TradeChronicles

Privacy Notice

Last updated: October 2026

This Privacy Notice explains how Milios Panagiotis Nektarios, 14 Kimolou Street, Kipseli 11362, Athens, Greece (the "Operator", "we", "us"), processes personal data when you use the online game TradeChronicles (the "Game") at trade-chronicles.com. We process personal data in accordance with the General Data Protection Regulation (GDPR) and Greek data protection law. The Operator is the controller of the processing described here. We are not responsible for the processing carried out by third parties under their own responsibility, such as the Backend Service Provider or the payment provider, which have their own privacy notices.

1. Definitions

Backend Service Provider: the third-party service that handles player accounts, authentication and related services for the Game, currently brainCloud, operated by bitHeads Inc.
Game Servers: the servers operated for the Operator on which the Game worlds run.
Payment Provider: the third-party service that processes purchases of Virtual Currency.
Personal Data: any information relating to an identified or identifiable natural person, as defined in Article 4(1) GDPR.

2. Data we collect

2.1 Account and authentication data

When you register or sign in, your e-mail address and password are handled by the Backend Service Provider, which authenticates you and gives you a profile identifier and a session identifier. From the authentication response we receive and process your profile identifier, session identifier, merchant (player) name, the time of login and the country and language reported for your session. We do not receive your password; it is stored by the Backend Service Provider in protected form.

2.2 Gameplay and server data

When you play, the Game Servers process your IP address, browser and device identifiers (such as the browser type and operating system), session timestamps, connection logs and the country derived from your IP address. This data is needed to deliver the Game to your browser and to keep the servers secure.

2.3 Game data

The Game Servers store your in-Game account and progression: the world you play in, your trading offices, ships, buildings, goods, gold, trades, routes and settings, together with your Virtual Currency balance and its history, records of your purchases (date, amount, items bought and a transaction reference; never card or bank details) and session telemetry such as actions taken and their timestamps.

2.4 Communications

Your merchant name and in-Game actions, such as trades and buildings, are visible to other players in the same world. Where the Game offers messages or chat, the content you send is processed to deliver it to the recipients and kept only for as long as needed for delivery and a limited moderation period.

2.5 Direct contact

If you contact us, for example by e-mail with a support request, we process the data you provide, including your e-mail address and the content of your message.

3. Purposes

We process personal data to:

provide, operate and maintain the Game and your User Account;
process purchases of Virtual Currency and manage your balance;
keep the Game secure, prevent cheating, fraud and abuse, and enforce our Terms of Use;
find and fix errors and improve the Game;
answer your support requests and communicate with you about the Game;
comply with legal obligations, such as tax and accounting rules, and establish, exercise or defend legal claims.

4. Legal bases

Performance of a contract (Article 6(1)(b) GDPR): providing the Game, your User Account and your purchases.
Legal obligation (Article 6(1)(c) GDPR): keeping transaction records required by tax and accounting law and responding to lawful requests from authorities.
Legitimate interests (Article 6(1)(f) GDPR): securing the Game, preventing fraud and cheating, fixing errors and improving the Game. You may object to this processing (see section 8).
Vital interests (Article 6(1)(d) GDPR): in rare cases, to protect your life or that of another person.
Consent (Article 6(1)(a) GDPR): where we ask for it, for example for optional communications. You may withdraw consent at any time with effect for the future.

5. Sharing of data

We share personal data only with:

the Backend Service Provider, which handles accounts and authentication;
hosting providers that run the Game Servers and the website;
the Payment Provider, which processes purchases of Virtual Currency;
e-mail and communication providers we use to answer you;
authorities, courts and legal advisers, where required by law or to establish, exercise or defend legal claims.

Service providers that process data on our behalf are bound by data processing agreements under Article 28 GDPR. We do not sell personal data and do not share it with advertising networks, data brokers or social-media platforms. The Game contains no third-party advertising or social-media SDKs.

6. International transfers

The Game Servers may be located in the European Economic Area (EEA) or in other countries, and the Backend Service Provider and the Payment Provider may process data outside the EEA. Where personal data is transferred outside the EEA, we rely on an adequacy decision of the European Commission (such as the EU–U.S. Data Privacy Framework or the adequacy decision for Canada) or on the Standard Contractual Clauses adopted by the European Commission, together with any additional safeguards that are needed.

7. Retention

Account and game data: kept for as long as your User Account is active. After the account is closed, the data is deleted or anonymised, unless we must keep it for the reasons below.
Transaction records: kept for as long as needed for operation, refunds and reconciliation, fraud prevention and legal claims, and for the retention periods required by tax and accounting law.
Messages: deleted after delivery and a limited moderation period.
Server and connection logs: kept for a limited period for security and troubleshooting, then deleted.
Support correspondence: deleted once the request has been handled, unless we need it for legal claims.

8. Your rights

Under the GDPR you have the right to access your personal data, to have it rectified or erased, to restrict or object to its processing, and to receive the data you have provided in a portable format. Where processing is based on consent, you may withdraw it at any time. To exercise your rights, contact us at the address in section 10. We answer within one month; this period may be extended by two further months where necessary, as provided in Article 12(3) GDPR, in which case we will inform you. You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work or place of the alleged infringement. In Greece this is the Hellenic Data Protection Authority (www.dpa.gr).

9. Children

The Game is intended for persons aged 13 and over. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has created a User Account, contact us and we will delete the account and its data. Where the law of your country requires parental consent for the processing of a minor's data, such consent is required to use the Game.

10. Contact

Milios Panagiotis Nektarios
14 Kimolou Street, Kipseli 11362
Athens, Greece
E-mail: panayiotismilios@gmail.com

11. Changes to this notice

We may update this Privacy Notice from time to time, for example when the Game or the law changes. The current version is always available at trade-chronicles.com/privacy.html, and the date of the last update is shown at the top. We will inform you of material changes in the Game or by e-mail.