How We Use Your Data:

• To provide the game service.
• To improve the game.
• Anonymized data (not linked to you personally) may be shared with authorities/researchers for disaster preparedness studies.

Data Sharing (Data Processors):

• Epic Online Services: For player login and essential game functionality.
• Optional Integrations (RU-prepared, Disastropedia, IM-prepared): We only share your data (EpicID and sometimes progress) with these platforms if you actively choose to connect them. You can disconnect them at any time.

Your Rights:

• Withdraw Consent: You can stop the processing of your data at any time (e.g., by deleting your account or uninstalling the game). This will mean you can no longer play online.
• Right to Erasure: You can request that we delete your personal data.
• Right to Object: You can object to the processing of your data.
• Right to Complain: If you have concerns, contact our Data Protection Officer, or the national Supervisory Authority (NAIH in Hungary).

Duration: We keep your data only until you withdraw your consent, after which it will be deleted or permanently anonymized.

Full text of the VR-prepared Privacy Policy

Introduction

The data management information describes the processing of personal data by Székely Family and Company Nonprofit Ltd. as the data controller for the VR multiplayer coop game VR-prepared. It informs the data subjects (players) about their rights and the way to exercise them.

By accepting the Privacy Policy and Terms of Use, the player gives their consent to the processing of their EpicID as personal data as described herein. For underage persons, a valid consent requires the explicit consent of their parents or legal guardians.

Responsibilities for data management

Data Controller

Székely Family and Company Ltd.,
1191 Budapest Fő utca 11. 7/20.,
info@szekely.family

Data Protection Officer

Bence Juhász
sustainability@szekely.family
+36303271404

Data Processors

1. Epic Online Services (used for player login)
   • Note: A data processing agreement exists between VR-prepared and Epic Online Services following EU SCC rules.
2. RU-prepared (when connected via player consent) – https://edugamitec.com/privacy-policy/ 
3. Disastropedia (when connected via player consent) – 
4. IM-prepared (when connected via player consent)

We use data processors through software and software services for essential game functionality, user login, and to facilitate optional integrations with other platforms.Principles, purposes and legal basis for processing

Brief description of data management

The purposes of the data processing are to provide the VR-prepared game experience, ensure its technical operation, enhance the product through development, and perform research on citizen disaster preparedness. Data processing is primarily based on the player’s consent.

Proportionality and necessity of processing

Székely Family and Company Nonprofit Llc. processes personal data only when its processing is proportional and necessary to advance security, sustainability, and space capabilities of humanity, contributes towards the expected impact along the just and green societal and economic transformation of our society, which is serving mutual interest of the data subject and the company. We only process data when there is a good reason and a justified purpose and we do not process data longer than is strictly necessary, without prejudice to archiving purposes.

Overview of the legal bases and purposes of data processing

VR-prepared processes player data on the following legal basis:

1. Consent: We process data because “the data subject has given his or her consent to the processing of his or her personal data for one or more specific purposes” (Article 6(1)(a) GPDR).
   • By accepting the Privacy Policy and Terms of Use, the player consents to the processing of their EpicID and performance data.

Register for Data Processed Based on Consent (VR-prepared Player Data)

This register contains the personal data processed for the specific purpose of providing the VR-prepared game experience, performing research, innovation, and making results of those available to the public. This processing shall be based solely on the informed consent of the data subject, which may be withdrawn at any time.

The following data is processed on the basis of your consent:

1. EpicID: This is the only personal identifier collected from the player.
2. In-game player performance data:
   • Completion of missions
   • Accuracy of missions
   • Time spent in missions
   • Number of attempts
   • Number of players in the same mission or in the same scenario

The collected player performance data is used to further develop the VR-prepared experience. Anonymized (non-personal) data on player performance may be shared for competent and mandated authorities or research institutions with the aim to better understand and develop citizen disaster preparedness.

Integration with B-prepared Components

VR-prepared can be connected to other B-prepared components, such as Disastropedia, IM-prepared, or RU-prepared.

• This connection must be initiated by the player.
• Initiating this connection constitutes a consent to share the player’s EpicID and — in the case of RU-prepared — the player’s progress.
• This integration can be canceled at any time, which acts as a withdrawal of consent for data sharing with the integrated component.

Duration of data processing

The processing based on the informed consent of the data subject shall continue until the data subject withdraws his or her consent, after which the processing shall cease. The obligation to erasure does not exclude the processing of information obtained from the anonymised processing of data for statistical purposes prior to their erasure, but such information must not contain personal data and must not make the data subject identifiable.

Process of data processing

Information to the person concerned

The data subject must be informed before the processing starts, and must be given the opportunity to familiarise him or herself with the information notice. This is done by making it available and requiring acceptance before first use.

Establishment of the legal basis and Consent

Before processing, the legal basis on which we process the personal data of the data subject is established as consent (Article 6(1)(a) GPDR). By accepting the Privacy Policy and Terms of Use, the player provides this consent. Underage persons must have the consent of their parents to have a valid consent.

Data capture

Data processing is initiated by the communication of data (EpicID upon login) and the recording of in-game performance data based on the data subject’s informed consent. The legal basis for the processing must be checked before recording.

Data storage and processing

The data is stored and processed automatically to enable the game functionality, track progress, and gather data for development and research. The processed data may be anonymised and used to produce statistical reports upon termination of the processing; the anonymised statistical report thus produced is no longer personal data.

Additions, corrections, data changes

The data subject has the right to request that personal data stored about him or her be supplemented, corrected or changed. For the VR-prepared game, this is limited to the EpicID and associated account information managed by Epic Online Services.

Withdrawal of consent

The data subject may withdraw his or her consent at any time without undue prejudice. This includes withdrawing consent for the processing of EpicID, performance data, or an optional integration with B-prepared components. A legitimate consequence, such as the termination of the service (inability to play VR-prepared online), shall not be considered as an unjustified disadvantage. After withdrawal of consent, the termination of processing shall be implemented. When consent is withdrawn, the processing must cease. If there is no retention obligation, the data must be deleted or its connection with the natural person severed irrecoverably (anonymisation). Retention obligations may  be imposed by mandated public authorities, such as courts and in some cases, criminal police or by legitimate interests of third parties if thoroughly justified.

Delete data

If there is no retention obligation or the retention period has expired, the data must be deleted. This will terminate the data management.

Data transmission

We will not disclose the data to third parties without the express authorisation of the data subject for the data and the transfer. Exceptions to this are our contracted data processors (Epic Online Services, RU-prepared, Disastropedia, and IM-prepared) and authorities to whom we are legally obliged to transfer the data.

Rights of data subjects

Right to complain

Any data subject has the right to complain to our Data Protection Officer and if no action has been taken by us within 30 days, to the supervisory authority regarding the processing of his or her personal data.

Data Protection Supervisory Authority:

E-mail: ugyfelszolgalat@naih.hu
Mailing address: 1363 Budapest, Pf.: 9.
E-gov contact: Short name – NAIH, KR ID – 429616918
Phone: +36 (30) 683-5969, +36 (30) 549-6838, +36 (1) 391 1400

Right to erasure

The data subject has the right to request the erasure of personal data concerning him or her without undue delay, and the data controller shall have the obligation to erase personal data without undue delay where one of the legal grounds set out in Article 17 of the GDPR applies.

Right to object

The data subject has the right to object to the processing of personal data concerning him or her at any time on grounds relating to his or her particular situation.