1. Data controller
The controller responsible for the processing of your personal data on brightforgely.com (the "Website") is:
- Controller
- [OPERATOR LEGAL NAME]
- Company ID (IČO)
- [IČO / COMPANY ID]
- Registered office
- [REGISTERED OFFICE ADDRESS], Czech Republic
- Privacy contact
- [email protected]
- Phone
- [PHONE]
We process personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") and Czech Act No. 110/2019 Coll. on personal data processing. Given the small scale and nature of our processing, we have not appointed a Data Protection Officer; all privacy questions go to [email protected].
2. Scope of this policy
This policy applies to everyone who visits or uses the Website, in every language version, whether or not they register. It covers data stored in your browser by the Website, data sent to our server, data processed by our hosting and delivery providers and emails you send us. It does not cover third-party websites we link to, such as helpline organisations or regulators, which have their own policies. Details on browser storage and cookies are also given in our Cookie Policy.
3. What data we process and where it is stored
3.1 Data stored only in your browser
Brightforgely is designed so that most information never leaves your device. The Website uses your browser's local storage (localStorage). We cannot read these values from our server; they stay on your device until you delete them.
| Key | Purpose |
|---|---|
bfy_lang | Your chosen language (also set as a first-party cookie of the same name for 12 months so the server can show the right language). |
bfy_users | List of accounts created on this device: email, display name and a hash of the password. The password hash never leaves your browser. |
bfy_user | The account currently signed in on this device: email, display name, registration flag and creation date. |
bfy_credits | Your virtual credit balance. Credits have no monetary value. |
bfy_age_ok | Remembers that you confirmed you are 18 or over, so the notice is not shown on every page. |
bfy_cookies | Your cookie and storage choice ('1' all, '0' essential only). |
bfy_free_refill_used | Records that the one free 500-credit top-up has been used. |
bfy_unsub | A local list of unsubscribe requests made from this device, so the page can confirm them to you. |
3.2 Data sent to our server when you register
If you create an optional account, the Website sends three items to our server endpoint /save_email.php: your email address, a timestamp of registration and a hashed IP address (a one-way hash, not the readable IP). We use this record to manage the list of accounts, handle unsubscribe and self-exclusion requests and prevent abuse such as mass registrations. Your display name and password are not sent.
3.3 Hosting server logs
Like any website, our hosting provider automatically records technical access data for every request: IP address, date and time, the page requested, HTTP status, browser user agent and referring page. These logs are used only for security, troubleshooting and abuse prevention.
3.4 Emails you send us
Our contact form opens your own email program (a mailto link), so nothing you type is stored on the Website. When you email us, we receive your email address, your message and anything you attach, and we keep it in our mailbox to answer you.
3.5 Third-party services
- Google Fonts. Our typefaces are loaded from Google's servers (fonts.googleapis.com and fonts.gstatic.com). To deliver them, your browser connects to Google, which receives your IP address and browser information. Google Ireland Limited / Google LLC are responsible for that processing.
- Cloudflare. The Website may be delivered through the Cloudflare content delivery network, which handles requests (including your IP address) to deliver pages quickly and protect them from attacks.
We use no analytics tools, no advertising or tracking cookies, no social media pixels and no third-party ad networks.
4. Purposes and legal bases
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Providing the Website, remembering language, credits and settings | localStorage values, language cookie | Art. 6(1)(b) performance of the contract (our Terms) and 6(1)(f) legitimate interest in a working site; storage is strictly necessary for the service you request |
| Managing optional accounts | Email, timestamp, hashed IP | Art. 6(1)(b) contract and 6(1)(f) legitimate interest in preventing abuse |
| Unsubscribe and self-exclusion requests | Email, request date, chosen period | Art. 6(1)(b) contract and 6(1)(f) legitimate interest in protecting players and honouring their choices |
| Security and troubleshooting | Server logs, CDN data | Art. 6(1)(f) legitimate interest in a secure and stable Website |
| Displaying our fonts | IP address, browser data sent to Google | Art. 6(1)(f) legitimate interest in a consistent, readable design |
| Answering your emails | Email address, message content | Art. 6(1)(b) where it concerns your use of the Website, otherwise 6(1)(f) |
| Recording your cookie choice | bfy_cookies | Art. 6(1)(c) legal obligation to respect your choice and 6(1)(f) |
| Establishing or defending legal claims | Relevant records | Art. 6(1)(f) legitimate interest |
Where we rely on legitimate interests, we have weighed them against your rights and kept the data to a minimum. You may object at any time (see section 13).
5. How long we keep data
| Data | Retention |
|---|---|
| localStorage values | Until you clear your browser data or sign out and delete them; we have no access to them |
Language cookie bfy_lang | 12 months, or until you delete it |
| Server account record (email, timestamp, hashed IP) | Until you delete your account, or 24 months after your last activity, whichever comes first |
| Self-exclusion block | For the period you chose (6 months, 1 year or permanent), then deleted |
| Hosting server logs | Up to 30 days, unless needed to investigate a specific security incident |
| Emails to us | As long as needed to deal with your request, and no longer than 24 months after it is closed |
6. Recipients and processors
We do not share your data with anyone except where needed to run the Website:
- Hosting provider (processor) which stores the Website, the account records and the server logs on servers in the European Union, under a data processing agreement (Art. 28 GDPR).
- Cloudflare, Inc. (processor) as content delivery network and security service, where used.
- Email service provider (processor) that hosts our mailboxes.
- Google, as an independent provider of Google Fonts.
- Public authorities, courts or legal advisers, only where we are legally obliged or it is necessary to establish or defend legal claims.
Our processors may only use the data on our instructions and must keep it secure and confidential.
7. International transfers
We aim to keep data in the European Economic Area. Cloudflare and Google may process data, in particular IP addresses, in the United States or other countries outside the EEA. Where this happens, the transfer is based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (for certified companies) and/or on the Standard Contractual Clauses adopted by the Commission (Art. 46(2)(c) GDPR), with additional safeguards where applicable. You can ask us for information about these safeguards at [email protected].
8. No profiling, no automated decisions
We do not build profiles of you, do not analyse your play to predict your behaviour or interests and do not take any decision about you based solely on automated processing that has legal or similarly significant effects (Art. 22 GDPR). Game outcomes are produced by a random number generator and are not personalised.
9. No sale of data
We do not sell, rent or trade your personal data, and we do not share it with advertisers, data brokers or gambling operators. We do not send marketing on behalf of third parties.
10. Children
The Website is only for people aged 18 or over. We do not knowingly collect data from anyone under 18. If you believe a minor has registered, please contact [email protected] and we will delete the server-side record promptly.
11. Security
We protect data with measures appropriate to the risk: all traffic is encrypted with HTTPS; passwords are hashed and stay in your browser; IP addresses sent at registration are stored only as a one-way hash; server access is limited to the people who need it and protected by strong authentication; we collect only what we need and delete it on schedule. No system is perfectly secure, so please also protect your own device and do not reuse passwords.
12. Data breaches
If a personal data breach occurs, we will notify the Czech Office for Personal Data Protection (ÚOOÚ) without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to your rights (Art. 33 GDPR). If the breach is likely to result in a high risk, we will also inform affected users directly and without undue delay (Art. 34 GDPR).
13. Your rights
Under Articles 15 to 22 GDPR you have the following rights:
- Right of access (Art. 15): to know whether we process your data and to receive a copy together with information about the processing.
- Right to rectification (Art. 16): to have inaccurate data corrected and incomplete data completed.
- Right to erasure (Art. 17): to have your data deleted, for example when it is no longer needed or you withdraw from the account ("right to be forgotten").
- Right to restriction (Art. 18): to have processing limited while, for instance, the accuracy of data or an objection is being checked.
- Notification obligation (Art. 19): we will inform any recipients of a rectification, erasure or restriction, and tell you who they are if you ask.
- Right to data portability (Art. 20): to receive the data you gave us in a structured, commonly used, machine-readable format (for example JSON) and to have it sent to another controller.
- Right to object (Art. 21): to object at any time, on grounds relating to your situation, to processing based on legitimate interests; we will stop unless we have compelling legitimate grounds or need the data for legal claims.
- Rights related to automated decisions (Art. 22): not to be subject to a decision based solely on automated processing with legal or similarly significant effects. We make no such decisions.
Where processing is based on consent, you may withdraw it at any time without affecting earlier processing. You can change your storage choice at any time with the cookie settings link or by clearing your browser data.
14. How to exercise your rights
Email [email protected], ideally from the address you registered with, and tell us which right you want to exercise. Exercising your rights is free of charge. We will reply within 30 days at the latest; for complex or numerous requests this may be extended by up to two further months, in which case we will tell you why within the first 30 days. If we have reasonable doubts about your identity, we may ask for information to confirm it. Data stored only in your browser can be viewed and deleted directly by you in your browser settings, because we have no copy of it.
15. Supervisory authority
If you think we process your data unlawfully, please contact us first so we can put it right. You also have the right to lodge a complaint with the supervisory authority:
- Authority
- Úřad pro ochranu osobních údajů (ÚOOÚ), Office for Personal Data Protection
- Address
- Pplk. Sochora 27, 170 00 Praha 7, Czech Republic
- Website
- uoou.gov.cz
You may also complain to the supervisory authority in the EU member state where you live or work, or where the alleged infringement took place.
16. Changes to this policy
We may update this policy when the Website, our providers or the law change. The "Last updated" date at the top shows the current version. Significant changes will be announced on the Website and, if you have an account, we may also inform you by email before they take effect.
17. Contact
For any question about privacy or this policy, write to [email protected] or by post to [OPERATOR LEGAL NAME], [REGISTERED OFFICE ADDRESS], Czech Republic. For other matters see our contact page and our Terms & Conditions.