Xsolla charge on your credit card? Learn more →

Privacy Policy

This Privacy Policy is designed to provide data subjects (individuals) with information on the processing of their personal data (any information relating to them) with the use of the website xsolla.com

For further information about Privacy Policy or processing of data about you, please contact us by either of the following methods

Email: gdpr@xsolla.com

Postal address: Arch. Makariou III, 155, Proteas House, 5th floor, 3026, Limassol, Cyprus.

Controller and its representative

The companies of Xsolla Group ("Xsolla") are joint controllers of personal data processed under this Privacy Policy. It means that these companies jointly determine the purposes and means of processing of these personal data. Xsolla includes the following companies:

Company Name

Xsolla (USA), Inc.

15260 Ventura Blvd., Suite 2230, Sherman Oaks, CA 91403 USA

Xsolla Korea LLC

5th floor, 24-2 Samseongro-100-gil (Otris Building, Samseong-dong), Gangnam-gu, Seoul, South Korea

Way2Play LLP

010000, Republic of Kazakhstan, Astana, Almaty district, Tauelsijdyzd Ave., 34, 3rd floor, Coworking

Xsolla Singapore PTE LTD

6 EU TONG Sen Street #10-15, The Central Singapore (059817), Singapore

Xsolla HK Limited

Suites 1401-02 14F, Rightful Centre No. 11-12 Tak Hing Street, Tsimshatsui, Hong Kong

Exsolum LTD

WIS BUSINESS CONSULTANCY DMCC, Unit No.810-003, Platinum Tower, Plot No. JLT-PH1-12, Jumeriah Lakes Towers, P. O. Box 390226, Dubai, UAE

Suraway LTD

Arch. Makariou III, 155, Proteas House, 5th floor, 3026, Limassol, Cyprus.

Xsolla LLC

614000, Perm city, Komsomolsky prospect, 1, entrance 2, floor 6, office 3

Xsolla Games LLC

614000, Perm city, Komsomolsky prospect, 1, entrance 2, floor 6, office 2

Under the arrangement between the companies of Xsolla, Xsolla (USA), Inc. is responsible for exercising of the rights of the data subjects and for provision of the information to the data subjects who can use Xsolla (USA), Inc. as a contact point.

To contact Xsolla (USA), Inc. please use the following contact details:

support@xsolla.com

+1 (818) 435-6613

15260 Ventura Blvd., Suite 2230, Sherman Oaks, CA 91403 USA

Purposes and legal basis for the processing

Xsolla processes personal data for the following purposes and on the following legal basis:

PurposeLegal Basis
To license different software (including computer games) for a fee to the users of the website. Performance of a contract to which the data subject is party.
To provide smooth functioning of the website by storing users’ information (so that they do not have to reenter it during their current or future website sessions) and with the use of third parties’ hosting, maintenance, and security services. Performance of a contract to which the data subject is party.
To improve design and functions of the website on the basis of analysis of users’ behavior on the website and aggregate website usage metrics (total number of visitors and pages accessed) Legitimate interests pursued by Xsolla.
To automatically update the software purchased by the users of the website from Xsolla.Performance of a contract to which the data subject is party.
To provide the users of the website (at their request) with information on the terms of their probable cooperation with Xsolla or the capabilities of services offered by Xsolla. Necessity of the processing in order to take steps at the request of the data subject prior to entering into a contract.
For conventional direct marketing and other forms of marketing or advertisement.Legitimate interests pursued by Xsolla.
For enforcement of legal claims including debt collection via out-of-court procedures; prevention of fraud or misuse of services; IT and network security; for marketing research based on analysis of users’ entries, submissions, and status in any promotions or other activities. Legitimate interests pursued by Xsolla.
To comply with applicable laws (including copyright, defamation, tax, and data protection laws).Compliance with a legal obligation to which Xsolla is subject.
To provide targeted advertisement and to evaluate for marketing purposes certain personal aspects relating to the data subject, in particular to analyse or predict aspects concerning the data subject’s personal preferences, interests, behaviour, and location. Consent of the data subject to the processing of his or her personal data.
For third parties’ targeted advertisement and evaluation for marketing purposes of certain personal aspects relating to the data subject. Consent of the data subject to the processing of his or her personal data.

Rights of the data subject

Right to access. The data subject can ask Xsolla to confirm whether or not Xsolla processes his or her personal data. If so, the data subject can access these personal data and can ask Xsolla to explain certain details of the processing. To exercise the right to access, the data subject shall contact Xsolla via the following email: support@xsolla.com

Right to rectification. The data subject can ask Xsolla to correct inaccurate personal data concerning him or her. If it complies with the purposes of the processing, the data subject can ask Xsolla to complete incomplete personal data. To exercise the right to rectification, the data subject shall contact Xsolla via the following email: support@xsolla.com

Right to erasure ("right to be forgotten"). In certain cases, the data subject can ask Xsolla to erase personal data concerning him or her. For example, this applies if (1) the personal data are no longer necessary in relation to the purposes for which they were processed; (2) the data subject withdraws consent to the processing and there is no other legal ground for the processing; (3) the personal data have been unlawfully processed. To exercise the right to erasure, the data subject shall contact Xsolla via the following email: support@xsolla.com

Right to restriction on processing. In certain cases, the data subject can ask Xsolla to mark the stored personal data with the aim to limit their processing in the future. This applies if (1) the data subject contests the accuracy of the personal data; (2) the data subject asks to restrict the use of the personal data when their processing is unlawful; (3) the data subject needs personal data to protect his or her rights when Xsolla no longer needs the personal data; (4) the data subject has objected the processing based on the legitimate interests pursued by Xsolla or by a third party. To exercise the right to restriction on processing, the data subject shall contact Xsolla via the following email: support@xsolla.com

Right to objection to processing. The data subject can object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on the legitimate interests pursued by Xsolla or by a third party. Xsolla shall no longer process the personal data unless Xsolla demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

To exercise the right to objection to processing, the data subject shall contact Xsolla via the following email: support@xsolla.com. Xsolla can provide the data subject with other options to exercise the right to objection to processing at the time of communication with the data subject (for example, by "unsubscribe" link in a direct marketing email).

Right to portability. When the processing is based on consent of the data subject or on a contract with the data subject, the data subject can receive the personal data concerning him or her, which he or she has provided to Xsolla, in a structured, commonly used and machine-readable format and can freely transmit those data to another controller. Where technically feasible, the data subject can also ask Xsolla to transmit the personal data directly to another controller. To exercise the right to portability, the data subject shall contact Xsolla via the following email: support@xsolla.com

Right to withdraw consent at any time. Where processing is based on consent, the data subject can withdraw his or her consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. To exercise the right to withdraw consent, the data subject shall contact Xsolla via the following email: support@xsolla.com

Right to lodge a complaint with a supervisory authority. When Article 77 of the General Data Protection Regulation (the GDPR)[1] applies, the data subject can lodge a complaint with a supervisory authority, in particular in the member state of the European Union of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes the GDPR.

The most important aspects of the data processing

Data subjects shall pay special attention to the following information on the processing of their personal data which has the most impact on them and processing which could surprise them:

  1. Xsolla processes extensive personal data for marketing purposes including targeted advertisement and profiling and discloses personal data to different third parties to let them process personal data for the same purposes. For details please refer to the following sections of this Privacy Policy:

    Categories of personal data concerned

    Purposes and legal basis for the processing

    Recipients of the personal data

    Automated decision-making including profiling

  2. Xsolla transfers personal data to many countries that provide different level of protection of natural persons with regard to the processing of personal data. For details please refer to the Transfers to third countries section of this Privacy Policy.
  3. Xsolla stores personal data for a long time. For details please refer to the Storage period section of this Privacy Policy.

    Data subjects shall also pay special attention to the most important consequences of the processing of their personal data by Xsolla for them:

    • Data subjects may receive advertisements from many companies from different countries based on a deep knowledge of their personal preferences, interests, behavior and other personal aspects.
    • For a long time, data subjects may suffer data breaches which may lead to unauthorised disclosure of their personal data to the public.
  4. These consequences have a high impact on the data subjects’ fundamental rights to privacy and protection of personal data.

Data protection officer

Data subjects may contact the Data Protection Officer of Xsolla with regard to all issues related to processing of their personal data and to the exercise of their rights under data protection law using the following contact details: gdpr@xsolla.com

Arch. Makariou III, 155, Proteas House, 5th floor, 3026, Limassol, Cyprus.

Legitimate interests pursued by Xsolla and third parties

When processing personal data for some purposes, Xsolla pursues the following legitimate interests:

  • improvement of design and functions of the website;

  • conventional direct marketing and other forms of marketing or advertisement;

  • enforcement of legal claims including debt collection via out-of-court procedures; prevention of fraud or misuse of services; IT and network security; marketing research.

  • To obtain information on the balancing test (evaluation of interests of Xsolla and data subjects which allows Xsolla to rely on its legitimate interests as a lawful basis for data processing), the data subject can contact Xsolla via the following email: support@xsolla.com.

To obtain information on the balancing test (evaluation of interests of Xsolla and data subjects which allows Xsolla to rely on its legitimate interests as a lawful basis for data processing), the data subject can contact Xsolla via the following email: support@xsolla.com.

Categories of personal data concerned

Xsolla processes the following categories of personal data:

  • identity and contact details of the user (full name, date of birth, age, sex, nickname, profile picture, email address, home or mobile telephone number, address, postal code, PayPal account, bank account and credit card number and billing information);

  • the user’s Internet Protocol address (IP address), geolocation, a unique user ID, version of software installed, system type, the content and pages accessed on the website, dates and times of visits of the website, time zone, the user’s accounts in social networks (including profile picture and information on education, job, marital status); tokens for access to the user’s accounts in social networks, accounts in social networks of friends of the user (including nicknames, profile pictures), history of payments with the use of the website, fingerprint of the user’s device and IP (identification of position) at the time of a payment;

  • "cookies information" of the user (session and persistent cookie files).

To obtain information on the balancing test (evaluation of interests of Xsolla and data subjects which allows Xsolla to rely on its legitimate interests as a lawful basis for data processing), the data subject can contact Xsolla via the following email: support@xsolla.com

Recipients of the personal data

Xsolla discloses personal data to the following recipients:

  • developers and publishers of the software licensed by Xsolla to the users of the website (the developers and publishers may be located anywhere in the world but mainly they are located in the European Union and the United States of America);

  • payment processors retained by Xsolla to process payments of the users of the website (the processors may be located anywhere in the world but mainly they are located in the European Union and the United States of America);

  • providers of hosting, maintenance, and security services retained by Xsolla to run the website (the providers of these services may be located anywhere in the world but mainly they are located in the European Union and the United States of America);

  • advertising and marketing companies that aggregate personal data from different sources to evaluate certain personal aspects relating to the data subject, to perform marketing research and to provide advertising and marketing services to third parties (these companies may be located anywhere in the world but mainly they are located in the European Union and the United States of America);

  • government authorities including tax authorities and police (it may be government authorities of any country but mainly it is government authorities of the European Union and the United States of America).

Transfers to third countries

Xsolla transfers personal data to the following countries of the European Economic Area (that ensure a high level of protection of natural persons with regard to the processing of personal data):

  • Austria

  • Belgium

  • Bulgaria

  • Croatia

  • Cyprus

  • Czech Republic

  • Denmark

  • Estonia

  • Finland

  • France

  • Germany

  • Greece

  • Hungary

  • Ireland

  • Italy

  • Latvia

  • Lithuania

  • Malta

  • Netherlands

  • Norway

  • Poland

  • Portugal

  • Romania

  • Slovenia

  • Slovak Republic

  • Spain

  • Sweden

  • United Kingdom

Xsolla also transfers personal data to the following countries that, under decisions of the European Commission, ensure an adequate level of protection of natural persons with regard to the processing of personal data (adequacy decision under Article 45 of the GDPR):

ArgentinaDecision 2003/490/EC of 30 June 2003, available here
Canada (commercial organisations)Decision 2002/2/EC of 20 December 2001, available here
IsraelDecision 2003/490/EC of 30 June 2003, available here
New ZealandDecision 2003/490/EC of 30 June 2003, available here
SwitzerlandDecision 2003/490/EC of 30 June 2003, available here

Xsolla also transfers personal data to the following countries on the basis of standard data protection clauses adopted by the European Commission and available here (standard data protection clauses under Article 46.2 of the GDPR):

  • Albania
  • Algeria
  • Armenia
  • Australia
  • Belarus
  • Bolivia
  • Bosnia and Herzegovina
  • Brazil
  • Chile
  • China
  • Colombia
  • Costa Rica
  • Dominican Republic
  • Ecuador
  • Egypt
  • Georgia
  • Greenland
  • Guatemala
  • Hong Kong
  • India
  • Indonesia
  • Iran
  • Iraq
  • Japan
  • Jordan
  • Kazakhstan
  • South Korea
  • Kyrgyzstan
  • Lebanon
  • Malaysia
  • Martinique
  • Mexico
  • Moldova
  • Mongolia
  • Montenegro
  • Morocco
  • Nepal
  • Nicaragua
  • Pakistan
  • Paraguay
  • Peru
  • Philippines
  • Russia
  • Saudi Arabia
  • Singapore
  • Serbia
  • South Africa
  • Taiwan
  • Thailand
  • Tunisia
  • Turkey
  • Ukraine
  • United Arab Emirates
  • United States of America
  • Uzbekistan
  • Vietnam
  • Venezuela

Storage period

Xsolla stores personal data for as long as required to achieve the purposes of their processing. Due to their nature, these purposes cannot be achieved in some definite or definable time in the future. To provide fair processing of personal data, Xsolla regularly reminds data subjects that Xsolla processes their personal data and that they have legal remedies to stop this processing.

Requirement to provide information

To enter into a contract with Xsolla and to let Xsolla perform a contract with him or her, the data subject shall provide Xsolla with the following personal data:

  • full name;

  • email address;

  • PayPal account;

  • home or mobile telephone number;

  • bank account and credit card number.

If the data subject does not provide these personal data to Xsolla, Xsolla cannot enter into and perform an agreement with him or her.

Source of personal data

Xsolla receives personal data not only from data subjects themselves, but also from payment systems, games developers, social networks, Google Analytics (web analytics service offered by Google), and other privately held sources in the field of internet services.

Automated decision-making including profiling

Xsolla analyzes personal data of the users of the website to predict their future requests and to provide them with individual proposals.

Children’s Privacy

Xsolla does not process personal data of children under 13 and takes appropriate measures to ensure that they do not use its services. If you find out that a child under 13 has provided Xsolla with his or her personal data, please contact Xsolla at support@xsolla.com

California Privacy Rights

Under Section 1798.83 of California Civil Code, data subjects that are California residents can ask Xsolla to provide information on disclosure of their personal data to third parties for direct marketing purposes of these third parties. To make such a request, California residents can contact Xsolla via the following email support@xsolla. com

Changes to this Privacy Policy

Xsolla may change this Privacy Policy from time to time at its sole discretion. If so, Xsolla notifies the users of the websites about these changes by a pop-up line on the website.

[1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.