This document is a starting template. Have it reviewed by a qualified attorney before relying on it commercially.

Effective date: 1 January 2026
Last updated: 1 January 2026

1. Introduction

This Privacy Policy (“Policy“) explains how [LEGAL_ENTITY_NAME] (“we“, “us“, “our“, “Bloodhound” or the “Studio“), the developer of the video game Bloodhound (the “Game“), collects, uses, discloses, and protects personal data when you visit bloodhoundgame.com (the “Site“), interact with our forms, follow our links to third-party platforms (Steam, Discord, Instagram, TikTok, YouTube), or otherwise engage with us.

The Game itself is distributed by Kruger & Flint Productions (the “Publisher“) via Valve Corporation’s Steam platform, which has its own separate privacy practices. This Policy covers only the Site and the data we control.

By using the Site you confirm that you have read and understood this Policy. If you do not agree, please discontinue using the Site.

This Policy is written to comply with:

European Union / European Economic Area / United Kingdom — Regulation (EU) 2016/679 (“GDPR“), the UK GDPR, and the ePrivacy Directive (2002/58/EC) as implemented locally;
United States of America — California Consumer Privacy Act / California Privacy Rights Act (“CCPA/CPRA“), Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, and the Children’s Online Privacy Protection Act (“COPPA“);
People’s Republic of China — Personal Information Protection Law (“PIPL“);
India — Digital Personal Data Protection Act, 2023 (“DPDP Act“);
Japan — Act on the Protection of Personal Information (“APPI“), as amended.

Where local law grants you stronger rights than this Policy describes, those local rights prevail.

2. Who is the Data Controller?

The data controller (or, under PIPL, the “personal information handler”) for personal data processed via the Site is:

Legal entity: [LEGAL_ENTITY_NAME]
Registered address: [REGISTERED_ADDRESS]
Company / commercial register no.: [REGISTRATION_NUMBER]
VAT / Tax ID: [VAT_ID]
General contact: press@bloodhoundgame.com (or use the form at bloodhoundgame.com/contact)
Privacy / data-protection contact: press@bloodhoundgame.com
EU representative (Art. 27 GDPR), if applicable: [EU_REP_NAME_AND_ADDRESS]
UK representative (Art. 27 UK GDPR), if applicable: [UK_REP_NAME_AND_ADDRESS]
China representative (Art. 53 PIPL), if applicable: [CN_REP_NAME_AND_ADDRESS]

If the Studio does not have a Data Protection Officer (“DPO“) because it is not legally required, the privacy contact above handles all data-protection inquiries.

3. What Personal Data We Collect

3.1 Information you provide directly

Contact form (bloodhoundgame.com/contact): name, email address, subject, and message body. Provided by you when you submit the form.
Email correspondence: any information you choose to include if you write to us directly.

3.2 Information collected automatically

Device and connection data — IP address (truncated where possible), browser type and version, operating system, screen resolution, language, time-zone offset, referrer URL, exit URL, time stamps of page loads.
Usage data — pages visited, time spent on each page, click events, scroll depth, click-through events on outbound links (Steam, Discord, social media), in-page CTA interactions.
Approximate geolocation — derived from your IP address by analytics providers; we do not collect precise (GPS-level) location.

3.3 Information from third parties

We do not buy lists or enrich your data with third-party datasets. If you reach the Site via a paid advertising click (Meta, Google), our advertising partners may share aggregate or pseudonymous click attribution data with us.

3.4 What we do NOT collect

Government identifiers (passport, national ID, social-security number).
Financial or payment data on the Site. Game purchases are made on Steam, governed by Valve’s privacy policy.
Special-category data (Art. 9 GDPR) — health, ethnicity, sexual orientation, religion, political opinions, biometric data — and we ask that you do not include such data in the contact form.

4. How and Why We Use Your Personal Data

We process your personal data for the following purposes:

Reply to your contact-form inquiry — using your name, email and message. Legal basis: performance of pre-contractual measures or our legitimate interest in supporting users.
Site analytics (visits, conversions, popular pages) — using device and usage data. Legal basis: your consent (where banner shown) or legitimate interest in improving the Site.
Conversion tracking for paid advertising — using click ID, pixel events, page-view events. Legal basis: your consent.
Anti-spam protection for the contact form — using form metadata and IP. Legal basis: legitimate interest in preventing abuse.
Comply with legal obligations and defend legal claims, where applicable.

We will not use your data for purposes incompatible with the above without informing you and, where required, obtaining your consent.

Profiling and automated decision-making. We do not engage in automated decision-making producing legal or similarly significant effects (Art. 22 GDPR). Analytics tools may apply behavioural classification at an aggregate level for reporting purposes only.

5. Cookies and Similar Technologies

We use the following categories of cookies and tracking technologies. You can manage your preferences via the cookie banner (where displayed) and your browser settings.

Strictly necessary (e.g., WordPress session, CSRF token) — first-party, session to 1 year, no consent required.
Analytics (Google Analytics 4: _ga, _ga_*) — Google Ireland Ltd, up to 2 years, requires consent in EU/UK.
Advertising (Meta Pixel: _fbp, fr) — Meta Platforms Ireland Ltd, up to 90 days, requires consent in EU/UK.
Functional (in-page UA detection, viewport units) — first-party, session, no consent required.

The Site implements Google Consent Mode v2 so that analytics and advertising cookies remain inactive by default for users in regions that require prior consent, until consent is granted through the cookie banner.

To withdraw consent, clear cookies for bloodhoundgame.com in your browser, or visit /privacy-policy/ and use the consent re-prompt link if shown.

6. Disclosure of Personal Data

We disclose personal data only as follows:

Service providers (data processors) acting on our documented instructions: hosting (dhosting.pl S.A., Poland, EU), analytics (Google Ireland Ltd), advertising/measurement (Meta Platforms Ireland Ltd), email and contact-form delivery.
Affiliates within our corporate group, where reasonably necessary and under equivalent privacy commitments.
Professional advisors (legal, accounting, audit) under confidentiality.
Acquirers in the event of a merger, acquisition, asset sale, or insolvency; you will be notified before your data becomes subject to a different privacy policy.
Law enforcement and public authorities when required by valid legal process and after assessment of necessity and proportionality.

We do not sell personal data for monetary consideration. Some analytics and advertising activity may meet the broad definition of “sharing” or “sale” under CCPA/CPRA — see Section 9.2 for your opt-out right. We do not transfer personal data to data brokers.

7. International Data Transfers

Your personal data may be transferred to and processed in countries outside your country of residence, including the United States of America, where some of our service providers (Google, Meta) are headquartered.

For transfers of EU/EEA/UK personal data to third countries that do not benefit from a European Commission adequacy decision, we rely on:

Standard Contractual Clauses (“SCCs“) adopted by the European Commission (Decision 2021/914);
UK International Data Transfer Addendum for UK transfers;
Supplementary technical and organisational measures (encryption in transit, pseudonymisation, IP truncation in analytics) where appropriate.

For PIPL, cross-border transfers from the People’s Republic of China are made only where one of the lawful mechanisms in Art. 38 PIPL is satisfied (CAC standard contract, certification, or security assessment as applicable).

You may request a copy of the relevant transfer mechanism by writing to press@bloodhoundgame.com.

8. Data Retention

Contact-form submissions: 24 months from last correspondence, then deleted, unless retention is required for legal claims.
Email correspondence: 24 months from last response.
Analytics data: aggregated/pseudonymised; retained 14 months in Google Analytics 4 (default).
Advertising / pixel data: up to 90 days for click-attribution; aggregated longer.
Server / access logs: 30 days, unless extended for security investigation.
Consent records: up to 5 years from withdrawal — to demonstrate compliance.

After the applicable period we delete or irreversibly anonymise the data.

9. Your Rights

9.1 Universal rights

Access — confirmation whether we process your data, and a copy of it.
Rectification — correction of inaccurate or incomplete data.
Erasure / deletion — removal of your data (subject to legal exceptions).
Restriction — limit how we process your data while a dispute is resolved.
Objection — object to processing based on legitimate interests, including direct marketing.
Withdraw consent — at any time, without affecting the lawfulness of pre-withdrawal processing.
Portability — receive a structured, machine-readable copy of data you provided.
Lodge a complaint — with the supervisory authority in your country.

To exercise any right, write to press@bloodhoundgame.com with sufficient detail to identify you and the right being exercised. We respond within 30 days (extendable by 60 days for complex cases under GDPR; 15 days for India under DPDP; “without undue delay” under CCPA, max 45 days extendable to 90).

9.2 California (CCPA/CPRA)

California residents additionally have the right to:

Know the categories of personal information collected, the sources, the business or commercial purpose, the categories of third parties to whom it is disclosed.
Opt out of “sale” or “sharing” — though we do not sell data for money, our use of advertising cookies may qualify as “sharing” under CCPA. To opt out, click the “Do Not Sell or Share My Personal Information” link in the Site footer (where shown), email press@bloodhoundgame.com with subject “CA Opt-Out”, or set your browser’s Global Privacy Control (GPC) signal — we honour it.
Limit use of sensitive personal information — we do not collect SPI as defined by CPRA, so this right does not apply in practice.
Non-discrimination — we will not deny services, charge different prices, or provide a different level of service because you exercised your rights.
Authorised agent — you may designate an agent in writing to act on your behalf.

9.3 Other US states

Residents of states with comprehensive privacy laws (Virginia, Colorado, Connecticut, Utah, and others) have rights to access, correct, delete, opt out of targeted advertising and certain profiling, and appeal denied requests. Submit to press@bloodhoundgame.com.

9.4 People’s Republic of China (PIPL)

In addition to the universal rights, individuals in the PRC have the right to:

Withdraw consent at any time.
Request that we stop using personal information through automated decision-making for personalised advertising or push notices.
Request the transfer of personal information to a personal-information handler designated by you, where technically feasible.
Lodge a complaint with the Cyberspace Administration of China (CAC) or the relevant local authority.

If a person whose data we hold passes away, their close relatives may exercise rights for legitimate purposes unless the deceased had instructed otherwise.

9.5 India (DPDP Act, 2023)

The right to nominate another individual to exercise rights on their behalf in case of death or incapacity.
The right to grievance redressal via our designated grievance officer (see Section 14).
The right to lodge a complaint with the Data Protection Board of India under Section 27 of the DPDP Act.

For minors (under 18 years) we require verifiable parental consent before processing data and will not engage in tracking, behavioural monitoring, or targeted advertising directed at minors.

9.6 Japan (APPI)

Individuals in Japan have the right to request disclosure, correction, addition or deletion, suspension of use, suspension of provision to third parties, and disclosure of records of provision under Articles 32–35 APPI as amended. Complaints may be brought to the Personal Information Protection Commission of Japan.

9.7 EU/EEA/UK supervisory authorities

You may lodge a complaint with your local Data Protection Authority — for example, UODO in Poland, the ICO in the United Kingdom, the CNIL in France, the AEPD in Spain, the Garante in Italy, the BfDI in Germany, the Data Protection Commission in Ireland, or any other EU/EEA DPA listed at edpb.europa.eu.

10. Children’s Privacy

The Site and the Game are not directed at children under 13 years of age (United States — COPPA), or under the digital-consent age applicable in your country (16 in most EU member states; 14 in Poland, Italy, Spain, Greece, Croatia, Cyprus; 13 in Belgium, Denmark, Estonia, Finland, Latvia, Malta, Portugal, Sweden, UK; 18 in India).

We do not knowingly collect personal data from children below the applicable threshold. If we learn that we have done so we will delete the data promptly. Parents or guardians who believe their child has submitted personal data to us should contact press@bloodhoundgame.com with the subject “Child Data Removal”.

11. Security

We implement appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage:

HTTPS / TLS 1.2+ for all data in transit;
WordPress core, theme, and plugin updates applied promptly;
Server-level firewall, brute-force protection, and rate limiting;
Role-based access control to administrative interfaces;
Encrypted off-site backups;
Restricted access to personal data on a need-to-know basis with confidentiality obligations.

No method of internet transmission or electronic storage is 100% secure. In the event of a personal-data breach affecting your rights or freedoms we will notify you and the relevant supervisory authorities within the timeframes required by applicable law (within 72 hours under GDPR/UK GDPR; without undue delay under PIPL, DPDP, and APPI).

12. Third-Party Services and Links

The Site contains links to third-party services that have their own privacy policies. We are not responsible for the privacy practices of those parties. Review their policies before providing data:

Steam (Valve Corporation) — store.steampowered.com/privacy_agreement
Discord (Discord Inc.) — discord.com/privacy
Instagram, Facebook (Meta) (Meta Platforms) — privacycenter.instagram.com / privacycenter.facebook.com
TikTok (TikTok Inc. / TikTok Pte. Ltd.) — tiktok.com/legal/privacy-policy
YouTube / Google (Google LLC) — policies.google.com/privacy

13. Changes to This Policy

We may update this Policy from time to time. The “Last updated” date at the top reflects the latest revision. For material changes affecting your rights we will provide reasonable advance notice (e.g., a banner on the Site or, where we have your email, a direct notification) and, where required, request renewed consent.

14. Contact Us

General privacy questions: press@bloodhoundgame.com
Data Subject Requests (DSRs): press@bloodhoundgame.com — subject “DSR”
Cookie consent withdrawal: use the cookie banner re-prompt or clear bloodhoundgame.com cookies
Press / business: press@bloodhoundgame.com
EU representative (Art. 27 GDPR): [EU_REP_CONTACT]
UK representative: [UK_REP_CONTACT]
China representative (PIPL Art. 53): [CN_REP_CONTACT]
India grievance officer (DPDP): [GRIEVANCE_OFFICER_NAME], press@bloodhoundgame.com
Japan APPI inquiries: press@bloodhoundgame.com

End of Privacy Policy.