Privacy Policy – Gamevestor

1. Identity of the Data Controller

The data controller is Gamevestor, a French simplified joint-stock company (Société par Actions Simplifiée), registered with the Trade and Companies Register of Annecy under number 938 196 714, with its registered office located at 5 rue de l’Industrie, 74000 Annecy, France.

Contact email for any questions relating to personal data: [email protected].

2. Data Subjects Concerned by the Processing

The personal data processing activities carried out by Gamevestor concern the following categories of individuals:

• website visitors;
• contributors (donations / contributions);
• investors (natural persons);
• project owners / studios (legal entities);
• legal representatives, corporate officers and beneficial owners of legal entities.

3. Nature of Personal Data Collected

3.1 Personal data relating to natural persons

Depending on the functionalities used, Gamevestor may collect in particular:

• first name and last name;
• date and place of birth;
• nationality;
• postal address;
• email address;
• numéro de téléphone ;
• login credentials and encrypted password;
• identity documents (national ID card, passport);
• proof of address;
• bank details (IBAN, BIC);
• tax information and tax preferences;
• responses to regulatory questionnaires (investor profile, financial knowledge, risk tolerance);
• amounts invested or contributed and transaction history;
• electronically signed contractual documents;
• communications exchanged with Gamevestor;
• IP address, connection logs and browsing data.

3.2 Personal data relating to legal entities

For project owners and legal entity investors, the personal data collected may include:

• company name;
• legal form;
• registration number (SIREN / SIRET);
• registered office address;
• articles of association;
• company registration extract (Kbis);
• declaration of beneficial owners;
• identity and contact details of legal representatives;
• identity documents of corporate officers and beneficial owners;
• valid professional bank account details opened in the name of the legal entity;
• financial, legal and operational documents required for project analysis and monitoring.

4. Purposes of Processing and Legal Grounds

Personal data are collected and processed for the following purposes:

• creation and management of user accounts;
• access to and use of the Platform services;
• management of contributions and investments;
• analysis, selection and monitoring of funded projects;
• compliance with the legal and regulatory obligations applicable to European Crowdfunding Service Providers (ECSP), in particular with respect to customer identity verification (Know Your Customer – KYC), business identity verification (Know Your Business – KYB), anti-money laundering and counter-terrorist financing obligations (AML/CFT), as well as fraud prevention.
• management of payments and payment accounts via regulated service providers;
• communication with users (notifications, contractual information);
• sending marketing communications subject to prior consent;
• improvement of the Platform and audience measurement;
• information system security.

5. Legal Grounds for Processing

The legal grounds applicable to the processing activities described above are as follows:

• performance of a contract or pre-contractual measures;
• compliance with legal and regulatory obligations;
• Gamevestor’s legitimate interest (security, fraud prevention, service improvement);
• user consent, in particular for marketing communications and non-essential cookies.

6. Regulatory Processing, Controls and Automated Decisions

As part of its regulatory obligations, Gamevestor may carry out automated processing, including profiling operations, in particular for:

• identity verification;
• risk profile assessment;
• prevention of money laundering and terrorist financing.

Such processing may lead to decisions such as refusal of access to certain services or projects, in accordance with applicable legal requirements.

7. Recipients of the Data

Personal data are accessible only to authorized Gamevestor personnel and may be transmitted, within the scope of their respective responsibilities, to the following recipients:

• technical and hosting service providers (including EasyCrowd, Cloudflare, Amazon Web Services (AWS), Heroku);
• payment and financial services provider: Lemonway, acting as an independent data controller;
• electronic signature service provider: Yousign;
• marketing email service provider: Brevo;
• project special purpose vehicles (SPVs) established as part of the financing operations, for the purpose of maintaining bondholder registers, managing financial flows and monitoring investors’ rights;
• project owner studios, strictly for the personal data necessary to execute the funded projects, in particular for the delivery of rewards, benefits or counterparties associated with contributions.

Data transmitted to studios are strictly limited to the information necessary for the proper execution of the relevant Project (such as identification of the reward beneficiary and logistical information) and may not be used for any other purpose.

In this context, project owner studios act as independent data controllers for the processing activities they carry out under their own responsibility and undertake to comply with all applicable personal data protection obligations.

Personal data may also be disclosed to competent administrative, judicial or supervisory authorities (including AMF, ACPR and TRACFIN) where required by law or regulation.

Personal data are not sold or used by third parties for commercial purposes.

8. Public and Non-Public Data

In the context of the use of the Platform, certain information may be made accessible to other users or project stakeholders under strictly controlled conditions.

8.1 Data that may be made accessible

Depending on the functionalities used and the funded projects, the following information may be made accessible in a limited manner:

• first name and first letter of the last name;
• pseudonym or public identifier;
• total amount invested or contributed to a project;
• investor or contributor status on a project.

Such information is used exclusively for transparency and monitoring of funded projects.

8.2 Data never made public

The following data are never made public or accessible to unauthorized third parties:

• passwords and login credentials;
• identity documents and supporting documents (ID, proof of address, KYC / KYB);
• bank details (IBAN, BIC);
• full postal address, email address and phone number;
• IP address and detailed connection data;
• private communications with Gamevestor
• tax information and responses to regulatory questionnaires.

9. Business Continuity and Run-Off Management

In accordance with the regulations applicable to PSFPs, Gamevestor has implemented a business continuity and run-off management framework designed to ensure the continued monitoring of financing operations until their completion.

The purpose of this framework is to ensure that, in the event of an interruption or cessation of the Platform’s activity, the monitoring and management of financing operations can continue until their completion, in the interests of investors and project owners.

In this context, certain personal data may be retained and, where appropriate, transmitted to identified service providers (in particular EasyCrowd) or authorities in order to ensure continuity of contractual and regulatory obligations towards investors and project owners.

10. Data Retention Periods

Personal data are retained for the following periods:

• account data: for the duration of the contractual relationship, then archived for up to five (5) years;
• regulatory and financial data: five (5) to ten (10) years in accordance with legal obligations;
• security and fraud prevention data: up to one (1) year;
• marketing data: three (3) years from the last contact or withdrawal of consent;
• cookies: a maximum of thirteen (13) months.

11. Data Security

Gamevestor implements appropriate technical and organizational measures to ensure the security, integrity and confidentiality of personal data, in particular through encryption of sensitive data, access restrictions and secure hosting within the European Union.

12. Cookies

The Platform uses cookies and trackers subject to user consent, in particular for audience measurement purposes (Google Analytics). Preferences may be modified at any time via the cookie management tool.

13. Data Subject Rights

In accordance with applicable regulations, users have the following rights:

• right of access;
• right to rectification;
• right to erasure;
• right to restriction of processing;
• right to object;
• right to data portability;
• right to withdraw consent.

These rights may be exercised by contacting [email protected]. Proof of identity may be required.

Users may also lodge a complaint with the competent supervisory authority.

14. Changes to the Policy

This Policy may be amended at any time in order to reflect legal, regulatory or operational developments. The version in force is the one published on the Platform.