1. Who is responsible for your data?
The data controller is the L2Pegasus project operator. The final legal identity, postal address, dedicated privacy email and hosting details will be published before public commercial launch. During internal testing, privacy requests may be sent through the official L2Pegasus Discord.
2. Data we collect
Depending on the features you use, we may process:
- account data, including account name, email address and securely hashed password;
- game data, including character names, identifiers, inventory, progression, actions, sanctions and server logs;
- technical and security data, including IP address, connection time, device or launcher information, crash information and anti-abuse signals;
- transaction data, including order reference, selected reward, character, amount, currency, payment status and provider reference;
- voting data, including the selected character, voting platform, platform vote reference, validation status and timestamps needed to prevent duplicate rewards;
- support and community communications you send to us;
- basic website data such as necessary cookies, session identifiers and security logs.
Payment card or PayPal credentials will be handled directly by the relevant payment provider when payments are enabled. L2Pegasus does not intend to store full card details.
3. Why we use your data
We process data to create and authenticate accounts, operate the game and website, preserve characters and inventory, deliver digital rewards, process and document transactions, prevent fraud and cheating, secure the infrastructure, enforce rules, answer support requests, comply with legal obligations and improve reliability.
4. Legal bases
Depending on the purpose, processing is based on performance of the contract with you, compliance with legal obligations, our legitimate interests in operating and securing the Service, or your consent where consent is required. You may withdraw consent at any time, without affecting earlier lawful processing.
5. Who receives the data?
Access is limited to authorised L2Pegasus administrators and service providers that need the information to perform their role. These may include hosting and infrastructure providers, security and logging providers, payment providers such as Stripe and PayPal, voting platforms such as L2TOP, Hopzone and Top100Arena when you choose to vote, and support tools. Providers act under their own policies or contractual data-protection obligations as applicable.
Discord is an independent third-party service. Information you publish or send through Discord is also processed by Discord under its own privacy policy. Do not send passwords or unnecessary sensitive data through public channels.
6. International transfers
Some providers may process data outside the European Economic Area. Where required, transfers will rely on an adequacy decision, approved contractual safeguards or another lawful transfer mechanism. Provider information will be completed before those services are enabled publicly.
7. How long we keep data
Account and game data are generally kept while the account or project remains active and for a reasonable period afterward for security, dispute and restoration purposes. Security logs are kept only as long as reasonably necessary for abuse prevention and investigation. Transaction and accounting records may be retained for the period required by tax, accounting and consumer law. Support messages are deleted or anonymised when no longer needed.
Specific retention periods will be documented before public launch and reviewed regularly. Data may be retained longer where necessary to establish, exercise or defend legal claims.
8. Security
We use reasonable technical and organisational safeguards, including access restrictions, password hashing, backups, logging and environment separation. No online system is completely secure. Players must use a unique password, protect their credentials and report suspected compromise promptly.
9. Cookies and local storage
The website may use strictly necessary cookies or local storage for authentication, security and user preferences. Optional analytics or marketing technologies will not be activated without the information and consent required by applicable law. A cookie-management interface will be added if non-essential trackers are introduced.
10. Your rights
Subject to applicable law, you may request access, correction, deletion, restriction, portability or objection to certain processing. You may also withdraw consent and lodge a complaint with the competent supervisory authority, including the French CNIL where applicable.
We may need to verify your identity before fulfilling a request. Certain information may be retained where required by law, necessary for security or needed to establish or defend legal claims.
11. Children
The Service is not directed at children who cannot lawfully consent to data processing or enter these terms in their jurisdiction. A parent or legal guardian must authorise use where required. If we learn that data was collected unlawfully from a child, we will take appropriate steps to delete it.
12. Changes and contact
This policy may be updated as the Service and its providers evolve. Material changes will be announced and the effective date updated. Until the dedicated privacy email and final operator details are published, contact the L2Pegasus team through the official Discord for privacy requests.
