Regional Privacy Addendum
This Regional Privacy Addendum supplements the Privacy Policy and Cookie and Similar Technologies Policy. It explains additional rights and compliance measures for users located in the European Union, Portugal, Brazil, the United States, the United Kingdom, Australia and New Zealand.
1. European Union, EEA and Portugal
If you are located in the European Union or European Economic Area, the General Data Protection Regulation (GDPR), national data protection laws and ePrivacy rules may apply. BAD DUCK STUDIO, LDA is established in Portugal. The Portuguese supervisory authority is the Comissao Nacional de Protecao de Dados (CNPD).
In Portugal, where processing is based on consent for the direct offer of information society services to a child, children aged 13 or older may provide consent. For children under 13, consent must be given by a legal representative where required by law. Other EU/EEA countries may apply different age thresholds between 13 and 16.
Non-essential cookies, mobile SDK access/storage, advertising identifiers, personalised advertising, behavioural tracking and non-essential analytics require prior consent where required by law. Rejecting non-essential technologies must be available without preventing access to core gameplay, except where a technology is strictly necessary to provide a requested feature.
EU/EEA users may have the right to:
- access, rectify, erase or port personal data;
- restrict or object to processing;
- withdraw consent at any time;
- object to direct marketing;
- lodge a complaint with the CNPD or another competent supervisory authority.
Where personal data is transferred outside the EEA, we rely on lawful transfer mechanisms such as adequacy decisions, standard contractual clauses or other safeguards required by law.
For Portuguese consumer matters, users may also contact competent consumer authorities or use the Livro de Reclamacoes Eletronico where applicable.
2. Brazil
If you are located in Brazil, the Lei Geral de Protecao de Dados (LGPD) may apply. The controller is BAD DUCK STUDIO, LDA. You may contact us at contact@badduckstudio.com for privacy requests. If a formal encarregado / data protection officer is appointed for Brazil, we will publish the contact details here.
We process personal data for lawful purposes connected with the Application, including gameplay, accounts, cloud saves, leaderboards, purchases, security, fraud prevention, support, analytics and advertising. Legal bases may include contract performance, consent, legitimate interests, legal obligation, exercise of rights and protection of users or third parties, as permitted by the LGPD.
Brazilian users may have the right to:
- confirm whether we process personal data;
- access personal data;
- correct incomplete, inaccurate or outdated data;
- request anonymisation, blocking or deletion of unnecessary, excessive or unlawfully processed data;
- request data portability where regulated by the ANPD;
- receive information about sharing with public and private entities;
- withdraw consent and request deletion of data processed based on consent, subject to legal exceptions;
- request review of decisions based solely on automated processing where applicable;
- petition the Autoridade Nacional de Protecao de Dados (ANPD).
Brazil's ECA Digital applies to digital products and services directed to, likely to be accessed by or capable of attracting children and adolescents, including electronic games and apps. We therefore aim to apply heightened protections for children and adolescents in Brazil, including data minimisation, transparency, age-appropriate settings, parental involvement where required, restrictions on personalised advertising for children and mechanisms to respond to safety or privacy concerns.
If we become aware that personal data from a child or adolescent has been collected in a manner requiring parental consent or additional safeguards, we will take appropriate steps, which may include deletion, limitation of processing, disabling personalised ads or requesting parental authorisation.
3. United States
US privacy law varies by state. Depending on your state, age, the data involved and whether statutory thresholds are met, you may have rights to know, access, delete, correct, port data, opt out of targeted advertising, opt out of sale or sharing of personal information, limit use of sensitive personal information or appeal a decision.
We do not sell personal data for money. However, some advertising and analytics practices may be considered sale, sharing, targeted advertising or cross-context behavioural advertising under certain state privacy laws. Where required, we provide a "Your Privacy Choices" or "Do Not Sell or Share My Personal Information" mechanism through the Application, website or another method made available to users.
The Application may be suitable for children. Under COPPA, if the Application is directed to children under 13 or we have actual knowledge that we are collecting personal information from a child under 13, we will provide required notices, obtain verifiable parental consent where required, give parents access/deletion rights, and avoid targeted advertising to known children without required consent.
California users may have rights under the CCPA/CPRA where applicable, including rights to know, delete, correct, opt out of sale/sharing, limit sensitive personal information and be free from unlawful discrimination for exercising privacy rights. For users known to be under 16, opt-in rules may apply to sale or sharing where applicable.
4. United Kingdom
If you are located in the United Kingdom, UK GDPR and the Privacy and Electronic Communications Regulations (PECR) may apply. We request consent before using non-essential cookies, SDK access/storage, personalised advertising, behavioural tracking, non-essential analytics and ad measurement where required.
UK users may have rights to access, correct, erase, restrict, object, withdraw consent, portability and lodge a complaint with the Information Commissioner's Office (ICO).
The UK Age Appropriate Design Code may apply to online services likely to be accessed by children under 18. Where relevant, we aim to apply high privacy defaults, data minimisation, restrictions on profiling and age-appropriate transparency for children and teenagers.
5. Australia
If you are located in Australia, the Privacy Act 1988 and Australian Privacy Principles may apply if we are covered by the Act or otherwise choose to apply equivalent privacy protections. We aim to provide transparent notice, collect personal information only where reasonably necessary for legitimate functions, protect information, allow access and correction, and explain overseas disclosures.
WordWildWest may use service providers and advertising partners outside Australia. Where Australian cross-border disclosure requirements apply, we will take reasonable steps required by law or rely on an applicable exception.
Australia is developing a Children's Online Privacy Code for online services such as apps, games and websites likely to be accessed by children or primarily concerned with children's activities. We will review the final Code when in force and update our practices where required.
Australian users may contact us to request access, correction or raise a privacy complaint. If unresolved, you may be able to complain to the Office of the Australian Information Commissioner (OAIC).
6. New Zealand
If you are located in New Zealand, the Privacy Act 2020 and information privacy principles may apply. These principles cover collection purpose, source, notice, indirect collection notice, fairness, security, access, correction, accuracy, retention, use, disclosure, overseas disclosure and unique identifiers.
WordWildWest may collect information directly from you and indirectly from app stores, platform services, advertising SDKs, authentication providers and backend providers. Where New Zealand's indirect collection notice rules apply, we provide information about the source, purpose and use of this information in our Privacy Policy and Partners and SDKs Notice.
New Zealand users may request access to or correction of personal information. If unresolved, you may be able to complain to the Office of the Privacy Commissioner.
7. Global advertising choices
You can manage advertising choices through the Application settings where available, the consent management interface, device privacy settings, Google and Apple privacy controls, advertising ID settings and partner opt-out tools. If you opt out of personalised advertising, you may still see contextual or non-personalised ads.
8. How to exercise rights
To exercise privacy rights or ask questions, contact us at contact@badduckstudio.com. Please include your country or region, the right you wish to exercise and enough information for us to locate your account or data. We may need to verify your request before acting on it.