Privacy Policy.

Privacy Policy for Shuttle 11

Effective as of July 16 2025

Who We Are

This Privacy Policy explains how Bear Cave SRL collects, uses, stores, discloses, transfers and protects the personal data of users who access and participate in Shuttle 11(“the Game”), which is operated via the Telegram platform.  We are committed to protecting your (“you”, “your”, “player”) privacy and complying with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and Romanian national data protection laws.

This Privacy Policy applies to Shuttle 11, operated under the Secret Arcade Society label and managed by Bear Cave SRL (“Secret Arcade Society”, "we", "us", or "our"), a company incorporated under Romanian law with its registered office at Strada Teleajen 33, Bucharest, Romania, registered under Company Registration Number and VAT ID RO45559860.

Bear Cave SRL is the data controller responsible for processing your personal data in relation to your use of the Game.

By accessing or playing the Game, you agree to the collection and processing of your personal data in accordance with this Privacy Policy. If you do not want Bear Cave SRL to collect, use, disclose, or transfer your information in the ways described in this Privacy Policy, you may not be able to play Shuttle 11.

What Data We Process and How We Use It

When you use the Game, we process certain personal data needed to operate the service, ensure fair play, process purchases, comply with legal obligations, and deliver prizes. Specifically, we may collect:

• Telegram user data: your Telegram user ID, username, and public profile data to identify your gameplay account.
  
  

• Gameplay data: your level completions, scores, leaderboard position, and session activity, to manage your game experience and detect cheating or abuse.
  
  

• TON wallet and transaction data: wallet addresses you connect for purchases or prizes, plus transaction timestamps and values recorded on the blockchain, used to process your purchases and distribute rewards.
  
  

• Country of residence data: provided by you during registration or purchase, to determine eligibility, apply local VAT rules. Supplying false information may result in suspension or termination of your account.
  
  

• IP-based location data: used together with your declared country to determine applicable VAT or other indirect tax obligations under EU law (including Article 24f of Regulation (EU) 282/2011).
  
  

• Prize winner data: if you win a prize, we will process your full legal name, date of birth, country of residence, and confirmation that your TON wallet is accessible via Telegram.
  
  

• Tax records and invoices: we keep electronic records of your purchases, including applicable VAT. Invoices may be sent via Telegram message or another electronic channel you provide. By using the Services, you consent to receive invoices electronically.
  
  

We process this data to:

• Operate the Game, maintain leaderboards, and provide customer support.
  
  

• Process in-game TON purchases and manage your lives or other inventory.
  
  

• Verify fair gameplay and detect fraud, bots, or other abuse.
  
  

• Determine tax obligations and issue VAT-compliant invoices under EU law.
  
  

We do not process unnecessary personal data and will never process your data for unrelated purposes, nor sell or rent your data to third parties.

Categories of Data, Purposes, and Legal Bases

Data Retention

We retain personal data only as long as necessary for the purposes described in this Policy, or as required by applicable law. Specifically:

• Gameplay and leaderboard data: retained for up to twelve (12) months following the end of the competition period, then deleted or anonymized.
  
  

• Verification data: retained for up to five (5) years after the end of the fiscal year in which the prize was awarded, to comply with EU and Romanian accounting regulations.
  
  

• Location and country data for VAT compliance: stored for ten (10) years from the date of each transaction, to comply with EU and Romanian tax regulations.
  
  

If data is not subject to a specific legal retention requirement, we keep it only as long as necessary to fulfill the purposes for which it was processed, after which it is securely deleted or anonymized.

In certain cases, we may be required to retain data longer than these standard periods to resolve disputes, enforce our agreements, or comply with investigations or requests from regulators or law enforcement authorities. In such instances, the data will be kept securely and used only for these purposes until the matter is concluded.

How We Share Your Data

We may share your personal data with specific categories of recipients where necessary to operate the Game, comply with legal obligations, or protect our legitimate interests. This includes:

• Technical and operational service providers: who help us operate, maintain, and support the Game, such as hosting providers, payment processors, TON wallet integrations,.
  
  

• Auditors, accountants, and legal advisors: who assist us with financial, tax, compliance, or legal requirements.
  
  

• Administrative or judicial authorities: when we are required by law to disclose data for institutional purposes, such as investigations, detection and prosecution of crimes, prevention or safeguarding against threats to public security, or to enable Bear Cave SRL to establish, exercise, or defend legal claims, or protect the rights and freedoms of others.
  
  

• Potential buyers, investors, or successor entities: in connection with a restructuring, acquisition, financing, merger, sale of assets, or other similar transaction involving Bear Cave SRL, including in the event of insolvency or bankruptcy, where personal data may be transferred as part of our business assets.
  
  

Additionally, your Telegram username and game score may be displayed on public leaderboards and used to announce winners or competition results. If you win a prize, we may also contact you directly via Telegram to confirm your status,, and arrange prize delivery.

We do not sell or rent your personal data to any third parties and do not share it for marketing purposes.
All service providers and partners are contractually required to handle your data securely and only in accordance with applicable data protection laws.

Data Transfers

Your personal data may also be transferred to or processed in countries outside your country of residence or outside the European Economic Area (EEA). These countries may have different data protection standards from those in your jurisdiction.

Whenever we transfer data to third parties or service providers located outside the EEA, we ensure that appropriate safeguards are in place to protect your personal data, such as the use of the European Commission’s standard contractual clauses (SCCs) or other legally accepted mechanisms.

A list of countries outside the EEA to which we may transfer your personal data is available upon request by contacting us using the details provided in this Privacy Policy.

Your Rights Under GDPR

Under the General Data Protection Regulation (GDPR), you have a number of rights relating to your personal data, which may be exercised at any time and free of charge, as provided below: 

• Right to information – Art. 13, 14 GDPR: To be informed about the purposes and means of the processing of your personal data.
  
  

• Right of access – Art. 15 GDPR: To obtain confirmation as to whether or not personal data concerning you is being processed, and to request a copy of the personal data we hold about you.
  
  

• Right to rectification – Art. 16 GDPR: To request that we update or correct the personal data we hold about you. We may need to verify the accuracy of any new data you provide.
  
  

• Right to erasure (‘right to be forgotten’) – Art. 17 GDPR: To request the erasure of your personal data, subject to conditions specified in Article 17 GDPR.
  
  

• Right to restriction of processing – Art. 18 GDPR: To request that we restrict the processing of your personal data under certain circumstances.
  
  

• Right to data portability – Art. 20 GDPR: To receive your personal data in a structured, commonly used, machine-readable format, where the conditions specified in Article 20 GDPR are met.
  
  

• Right to object – Art. 21 GDPR: To object to the processing of your personal data on grounds relating to your particular situation if processing is based on our legitimate interests.
  
  

• Right of withdrawal – Art. 7 GDPR: If processing is based on your freely given consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.
  
  

• Right to lodge a complaint – Art. 77, 79 GDPR: To lodge a complaint with a supervisory authority or pursue judicial remedies. In Romania, this is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP).
  
  

If you wish to exercise any of these rights, please contact us using the details below. We will respond in accordance with applicable legal timelines.

Data Security

We take the security of your personal data seriously. In order to ensure the integrity and confidentiality of your data and protect it from any malicious intrusion, loss, alteration, or disclosure to unauthorized third parties, we implement appropriate technical and organizational measures. These include encryption, access control, and secure storage systems.

Access to personal data is restricted solely to those employees, contractors, or third parties who require it for legitimate operational or legal purposes.

However, please be aware that no security measures are entirely foolproof. While we strive to protect your personal data, we cannot guarantee absolute security. You are also responsible for maintaining the confidentiality of your Telegram account credentials and your TON wallet access.

Children’s Data

The Game is intended only for individuals aged 18 years, or the age of legal majority in your Country of Residence, and no personal information should be submitted to Bear Cave SRL by users under this minimum age requirement.

We do not knowingly collect or process personal data from individuals under the age of 18. If we learn that we have inadvertently processed data from someone underage, we will take appropriate steps to delete that data immediately.

Third Parties Collecting Data

The Game may contain links to external sites or rely on services provided by third parties that are beyond our control. This Privacy Policy only governs how we process and handle personal and non-personal information. When you access external sites or use third-party services, you do so in accordance with their respective privacy policies.

Important: This includes Telegram itself, which operates the platform you use to access the Game. Telegram’s collection and processing of your data, including your Telegram username, profile, and any public interactions, are governed by Telegram’s own privacy policy. We do not control, and are not responsible for, how Telegram or other third parties handle your data.

Therefore, we strongly encourage you to review the privacy policies of any third-party services you use. Without limiting the disclaimers in this Privacy Policy, we are not liable in any way for the actions, inactions, or data handling practices of such external services.

Updates to This Policy and Contact

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the Game’s features. When we do, we will post the updated version within the Game or in our official Telegram channel. Your continued use of the Game after such changes constitutes your acceptance of the updated Privacy Policy.

If you have any questions about this Policy, wish to exercise your rights under GDPR, or need more information, you may contact us at:

Secret Arcade Society
Bear Cave SRL
Strada Teleajen 33
Bucharest, Romania
Email: contact@secretarcadesociety.com