer to the respective parent companies in the USA; Google LLC and Apple Inc. are certified under the EU-US Data Privacy Framework. The provider's privacy policy applies. The legal basis for our processing of the data transmitted to us is Art. 6(1)(b) GDPR.

Transactional emails. Emails sent by the account service (for example to confirm your email address or to reset your password) are delivered via the sending service Lettermint B.V., Willemsvaart 16 B, 8019 AB Zwolle, Netherlands. The provider processes your email address and the content of the message exclusively on our behalf on servers within the EU. A data processing agreement pursuant to Art. 28 GDPR is in place.

Game saves (cloud save). Signed-in users can store game saves across devices. Game saves are stored on our server in Germany and linked to your account (Art. 6(1)(b) GDPR).

Retention. Account data and game saves are kept for as long as the account exists. They are removed when the account is deleted, unless statutory retention obligations require otherwise.

9. Processing in our apps

Our apps for iOS and Android do not contain any third-party components for analytics, crash reporting or advertising (no analytics, tracking or advertising SDKs). The processing of personal data in the apps is limited to communication with our account service as described in section 8, and only if you create an account or sign in. Without signing in, the apps do not transmit any personal data to us.

If advertising is displayed in our games, it is selected and integrated by us. No advertising networks are used, and no data about you is transmitted to advertising partners.

The apps themselves are distributed via the App Store and Google Play. Which data is processed between you and the respective store operator is governed by that operator's privacy policy; we have no influence over it.

10. Links to the games and to app stores

This site links to our games as well as to the App Store (Apple) and Google Play (Google). These connections are established only when you actively click the respective link. Third-party content is not loaded automatically, and your data is not transmitted merely by visiting this site. After the click, the privacy policy of the respective provider applies; this may involve processing in third countries.

11. Recipients and transfers to third countries

Your data is passed on to third parties only where this is permitted by law or necessary for the purposes described. The following processors pursuant to Art. 28 GDPR are used: netcup GmbH (hosting and email mailboxes) and Lettermint B.V. (transactional emails). Our processors operate the infrastructure used for us within the EU/EEA. When emails are delivered, a transfer to the email system you have chosen may take place outside the EU/EEA. Beyond that, transfers to third countries can arise if you deliberately sign in via Google or Apple (section 8). No other transfers of data to countries outside the EU/EEA take place.

12. Your rights

You have the following rights with regard to your personal data:

• right of access (Art. 15 GDPR)
• right to rectification (Art. 16 GDPR)
• right to erasure (Art. 17 GDPR)
• right to restriction of processing (Art. 18 GDPR)
• right to data portability (Art. 20 GDPR)
• right to withdraw consent with effect for the future (Art. 7(3) GDPR)

Right to object under Art. 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(f) GDPR.

Right to lodge a complaint

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart (https://www.baden-wuerttemberg.datenschutz.de).

13. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

14. Changes to this privacy policy

This privacy policy is updated whenever the legal situation or our services change. The version published on this page applies.