WARDOGS PRIVACY POLICY

​This Privacy policy sets out how Bulkhead Limited (“Bulkhead”) collects, uses, stores and shares personal data when you use our website, play our video games and related online services, which we refer to in this policy as our “Games”, and when you otherwise interact with us.

This Privacy Policy is intended to provide information required by the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and, where applicable, the EU General Data Protection Regulation (“EU GDPR”) and other applicable data protection and privacy laws.

Where we refer to “personal data”, we mean information relating to an identified or identifiable individual.

​

Contents

1. Important information and who we are

2. The types of personal data we collect about you

3. How is your personal data collected?

4. How we use your personal data

5. Disclosures of your personal data

6. International transfers

7. Data security

8. Data retention

9. Your legal rights

10. Contact details

11. Complaints

12. Changes to the privacy policy and your duty to inform us of changes

13. Third-party links

 

1. Important information and who we are

​

Privacy policy

​

This Privacy Policy applies to personal data collected through our website and digital platforms, including data you provide when you purchase, access, download, test or play our games, and when you contact us or participate in a playtest, closed beta, competition, survey or promotional activity.

​

Our games may also be made available through third-party platforms (for example FirstLook / Pragma). Those platforms may collect and process personal data under their own privacy policies. Where a third party is responsible for its own processing, you should review its privacy information as well. Applications to take part in our playtests and closed tests, including as an external test partner, are run on a third-party platform. That platform collects and holds the information you give as part of your application, including any date of birth or age used to check that you are eligible, under its own privacy notice, and we receive only the accounts it confirms as eligible.

​

Our Games carry age ratings, which are shown on the store page for each Game. Our website and services are not directed at children under 16. You must be 16 or over to play our Games, unless your parent or legal guardian has consented to your use of them, as set out in our End User Licence Agreement.

​

We recognise that individuals aged 16 and 17 are children under UK data protection law and the ICO Age Appropriate Design Code (Children’s Code). We have therefore designed our services and privacy practices to provide appropriate protections for younger users.

​

We do not knowingly collect personal data from children where applicable law requires parental consent or otherwise prohibits such collection. If you believe that a child has provided us with personal data in circumstances where this should not have happened, please use the contact details section. Where we are informed that a child has provided personal data in circumstances that are not permitted, we will take appropriate steps to investigate and, where necessary, delete that information.

​

Children and Young Players

​

Our Games may be accessed by players who are under the age of 18. We seek to provide age-appropriate protections for younger users. Where we process personal data relating to children, we take account of their particular rights and interests.

We aim to collect only the information reasonably necessary to operate, secure and improve the service. We use privacy-protective settings by default where appropriate and provide information in language intended to be understandable by younger players.

​

Children under 18

​

Please don’t access our Games unless you have your parent or guardian’s consent.

Where your parent or guardian is involved in creating or authorising a child’s access to the service, we may communicate with your parent or guardian regarding your use of the service, privacy rights or account administration where appropriate.

​

Controller

​

Bulkhead Limited is the controller and responsible for your personal data (collectively referred to as “Bulkhead”, “we”, “us” or “our” in this privacy policy). When you play our Games, we make decisions about how and why we use your personal data when you play the game.

​

If you have any questions about this privacy policy, including any requests to exercise your legal rights, please contact us using the information set out in the contact details section.

​

2. The types of personal data we collect about you

​

Personal data means any information about an individual from which that person can be identified. It is also information which can be pieced together with other information to identify you like your age, gender, or the technical IDs given to your phone/laptop (these IDs are sometimes known as “online identifiers”); and the interactions of you and your account in our Games from which it’s possible to work out things about you, such as play time, item acquisition rates, achievements, inventory amounts, avatar characteristics and choices (i.e. “behavioural metrics”). We do not record gameplay but do use a voice service (collectively, the “Gameplay Data”).

​

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

​

• Identity Data includes first name, last name, any previous names, username or similar identifier. For the purposes of playing our Games, this will also include 17-digit SteamID, any aliases, profile information including avatars and in-game display names and the unique identifier we use for you.

• Contact Data includes email address and telephone numbers.

• Transaction Data includes records of purchases made in respect of our Games, such as the entitlement granted to your account and the order reference provided by the store you bought from. Payments themselves are taken by the store, not by us.

• Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, device ID and other technology on the devices you use to access this website and/or play our games. For the purposes of playing our Games, we may also collect and process anti-cheat and security telemetry, including hardware information, a uniquely generated hardware identifier, information about running processes, operating system information, and memory and driver data relating to the running game. We may also collect keyboard and mouse input telemetry captured by our Anybrain anti-cheat software development kit (SDK), and integrity and security telemetry captured by our Zero IT Lab anti-cheat and anti-tampering software during play sessions, as well as in-game text chat, which passes through our servers to the other players in your session and which we keep only where it is included in a player report. Voice chat is provided for us by a third party and is not recorded or stored.

• Profile Data includes your username, purchases or orders made by you, your interests, preferences, feedback and survey responses.

• Usage Data includes information about how you interact with and use our website, products and services.

• Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.

• ​

We also collect, use and share aggregated data such as statistical or demographic data which is not personal data as it does not directly (or indirectly) reveal your identity. For example, we may aggregate individuals’ Usage Data to calculate the percentage of users accessing a specific website feature in order to analyse general trends in how users are interacting with our website to help improve the website and our service offering.

Social Gaming Platforms. When you use third-party social gaming platforms (such as Discord or Twitch) and link your Bulkhead account, we may receive information associated with your account on those platforms.

​

3. How is your personal data collected?

​

We use different methods to collect data from and about you including through:

• Your interactions with us. You may give us your personal data by filling in online forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you:

  • apply for our services, such as being a part of a playtest or closed beta;

  • create an account on our website;

  • subscribe to our service or publications or play any of our games online or offline;

  • request marketing to be sent to you;

  • enter a competition, promotion or survey; or

  • give us feedback or contact us.

• Automated technologies or interactions. As you interact with our website and/or play our Games, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies.

• Third parties or publicly available sources. We do not receive personal data from third parties or public sources.

• Anti-cheat, inappropriate content and fraud prevention. When you use our services, we or third parties may use cookies and similar technologies, collect data about or from your machine or device, which may include a machine “fingerprint” of your machine components, and gather other evidence about your gameplay, machine state, or participation in our services for fraud prevention, security, cheat detection, and authentication purposes. We may also monitor publicly-available information, third-party sites, and/or use anti-cheat technology within our services, including automated anti-fraud and abuse algorithms.

• Technical Data. Analytics providers such as Google, based outside the UK.

 

Children under 18

​

Don’t cheat the system! We use anti-cheat tools to generate indicators and suggest to us if an account should be reviewed for cheating or misuse. A member of our team will always review these reports, but it could lead to you being banned from playing. You can appeal this is you don’t agree.

​

4. How we use your personal data

​

Legal basis

​

Our legal basis for processing your personal information varies depending on the type of information we collect, the context in which we collect it, as well as on your country of residence using your location as determined by your IP address and/or your device registration country. The law requires us to have a legal basis for collecting and using your personal data. We rely on one or more of the following legal bases:

​

• Performance of a contract with you: When it’s necessary to use your personal data to perform a contract with you, or because you have asked us to do something before signing a contract with you that requires the processing of your personal data. In these cases, if you don’t provide your personal data, then we won’t be able to perform the contract or do what you have asked us to do before signing the contract.

• Legitimate interests: We may use your personal data where it is necessary to conduct our business and pursue our legitimate interests, for example to prevent fraud and enable us to give you the best and most secure customer experience. We make sure we consider and balance any potential impact on you and your rights (both positive and negative) before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).

• Legal obligation: We may use your personal data where it is necessary for compliance with a legal obligation that we are subject to. We will identify the relevant legal obligation when we rely on this legal basis.

• Consent: We rely on consent only where we have obtained your active agreement to use your personal data for a specified purpose, for example if you subscribe to an email newsletter.

 

Purposes for which we will use your personal data

​

We have set out below, in a table format, a description of all the ways we plan to use the various categories of your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

​

Purpose:

• Provide and administer our games and online services

• Create and manage accounts

• Operate our Games and maintain gameplay functionality

• Process purchases and transactions

• Provide customer support

• Operate playtests and closed betas

• Improve and develop games and services

• Analytics and performance monitoring

• Security, fraud prevention and anti-cheat

• Communications and service updates

• Direct marketing

• Competitions, promotions and surveys

• Comply with legal and regulatory requirements

• Protect our business and manage corporate transactions

​

Relevant Data:

• Identity, Technical, Usage and Gameplay Data

• Identity and Contact Data

• Identity, Technical, Usage and Gameplay Data

• Transaction and Identity Data

• Identity, Contact, Technical, Transaction and Gameplay Data

• Identity, Contact, Profile, Usage and Gameplay Data

• Technical, Usage, Gameplay and Profile Data

• Technical, Usage and Gameplay Data

• Technical, Gameplay, Identity and Usage Data

• Contact, Identity, Profile and Marketing and Communications Data

•  Identity, Contact, Profile, Usage and Marketing and Communications Data

• Identity, Contact, Transaction and Technical Data

• Identity, Contact and Transaction Data

​

Lawful Basis:

• Contract; legitimate interests where appropriate

• Contract

• Contract; legitimate interests

• Contract; legal obligation where applicable

• Contract and/or legitimate interests, depending on the circumstances

• Contract and/or legitimate interests

• Legitimate interests and, where required, consent

• Legitimate interests and/or consent where required

• Legitimate interests; legal obligation where applicable

• Contract; legal obligation; legitimate interests

• Consent and/or another lawful basis permitted by applicable marketing law

• Consent and/or legitimate interests, depending on the activity

• Legal obligation; legitimate interests

• Legitimate interests; legal obligation where applicable

​​

Gameplay, telemetry and service data

​

When you play our Games or use our online services, we may collect and generate information about your gameplay and interactions with the service. This may include account state, mission times, item acquisition rates, inventory, achievements, ability usage, progression, session information and other gameplay metrics.

We use this information to operate the game, maintain your progress, understand how players use and experience the game, identify and fix bugs, improve performance and compatibility, develop and balance our games, and provide information or feedback about gameplay where appropriate.

​

Anti-cheat, fraud and security

​

We may use anti-cheat and security technologies, including technologies provided by third parties, to protect our games and players. Depending on the technology used, this may involve processing information about your device, hardware, operating system, IP address, processes, drivers, memory, account information and activity associated with the game.

We use this information to detect and investigate cheating, fraud, abuse and other security threats; verify accounts; prevent multiple or abusive account creation; investigate breaches of our terms; maintain network and service security; diagnose technical problems; and protect a fair gaming environment. We also process reports that players make about each other using the reporting feature in our Games, including the account reported, the account reporting, the time, the reason given, and a short extract of the recent text chat from that session (currently up to the last 50 messages) where the game attaches one, in order to investigate what the report describes. Where reports about the same person on one server build up, we may bar that person from that server for a period. We may also use a report, and any extract of text chat attached to it, to deal with misuse of the reporting feature itself, such as deliberately false or coordinated reports.

We will only process such information to the extent reasonably necessary for these purposes and will apply appropriate safeguards to it.

​

Chat and communications

​

Where our Games or another service provide text, voice or other communication features, we may process information necessary to deliver those communications to other users and to operate, secure and moderate the relevant service. This may include your alias, account identifier and the content or metadata associated with communications.

Where communications are public or visible to other players, you should take care not to include personal information that you do not want other players to see.

​

Children under 18

​

Under 18’s – please be aware we may record your voice and chats with other players.

​

Marketing

​

We may send you marketing communications where permitted by applicable law. Where consent is required, we will ask for your consent before sending the relevant communications.

​

Children under 18

​

We do not use children’s personal data for targeted advertising.

You can unsubscribe from marketing communications at any time by using the unsubscribe link in the relevant communication or by contacting us. You will continue to receive essential service communications, such as information about your account, transactions, security or changes to our terms or this Privacy Policy.

We will not sell your personal data. We will only share personal data with another company for that company’s own direct marketing where we have a lawful basis to do so and, where required, your consent.

​

Automated decision making

​

We work with third-party anti-cheat software providers to detect cheating and tampering. We may process your personal data using automated decision-making methods in order to identify users who are cheating by observing and detecting cheating behaviours and users registering for multiple accounts.

​

Where we determine that an account has breached our End User Licence Agreement, we may restrict or ban access to the game. Depending on what we detect, this may include a temporary suspension, a permanent ban of the account, or a ban applied to the device. If this happens you will be told the outcome. Permanent account bans can be appealed to a member of our team, who will review the decision, by emailing appeal@bulkhead.com. Our Security and Enforcement Policy explains which actions can be appealed and how we handle them. Separately, and whatever the type of ban, you can ask us to review a decision that was made about you by contacting us at privacy@bulkhead.com. Our End User Licence Agreement, Security and Enforcement Policy and player safety page are published at wardogs.com/legal.

​

5. Disclosures of your personal data

​

We may share your personal data where necessary with the parties set out below for the purposes set out in the table Purposes for which we will use your personal data above:

• Group companies and affiliated entities, where applicable, for the operation and management of our games and business.

• Playtest and beta-management providers. This currently includes FirstLook / player.gg (Pragma Platform, Inc., Sacramento, California), which collects player account information before players enter the game.

• Hosting and infrastructure providers. AWS is our hosting provider and Pragma provides our backend platform.

• Anti-cheat, fraud-prevention and security providers – Anybrain, S.A. and Zero IT Lab.

• Identity providers. Steam/Valve

• Voice chat providers. Unity Technologies (Vivox).

• Customer support, communications and ticketing providers.

• Analytics providers.

• Payment, transaction and platform providers.

• Marketing, advertising and communications providers, where relevant.

• Professional advisers, auditors, insurers and other service providers where reasonably necessary to operate our business.

• Regulators, law enforcement agencies, courts, government authorities and other third parties where disclosure is required by law or reasonably necessary to protect our rights, users, property or services.

• A buyer, investor or other relevant third party in connection with a proposed or completed merger, acquisition, restructuring, financing, sale or transfer of all or part of our business or assets.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

​

6. International transfers

​

We may transfer your personal data to service providers that carry out certain functions on our behalf. This may involve transferring personal data outside the UK to countries which have laws that do not provide the same level of data protection as the UK law.

Whenever we transfer your personal data out of the UK to service providers, we ensure a similar degree of protection is afforded to it by ensuring that the following safeguards are in place.

Where required, we will ensure that an appropriate transfer mechanism and safeguards are in place before transferring personal data internationally. Depending on the circumstances, this may include an adequacy regulation or decision, the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or another lawful mechanism. Our current providers are located in the United Kingdom, the European Economic Area (including Portugal and Hungary) and the United States.

Further information about relevant international transfers and safeguards can be obtained by contacting us using the contact details.

​

7. Data security

​

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

​

8. Data retention

​

How long will you use my personal data for?

​

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. Much of the Gameplay Data is deleted at the end of the game session or shortly afterwards. Anti-cheat and security telemetry is kept for as long as needed to investigate and act on what it shows. Player reports, including any extract of text chat attached to them, are kept for twelve months from the date of the report. Where we apply a ban to a device, the identifier we use to enforce that ban is held separately from your account and is kept for as long as the ban lasts, including after the account itself has been deleted. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

​

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

​

By law we have to keep basic information about our customers (including Contact, Identity and Transaction Data) for six years after they cease being customers for tax purposes.

​

In some circumstances you can ask us to delete your data: see Your legal rights below for further information.

​

In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

​

How we delete or anonymise data once retention periods expire

​

Our backend platform (Pragma) provides an account deletion function which permanently removes the player’s social identity, links to third-party accounts, links to game identities, and accompanying personal data, after a configurable waiting period (30 days by default); deletion is irreversible. Deleting an account does not lift a ban applied to a device, and the identifier used to enforce that ban is retained as described above.

​

9. Your legal rights

​

You have a number of rights under data protection laws in relation to your personal data.

You have the right to:

​

• Request access to your personal data (commonly known as a “subject access request”/SAR). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us. You can update your account information at any time through our privacy portal at account.wardogs.com.

• Request erasure of your personal data in certain circumstances. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) as the legal basis for that particular use of your data (including carrying out profiling based on our legitimate interests). In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your right to object.

• You also have the absolute right to object any time to the processing of your personal data for direct marketing purposes (see the Marketing section for details of how to object to receiving direct marketing communications).

• Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

• Withdraw consent at any time where we are relying on consent to process your personal data (see the table in section 4 for details of when we rely on your consent as the legal basis for using your data). However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain services to you. We will advise you if this is the case at the time you withdraw your consent.

• Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in one of the following scenarios:

  • If you want us to establish the data’s accuracy;

  • Where our use of the data is unlawful but you do not want us to erase it;

  • Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or

  • You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

 

Children under 18

​

Where location-based or profiling features are available, appropriate privacy protections will be applied for younger users.

If you wish to exercise any of the rights set out above, please contact us using the contact details. You can also make a request through our privacy portal at account.wardogs.com.

​

If you are under 18

​

You can contact us directly about your personal information. You can ask:

• what information we hold about you;

• for incorrect information to be corrected;

• for information to be deleted where applicable;

• for a decision affecting you to be reviewed.

You may also ask a parent, guardian or other trusted adult to help you.

​

No fee usually required

​

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

​

What we may need from you

​

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

​

Time limit to respond

​

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

 

10. Contact details

​

If you have any questions about this privacy policy or about the use of your personal data or you want to exercise your privacy rights, please contact us using the following ways: We have appointed an internal Privacy Lead to oversee our compliance with data protection law, who can be contacted using the email address below.

• Email address: privacy@bulkhead.com

• Privacy portal: account.wardogs.com

• Postal address: Bulkhead Limited, The Tramshed, 19-21 St James’s St, Derby, DE1 1RN

​

11. Complaints

​

You have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). However, before doing so please make sure you have first made your complaint to us or asked us for clarification if there is something you do not understand. The ICO will expect you to have done this before reviewing your complaint. You can raise it with us at privacy@bulkhead.com.

You can also contact the official organisation which regulates personal data in your country (the “regulator”) to lodge a complaint, if you think we are not using your personal data correctly. If you are in the EEA you can find a list of EEA data protection regulators here: Our members | European Data Protection Board

​

12. Changes to the privacy policy and your duty to inform us of changes

​

We keep our privacy policy under regular review. It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us, for example a new address or email address.

​

13. Third-party links

​

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.