Privacy Policy

1. Data Controller

The data controller within the meaning of the GDPR is:

KID-Institut – Bildungs- & Forschungs-Verein zu Künstlicher Intelligenz & Digitalisierung
(Education & Research Association for Artificial Intelligence & Digitalisation)
Erlafstraße 41, 3270 Scheibbs, Austria
Register number (ZVR): 1346523225
Email: office@kid-institut.org
Web: www.kid-institut.org

2. Data Collected and Purposes of Processing

We process personal data only to the extent necessary to provide our services or where you have given your express consent. Specifically:

2.1 Registration and Membership

During registration we collect: first name, last name, email address, username, password (stored in encrypted form), address, mobile number (optional), membership level and chosen project access.
Purpose: Administration of association membership and access to member areas and projects.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract / supporting membership relationship).

Membership with KID-Institut is exclusively structured as a supporting membership (Fördermitgliedschaft). Supporting members have no voting rights and are not invited to general assemblies or elections of the association's governing bodies. For full (ordentliche) membership, a formal application to the Präsidium is required. Please contact us at office@kid-institut.org.

2.2 Payments

No payments are processed and no payment data are handled on playsof.org. Memberships (including paid ones) are concluded exclusively via kid-institut.org; the privacy policy of kid-institut.org applies to them. When you log in, playsof.org only receives your membership level (see section 3, KID-Institut projects).

2.3 Newsletter

For the newsletter we collect your email address. Registration is via a double opt-in procedure: you receive a confirmation email, and by confirming it you give your consent. You may unsubscribe at any time.
Legal basis: Art. 6(1)(a) GDPR (consent).

2.4 Server Log Files and Technical Operation

When you visit our website, our hosting provider (Hostinger) automatically stores information in server log files: IP address, URL accessed, date and time, data volume transferred, browser type and operating system. These data are necessary to ensure technical operation and are deleted after a maximum of 30 days.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure operation of the website).

2.5 Cookie Consent

When you visit this website, your cookie consent decision is logged. This includes: IP address (anonymised), time of consent, choice made, and the applicable policy version. This log serves as proof of your consent in accordance with Art. 7 GDPR.
Legal basis: Art. 6(1)(c) GDPR (legal obligation).

2.6 Contact by Email

If you contact us by email, we store your email address and the content of your message in order to process your enquiry. These data are deleted after the matter is concluded, unless statutory retention obligations apply.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).

2.7 Recording of Login and Project Access Activity

For logged-in members, we record the following data for the purpose of evidencing service delivery and defending against unjustified payment disputes (chargebacks):

• Time of login and logout on kid-institut.org
• IP address at the time of login
• Time and target project when a KID-Institut project was accessed via single sign-on (SSO)
• Usage activity within individual projects (as described in each project's own privacy information)

These activity logs are retained for 18 months and then automatically deleted. They are used exclusively to document services rendered and to defend against unjustified claims, and are not passed on to third parties except where required by law.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest of the association in evidencing services rendered and defending against unjustified claims).

2.8 Feedback and Problem Reports

Using the feedback form in the game, you can send us comments, ideas and problem reports. We store your message, the selected category, the language and, if you upload one, a screenshot. For logged-in members, the internal user ID is stored. We only store an email address if you explicitly ask for a reply and enter it.

For technical reports (problem, game logic, display, text), technical data is also sent so that we can reproduce the problem: the current game state (hero name, values, inventory, game progress), adventure and section, browser, operating system, screen size, time zone and the most recent error messages of the page. You can view this data before sending via “Show details”.

To protect the form against misuse (a limit of a few reports per day), we do not store your IP address in plain text, only in pseudonymised form as a hash value together with the report.

All information is voluntary. Please do not include data in your message or screenshot that we do not need for your request (e.g. addresses or data of other persons).

Reports are used exclusively to fix problems and develop the game further. To analyse them (e.g. to group similar reports and find the causes of errors) we may use AI tools. In doing so we only transmit the content of the reports and the technical data – without email address, screenshot and IP hash; members appear only with their internal user ID. The providers of such tools may be based outside the EU (see section 3). None of this information is made public. The only other recipient is our hosting provider as a processor (see section 3); there is no transfer to any other third party. Reports including screenshots and the pseudonymised IP address are deleted automatically after 6 months; an email address you provided is also deleted at the latest at that point.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in an error-free game, in processing your feedback and in protecting the form against misuse). You may object to this processing at any time (see section 6).

3. Recipients and Transfer of Data

Your data are not generally passed on to third parties, except in the following cases:

• Hosting: Hostinger International Ltd., as our hosting provider, technically processes access data.
• AI tools: To analyse feedback and problem reports, their content may be transmitted to providers of AI tools without email address, screenshot and IP hash (see section 2.8). No data are made public.
• KID-Institut projects: Within our single sign-on (SSO) system, when you log in to a project the following data are transmitted to that project: user ID, role, membership level for that project, and membership expiry date. Transfer only occurs to projects you actively access.
• Legal obligation: Where required by law, data may be disclosed to authorities.

Transfer to third countries outside the EU/EEA occurs, where applicable, via providers of AI tools (section 2.8) and when the YouTube videos are loaded (after your consent, see Cookie Policy). It only takes place on the basis of an adequacy decision of the EU Commission (e.g. EU-US Data Privacy Framework) or EU Standard Contractual Clauses (SCC).

4. Social Media

Our website contains only simple hyperlinks to our profiles on the following platforms: Instagram, Facebook, X (Twitter), Discord and YouTube. Merely viewing these links does not transmit any data to those platforms. Data transmission only occurs when you actively click a link and visit the respective platform. The operators of those platforms are responsible for data processing on their sites. We have no influence over their data protection practices.

5. Retention Periods

6. Your Rights

Under the GDPR you have the following rights:

• Right of access (Art. 15 GDPR): You may request information about the data stored about you.
• Right to rectification (Art. 16 GDPR): You may request correction of inaccurate data.
• Right to erasure (Art. 17 GDPR): You may request deletion of your data, provided no statutory retention obligations apply.
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR): You may object to processing based on legitimate interests.
• Right to withdraw consent (Art. 7(3) GDPR): Consent may be withdrawn at any time with effect for the future.

To exercise your rights please contact: office@kid-institut.org

You also have the right to lodge a complaint with the Austrian Data Protection Authority:
Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, Austria
www.dsb.gv.at

7. Cookies and Cookie Settings

Scroll of Fate uses its own, strictly necessary cookies only. No analytics, marketing or tracking cookies are used. For the game videos, YouTube loads its own cookies with your consent (see below).

Our own cookies: sof_consent (stores your cookie decision, 365 days), sof_sess (game session for registered members, max. 8 hours), sof_lang (selected language, 365 days), sof_device_h (device screen height for the smartphone layout, just a pixel number, 365 days) and promo_pending (only when arriving via a promotion link: remembers the promotion until login, max. 7 days, deleted after redemption). Your game settings are kept in your browser local storage (sof_settings); they stay on your device and are not transmitted to us. For details see the Cookie Policy.

Third-party cookies (YouTube): Game sequences are streamed as embedded YouTube videos. When a video plays, YouTube may set cookies on your device (e.g. VISITOR_INFO1_LIVE, YSC, PREF). These are set by Google Ireland Limited and are subject to Google's Privacy Policy. KID-Institut has no control over these cookies. Legal basis: your consent (Art. 6(1)(a) GDPR, § 165(3) Austrian Telecommunications Act 2021), given with “Accept & Play” and revocable at any time via “Cookie Settings”.

Future integrations: Should further third-party services be integrated in future, this privacy policy will be updated and consent will be obtained again if required.

You can adjust your cookie preferences at any time via the "Cookie Settings" button in the footer of the game page.

8. Updates to this Privacy Policy

This Privacy Policy is current as of October 2026. We reserve the right to update it as necessary to comply with current legal requirements or to reflect changes to our services. The updated policy applies from your next visit to the website.