Short version

• We have no user accounts, no analytics, no ads and no tracking.
• PayPal handles the payment. We keep a purchase record (your code, the PayPal transaction, your PayPal email address, the amount and date, and how many download links were issued) for delivery, the order confirmation email, refunds and to stop abuse.
• This site sets no cookies. PayPal's checkout sets its own cookies, and only after you tick the two boxes to buy. YouTube loads only after you click the trailer.

Who is responsible

Daniel Infuehr, Gigantua, Kaposigasse 60, 1220 Wien, Austria, support@gigantua.net (controller under Art 4 Z 7 GDPR).

Visiting the site

The site is hosted on Microsoft Azure Static Web Apps in the EU (West Europe). To deliver a page, the hosting servers process your IP address, the page requested, the time and your browser's user agent. Microsoft keeps such technical logs for operations and security; we do not use them to identify visitors. Legal basis: our legitimate interest in running a secure website (Art 6(1)(f) GDPR). Microsoft is our processor: Microsoft privacy statement.

Buying a game

When you pay, you deal with PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, which processes your name, email address, payment details and billing data as an independent controller under its own privacy statement. If you pay by card without a PayPal account, PayPal processes the card data the same way.

Our server receives from PayPal what it needs to complete the sale: the PayPal order and transaction IDs, the item, the amount, the payment status and the email address of your PayPal account. It stores one purchase record in Microsoft Azure Table Storage (EU): your download code, the PayPal transaction (capture) and order IDs, your PayPal email address, the amount and currency, the date, the page language, how many download links were issued, and whether the purchase was refunded. We use it to deliver the game, to send you the order confirmation, to process refunds, and to limit the number of download links per code (abuse protection). Your name, address and payment details stay with PayPal. Where our server writes diagnostic logs, they hold order and transaction IDs only (no names, no emails) and are kept for at most 30 days.

Order confirmation email. Right after the payment we send the confirmation (code, date, amount, your agreement to immediate delivery, the refund offer) to your PayPal email address through Microsoft Azure Communication Services (EU data location), as our processor. Replies go to support@gigantua.net.

How long. The purchase record is part of our business records and is kept for seven years from the end of the year of the purchase, as Austrian tax law requires for accounting records (§ 132 Bundesabgabenordnung), then deleted.

PayPal keeps the record of the sale in our PayPal business account: date, item, amount, transaction ID, and the payer's name and email. We need it to account for the sale and to help you if you lose your code. Austrian tax law (§ 132 BAO) requires us to keep business records for seven years. Legal basis: performing the contract with you (Art 6(1)(b) GDPR) and our legal obligations (Art 6(1)(c) GDPR); the download limit rests on our legitimate interest in preventing abuse (Art 6(1)(f) GDPR).

The download

The game file is stored privately on Microsoft Azure Storage in the EU. A valid code gets a link that works for 15 minutes. Azure processes your IP address to deliver the file.

What your browser keeps

This site stores your codes and an unfinished order in your browser's local storage, so you can find them again on the redeem page. This data stays on your device and is not sent to us except when you redeem a code. You can delete it at any time by clearing the site data in your browser. It is not a cookie and is not used to track you.

Cookies

gigantua.net sets no cookies. PayPal's checkout script, which we load only after you tick both boxes on a game page, sets cookies that PayPal needs for the payment and fraud prevention. See PayPal's cookie statement.

Trailer (YouTube)

The trailer on the game page is a still image until you click it. Only then does your browser load the video from YouTube (Google Ireland Limited) in privacy-enhanced mode (youtube-nocookie.com); from that moment Google processes your IP address and device data under its privacy policy. Before the click nothing is loaded from YouTube. Where the trailer links to a store page instead (for example Steam), that site opens in a new tab under its own policy. Legal basis: your consent by clicking (Art 6(1)(a) GDPR).

Links to other stores

Links and badges to other stores (Steam, Microsoft Store, Google Play, Epic Games Store, Amazon Appstore, Meta Quest) are plain links. The badge images are stored on our server; nothing is loaded from those stores until you click a link.

Emails to us

If you write to us, we use your email and what you send to answer you, and keep it as long as needed for that and for legal obligations.

Transfers outside the EU

Microsoft and PayPal belong to groups based in the USA. Both take part in the EU-US Data Privacy Framework and use the EU standard contractual clauses for transfers.

Your rights

You have the right to access, correct and delete your data, to restrict or object to processing, and to data portability (Art 15 to 21 GDPR). Write to support@gigantua.net. You can also complain to the Austrian data protection authority, Datenschutzbehörde, Barichgasse 40-42, 1030 Wien.

The game itself

The game collects no personal data. Its own privacy policy: Seven Worlds privacy policy.