Privacy Policy

1. Introduction & Data Controller

This Privacy Policy governs the collection, processing, and protection of personal data by Cosmo Fame Limited (operating the CosmoDraft platform at gameofworld.xyz), incorporated under the laws of Hong Kong SAR, having its registered office at 2/F WEST WING, 821 LAI CHI KOK RD, Cheung Sha Wan, Hong Kong. In accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA, S.C. 2000, c. 5), the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), and the Personal Data (Privacy) Ordinance (PDPO, Cap. 486), we are committed to transparent, fair, and secure data practices. If you have questions, please reach our Data Protection Officer at support@gameofworld.xyz.

2. Categories of Data We Collect

CosmoDraft processes data strictly necessary to deliver free fantasy sports gameplay, analytics, and platform reliability:

• Account Credentials: Display name, email address, salted password hash, and preferred language (EN/FR).
• Gameplay & Squad Telemetry: Fantasy rosters, squad formations, transfer records, Power Chip activations, and match simulation logs.
• Technical Diagnostics: Anonymised IP addresses (truncated after 7 days), browser user-agent, device viewport dimensions, and crash diagnostics.
• Support Records: Communications, feedback, and timestamped resolution histories submitted via our contact channels.
• Explicitly Excluded Data: We never collect, store, or process payment card numbers, bank account credentials, government identity documents, or biometric identifiers.

3. Legal Bases and Processing Purposes

We process your data under the following lawful grounds:

• Contractual Performance (GDPR Art. 6(1)(b)): To initialize and host matchday simulations, manage leaderboard scores, and maintain squad states.
• Legitimate Interests (GDPR Art. 6(1)(f)): To detect multi-accounting, prevent automated scraping, optimize network latency, and safeguard infrastructure.
• Explicit Consent (PIPEDA Principle 4.3 & GDPR Art. 6(1)(a)): For optional browser cookie tracking, telemetry analytics, and direct communications.
• Statutory Compliance (GDPR Art. 6(1)(c)): To maintain audit trails and satisfy regulatory reporting obligations.

4. PIPEDA & Canadian Privacy Rights

In full adherence to Canada's 10 Fair Information Principles under PIPEDA Schedule 1:

• Principle 4.1 (Accountability): Cosmo Fame Limited designates a privacy compliance lead responsible for overarching governance.
• Principle 4.2 (Identifying Purposes): Purposes are stated at or prior to the point of information capture.
• Principle 4.3 (Consent): Clear, affirmative consent is required before processing non-essential data.
• Principle 4.4 & 4.5 (Limiting Collection, Use, Disclosure & Retention): Data is purged once the operational necessity has elapsed.
• Principle 4.9 (Individual Access): Canadian residents may request a portable, machine-readable export of their stored profile within 30 calendar days at zero fee.

5. GDPR & Cross-Border Data Transfers

For individuals accessing CosmoDraft from the European Economic Area or United Kingdom, personal data may be transferred to and maintained on cloud servers located in Canada and Hong Kong SAR. All international data transfers are safeguarded under European Commission Standard Contractual Clauses (SCCs 2021/914) and rigorous Data Processing Agreements (DPAs) with infrastructure providers.

6. Third-Party Disclosures & Non-Sale Guarantee

We uphold a strict Zero-Sale Policy. We do not sell, rent, lease, or monetize your personal information to data brokers, ad exchanges, or marketing conglomerates. Disclosures occur solely with vetted infrastructure partners:

• Edge Content Delivery: Cloudflare Inc. (TLS termination, DDoS mitigation, Web Application Firewall).
• Sports Analytics: Stats Perform / Opta (live match feeds — processed on an anonymised identifier basis).
• Statutory Mandates: Law enforcement or judicial authorities only upon service of a legally binding subpoena or court warrant.

7. Data Retention & Account Deletion

Active account records are preserved for the lifespan of the account plus 12 months for disaster recovery. Server access logs are anonymised after 90 days. To exercise your Right to Erasure, send an email to support@gameofworld.xyz with the subject "Account Deletion Request". All associated profile data, leaderboard entries, and identifiers will be permanently destroyed within 30 days pursuant to PIPEDA Principle 4.5 and GDPR Article 17.

8. Technical & Organisational Security Measures

We implement bank-grade security protocols: 256-bit TLS 1.3 encryption in transit, AES-256 encrypted database volumes at rest, strict role-based access control (RBAC), and automated intrusion detection. In the unlikely event of a security breach involving personal data, affected users and relevant supervisory authorities will be notified within 72 hours in compliance with GDPR Article 33.

9. Age Eligibility (18+ Policy)

CosmoDraft is designed exclusively for persons 18 years of age or older (or the age of majority in your jurisdiction). We do not knowingly solicit, collect, or process information from minors. Accounts discovered to belong to underage users are terminated immediately.

10. Cookies & Consent Management

Our website utilizes strictly necessary cookies and optional performance metrics. For granular details regarding cookie lifetimes, purpose categories, and opt-out controls, please consult our Cookie Policy.

11. Amendments & Notifications

We may update this Privacy Policy periodically. Substantial changes will be highlighted via site notices 14 days prior to implementation. Ongoing use of CosmoDraft confirms agreement to updated terms. For inquiries: support@gameofworld.xyz.