Hirozz

Instagram X-twitter

Privacy Policy - HIROZZ

Introduction

With the following data protection declaration, we would like to inform you about the types of your personal data (hereinafter also referred to as « data ») that we process, for what purposes and to what extent. The data protection declaration applies to all processing of personal data carried out by us, both as part of the provision of our mobile game services and, in particular, within our mobile application HIROZZ, on our websites, and within external online presences, such as our social media profiles (hereinafter collectively referred to as « online offer »). The terms used are not gender-specific.

Status: August 6, 2025

Responsible persons

PLETORY
10 rue de la Paix, 75002 Paris

Represented by
Thomas Boulesteix

E-mail address: hello@pletory.com

Processing overview

The following overview summarizes the types of data processed and the purposes of their processing and refers to the data subjects.

Types of data processed

  • Contact details

  • Content data

  • Usage data

  • Meta/communication data

  • Game progress and performance data

  • Device identifiers

Categories of affected persons

  • Communication partner

  • Players

  • App users

Processing purposes

  • Contact requests and communication

  • Security measures

  • Managing and responding to requests

  • Feedback

  • Provision of our mobile game services and user experience

  • Information technology infrastructure

  • Game functionality and progression tracking

  • In-app advertising and monetization

  • We process personal data to send reactivation notifications to players who have been inactive for a certain period, aiming to encourage continued engagement with our game.

Relevant legal bases

The following is an overview of the legal basis of the GDPR based on which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or domicile. Furthermore, should more specific legal bases be relevant in individual cases, we will inform you of these in the data protection declaration.

  • Contractual performance and pre-contractual requests (Art. 6 (1) p. 1 lit. b) GDPR) – Processing is necessary for the performance of a contract to which the data subject is a party or for the performance of pre-contractual measures taken at the data subject’s request.

  • Legitimate interests (Art. 6 (1) p. 1 lit. f) GDPR) – Processing is necessary for the legitimate interests of the controller or a third party unless such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data.

In addition to the data protection regulations of the General Data Protection Regulation, national regulations on data protection apply in France. The processing of personal data for sending reactivation notifications is based on our legitimate interest in maintaining player engagement and providing relevant information about our game services, as per Article 6(1)(f) GDPR.

Security measures

We take appropriate technical and organizational measures by the legal requirements, taking into account the state of the art, the implementation costs, and the nature, scope, circumstances, and purposes of the processing, as well as the different probabilities of occurrence and the extent of the threat to the rights and freedoms of natural persons, to ensure a level of protection appropriate to the risk.

The measures include, in particular, safeguarding the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data as well as access to, the input of, disclosure of, assurance of availability of, and segregation of the data. Furthermore, we have established procedures to ensure the exercise of data subjects’ rights, the deletion of data, and responses to data compromise. Furthermore, we already take the protection of personal data into account during the development or selection of hardware, and software as well as procedures following the principle of data protection, through technology design and data protection-friendly default settings.

TLS encryption (https): To protect your data transmitted via our online services, we use TLS encryption. You can recognize such encrypted connections by the prefix https:// in the address bar of your browser when visiting our website.

Transmission of personal data

In the course of our processing of personal data, it may happen that the data is transferred to or disclosed to other bodies, companies, legally independent organizational units or persons. The recipients of this data may include, for example, service providers commissioned with IT tasks, game analytics providers, advertising networks, or providers of services and content that are integrated into our mobile application. In such cases, we comply with the legal requirements and, in particular, conclude appropriate contracts or agreements that serve to protect your data with the recipients of your data.

Data processing in third countries

If we process data in a third country (i.e., outside the European Union (EU), the European Economic Area (EEA)) or the processing takes place in the context of the use of third-party services or the disclosure or transfer of data to other persons, entities or companies, this is only done following the legal requirements.

Subject to express consent or contractually or legally required transfer, we only process or allow the processing of data in third countries with a recognized level of data protection, contractual obligation through so-called standard protection clauses of the EU Commission, in the presence of certifications or binding internal data protection regulations (Art. 44 to 49 GDPR, information page of the EU Commission: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_en).

Compliance with the Children’s Online Privacy Protection Act (COPPA)

Our Company is committed to protecting the privacy of children who use our game services. In compliance with the Children’s Online Privacy Protection Act (COPPA), we do not knowingly collect, use, or disclose personal information from children under the age of 13 without obtaining prior verifiable consent from their parents or guardians. We have implemented an age-verification mechanism to identify users under 13 and ensure appropriate consent is obtained before collecting any personal information. If you are a parent or guardian and believe that your child under 13 has provided us with personal information without your consent, please contact us immediately. We will take steps to promptly remove such information from our records and cease any further collection or use of your child’s information. Our full privacy practices regarding children, including how we collect, use, and disclose their personal information, how parents can review and request deletion of their child’s information, and our contact information for privacy inquiries, are detailed in this Privacy Policy.

Compliance with the General Data Protection Regulation (GDPR) for Children’s Data

In accordance with the General Data Protection Regulation (GDPR), our Company is dedicated to protecting the privacy and personal data of users within the European Union, especially children under the age of 16 (or a lower age if permitted by the law of the member state). We recognize the importance of providing additional protection for children who engage with our game services.

Therefore, we do not intentionally collect personal data from children under the age of 16 without obtaining prior consent from their parents or legal guardians. When processing the personal data of children, we adhere strictly to the requirements of the GDPR, ensuring that all data collection, storage, and processing practices are designed with the child’s best interest in mind.

For services directed towards children under the age of 16 (or the applicable age of consent in the member state), we will take additional steps to verify parental consent, in accordance with GDPR requirements. If you are a parent or guardian and are aware that your child has provided us with personal information without your consent, please contact us immediately. We are committed to promptly addressing such concerns, including the removal of any inadvertently collected personal data and the cessation of any further processing.

California Consumer Privacy Act (CCPA) Notice

At PLETORY, we respect and protect the privacy of our users. This section of our Privacy Policy is dedicated to California residents and applies to them under the California Consumer Privacy Act (CCPA). If you are a resident of California, the following rights are available to you in relation to your personal information:

Right to Know and Access
 You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Upon verification of your request, we will provide you with access to the specific pieces of personal information we have collected about you.

Right to Deletion
 You have the right to request the deletion of your personal information that we have collected from you, subject to certain exceptions as provided by law.

Right to Opt-Out of Sale
 PLETORY does not sell any personal information.

Right to Non-Discrimination
 You have the right not to receive discriminatory treatment for exercising any of your CCPA rights. We will not deny you goods or services, charge you different prices, or provide a different level or quality of goods or services just because you exercised your rights under the CCPA.

How to Exercise Your Rights
 To exercise any of your rights under the CCPA, please submit a verifiable consumer request to us by:
 Emailing us at: hello@pletory.com

Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your personal information. You may only make a verifiable consumer request for access or data portability twice within a 12-month period.

You have the right to object at any time to the processing of your personal data for direct marketing purposes, including reactivation notifications. If you object, we will no longer process your personal data for such purposes.

Changes to Our Privacy Notice

PLETORY reserves the right to amend this privacy notice at our discretion and at any time. When we make changes to this privacy notice, we will post the updated notice on our website and within our mobile application, and update the notice’s effective date.

Transparency and Consent Framework (TCF) Version 2

TCF Version 2 Compliance
 PLETORY aligns with the IAB Europe’s Transparency and Consent Framework Version 2. This ensures that we conduct our digital advertising practices with transparency and respect for your privacy choices. As part of our commitment, you have the right to:

  • Receive transparent information regarding the collection and use of your personal data for advertising purposes.

  • Provide or withdraw consent for the processing of your personal data based on your personal preferences.

  • Obtain information about the third-party vendors we partner with and the data they collect for advertising.

We are dedicated to providing you control over your personal data within our advertising ecosystem. For more information or to manage your preferences, please contact us at hello@pletory.com.

Virginia Consumer Data Protection Act (VCDPA)

VCDPA Compliance
 PLETORY acknowledges the rights of Virginia residents as outlined in the Virginia Consumer Data Protection Act (VCDPA). You possess the right to:

  • Confirm whether or not we are processing your personal data.

  • Access and obtain a copy of your personal data.

  • Correct inaccuracies in your personal data.

  • Delete personal data provided by or obtained about you.

  • Data portability, allowing you to obtain your data in a portable and, to the extent technically feasible, readily usable format.

  • Opt out of processing of personal data for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects on you.

PLETORY ensures adherence to the VCDPA and will not discriminate against you for exercising any of your rights under the Act. For inquiries, please reach out to hello@pletory.com.

Connecticut Data Privacy Act (CTDPA)

CTDPA Compliance
 In compliance with the Connecticut Data Privacy Act (CTDPA), PLETORY respects the privacy rights of Connecticut residents. Under the CTDPA, you are entitled to:

  • Access personal data we hold about you.

  • Correct inaccuracies in your personal data.

  • Delete personal data that you have provided to us.

  • Restrict the processing of your personal data.

  • Obtain a copy of your personal data in a format that is portable and usable.

We adhere strictly to the provisions of the CTDPA and do not engage in any discriminatory practices based on the exercise of these rights. Please direct any requests or concerns to hello@pletory.com.

Utah Consumer Privacy Act (UCPA)

UCPA Compliance
 PLETORY is committed to protecting the privacy of our users in Utah in accordance with the Utah Consumer Privacy Act (UCPA). If you are a Utah resident, you have the right to:

  • Access personal data we hold about you.

  • Request deletion of your personal data.

  • Opt out of the processing of your personal data for purposes of targeted advertising or sale.

  • Obtain a copy of your personal data in a format that can be easily used and shared with others.

We do not discriminate against users who exercise their UCPA rights. For any UCPA related requests or questions, please contact us at hello@pletory.com.

Data deletion

The data processed by us will be deleted following the legal requirements as soon as their consents permitted for processing are revoked or other permissions cease to apply (e.g. if the purpose of processing this data has ceased to apply or it is not required for the purpose). If the data are not deleted because they are required for other and legally permissible purposes, their processing will be limited to these purposes. That is, the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for reasons of commercial or tax law or whose storage is necessary for the assertion, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person. Our data protection notices may also contain further details on the retention and deletion of data, which have priority for the respective processing operations.

Provision of the mobile game service and hosting

We process the users’ data in order to provide them with our mobile game services. For this purpose, we process the user’s device identifiers, game progress data, and usage patterns, which are necessary to deliver the game content and functions to the user’s mobile device.

Types of data processed: Usage data (e.g. game levels completed, time spent playing, in-game purchases); meta/communication data (e.g. device information, IP addresses, device identifiers).
 Data subjects: Players (e.g., mobile game users, registered players).
 Purposes of processing: Provision of our mobile game services and user experience; information technology infrastructure (operation and provision of game servers and technical equipment); security measures; game progress tracking and synchronization.
 Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) GDPR).

Further notes on processing processes, procedures and services:

  • Provision of mobile game service on cloud infrastructure: For the provision of our mobile game service, we use cloud storage, computing capacity and software that we rent or otherwise obtain from corresponding server providers; Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) GDPR).

  • Collection of usage data and game analytics: Access to our mobile game service is logged for analytics purposes. This may include game progression data, player behavior patterns, device information, session duration, and technical performance metrics. This data is used to improve game performance, fix bugs, and enhance user experience; Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) GDPR); Deletion of data: Analytics information is stored for a maximum of 24 months and then deleted or anonymized.

Contact and request management

Types of data processed: Contact data (e.g. e-mail, in-game usernames); Content data (e.g. support requests, feedback messages); Usage data (e.g. game activities, technical issues); Meta/communication data (e.g. device information, game version).
 Data subjects: Communication partners, players.
 Purposes of processing: Contact requests and communication; managing and responding to support requests; feedback collection; providing customer support for our mobile game service.
 Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) GDPR); Contract performance and pre-contractual requests (Art. 6 para. 1 p. 1 lit. b) GDPR).

Further notes on processing processes, procedures and services:

  • In-game support and contact systems: If players contact us via our in-game support system, e-mail or other communication channels, we process the data communicated to us in this context to process the support request; Legal basis: Contract performance and pre-contractual requests (Art. 6 para. 1 p. 1 lit. b) GDPR), Legitimate interests (Art. 6 para. 1 p. 1 lit. f) GDPR).

In-App Advertising

At PLETORY, we are dedicated to maintaining your trust and transparency. This section of our Privacy Policy provides detailed information about how we handle personal data in relation to the in-app advertising you may see within our mobile game HIROZZ.

Collection and Use of Data for Advertising Purposes
 Our game displays advertisements to support our services and enhance your gaming experience. To make the ads more relevant to you, we may collect and use certain information about your activities within our game, including but not limited to:

  • Device identifiers and technical information about your device (such as model, operating system version, and IP address);

  • Information about your interactions with the ads (such as click-throughs and time spent viewing an ad);

  • Information about your gameplay patterns, preferences, and geographic location;

  • Game progression and in-app purchase history.

This data helps us and our advertising partners deliver ads that are more tailored to your interests and gaming preferences.

Sharing of Information with Third-Party Advertisers
 To facilitate in-app advertising, we may share the collected data with trusted third-party advertising partners. These partners may use this information to:

  • Display targeted ads within our game or in other apps;

  • Measure the effectiveness of ads;

  • Conduct analysis and research to improve advertising strategies.

We require all third-party advertisers to respect the privacy of our users and to comply with all applicable data protection laws and regulations.

Your Choices and Control
 You have control over your personal information and how it is used in relation to in-app advertising:

  • Ad Preferences: You can adjust your ad preferences through the settings within our game, where applicable, to limit the type of data that can be collected and used for advertising purposes.

  • Opt-Out: You can opt out of targeted advertising by adjusting the privacy settings on your device. Please refer to your device’s documentation for instructions on how to limit ad tracking.

Please note that opting out of targeted advertising does not mean you will no longer receive advertising; it simply means that the ads you see may not be as closely aligned with your gaming interests.

Changes to Our Advertising Practices
 PLETORY reserves the right to modify our in-app advertising practices at any time. Should there be any changes, we will update this section of our Privacy Policy and provide you with notice as required by law.

For more information about our data collection and use practices, please review the rest of our Privacy Policy. If you have any questions about our in-app advertising practices, please contact us at hello@pletory.com.

Game Data and Analytics

Collection of Game Performance Data
 We collect various types of data related to your gameplay to improve our game services and provide you with a better gaming experience:

  • Game progression and achievements

  • In-game purchases and virtual currency transactions

  • Technical performance data (frame rates, loading times, crashes)

  • Player behavior patterns and preferences

  • Social features usage (if applicable)

Purpose of Game Analytics
 This data is used to:

  • Optimize game performance and fix technical issues

  • Balance game difficulty and progression

  • Develop new features and content

  • Provide personalized gaming experiences

  • Prevent fraud and ensure fair play

Modification and update of the privacy policy

We ask you to regularly inform yourself about the content of our privacy policy. We adapt the data protection declaration as soon as the changes in the data processing carried out by us make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g. consent) or other individual notification.

If we provide addresses and contact information of companies and organizations in this privacy statement, please note that the addresses may change over time and please check the information before contacting us.

Rights of the data subjects

As a data subject, you are entitled to various rights under the GDPR, which arise in particular from Art. 15 to 21 GDPR:

Right of objection: you have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. If the personal data concerning you is processed for direct marketing, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling insofar as it is related to such direct marketing.

  • Right to revoke consent: You have the right to revoke any consent given at any time.

  • Right of access: You have the right to request confirmation as to whether the data in question is being processed and to obtain information about such data, as well as further information and a copy of the data by the law.

  • Right to rectification: You have the right, following the law, to request that data concerning you be completed or that inaccurate data concerning you be rectified.

  • Right to erasure and restriction of processing: You have the right, per the law, to request that data concerning you be erased without delay, or by the law, to request the restriction of the processing of the data.

  • Right to data portability: You have the right to receive data relating to you that you have provided to us in a structured, common, and machine-readable format, or to request that it be transferred to another controller, by the law.

  • Complaint to a supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to complain with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the requirements of the GDPR.

Definitions of terms

This section provides you with an overview of the terms used in this privacy policy. Many of the terms are taken from the law and defined primarily in Art. 4 of the GDPR. The legal definitions are binding. The following explanations, on the other hand, are primarily intended to aid understanding. The terms are sorted alphabetically.

  • Personal data: « Personal data » means any information relating to an identified or identifiable natural person (hereinafter « data subject »); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. device ID) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

  • Controller: « Controller » means the natural or legal person, public authority, agency or other body which alone or jointly with others determines the purposes and means of the processing of personal data.

  • Processing: « Processing » means any operation or set of operations which is performed upon personal data, whether or not by automatic means. The term is broad and includes virtually any handling of data, whether collecting, evaluating, storing, transmitting or erasing.

Contact Information
 If you have any questions about this Privacy Policy or our data processing practices, please contact us at:

PLETORY
 10 rue de la Paix, 75002 Paris
 Email: hello@pletory.com
 Representative: Thomas Boulesteix