PRIVACY POLICY www.catmaster.eu 2026-03-20

PRIVACY POLICY

www.catmaster.eu

§ 1 GENERAL PROVISIONS

The data controller for the personal data of users of the website and browser game located at the domain www.catmaster.eu is SPICYGLASS SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, with its registered office in Gdańsk, at ul. Sierpowa 33, 80-738 Gdańsk, entered in the National Register of Entrepreneurs maintained by the District Court for Gdańsk-Północ in Gdańsk, 7th Commercial Division of the National Court Register, under KRS number: 0001184017, with tax identification number (NIP): 5833543394, and statistical number (REGON): 54228578, share capital: PLN 144,000.00, fully paid up (hereinafter: “the Administrator”).
The Administrator has set up an electronic contact point for direct communication with the authorities of Member States, the Commission and the Digital Services Board, available at: contact@catmaster.eu. Users may also use this channel to contact the Administrator quickly and directly.
You can also contact us:
in writing at the address given above,
via the in-game chat,
or via the contact form available on the Service’s website.
Communication may take place in Polish or English.
The purpose of this Policy is to set out the measures taken in relation to personal data collected via the Administrator’s website and the associated services and tools used by its users, as well as in the context of entering into and performing contracts through channels other than the website.
The Administrator emphasises that this privacy policy describes only how the Administrator processes data and is based on the data it has obtained itself. The Administrator makes every effort to ensure the highest possible level of data security by verifying the entities with which it cooperates; however, it encourages users to familiarise themselves with the privacy policy applicable on the relevant portal before making a purchase.
If necessary, the provisions of this Policy may be amended. Users will be notified of any changes by means of a new version of the Policy; in the case of individuals who have consented to the processing of their data via email or provided their email address when entering into contracts, they will also be notified of the changes by email.

§ 2 LEGAL BASIS FOR PROCESSING, PURPOSES AND STORAGE OF PERSONAL DATA

Users’ personal data is processed in accordance with the General Data Protection Regulation, the Personal Data Protection Act, the Personal Data Protection Act of 10 May 2018, and the Act on the Provision of Electronic Services of 18 July 2002, together with subsequent amendments thereto, and for the purposes of making a notification pursuant to Article 16(1) of Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on the Digital Services Market and amending Directive 2000/31/EC (Digital Services Act) (OJ L 2022, 277.1, as amended; ‘DSA’), and also pursuant to Article 3(h) of the DSA.
The Administrator may collect the following data for the following purposes:

PURPOSE OF DATA PROCESSING	LEGAL BASIS FOR DATA PROCESSING AND DATA RETENTION PERIOD	DATA RETENTION PERIOD	RANGE OF DATA PROCESSED
To perform a contract with the Customer or to take action at the request of the data subject prior to the conclusion of the aforementioned contracts	Article 6(1)(b) of the GDPR (performance of a contract).	for the duration of the aforementioned agreement until the expiry of the legal obligation relating to accounting the data will be processed until the expiry of the period during which claims may be brought	first name and surname; email address; phone number; address (street, house number, flat number, postcode, town/city, country), company name, NIP
E-services implementation	Article 6(1)(f) of the GDPR (the administrator’s legitimate interests). The Administrator may process data for direct marketing purposes only after obtaining the data subject’s consent and provided the data subject has not objected. Article 6(1)(b) of the GDPR (performance of a contract).	until you withdraw your consent – please note that you may withdraw your consent at any time. The processing of your data remains lawful until you withdraw your consent. the data will be processed until the expiry of the period during which claims may be brought	email address; phone number; user ID; IP address; browser, The content and URLs that the User accesses, Date and time of calls. User password, the user’s date of birth the user's country of origin.
Marketing	Article 6(1)(a) of the GDPR (consent)	until you withdraw your consent – please note that you may withdraw your consent at any time. The processing of your data remains lawful until you withdraw your consent. the data will be processed until the expiry of the period during which claims may be brought until you unsubscribe from the newsletter.	first name and surname; email address; phone number; address (street, house number, flat number, postcode, town/city, country),
The Customer’s feedback	Article 6(1)(a) of the GDPR	if you do not express an opinion within 30 days of making your purchase or until your objection to the processing has been taken into account; when expressing an opinion – until it is deleted or until an objection to the processing is upheld the data will be processed until the expiry of the period during which claims may be brought	first name and surname; email address; phone number;
Bookkeeping	Article 6(1)(c) of the GDPR in conjunction with Article 86(1) of the Tax Ordinance, i.e. of 17 January 2017 (Journal of Laws of 2017, item 201) or Article 74(2) of the Accounting Act, i.e. of 30 January 2018 (Journal of Laws of 2018, item 395).	the data will be processed until the expiry of the period during which claims may be brought The data is retained for the period required by the legal provisions governing the retention of tax records (until the expiry of the limitation period for tax liabilities, unless otherwise provided for in tax legislation) or accounting records (five years from the start of the year following the financial year to which the data relates).	first name and surname; email address; phone number; address (street, house number, flat number, postcode, town/city, country), NIP; company name,
Processing a refund	The performance of the Contract or the taking of steps at the request of the data subject prior to entering into the Contract (Article 6(1)(b) of the GDPR).	5 years after the end of our business relationship with the customer	first name and surname; email address; phone number; address (street, house number, flat number, postcode, town/city, country), business entity details.
The establishment, pursuit or defence of claims that may be brought by the Administrator or against the Administrator	Article 6(1)(f) of the GDPR	The data is retained for as long as our legitimate interest persists, but for no longer than the limitation period for claims against the data subject arising from our business activities.	first name and surname; email address; phone number; address (street, house number, flat number, postcode, town/city, country), NIP; company name
Conducting research and analysis to improve the performance of existing services	Article 6(1)(f) of the GDPR	the data will be processed until the expiry of the period during which claims may be brought until the expiry or deletion of cookies used for analytical purposes	company name email address; phone number; address (street, house number, flat number, postcode, town/city, country), computer components, settings; the installed software.
Collection of telemetry data	Article 6(1)(f) of the GDPR	until the expiry or deletion of cookies used for analytical purposes	IP address, approximate location based on IP address, username, the distribution and use of software.
Customer account registration	The performance of the Contract or the taking of steps at the request of the data subject prior to entering into the Contract (Article 6(1)(b) of the GDPR)	5 years after the end of the business relationship with the customer	first name and surname; email address; phone number; address (street, house number, flat number, postcode, town/city, country), business entity details.
Sending notifications to the customer	The performance of the Contract or the taking of steps at the request of the data subject prior to entering into the Contract (Article 6(1)(b) of the GDPR) Compliance with a legal obligation to which the Administrator is subject (Article 6(1)(c) of the GDPR)	5 years after the end of the business relationship with the customer	first name and surname; email address; phone number; address (street, house number, flat number, postcode, town/city, country), business entity details.
Providing customer service	The performance of the Contract or the taking of steps at the request of the data subject prior to entering into the Contract (Article 6(1)(b) of the GDPR)	5 years after the end of the business relationship with the customer 2 years after the customer's last enquiry	first name and surname; email address; phone number; address (street, house number, flat number, postcode, town/city, country), business entity details.
Proper functioning of the website	Maintaining the performance of the Website and improving it (Article 6(1)(f) of the GDPR)	5 years after the end of the business relationship with the customer	As in the cell above, Information about activities carried out on the website (button clicks, duration of visits, notifications viewed, and other information depending on the specific business context).
Allowing the customer to reset their password	Protection and security of the website, customers’ interests, safeguarding customer security (Article 6(1)(f) of the GDPR)	5 years after the end of the business relationship with the customer	first name and surname; email address; business entity details. the customer's password, User ID.
Monitoring compliance with regulations, contracts and privacy policies	Protection and security of the website, customers’ interests, safeguarding customer security (Article 6(1)(f) of the GDPR)	5 years after the end of the business relationship with the customer	transaction data, business entity details.
Processing requests regarding personal data,	Article 6(1)(f) of the GDPR	The period during which the Administrator’s legitimate interest subsists, but not exceeding the limitation period for claims against the data subject arising from the Administrator’s business activities.	first name and surname; email address; phone number; address (street, house number, flat number, postcode, town/city, country), NIP; company name
Providing information to law enforcement agencies and other state institutions,	Article 6(1)(f) of the GDPR	The period during which the Administrator’s legitimate interest subsists, but not exceeding the limitation period for claims against the data subject arising from the Administrator’s business activities.	first name and surname; email address; phone number; address (street, house number, flat number, postcode, town/city, country), NIP; company name
Compliance with the legal obligation set out in Article 16(1), (4), (5) and (6) of the DSA, which consists of: 1. receiving a notification regarding the presence on a hosting service of information which, in the notifier’s view, constitutes illegal content within the meaning of Article 3(h) of the DSA; 2. examining the notification; 3. informing the notifier of the decision taken regarding the notification; 4. informing the notifier of the possibility of appealing against the decision referred to in point 3).	Article 6(1)(f) of the GDPR	Until you are informed of: 1) the decision taken by the Administrator regarding the notification submitted; 2) the possibility of appealing against the decision referred to in point 2).	first name and surname; email address; phone number; address (street, house number, flat number, postcode, town/city, country), NIP; company name
The processing of personal data to the extent that, on the basis of proceedings conducted before competent public administrative authorities, including law enforcement agencies, in matters concerning the purposes or legal basis for the processing of personal data, the Administrator is obliged to process such data.	Article 6(1)(f) of the GDPR	For the duration of such an obligation	first name and surname; email address; phone number; address (street, house number, flat number, postcode, town/city, country), NIP; company name

To the extent necessary for the proper functioning of the website, its features and the correct processing of payment transactions (where such transactions are carried out via the website), the website uses the User’s metadata. Metadata refers to the process by which the website’s IT system reads and recognises the configuration and components of the computer used by the user in order to adapt the website to the user’s capabilities and to establish a secure connection between the user’s computer and the website. Importantly, such metadata cannot be used to identify the User, nor does it in any way harm the data stored on the computer. Nevertheless, the User has the right to withdraw their consent to the processing of metadata at any time by configuring their browser accordingly or by downloading the relevant plug-in provided by the browser manufacturer. To do so, please consult the software manufacturer and follow their recommendations.
In connection with the creation and management of an account on the Website, the Administrator may collect data relating to minors. By registering on the Website, the User declares that they have obtained consent for such processing from the minor’s parent or legal guardian at the time of registration. The Administrator states that, in relation to at least some of such data, additional and protective encryption will be applied to prevent unauthorised access to it.
The use of the live chat, including the provision of personal data within it, is entirely voluntary and not mandatory. If the User does not consent to the processing of their data in this way, they should immediately stop using the chat.
The Administrator may use profiling for direct marketing purposes, but decisions made by the Administrator on this basis do not relate to the conclusion or refusal to conclude a contract, or to the ability to use electronic services. Profiling involves the automatic analysis or prediction of a person’s behaviour on the Administrator’s website by analysing their previous activity history on the site.
To the extent necessary for the proper functioning of the website and its features, the website may, whilst the User is using it, collect other information, including but not limited to:
IP address;
information about your device, hardware and software, such as hardware identifiers, mobile device identifiers (e.g. Apple Identifier for Advertising [“IDFA”] or the advertising ID on an Android device [“AAID”]),
type of platform,
settings and components,
the presence of the necessary plug-ins;
approximate geolocation data (derived from your IP address or device settings);
web browser data, including browser type and preferred language;
Taking into account the nature, scope, context and purposes of the processing, as well as the risk of varying likelihood and severity of harm to the rights and freedoms of natural persons, the Administrator implements appropriate technical and organisational measures to ensure that the processing is carried out in accordance with the Regulation and to be able to demonstrate this. These measures are reviewed and updated as necessary. The Administrator implements technical measures to prevent unauthorised persons from accessing or altering personal data transmitted electronically.

§ 3 DISCLOSURE OF DATA

The Administrator ensures that all personal data collected is used to fulfil obligations towards users. This information will not be disclosed to third parties, except in the following circumstances:
1. the data subjects have given their explicit consent to such processing, or
2. if the obligation to disclose such data arises or will arise under applicable law, e.g. to law enforcement authorities.
In addition, the personal data of service users and customers may be disclosed to the following recipients or categories of recipients:
service providers supplying the Administrator with technical, IT and organisational solutions that enable the Administrator to conduct business activities, including the website and the electronic services provided through it (in particular, software providers, marketing agencies, email and hosting providers, providers of business management software and technical support to the Administrator and the product delivery operator) - The Administrator shall disclose the Customer’s personal data to a selected service provider acting on its behalf only where and to the extent necessary to fulfil the relevant purpose of data processing in accordance with this privacy policy.
accounting, legal and advisory service providers providing the Administrator with accounting, legal or advisory support (in particular, an accounting firm, a law firm or a debt collection agency) - The Administrator shall make the collected personal data of the Customer available to a selected provider acting on its behalf only where and to the extent necessary to achieve the specific purpose of data processing in accordance with this privacy policy.
providers of payment gateways and on-site payment processing solutions – The Administrator shall disclose the Customer’s personal data to a selected provider acting on its behalf only where and to the extent necessary to fulfil a specific data processing purpose in accordance with this privacy policy. In the case of the Administrator’s operations, this service is provided by:

Autopay S.A. (Blue Media), with its registered office in Sopot at 6 Powstańców Warszawy Street, entered in the Register of Entrepreneurs maintained by the District Court for Gdańsk-Północ, 8th Commercial Division of the National Court Register, under KRS number 0000320590, NIP 5851351185, REGON: 191781561, with share capital of PLN 2,000,000 (fully paid up).

The Administrator may share anonymised data (i.e. data that does not identify specific Users) with external service providers in order to better assess the appeal of advertisements and services to users; in this regard, depending on the location of the software providers, data may be transferred – in accordance with data protection principles – to third countries which, however, ensure the standard contractual clauses approved by the European Commission regarding the processing of personal data or which have the appropriate authorisation to do so on the basis of bilateral data processing agreements between the European Union and the third country in question, provided that the latter is not a member of the European Economic Area. In the case of the Administrator, these entities are:

Google LLC (registered office: 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) for Google Analytics, a tool used to analyse website statistics; Google Tag Manager, a tool used to manage scripts by easily adding code snippets to a website or application and to track user activity on a website; Google Ads, used to display sponsored links in Google search results and on websites participating in the Google AdSense programme; Google Workspace, enabling comprehensive website editing and coordination of the work of those involved (including Google Drive, Gmail, Google Sheets, Google Forms, Google Looker Studio);

The Administrator conducts ongoing risk assessments to ensure that personal data is processed securely – ensuring, above all, that access to the data is restricted to authorised persons and only to the extent necessary for the performance of their duties. The Administrator ensures that all operations involving personal data are recorded and carried out only by authorised staff and associates.
The Administrator shall take all necessary measures to ensure that its subcontractors and other cooperating entities also guarantee the implementation of appropriate security measures whenever they process personal data on behalf of the Administrator.
Third-party analytics technologies integrated into the Administrator's services (including SDKs [Software Development Kits] and APIs [Application Programming Interfaces]) may combine data collected in connection with the user's use of the Administrator's website with information that they have collected separately over time and/or across different platforms. Many of these companies collect and use information in accordance with their own privacy policies, which can be found on their websites. The Administrator encourages you to review these policies.
The Administrator’s website may use Google Analytics, a web analytics service provided by Google, LLC. (‘Google’). Google Analytics uses cookies to help website operators analyse how visitors use the site. The information generated by the cookie about visitors’ use of the website is usually transmitted to and stored by Google on servers in the United States. In accordance with current IT standards, the IP addresses of users visiting the Administrator’s website are truncated. Only in exceptional cases is the full IP address transmitted to a Google server in the United States and truncated there. On behalf of the Administrator, Google will use this information to evaluate the website for its users, compile reports on website traffic, and provide other services relating to website traffic and internet usage to website operators. Google will not associate the IP address transmitted via Google Analytics with any other data held by Google. Further information on how Google Analytics collects and uses data can be found on Google’s official website at: www.google.com/policies/privacy/partners. Furthermore, any User may prevent Google from collecting and processing data relating to their use of the website by downloading and installing the browser plug-in available at the following link: http://tools.google.com/dlpage/gaoptout.
When disclosing data to third parties, the Administrator makes every effort to ensure that such disclosure is made only to entities that meet the criteria and requirements set out in Articles 46 or 49 of the GDPR. Where applicable, the Administrator will rely on the EU Standard Contractual Clauses and other safeguards to enable transfers outside the EEA. In accordance with the decision of the Court of Justice of the European Union of 16 July 2020, the Administrator continues to assess the legal systems of the countries to which data is transferred and, where necessary, updates the measures designed to ensure adequate levels of protection.
With regard to data transferred to the United States, when disclosing data to third parties, the Administrator makes every effort to ensure that this is done, in accordance with the European Commission’s decision of 10 July 2023, only to entities and organisations in the US that ensure compliance with the new ‘EU-US Data Privacy Framework’. A list of these organisations has been published by the US Department of Commerce. The transfer of personal data from the EEA to organisations that have joined the ‘EU-US Privacy Shield’ programme and are included on this list is possible without the need to obtain additional authorisations or to use legal instruments such as standard contractual clauses or binding corporate rules. However, where a particular data importer in the US has not joined the ‘EU-US Privacy Shield’ programme, the transfer of personal data to that importer is possible and will take place once the conditions set out in Articles 46 or 49 of the GDPR have been met. In such cases, the Administrator will rely on the EU Standard Contractual Clauses and other safeguards to enable transfers outside the EEA.

§ 4 USER RIGHTS

A data subject whose personal data is being processed has the right to:
access, rectification, restriction, erasure or portability – the data subject has the right to request from the Administrator access to their personal data, its rectification, erasure (‘right to be forgotten’) or restriction of processing, and has the right to object to the processing, as well as the right to data portability. The detailed conditions for exercising the above rights are set out in Articles 15–21 of the GDPR.
withdraw consent at any time – a data subject whose data is processed by the Administrator on the basis of consent (pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR) has the right to withdraw consent at any time without affecting the lawfulness of processing carried out on the basis of consent prior to its withdrawal.
lodging a complaint with the supervisory authority – a data subject whose data is processed by the Administrator has the right to lodge a complaint with the supervisory authority in the manner and in accordance with the procedures set out in the provisions of the GDPR and Polish law, in particular the Personal Data Protection Act. The supervisory authority in Poland is the President of the Office for Personal Data Protection in Warsaw.
objection – the data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of their personal data based on Article 6(1)(e) (public interest or public tasks) or (f) (the Administrator’s legitimate interest), including profiling based on those provisions. In such a case, the Administrator may no longer process that personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.
bjection to direct marketing – if personal data is processed for the purposes of direct marketing (based on the Administrator's legitimate interest, not on the data subject's consent), the data subject has the right to object at any time to the processing of their personal data for the purposes of such marketing, including profiling, to the extent that the processing is related to such direct marketing.
These rights are exercised upon receipt of a request from the user sent to the Administrator's email address. Such a request should include the user's full name.
The user warrants that the data provided or published by them on the website is accurate.

§ 5 COOKIES

The term ‘cookies’ refers to IT data, in particular text files, stored on users’ end devices (usually on a computer’s hard drive or on a mobile device) which are used by the user’s browser to save specific settings and data for the purpose of using websites. These files allow the user’s device to be recognised and the website to be displayed accordingly, ensuring a comfortable user experience. The storage of cookies therefore enables the website and its content to be tailored to the user’s preferences – the server recognises the user and remembers preferences such as visits, clicks and previous actions.
“Cookies” contain, in particular, the domain name of the website from which they originate, the duration for which they are stored on the end-user’s device, and a unique number used to identify the browser from which the connection to the website is made.
Cookies are used for the following purposes:
to tailor website content to the user’s preferences and to optimise the user experience on the websites,
to generate anonymous statistics which, by helping to determine how users interact with websites, enable improvements to be made to their structure and content,
dostarczania użytkownikom witryny treści reklamowych dostosowanych do ich zainteresowań.

Cookies are not used to identify users, and their identity is not determined on the basis of these files.

The basic classification of cookies involves distinguishing between:
Essential cookies – these are absolutely essential for the website to function properly or for the features the user wishes to use, as without them we would be unable to provide many of the services we offer. Some of them also ensure the security of the services we provide electronically.
Functional cookies are essential for the website to function properly because:

- they enhance the website’s functionality; without them, the website will still work, but it will not be tailored to the user’s preferences,

- are designed to ensure a high level of website functionality; without them, the website’s functionality may be reduced, but their absence should not prevent the website from being used in full,

- are used for most website features; blocking them will prevent certain functions from working properly.

Cookies used to configure websites – these enable the customisation of features and services on websites.
Cookies used to ensure the security and reliability of websites – they enable authentication and optimise website performance.
Authentication cookies – these let the website know when a user is logged in, enabling it to display the relevant information and features.
Session cookies – these enable us to record information about how users interact with the website. This may include details of the most frequently visited pages or any error messages displayed on certain pages. Cookies used to store the so-called ‘session state’ help to improve services and enhance the browsing experience.
Cookies that track activity on the website - enable the website and its features to function smoothly.
Cookies that access your location – these enable the information displayed to be tailored to your location.
Cookies used for analytics, research or audience measurement - enable website owners to better understand their users’ preferences and, through analysis, to improve and develop their products and services. Typically, the website owner or a research company collects information anonymously and processes data on trends without identifying the personal details of individual users.
The use of cookies to tailor website content to a user’s preferences does not, as a rule, involve the collection of any information that could identify the user; however, such information may occasionally constitute personal data, i.e. data that allows certain behaviours to be attributed to a specific user. Personal data collected using cookies may only be gathered for the purpose of performing specific functions on behalf of the user. Such data is encrypted in a manner that prevents unauthorized persons from accessing it.
The cookies used by this website are not harmful to either the user or the device they are using; therefore, to ensure the website functions correctly, we recommend that you do not disable them in your browser. In many cases, the software used to browse websites (web browser) allows, by default, the storage of information in the form of ‘cookies’ and other similar technologies on the user’s device. You can change your browser’s cookie settings at any time. To do so, you will need to adjust your browser settings. The procedure for changing these settings varies depending on the software (web browser) you are using. You will find the relevant instructions on the relevant pages, depending on the browser you are using.
Cookies are also used to make it easier to log in to your account, including via social media, and to allow you to navigate between pages on websites without having to log in again on every page. At the same time, cookies are used to secure websites, for example, to prevent unauthorised access.
As part of its use of cookies, the Administrator may use tracking pixels or clear GIFs to collect information about how users use its services and how they respond to marketing messages sent by email. A pixel is a piece of software code that allows an object, usually a pixel-sized image, to be embedded on a website, enabling the tracking of user behaviour on the websites where it is placed. Once consent has been given, the browser automatically establishes a direct connection with the server hosting the pixel; therefore, the processing of data collected by the pixel takes place in accordance with the data protection policy of the partner administering the aforementioned server.
The Administrator may use web logs (which contain technical data such as the user’s IP address) to monitor traffic within its services, resolve technical issues, detect and prevent fraud, and enforce the terms of the User Agreement.
The Administrator informs users that the website does not respond to DNT (Do Not Track) signals; however, users may disable certain forms of online tracking, including some analytics data and personalised advertising, by changing their browser’s cookie settings or using our cookie consent tools (where applicable).
Detailed information on how to change your cookie settings and delete cookies yourself in the most popular web browsers is available in your browser’s help section and on the following websites (simply click on the relevant link):
Google Chrome
Mozilla Firefox
Microsoft Edge
Opera
Safari macOS
Safari iOS/iPad OS
Detailed information on managing cookies on a mobile phone or other mobile device should be found in the user manual for that device.