Download PDFPrint

Privacy and Cookie Policy

Version of 2026-10-07. This policy applies to the Shop at https://archiwumzagadek.pl, to the online games we offer in it (for example “Ostatni Odczyt”) and to games sold in a box and delivered by post.

1. Data controller

1. The controller of your personal data is Piotr Niemiec, ul. Stefana Batorego 128, 65-735 Zielona Góra, tax identification number (NIP) 9291836445, statistical number (REGON) 529948264, who runs the online shop Archiwum Zagadek at https://archiwumzagadek.pl (we, the Controller).
2. Contact in matters concerning personal data: kontakt@archiwumzagadek.pl or by post to the address above. We have not appointed a data protection officer, as the law does not require one.

2. What data, for what purposes and on what legal basis

1. Account. Email address; when you sign in with Google, also your Google account identifier and the first name and surname from your Google profile (we do not store the profile photo); when you sign in with Apple, your Apple account identifier and your first name and surname if you share them with Apple on first sign-in (if you choose “Hide My Email”, we store the Apple relay address ending in @privaterelay.appleid.com); when you sign in with Facebook, the identifier of your account in our Facebook app (assigned by Meta and different in each app; we do not store your name or photo from Facebook); date of birth; Account language (point 19); dates of account creation and last activity; the version of the terms and conditions you accepted and the date of acceptance; session data (a hash of the session identifier, browser and system type, sign-in method). Purpose: maintaining the account and signing in. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
2. Age check. Your date of birth is used solely to check whether you can play games with an age restriction (the minimum age of each game is on its page, for example “Ostatni Odczyt”: from 15), whether a parent’s or guardian’s consent is needed for a purchase and whether you can consent to marketing emails (from 16). Legal basis: performance of a contract (Article 6(1)(b) GDPR) and our legitimate interest in protecting minors from content unsuitable for their age (Article 6(1)(f) GDPR).
3. Game progress. The state of play: opened envelopes, notes and other texts you enter in the game, opened hints (which hint and at what time it was opened; the text of a hint appears only after it is opened, and the number of hints opened counts towards the score, the result card and the leaderboard), playing time, result, game language, the times at which progress was saved to the account (the server measures the playing time for the leaderboard from them, point 20), as well as a random identifier of the browser from which progress was saved, the playing time separately for each device and the timestamps of changes to your entries (so that, when you play on several devices or offline, saves can be merged without loss and we can tell which version of an entry is newer). When you change the same entry on two devices, the older version (up to the last 6) stays in the game save so that you can restore it; when one save replaces another (for example after “Start again” on another device), the previous version of your progress stays on the account as a single copy for restoring, replaced by the next one. Purpose: saving progress to the account, playing on several devices and offline, handling complaints. Legal basis: performance of a contract (Article 6(1)(b) GDPR). Do not enter other people’s personal data in your notes.
4. Purchase. Email address, order number, product (online game, gift or box), amount, discount code used and amount before the discount, payment status and method, the payment identifier at the payment service provider, the dates and content of the statements made at purchase, the language of the page on which the order was placed, for a purchase as a gift also the data referred to in point 12, for a box order the data referred to in point 5, and if you want an invoice: invoice details (for a business: name, address and NIP or EU VAT number; for a private individual: first name, surname and address) and the invoices and corrective invoices issued, with their numbers, and if an invoice has been sent to the National e-Invoicing System, also its KSeF number. Purposes and legal bases: performance of a contract (Article 6(1)(b) GDPR); tax and accounting obligations, including issuing and keeping invoices (Article 6(1)(c) GDPR in conjunction with Articles 106b, 106e and 112 of the VAT Act (ustawa o podatku od towarów i usług)); establishing and defending claims (Article 6(1)(f) GDPR). Purchase data is kept for this period even after the account is deleted.
5. Box delivery. The recipient’s first name and surname, delivery address, telephone number, chosen delivery method and parcel locker code, tracking number, dates of dispatch and delivery. Purpose: preparing and delivering the parcel, notification about it by the carrier, handling returns and complaints. Legal basis: performance of a contract (Article 6(1)(b) GDPR). When you send a box to someone as a gift, we receive the recipient’s data from you; the recipient will find in the parcel information on where to read this policy (Article 14 GDPR), and we process their data in our legitimate interest, namely in order to fulfil your order (Article 6(1)(f) GDPR).
6. Sign-in with a link or code sent by email. Email address and hashes of the single-use token and code. The link and code are valid for 30 minutes. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
7. Correspondence and complaints. The content of messages and the data provided in them. Legal bases: performance of a contract and legal obligations (Article 6(1)(b) and (c) GDPR) and our legitimate interest in replying to messages (Article 6(1)(f) GDPR).
8. Security, server logs and alerts. IP address, date and time, page address, browser type, number of attempts to sign in and to use codes, and for suspicious events (for example a series of wrong sign-in codes or gift codes, an attempt to enter the administrator panel without authorisation, a very large number of new accounts from one address, an attempt to sign in to a blocked account) also the type of event and the email address of the account concerned. Purpose: protecting the Shop and accounts against abuse (attempt limits, alerts for the Controller), fixing faults. Legal basis: legitimate interest (Article 6(1)(f) GDPR), namely the security of the Shop and of Users’ data. We do not create profiles on this basis and do not combine this data with advertising. Emails from the Shop contain the Shop’s logo as an image downloaded from our server when your email program displays images. The image address is the same for all recipients: it contains no message identifier or your address, so it is not used to check whether and when you opened a message. When the image is downloaded, the server records the same technical data as when a page is visited (IP address, time, type of program).
9. Bot protection (Cloudflare Turnstile). When protection is switched on, the email sign-in form and gift code redemption after failed attempts display a Cloudflare Turnstile check. Cloudflare checks whether a human is filling in the form on the basis of the IP address, information about the browser and device and the way of interacting with the check; it passes on to us only the result (passed or not). Purpose: protecting sign-in and codes against automated guessing and abuse. Legal basis: legitimate interest (Article 6(1)(f) GDPR). The check is not used for advertising or tracking. Cloudflare processes the data on our behalf in accordance with its privacy policy; we do not store the result of the check.
10. Event log. Email address (for a gift also the recipient’s address), type and time of the event (for example sign-in, purchase, sending a gift, change of access, refund, change of consent, acceptance of the terms and conditions, dispatch of a parcel). Purpose: security, handling complaints and accountability (including demonstrating that consents were given). Legal basis: legitimate interest (Article 6(1)(f) GDPR).
11. Access given by us and gift codes. When someone (for example a family member) asks us to give you access to a game, we store your email address, a note and the giver’s first name, and send an invitation to your address. Purpose: making the game available. Legal basis: legitimate interest (Article 6(1)(f) GDPR).
12. Gift bought in the Shop: the recipient’s data. When someone buys you a game as a gift, they give us your email address and, if they wish, also your first name, their signature, the text of their wishes, the day on which the invitation is to be sent and its language. We receive this data from the person who bought the gift (Article 14 GDPR); we say so in the invitation. Purposes: sending the invitation with the gift code on behalf of the buyer, handling the code (redemption, change of address or sending day at the buyer’s request, cancellation after a refund) and complaints. Legal basis: our legitimate interest, namely carrying out the buyer’s instruction (Article 6(1)(f) GDPR); in relation to the buyer, this is performance of the contract concluded with them (Article 6(1)(b) GDPR). We delete the text of the wishes 90 days after the invitation is sent; we keep your email address, first name and sending day together with the order data (table below). We send only the invitation to your address: no reminders and no advertising. You may object to the processing of this data at any time (Article 21 GDPR) by writing to kontakt@archiwumzagadek.pl. We will then not send the invitation if it has not yet gone out and will stop processing your data unless it is needed to establish, pursue or defend claims. The person who bought the gift has a copy of the code and can pass it on in another way.
13. Notification of box availability. When a box is temporarily unavailable, you can ask for a message when it is back. We store your account email address, the game and the date of the request. Purpose: a one-off email when the box is back on sale (this is not a newsletter). Legal basis: your request, that is, performance of the contract for maintaining the account (Article 6(1)(b) GDPR). You can cancel the request on the order page (“Don’t notify me”).
14. Discount codes. The code, its value and validity, the email address of the person for whom it is intended, its source (for example a birthday email, the player card in the panel, the offer after solving a case) and whether it has been used. Purpose: granting the discount and making sure that the code works only once and only for that person. Legal bases: your consent, when the code comes in a marketing email (Article 6(1)(a) GDPR); performance of a contract, for a purchase with a code and for a code you claim after solving a case with the “Claim code” button (Article 6(1)(b) GDPR); we create a code handed over personally on the basis of our legitimate interest (Article 6(1)(f) GDPR). For the offer after solving a case, we also record that you have claimed the code for a given game (so that you can claim it only once), and in the event log the code, the discount percentage and the period of validity. The percentage and the period of validity are set by the Shop; changing these settings does not affect codes you have already claimed.
15. Cookie consents. A random identifier, your choice, the date and the version of the banner. Purpose: demonstrating whether or not you gave consent. Legal basis: legal obligation and legitimate interest (Article 6(1)(c) and (f) GDPR).
16. Advertising and statistics (only with consent). Cookie identifiers, IP address, information about the device and browser, Shop pages visited, the source of the visit (for example clicking an advert) and information about a purchase (order number and amount) for measuring the effectiveness of adverts. Purposes: measuring the effectiveness of Google Ads adverts, remarketing (showing adverts for the game to people who have visited the Shop) and visit statistics (Google Analytics). Legal basis: your consent (Article 6(1)(a) GDPR). Google keeps the data in accordance with its own rules; in Google Analytics we set data retention to 2 months. Statistics also include remembering which advert, message or website brought you to us (the source, medium and campaign name from the page address, or the name of the search engine, social network or referring website) in the “oo_utm” cookie for 30 days, and recording that source with your order if you buy (for 14 months), so that we know which campaigns sell. This applies only to adults who have consented to analytics cookies. We then send Google Analytics events about the use of the Shop (viewing the list of games and a game, going to the order page, purchase, account creation and sign-in, sharing a result, sending an enquiry form), without the email address, surname or message content. If we switch on another analytics or advertising tool, we will add it to Section 4 before switching it on; no such tool will run without your consent in the relevant category.
17. Marketing emails (only with consent). Email address, first name (if we know it), the date and source of consent (account page, request after sign-in, order) and, when consent is withdrawn, the date and method of withdrawal. To tailor messages we use data we already have: date of birth (birthday wishes), access to games and progress (a reminder about an unopened or unfinished game, congratulations after solving a case with a request for a rating), order status (a reminder about an unpaid order). Purpose: informing you about new games and promotions, discount codes, reminders and wishes. Legal basis: your consent (Article 6(1)(a) GDPR), required by Article 398 of the Electronic Communications Law of 12 July 2024 (ustawa z dnia 12 lipca 2024 r. – Prawo komunikacji elektronicznej). You give and withdraw consent in the “Account” tab (“Consents and notifications” section) or via the “unsubscribe” link in every such email; withdrawal takes effect immediately. We do not send such messages to people under 16 or to accounts without a date of birth. We keep a history of messages sent (type, date, address, discount code) so as not to send the same message twice and to be able to show that we sent them with consent (Article 6(1)(f) GDPR).
18. Post-game survey. Your answers: rating, whether you would recommend the game, how difficult it was, how many people played, what you liked, what to improve; the age range calculated from your date of birth (we do not store the date itself in the survey), the survey language and the state of the game at the time of completion (playing time, result). You give your gender voluntarily (“I prefer not to say” is also an answer). Purpose: improving the games and statistics. Legal bases: our legitimate interest in improving the games (Article 6(1)(f) GDPR) and, for gender, your consent given by selecting it (Article 6(1)(a) GDPR); you can withdraw consent by correcting the survey or by writing to us. At the end of the survey we ask, voluntarily, whether we may include your rating (only the number of stars, without your name and without any text) in the average rating shown on the game page. The answer “Yes, you may” is your consent (Article 6(1)(a) GDPR); no answer or “No” means that your rating is not shown. We show the average rating publicly (on the game page and in data for search engines) only once there are five ratings with consent, as a number of stars and a number of ratings, without any data about the people who gave them. You can withdraw this consent at any time by writing to the address in Section 1: we will stop counting your rating in the average. The survey is voluntary. After the account is deleted, the answers remain without any link to the account, for statistics only. Do not enter personal data in the survey.
19. Language of the website, game and emails. We store the account language (Polish, English or Ukrainian): when the account is created, the language of the page on which it was created, and later the language you choose with the language switcher after signing in. When game progress is saved and with the survey, we store the code of the language in which you play or complete the survey, and in the order data the language of the page on which the order was placed and the chosen language of a gift invitation. Purpose: displaying the website and the game in your language, sending emails in that language (confirmations, sign-in links, invitations, dispatch information and, if you consent, also marketing emails) and aggregate statistics (in which languages how many people play and buy). The game language is shown with a result in the leaderboard (point 20). Legal bases: performance of a contract (Article 6(1)(b) GDPR), for marketing emails your consent (point 17), and for statistics our legitimate interest (Article 6(1)(f) GDPR). You can change the account language at any time with the language switcher. Your choice of language on the website is also remembered by the “oo_jezyk” cookie (Section 8, point 2).
20. Detective nickname and leaderboards (only if you set a nickname). You can set a nickname: one per account, shown publicly instead of any account data. With a nickname, your solved cases go into the public leaderboards, onto result pages (an address with a random code) and onto images for sharing. Only the following is publicly visible: the nickname, playing time, number of hints, month of solving, game language, position in the leaderboard, badges and the percentage of players you were faster than. We do not publish your first name, email address, place of residence, age, account identifier or a link to the account. A nickname must not contain your first name and surname, email address, telephone number, website address or a social media profile name: the system rejects such nicknames, but do not enter any other data by which you could be recognised either. If the nickname you enter is taken, we suggest a few free nicknames built from the one you entered (for example with a digit, an initial or an adjective in the game language). They are generated automatically on the Shop’s server, without any external tools, and are not stored anywhere; the system makes sure that they do not contain your first name, surname or email address. Your nickname changes only when you click “Save nickname” yourself. For each solved case the server records: the playing time measured by the server and reported by the browser, the number of progress saves, the number of hints and wrong answers, the language, the start and solve times and the random code of the result page. This data is also used to calculate badges and to detect false times: times shorter than 20 minutes and longer than 100 hours do not enter the leaderboard, and a result from a game played partly offline is checked by the Controller before it becomes public. Purpose: showing your results in the leaderboards and on result pages, which you can share. Legal bases: performance of a contract as regards the leaderboards, which you switch on by setting a nickname (Article 6(1)(b) GDPR, § 17 of the Terms and Conditions); without a nickname nothing is public; detecting false times is our legitimate interest in a fair leaderboard (Article 6(1)(f) GDPR). You can leave the leaderboards at any time by deleting your nickname on the account page: you then disappear from all leaderboards, and the result pages and images stop working. You can also hide an individual result without deleting your nickname. We may hide an entry with an inappropriate nickname or reset the nickname (§ 3(7) of the Terms and Conditions); you will then see a request for a new one on the account page.
21. Share counters. For each result page we count how many times it was opened and how many times each share button was clicked: only as numbers per channel (Facebook, X, WhatsApp, Messenger, Telegram, copying the link, downloading the image), without recording who visited or clicked. The IP address is only in the technical attempt counter, as with the Shop’s other protection measures, and disappears from it after one day. The buttons are ordinary links: after a click, further processing takes place in the service concerned, on its terms; the scripts of these services do not run on our website. The “faster than X% of players” indicator is calculated from the aggregate times of all people who solved the case (including those without a nickname), in a way that does not allow anyone to be identified. Purpose: assessing whether sharing works. Legal basis: our legitimate interest (Article 6(1)(f) GDPR).
22. Statistics. From the data in points 1–5, 14 and 17–21 we calculate aggregate statistics: sales, age ranges of buyers and players, gender from surveys, languages of players and purchases, order sources (campaigns, search engines, social networks; point 16), the number of enquiries from the form for companies and groups by source, the number of games per customer, completion rate, ratings, the number of results in the leaderboards and of shares. Purpose: planning the range of products and marketing. Legal basis: our legitimate interest (Article 6(1)(f) GDPR). The results are aggregate and do not allow anyone to establish who you are. Files with data on individual people are created only by the Controller: a version with personal data for its own use, and for analysis a version without email addresses, names, dates of birth and order numbers.
23. Market analysis (offers, ratings and reviews in other shops). Usually once a day, the Shop’s program visits the public pages of a few game shops we follow and records information about their offer: product names, prices and addresses, short descriptions from the pages’ structured data, dates of changes and the name of the shop and of the business. From the same public pages it also reads the number of reviews and the average rating of the shop and of products, and from the reviews that the shop publishes with a product it records short extracts of text (up to 600 characters) together with the rating, the date and the product name. We do not record review authors (neither the name, nor the photo, nor the profile address), and we remove from the text email addresses, telephone numbers, links, account names (@) and signatures after greetings. Figures on businesses’ presence on social media (followers, likes, comments) are read from the official YouTube and Instagram interfaces (business accounts) or entered manually by the Controller (Facebook, TikTok, Google Maps); a business’s Google Maps rating is shown live in the panel and is not stored. The program does not sign in, follows the robots.txt file, does not enter social media services other than through these official interfaces, does not collect data about the customers of these shops and does not look for review authors. Personal data may appear here only exceptionally: when a shop is run by a natural person (the name of their business may include their first name and surname) or when the author of a review has themselves written something in it by which they can be recognised; such data comes from the public page of the shop concerned (Article 14 GDPR). Purpose: market analysis, understanding what players like and dislike in other companies’ games, and planning our games and marketing. Legal basis: our legitimate interest (Article 6(1)(f) GDPR). Only the Controller sees the data in the panel; we do not publish it or combine it with other data. Because we do not record review authors or their contact details, we usually cannot establish whom a given review concerns and cannot notify them individually (Article 11 GDPR); that is why we provide this information here. If you recognise your review in our data, write to us indicating the shop and an extract of the text: we will delete it (only its hash, from which the text cannot be read, will remain, so that the program does not record it again); we accept objections in the same way (Section 6, point 4). We keep reviews for a limited time: usually 12 months from the date of the review, never longer than 36 months, and usually no more than 300 per shop. We keep figures and ratings for as long as we follow the shop concerned, and figures obtained from the YouTube interface for no longer than 30 days, in accordance with YouTube’s terms. Removing a shop from the list also deletes its offers, figures, reviews and history.
24. AI assistant in the administrator panel. For statistical analyses, suggestions for titles and descriptions of Shop pages and market analysis (point 23) we use language models from one of two providers, depending on the setting in the panel: Anthropic (the Claude model) or Google (Gemini API). We send them only: aggregate figures (for example sales by month, the number of people in age ranges, average ratings, breakdowns calculated for groups of at least 3 people); for statistical analyses also short texts of survey answers not attributed to any person, that is without email address, name, date, age and gender, after removing email addresses, telephone numbers and links; public content of Shop pages (suggestions for titles and descriptions) and public information about the offers, ratings and numbers of followers of other businesses, including short extracts of reviews from the public pages of other shops (market analysis, point 23): without author names, email addresses, telephone numbers and links, no more than 42 extracts of no more than 200 characters each per analysis, and without survey answers. We do not send email addresses, names, dates of birth, order numbers or account identifiers. As a rule, such data is not personal data (recital 26 GDPR), so we do not transfer your personal data to the AI providers. However, if you yourself enter in the survey or in a public review of a game information that allows you to be recognised (for example a name), an extract of it could end up in an analysis; so please do not do this, and we remove email addresses, telephone numbers, links and account names from reviews from other shops beforehand. We prepare these summaries on the basis of our legitimate interest in improving the games and planning our offer (Article 6(1)(f) GDPR). The providers process the content sent on their servers, including outside the EEA, under their business terms (Section 4, point 7). We keep the assistant’s reports in the panel until the Controller deletes them.
25. Shop administrator accounts. On administrator accounts we additionally store cryptographic hashes of known devices and networks (to warn of a sign-in to the panel from a new device) and, if the administrator switches on push notifications, the push subscription address and the encryption keys of their browser. If an administrator switches on two-factor authentication, we also store the encrypted key for generating codes in the app, cryptographic hashes of their backup codes, the date it was switched on and last used, and information on which sessions were confirmed with a code. We do not send push notifications to Shop customers. Legal basis: legitimate interest (Article 6(1)(f) GDPR), namely the security of the Shop.
26. Watermark in the game and on printouts. On the case file pages in the game and in the footer of printed maps and sheets we display a discreet watermark: your nickname (if you have set one) or, without a nickname, a shortened email address of the account (the first three characters and the last character before the “@” and the domain), together with the date; when you play without signing in, a random device identifier stored in the browser (the same one we use to mark progress saves, point 3). The watermark is created by the game on your device from data we already have (it takes the nickname from your account); we do not store any new data on the server for this. Purpose: protecting the copyright in the games, namely discouraging the distribution of screenshots, recordings and printouts of game content and establishing from which account content published in breach of the Terms and Conditions (§ 10) originates, and taking the action referred to in § 4(6) of the Terms and Conditions or pursuing claims. Legal basis: our legitimate interest in protecting copyright and pursuing claims (Article 6(1)(f) GDPR). You may object (Article 21 GDPR); the watermark is, however, part of the game’s protection measures described in § 3(4) of the Terms and Conditions.
27. App and game Library. You can install the Shop on your device as an app (instructions: https://archiwumzagadek.pl/en/jak-zainstalowac). The “Library” page shows your games, your progress and games you can buy, on the basis of the account data referred to in points 1 and 3. So that the Shop and the Library open quickly and the list of your games is visible offline too, the Shop’s service worker stores on your device (not on our server): Shop files (layout, scripts, fonts, icons, game covers and a few pages that contain none of your data: the home page, the game catalogue, the Library, the installation instructions and the “You are offline” page) and the list of games on your account: game identifiers, information about your access to them and its source (for example purchase, gift, code), the date access was obtained and your progress (stage number, whether the case is solved, result, playing time and date of the last save). The list does not contain your email address, name, date of birth, nickname or the content of your notes. The app does not set its own cookies (sign-in is maintained by the same “oo_sesja” cookie as in the browser, Section 8, point 2), does not count installations and does not send us any data other than ordinary requests to the Shop. When you start the app from its icon or a shortcut, the start address contains a marker (for example “?zrodlo=aplikacja”), which is recorded in the server logs together with the page address (point 8). Purpose: faster operation of the Shop and the Library and working offline. Legal basis: performance of the contract for maintaining the account (Article 6(1)(b) GDPR) and, as regards the Shop files, our legitimate interest in the efficient operation of the Shop (Article 6(1)(f) GDPR). The list of games disappears from the device after you sign out (including “Sign out on all devices”), after the account is deleted, at the next sign-in and when the Shop responds that the session has expired; the app deletes a list older than 30 days the next time it starts and does not show it. You can also delete everything yourself by uninstalling the app or clearing the site data in your browser settings. Installation of the app from the browser is carried out by your browser or system on the terms of their provider (for example Chrome, Edge, Safari, Huawei Browser); we do not pass on any data about you to it for this purpose.
28. Fetching company details. When you click “Fetch company details” in an order or on the account page, we send the number entered (NIP or EU VAT number) to a public register: the VAT taxpayer register kept by the Head of the National Revenue Administration, the REGON register kept by the President of Statistics Poland or the European Commission’s VIES system. The register returns the name and address of the business, which we insert into the form; you can correct them. We do not store the registers’ responses (only the server’s working memory keeps them for 15 minutes, so as not to ask twice); we store only the data you confirm in the order. Purpose and legal basis: making it easier to enter invoice details at your request (Article 6(1)(b) GDPR) and checking an EU VAT number before applying the reverse charge (Article 6(1)(c) GDPR).
29. Unfinished sign-in with Facebook (when this option is switched on). When you sign in with Facebook for the first time, we store, for the time needed to confirm your email address: the identifier of your account in our Facebook app, the email address Facebook may have provided, the email address you entered for confirmation, a hash of the code sent, the number of attempts and the page language. We store the code sent and the browser token only as cryptographic hashes. Purpose: confirming that the address is yours before we create an account or link it to an existing one. Legal basis: performance of a contract (Article 6(1)(b) GDPR), at your request. The sign-in expires after 30 minutes, and we delete the record within one day at the latest. When you ask Facebook to delete your data or remove our app there, we record in the deletion log the confirmation code, a hash of the identifier, the date and the outcome (Section 6, point 5).
30. Enquiries from the form for companies and groups. First name and surname, company name (if you give it), email address, telephone number (optional), number of participants and planned date (optional), the message, the date of consent to contact, the page from which the form was sent, the page language and, if you have consented to analytics cookies, the source of the visit (point 16). Purpose: replying to the enquiry and preparing an offer. Legal bases: your consent to contact regarding the enquiry, which you tick in the form (Article 6(1)(a) GDPR), and where the enquiry concerns the conclusion of a contract, also steps taken at your request before entering into a contract (Article 6(1)(b) GDPR). You can withdraw consent at any time by writing to the address in Section 1; we will then delete the enquiry. The enquiry reaches the Controller by email and in the panel; we do not pass it on beyond the providers listed in Section 4, point 1 (hosting and email). We do not link enquiries to player accounts.
31. Providing data is voluntary, but without an email address you cannot create an account, without a date of birth you cannot play a game with an age restriction, without purchase data you cannot buy access, without the recipient’s email address we cannot send them a gift, and without a delivery address and telephone number we cannot send a box. Consent to marketing emails, the survey and the nickname are voluntary: without them you can buy and play the game in exactly the same way (without a nickname you just do not appear in the leaderboards).

Retention periods

This is how long we keep each type of data (counted from the event stated in the table). After this period we delete the data or remove its link to the person.

3. Signing in with Google, Apple and Facebook

1. If you choose “Sign in with Google”, you go to Google’s page and sign in there. Our pages do not load any Google scripts for signing in. Google passes on to us only: your Google account identifier, your email address with information on whether it is verified, your first name and surname and the address of your profile photo (we do not store the photo). We have no access to your password, email, contacts, calendar or any other data in Google.
2. If you choose “Sign in with Apple”, you go to Apple’s page and sign in there. Our pages do not load any Apple scripts. Apple passes on to us only: your Apple account identifier (different for each shop), your email address with information on whether it is verified and, only on first sign-in and only if you agree, your first name and surname. We have no access to your password or any other data in Apple.
3. When signing in with Apple you can choose “Hide My Email”. Apple will then give us a random relay address (…@privaterelay.appleid.com) and will forward our messages (sign-in links, purchase confirmations) to your real address. Your account in the Shop will have the relay address.
4. If you choose “Continue with Facebook” (when this option is switched on), you go to Facebook’s page and sign in there. Our pages do not load any Facebook or Meta scripts, so until that moment Meta receives no data from us. Facebook passes on to us only: the identifier of your account in our app (different in each app) and, if you have one and allow it, your email address. We do not ask for your name, profile photo, friends list or any other data and do not store them. We have no access to your password or your Facebook profile.
5. We treat the email address from Facebook only as a suggestion. On first sign-in we send a code to the address, which you enter in the same browser; only then do we create an account or link it to an account with the same address. If Facebook does not provide an address, we will ask you to enter it. Your account in the Shop has the address you confirmed with the code. This means no one can create an account with your address or take over your account through someone else’s Facebook account. On later sign-ins with Facebook no code is needed. Signing in with Google, Apple, Facebook or with an email link or code leads to one account in the Shop when the email address is the same; we add Facebook to an existing account only once you confirm that the account is yours (with a code from the email, by signing in to it with Google or Apple or, once signed in, with the “Link with Facebook” button in the “Account” tab), and we notify you of this by email.
6. You can link one account in the Shop to only one Facebook account.
7. We use the data from Google, Apple and Facebook solely to sign you in and maintain your account. We do not sell it, do not pass it on for advertising and do not use it for any other purpose. On its sign-in page Google uses its own cookies under the Google Privacy Policy, Apple under the Apple Privacy Policy and Meta under the Meta Privacy Policy.
8. You can revoke access at any time: in your Google account settings (Security → Your connections to third-party apps and services), in your Apple account settings (on iPhone: Settings → [your name] → Sign-In & Security → Sign in with Apple), and on Facebook in the apps and websites settings (after signing in at facebook.com: Settings & privacy → Settings → Apps and websites). When you remove our app there, Facebook notifies the Shop and we unlink Facebook from your account. This does not delete your account in the Shop.

4. Who we share data with

1. Providers that process data on our behalf under data processing agreements: SEOHOST Sp. z o.o., ul. Obornicka 330, 60-689 Poznań (the server on which the Shop and the database run); the email provider through which we send sign-in links, confirmations, gift invitations and dispatch information; an accounting office (purchase data, copies of invoices and a monthly summary of sales documents, including for boxes), if we use one; the provider of invoicing software (the Fakturownia service), if we use it to issue invoices and send them to KSeF; an intermediary through which we send parcels (for example a courier booking service), if we use one.
2. The payment service provider through which you pay, depending on the payment gateway chosen by us (the Seller): Krajowy Integrator Płatności S.A., pl. Andersa 3, 61-894 Poznań, Poland (Tpay service); mBank S.A., ul. Prosta 18, 00-850 Warszawa, Poland (Paynow service); or Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, the Netherlands. We show the provider’s name on the order page before you go to payment. We pass on the amount, description, order number and the language of the payment page, and to Tpay and Paynow also your email address (they send the payment confirmation to it); you provide payment data (for example card number, online banking login details, BLIK code) directly to the provider, which processes it as a separate controller under its privacy policy (Mollie: privacy policy; Tpay and mBank: the privacy policy on their websites). The payment service provider does not receive the gift recipient’s data, the delivery address or the telephone number.
3. Carriers. To the carrier with which we send the parcel with the box (for example InPost sp. z o.o., Kraków; DPD Polska sp. z o.o., Warsaw; Poczta Polska S.A., Warsaw, depending on the delivery method chosen in the order) we pass on the recipient’s first name and surname, address or parcel locker code, telephone number and email address, so that it can deliver the parcel and notify the recipient about it. The carrier processes this data as a separate controller under its own privacy policy.
4. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland: sign-in with Google (if you choose it) and, only with your consent, Google Ads and Google Analytics. Google may also process data in Google LLC in the USA. In Google Ads, Google is a separate controller, and in Google Analytics it processes data on our behalf. Third-party providers, including Google, show our adverts on the internet and use cookies to tailor them to your previous visits to the Shop. How Google uses data from websites that use its services is described on the page How Google uses information from sites or apps that use our services. We also use Google Search Console (aggregate data on the Shop’s visibility in search: numbers of impressions and clicks, queries, positions), we report the public addresses of the Shop’s pages and the sitemap to Google, we may ask Google to check the speed of the Shop’s public pages (PageSpeed Insights), and if we make products available on Google (Merchant Center), Google downloads from our server a file with game data (name, description, price, availability, image). In this way Google receives only public information about the Shop and the games, not data about people using the Shop. To read public figures on the YouTube channels of the businesses we follow (market analysis, Section 2, point 23) we use the YouTube API Services; we send them only the channel name or identifier and our access key, not data about people using the Shop. The YouTube Terms of Service and the Google Privacy Policy then apply. Similarly, to show a business’s Google Maps rating in the panel, we send only the name or identifier of the place and our key.
5. Apple Distribution International Limited, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland: sign-in with Apple (if you choose it), as a separate controller on its own terms. Apple may also process data in Apple Inc. in the USA.
6. Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA: the Cloudflare Turnstile check (when switched on), as a processor acting on our behalf (Section 2, point 9).
7. AI model providers: the AI assistant in the administrator panel (Section 2, point 24), depending on the setting: Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland (the Claude model) or Google (Gemini API; for paid access Google Cloud Poland sp. z o.o., Rondo Daszyńskiego 2C, 00-843 Warsaw, Poland, and for the free quota Google LLC, Mountain View, USA). We send them only aggregate data, survey answers not attributed to any person and public information about the Shop and the market (including short extracts of public reviews from other shops, without authors: Section 2, point 23), which as a rule is not personal data, so these providers are not recipients of your personal data. Should information about a person (for example a name) nevertheless remain in such an extract despite the removal of data that can be detected automatically, the providers process it under their business terms described below. Under their terms, the providers do not use this content to train or improve their models: the Anthropic Commercial Terms with the data processing agreement and the Gemini API Additional Terms of Service, under which in the EEA the rules for paid services also apply to the free quota, and content is processed under the Google data processing terms and logged for a limited time solely to detect abuse. If we were to start transferring data that allows you to be identified, we would first change this policy.
8. Search engines. So that new and changed pages of the Shop appear in search results more quickly, we report their public addresses to search engines: Google (Search Console), Microsoft Bing (Bing Webmaster Tools) and, via the IndexNow protocol, other search engines that support it (including Bing, Yandex, Seznam, Naver). We send only the addresses of the Shop’s public pages and the address of the sitemap (sitemap.xml), that is, information anyone can see in a browser. We do not pass on any data about you in this way. Search engine crawlers (including Apple’s Applebot) read the Shop’s public pages on the terms described in the robots.txt file; the account, purchase and game pages are closed to them.
9. We do not use any other analytics or advertising tools. If we switch any on (for example a pixel of another advertising platform), we will add its provider, purpose and cookies here before switching it on, and it will work only with your consent in the relevant category.
10. To public authorities, where required by law (for example the tax office, a court, the public prosecutor’s office). Invoices for businesses (and other invoices, if we send them there) go to the National e-Invoicing System (KSeF), in which the Ministry of Finance is a separate controller. After you click “Fetch company details”, the number entered goes to the VAT taxpayer register (Head of the National Revenue Administration), the REGON register (President of Statistics Poland) or the VIES system (European Commission), Section 2, point 28.
11. Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland: sign-in with Facebook (if you choose it and when this option is switched on), as a separate controller on its own terms. Meta may also process data in Meta Platforms, Inc. in the USA.
12. Services we only link to. The Shop’s pages may contain links to our social media profiles (for example Facebook, Instagram, TikTok, YouTube, X, LinkedIn, Pinterest, Threads), to our Google Business Profile (including for writing a review) and “Add to calendar” buttons (calendar file, Google Calendar, Outlook). These are ordinary links: we do not load plug-ins, scripts or images from these services and do not set their cookies, so we do not pass on any data about you to them until you click. After a click a new tab opens, and the browser does not send that service the address of the page you came from. From then on the rules and privacy policy of that service apply, and it is then the controller of your data. Google Calendar and Outlook receive only public information about the game’s premiere (title, date, short description and the address of the game page). We do not solicit Google reviews and offer nothing in return for them; we show the review link to everyone who has solved the case.

5. Transfers of data outside the European Economic Area

The Shop’s server and database are located in the European Union. Data may be transferred outside the EEA (to the USA) only through Google (if you sign in with Google or have consented to Google cookies), through Apple (if you sign in with Apple), through Meta (if you sign in with Facebook) and through Cloudflare (the Turnstile check, when switched on). Google LLC, Apple Inc., Meta Platforms, Inc. and Cloudflare, Inc. participate in the EU-US Data Privacy Framework, which is covered by a European Commission adequacy decision, and use the standard contractual clauses approved by the Commission. If our email provider processes data outside the EEA, this takes place on the basis of standard contractual clauses or an adequacy decision. Reports of page addresses to search engines (Google, Microsoft Bing, IndexNow) and data sent to the AI assistant (Anthropic, Google Gemini) as a rule do not contain personal data; the AI providers may also process them outside the EEA (Section 4, point 7).

6. Your rights

1. You have the right to: access your data and receive a copy of it, rectification, erasure, restriction of processing, data portability, object to processing based on legitimate interest and withdraw consent at any time (without affecting the lawfulness of processing before its withdrawal).
2. The same rights belong to a person whose data was given to us by someone else, for example when buying them a gift (Section 2, point 12) or sending them a box (Section 2, point 5). They do not need an account to exercise them: an email is enough.
3. You can exercise most of your rights yourself in the “Account” tab: you can download your data in a file and delete your account. You give your date of birth once; if you made a mistake, write to us. You can withdraw consent to marketing emails in the “Account” tab (“Consents and notifications” section) or via the “unsubscribe” link in every such email; email programs let you do this with one click. You can change your consent to cookies in “Cookie settings” at the bottom of the page. You can change or delete your nickname yourself on the account page (“Nickname and leaderboards”); deleting it switches off publication of your results in the leaderboards, and you can hide an individual result there too (“Hide this result”). You can change the account language with the language switcher. We will deal with other matters after a message to kontakt@archiwumzagadek.pl, within one month.
4. If we do not know who you are because we do not record your name or address (for example in the case of your public review in another shop, Section 2, point 23), tell us the shop, the product and an extract of the text so that we can find and delete it or take your objection into account. We do not collect additional data from you solely in order to identify you (Article 11 GDPR).
5. Deleting data from Facebook. You can unlink Facebook from your account in the Shop at any time: in your Facebook settings (remove our app in the apps and websites settings, together with a request to delete your data) or by writing to us. We then delete the Facebook identifier linked to the account and any unfinished sign-ins. After a data deletion request, Facebook will show you the address of a page with the deletion status and a confirmation code (https://archiwumzagadek.pl/usuniecie-danych). The account in the Shop itself remains until you delete it in the “Account” tab (we keep purchases and accounting documents for as long as the law requires, Section 2).
6. You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Moniuszki 1A, 00-014 Warsaw, Poland (uodo.gov.pl).

7. Automated decisions and profiling

1. We do not take decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Access to a game with an age restriction is switched on automatically on the basis of the date of birth you provided; if there is a mistake, write to us.
2. With your consent, Google may create audience lists for adverts (remarketing) on the basis of visits to the Shop and tailor adverts. You can opt out of this in “Cookie settings” or in Google My Ad Center.
3. If you consent to marketing emails, which email you receive is decided by simple conditions: date of birth, time since you received a game or since your last game, solving a case, an unpaid order. This does not produce legal effects concerning you or similarly significant effects. By opting out of such messages, you also opt out of this tailoring.
4. The server automatically rejects from the leaderboard times shorter than 20 minutes and longer than 100 hours and sets aside for manual checking results for which it has not measured the whole playing time. This concerns only a leaderboard for fun and does not produce legal effects concerning you or similarly significant effects. If you disagree with the assessment, write to us.

8. Cookies and browser storage

1. Cookies are small files that a website stores in your browser. The browser’s local storage (localStorage, sessionStorage, IndexedDB) and the app cache work in a similar way: they store data on your device.
2. Essential (they work without consent because without them the Shop and the game do not work or a function you expressly request, for example remembering the chosen language, would not work; Article 399(3) of the Electronic Communications Law):
   • “oo_sesja”: keeps you signed in; up to 180 days; not accessible to page scripts.
   • “oo_zgoda”: remembers your choice in the cookie banner; 12 months.
   • “oo_jezyk”: remembers the language of the website and the game that you choose with the language switcher (pl, en or uk); 12 months. We set it only after you click the switcher. The game also reads it, which is why it is accessible to page scripts. It contains no personal data.
   • “oo_google”: secures sign-in with Google (a single-use state code); 10 minutes, only when you choose to sign in with Google.
   • “oo_apple”: secures sign-in with Apple (a single-use state code); 10 minutes, only when you choose to sign in with Apple. It is set with SameSite=None because Apple sends you back to the Shop with a form from its own page.
   • “oo_facebook”: secures sign-in with Facebook (a single-use signed state code); 10 minutes, only when you choose to sign in with Facebook; not accessible to page scripts.
   • “oo_fb_oczekuje”: allows the first sign-in with Facebook to be completed by confirming your email address in the same browser (a random token, only its hash is stored in the database); up to 30 minutes; not accessible to page scripts.
   • “oo_urzadzenie”: only on Shop administrator accounts: a random browser identifier which allows the Controller to receive an alert about a sign-in to the panel from a new device; up to 2 years. We store only its cryptographic hash in the database.
   • Shop local storage (localStorage): remembers that we have already shown you the request for consent to marketing emails, so as not to ask twice; until the browser data is cleared.
   • browser tab storage (sessionStorage) on the order page: keeps the gift details entered (the recipient’s address and first name, signature, wishes, sending day), the box delivery address and the invoice details, so that you do not have to enter them again after signing in or a failed payment, and after a purchase a marker that the purchase has already been counted in the statistics (only with consent to analytics or advertising cookies); disappears when the tab is closed.
   • browser tab storage (sessionStorage): remembers that you closed the “This page is also available in your language” notice, so that it is not shown again; disappears when the tab is closed.
   • game local storage: stores the progress and settings of the game (language, sound, text size, narrator voices and speed, whether the tutorial was skipped), a random identifier of this browser for recognising saves from several devices, information on whether the post-game survey was completed or skipped, whether the result card after solving the case has already been shown or put off (“Later”), the print settings for maps and sheets (paper, orientation, margins) and the last measured length of the control segment (scale calculator), as well as the account nickname for the watermark (so that it works offline); until the browser data is cleared.
   • game cache (the game’s service worker): stores the parts of the game you have viewed (and, after choosing “Download the whole game”, the whole game) so that it works offline.
   • Shop app cache (the Shop’s service worker, Cache API): stores Shop files (layout, scripts, fonts, icons, game covers and a few pages without your data) so that the Shop opens faster and shows the “You are offline” page when there is no network, and also the list of games on your account with your progress (Section 2, point 27), so that the Library can show it offline. It does not contain your email address, name or date of birth. The list of games disappears after you sign out, after the account is deleted, at the next sign-in and when the session expires, and after 30 days without a refresh it is no longer shown. The Shop’s service worker is registered in the browser of every visitor to the Shop, including those without an account (we switch it off with one setting; it then removes itself). It does not touch the game (pages under https://archiwumzagadek.pl/gry/), which has its own storage, described in the previous item.
   • game release key (IndexedDB): the game files are encrypted; after you sign in, the browser stores the key that opens them so that the game also works offline. The key cannot be read by a page script, is valid for up to 30 days from the last connection with the Shop and disappears when you sign out in the game or lose access to the game.
   • game save queue (IndexedDB): when there is no internet connection or the Shop is temporarily not responding, it keeps the latest state of the game so that it can be sent to your account when the network returns, even after the tab has been closed (in browsers that allow this, the game’s service worker does it in the background). The entry disappears as soon as it is sent, when you sign out in the game and when the account in this browser changes. It contains the same data as the game progress (Section 2, point 3).
   • clock offset (game local storage): the difference between the device clock and the Shop’s clock, so that a wrongly set phone clock does not decide which version of an entry is newer. It contains no personal data.
   • Cloudflare Turnstile (when protection is switched on) works in a frame from the challenges.cloudflare.com domain and reads the browser information needed for the check. It is not used for advertising or tracking.