1. Controller
The controller for this website is Adreama d.o.o., Ulica Gustava Krkleca 55, 42202 Trnovec, Croatia.
For privacy requests, email office@adreama.hr. For customer support, email support@machinaarcana.com.
2. Personal data we collect
Website visits and security logs
When you visit the site, our hosting and application systems may process technical data such as IP address, browser and device information, requested URLs, referrer, timestamps, error messages, and security events.
Analytics and marketing technologies
Marketing pages may use Google Tag Manager, Google Analytics, and Meta Pixel. These services may process page views, events, device and browser information, approximate location, referrer, online identifiers, and cookie or pixel identifiers.
Analytics and marketing technologies are not necessary for the basic operation of the website. Where consent is required by law, these technologies should only be used with valid consent.
Accounts and Adreama Forge
If you create or use an account, we may process account identifiers, email address or username, password hashes, PHP session data, CSRF/security data, and account activity.
Forge/player features may process your owned boxes or collection, created sessions, selected scenarios and duration variants, selected machinations, selected or earned achievements, achievement progress, and personal session history.
User submissions
If public comments, replies, card issue reports, session reports, or similar features are available, we process the text you submit, related account or display information, timestamps, moderation status, and technical anti-abuse data.
Support, campaign, and fulfillment data
If you contact us by email, Gamefound, or another support channel, we process the information needed to answer you and handle your request. Current purchases are completed through external platforms such as Gamefound. Adreama d.o.o. may receive and process exported order or backer data for invoicing, VAT/OSS, logistics, support, and fulfillment.
Newsletter
If a newsletter is offered and you subscribe, we process your email address, subscription status, consent records, and email delivery or engagement data needed to operate the mailing list. You can unsubscribe from marketing emails at any time.
3. Why we use personal data
- To operate, secure, maintain, and improve the website, Card Database, and Forge.
- To provide account features, sessions, achievements, collections, comments, reports, and admin tools.
- To respond to support, legal, privacy, and customer requests.
- To process campaign/order exports for invoicing, tax, logistics, fulfillment, warranty, and customer support.
- To send newsletters or campaign updates where you subscribed or where the law otherwise permits it.
- To measure site performance and campaign effectiveness, where analytics or marketing tools are enabled lawfully.
- To prevent fraud, abuse, spam, security incidents, and misuse of the site.
- To comply with accounting, tax, consumer, product safety, and other legal obligations.
4. Legal bases
Depending on the context, we process personal data on these legal bases:
- Contract or steps before contract: accounts, Forge features, support, product fulfillment, and customer service.
- Legal obligation: accounting, tax, VAT/OSS, product, consumer, and regulatory obligations.
- Legitimate interests: site security, service improvement, abuse prevention, basic operational logs, support history, and moderation.
- Consent: newsletters and optional analytics or marketing technologies where consent is required.
7. International transfers
Some providers or partners may process data outside the European Economic Area, including in the United States. Where required, we rely on an adequacy decision, Standard Contractual Clauses, or another lawful transfer mechanism.
8. Retention
We keep personal data only for as long as needed for the relevant purpose, including legal, accounting, tax, warranty, consumer, security, and dispute-resolution needs.
- Technical logs are normally kept for a limited operational/security period, unless needed longer for investigation or legal reasons.
- Account and Forge data are kept while the account is active or as needed to provide the service, unless deletion is requested and no legal reason requires retention.
- Public comments, reports, and other submissions may remain visible until removed, moderated, or deleted according to account and moderation rules.
- Order, invoice, tax, fulfillment, and support records are kept for the periods required or permitted by applicable law.
- Newsletter data is kept until you unsubscribe or we stop operating the list, with suppression records retained where needed to respect opt-outs.
9. Your rights
Subject to legal conditions and limits, you may have the right to request access, correction, deletion, restriction, portability, objection to processing, and withdrawal of consent.
You can exercise these rights by emailing office@adreama.hr. You also have the right to lodge a complaint with a data protection authority. In Croatia, the supervisory authority is the Croatian Personal Data Protection Agency (AZOP): https://azop.hr/.
10. Children
The website is not directed to children. We do not knowingly collect personal data from children without appropriate consent or another lawful basis. If you believe a child provided personal data to us improperly, contact us so we can review it.
11. Changes
We may update this notice when the website, Forge, Card Database, providers, or legal requirements change. The updated version will be posted on this page with a new date.