Who is responsible for your data?

The website eldoria.unsolved-games.com (the "Submission Website") lets you take part in the Gold & Crystal contest (the "Contest") and submit your Submissions. It is published by UNSOLVED SAS, 1 rue Marguerin, 75014 Paris, France, Paris Trade and Companies Register no. 912 025 145 (the "Sponsor"), which is the controller of your personal data.

For any question about your data: contact+goldandcrystal@unsolvedhunts.com.

This policy supplements Section 16 of the Official Rules. Purchases made on the www.goldandcrystal.com store are covered by that store's privacy policy.

What data do we collect?

• Your account: first name, last name, email address, password (stored only in hashed form, unreadable even to us), display language, and the purchase or access code used to register (for a purchase, it contains your order number).
• Your Submissions: the coordinates and, where applicable, the text you submit, with the date and time our servers received them. They are encrypted in your browser before being sent.
• Technical data: IP address, browser and device type, date and time of your logins.
• Your correspondence with us, if you write to us.

If your Submission is validated, the Sponsor will ask you, outside this website, for the supporting documents required by the Official Rules (official photo ID, image release, tax forms where applicable).

We do not collect any sensitive data and do not use your data for advertising.

Why, and on what legal basis?

• Managing your registration and participation: checking your purchase code, ensuring one entry per person, giving you access to the file. Basis: performance of the Official Rules you accepted.
• Receiving, timestamping and validating your Submissions, determining the winner and awarding prizes. Basis: performance of the Official Rules.
• Sending you the emails the service requires (welcome, password reset). Basis: performance of the Official Rules.
• Securing the website and preventing fraud: limiting login attempts, detecting multiple accounts, keeping a login log. Basis: our legitimate interest in a fair and secure Contest.
• Measuring traffic anonymously and fixing technical errors. Basis: our legitimate interest in running the website.
• Complying with our legal obligations and defending our rights in the event of a dispute. Basis: our legal obligations and our legitimate interest.

Who has access to your data?

Your data is accessible only to authorized members of the Sponsor's team. Submissions can only be decrypted with a private key that is not stored on our servers: the Sponsor or its designated representative decrypts them solely to validate them.

We use the following service providers, who act on our instructions:

• Hostinger: hosting of the website and its database, on servers located in France.
• Cloudflare, Inc. (United States): routing and protection of the website's traffic.
• Google (Google Workspace): sending the website's emails.
• Functional Software, Inc. — Sentry (United States, data stored in the European Union): detection of technical errors, without IP addresses or cookies.
• Shopify: checking your order number when you register.

Traffic measurement uses Umami, a tool hosted by the Sponsor itself, without cookies and without storing your IP address: no data is passed on to third parties.

Where applicable, your data may be disclosed to the judicial officer with whom the Official Rules were filed (SCP Grassin & Associés) for oversight of the Contest, and to authorities where required by law. We do not sell or rent your data.

Transfers outside the European Union

Some providers (Cloudflare, Google, Sentry) are US companies. Any transfers of data to the United States are governed by the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.

How long do we keep your data?

• Account and Submissions: for the entire duration of the Contest, then archived with restricted access for 5 years after it closes (limitation period), before deletion. Submissions and their timestamps serve as evidence in the event of a dispute.
• Login log (IP address, browser): 12 months, then automatically deleted.
• Login sessions: deleted when they expire.
• Anti-abuse counters: 1 hour at most.
• Technical error reports: 90 days at most.
• Correspondence with us: as long as needed to handle your request, and at most until the Contest closes.
• Winner's supporting documents: as long as required by our legal obligations, in particular accounting and tax obligations.

Your rights

Under the GDPR and the French Data Protection Act, you may at any time access your data, have it corrected or erased, request restriction of its processing, object to processing based on our legitimate interest, and receive the data you provided to us in a readable format (portability). You may also set instructions regarding your data after your death.

To exercise these rights, write to contact+goldandcrystal@unsolvedhunts.com from your account's email address. We reply within one month. If we have reasonable doubts about your identity, we may ask you for proof of identity.

Deleting your account ends your participation: you can no longer sign in and your password is erased. Your first and last name, email address, purchase code, Submissions and their timestamps are kept in an archive with restricted access until 5 years after the Contest closes (limitation period), then erased. They are used only to prove who took part and when, in the event of a dispute or fraud, and to defend our rights.

If you believe your rights have not been respected, you may lodge a complaint with the CNIL (www.cnil.fr), the French data protection authority, or with the data protection authority of your country.

Cookies

The website only uses cookies that are strictly necessary for it to work: the session cookie that keeps you logged in and a display preference cookie. No advertising or analytics cookies are set, so your consent is not required.

Security

The website is only accessible over HTTPS. Passwords are hashed, Submissions are encrypted in your browser with a key whose private part is kept off our servers, login attempts are limited, and administrative access is restricted to the team and logged.

Minors

The Contest is open only to people who have reached the age of majority in their country of residence. We do not knowingly collect data about minors.

Changes

This policy may change, in particular if we change service providers. The date of the last update is shown at the top of this page.