Privacy Policy

This Privacy Policy is designed to provide data subjects (individuals) with information on the processing of their personal data (any information relating to them) with the use of the website xsolla.com

For further information about Privacy Policy or processing of data about you, please contact us by either of the following methods:

Email: gdpr@xsolla.com

Postal address: Arch. Makariou III, 155, Proteas House, 5th floor, 3026, Limassol, Cyprus

Controller and its representative

The companies of Xsolla Group (“Xsolla”) are joint controllers of personal data processed under this Privacy Policy. It means that these companies jointly determine the purposes and means of processing of these personal data. Xsolla includes the following companies:

Xsolla (USA), Inc.

15260 Ventura Blvd., Suite 2230, Sherman Oaks, CA 91403 USA; EU
Representative: Suraway Ltd.

Xsolla Singapore PTE LTD

6 EU TONG Sen Street #10-15, The Central Singapore (059817), Singapore; EU
Representative: Suraway Ltd.

Xsolla HK Limited

Suites 1401-02 14F, Rightful Centre No. 11-12 Tak Hing Street, Tsimshatsui, Hong Kong; EU
Representative: Suraway Ltd.

Exsolum LTD

WIS BUSINESS CONSULTANCY DMCC, Unit No.810-003, Platinum Tower, Plot No. JLT-PH1-12, Jumeriah Lakes Towers, P.O. Box 390226, Dubai, UAE; EU
Representative: Suraway Ltd.

Suraway LTD
Representative of Xsolla in Europe

Arch. Makariou III, 155, Proteas House, 5th floor, 3026, Limassol, Cyprus
Email: gdpr@xsolla.com

Xsolla LLC

614000, Perm city, Komsomolsky prospect, 1, entrance 2, floor 6, office 3, Russia; EU
Representative: Suraway Ltd.

Xsolla Games LLC

614000, Perm city, Komsomolsky prospect, 1, entrance 2, floor 6, office 2, Russia; EU
Representative: Suraway Ltd.

Under the arrangement between the companies of Xsolla, Xsolla (USA), Inc. is responsible for exercising of the rights of the data subjects and for provision of the information to the data subjects who can use Xsolla (USA), Inc. as a contact point.

Please contact us at gdpr@xsolla.com if you want to get acquainted with the essence of the arrangement.

To contact Xsolla (USA), Inc. please use the following contact details:

Email: support@xsolla.com

Phone number: +1 (818) 435-6613

Postal address: 15260 Ventura Blvd., Suite 2230, Sherman Oaks, CA 91403 USA

Data protection officer

Data subjects may contact the Data Protection Officer of Xsolla with regard to all issues related to processing of their personal data and to the exercise of their rights under data protection law using the following contact details:

Email: gdpr@xsolla.com

Postal address: Arch. Makariou III, 155, Proteas House, 5th floor, 3026, Limassol, Cyprus

Purposes and legal basis for the processing

Xsolla processes personal data for the following purposes and on the following legal bases:

PurposeLegal Basis
To license different software (including computer games) for a fee to the users of the website.Performance of a contract to which the data subject is party, Art. 6(1)(b) of the GDPR.
To provide smooth functioning of the website by storing users’ information (so that they do not have to reenter it during their current or future website sessions) and with the use of third parties’ hosting, maintenance, and security services.Performance of a contract to which the data subject is party, Art. 6(1)(b) of the GDPR.
To improve design and functions of the website on the basis of analysis of users’ behavior on the website and aggregate website usage metrics (total number of visitors and pages accessed).Legitimate interests pursued by Xsolla USA Inc., Art. 6(1)(f) of the GDPR.
To automatically update the software purchased by the users of the website from Xsolla.Performance of a contract to which the data subject is party, Art. 6(1)(b) of the GDPR.
To provide the users of the website (at their request) with information on the terms of their probable cooperation with Xsolla or the capabilities of services offered by Xsolla.Necessity of the processing in order to take steps at the request of the data subject prior to entering into a contract, Art. 6(1)(b) of the GDPR.
For conventional direct marketing and other forms of marketing or advertisement.Legitimate interests pursued by the Xsolla entity with which the user has a contract, Art. 6(1)(f) of the GDPR.
For enforcement of legal claims including debt collection via out-of-court procedures; prevention of fraud or misuse of services; IT and network security; for marketing research based on analysis of users’ entries, submissions, and status in any promotions or other activities.Legitimate interests pursued by the respective Xsolla entity, Art. 6(1)(f) of the GDPR.
To comply with applicable laws (including copyright, defamation, tax, and data protection laws).Compliance with a legal obligation to which the respective Xsolla entity is subject, Art. 6(1)(c) of the GDPR.
For third parties’ conventional direct marketing and other forms of marketing or advertisement; for third parties’ marketing research based on usage and demographic patterns for certain computer programs, content, services, advertisements, promotions or other functions of the website.Consent of the data subject to the processing of his or her personal data, Art. 6(1)(a) of the GDPR.
To provide targeted advertisement and to evaluate for marketing purposes certain personal aspects relating to the data subject, in particular to analyse or predict aspects concerning the data subject's personal preferences, interests, behavior, and location. Consent of the data subject to the processing of his or her personal data, Art. 6(1)(a) of the GDPR.
For third parties’ targeted advertisement and evaluation for marketing purposes of certain personal aspects relating to the data subject.Consent of the data subject to the processing of his or her personal data, Art. 6(1)(a) of the GDPR.

Rights of the data subject

Right to access. The data subject can ask Xsolla to confirm whether or not Xsolla processes his or her personal data. If so, the data subject can access these personal data and can ask Xsolla to explain certain details of the processing. To exercise the right to access, the data subject shall contact Xsolla via the following email: support@xsolla.com.

Right to rectification. The data subject can ask Xsolla to correct inaccurate personal data concerning him or her. If it complies with the purposes of the processing, the data subject can ask Xsolla to complete incomplete personal data. To exercise the right to rectification, the data subject shall contact Xsolla via the following email: support@xsolla.com.

Right to erasure (“right to be forgotten”). The data subject can ask Xsolla to erase personal data concerning him or her under applicable law. For example, this applies if (1) the personal data are no longer necessary in relation to the purposes for which they were processed; (2) the data subject withdraws consent to the processing and there is no other legal ground for the processing; (3) the personal data have been unlawfully processed. To exercise the right to erasure, the data subject shall contact Xsolla via the following email: support@xsolla.com.

Right to restriction on processing. The data subject can ask Xsolla to mark the stored personal data with the aim to limit their processing in the future under applicable law. This applies if (1) the data subject contests the accuracy of the personal data; (2) the data subject asks to restrict the use of the personal data when their processing is unlawful; (3) the data subject needs personal data to protect his or her rights when Xsolla no longer needs the personal data; (4) the data subject has objected the processing based on the legitimate interests pursued by Xsolla or by a third party. To exercise the right to restriction on processing, the data subject shall contact Xsolla via the following email: support@xsolla.com.

Right to object to processing. The data subject can object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on the legitimate interests pursued by Xsolla or by a third party. Xsolla shall no longer process the personal data unless Xsolla demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

Right to portability. When the processing is based on consent of the data subject or on a contract with the data subject, the data subject can receive the personal data concerning him or her, which he or she has provided to Xsolla, in a structured, commonly used and machine-readable format and can freely transmit those data to another controller. Where technically feasible, the data subject can also ask Xsolla to transmit the personal data directly to another controller. To exercise the right to portability, the data subject shall contact Xsolla via the following email: support@xsolla.com.

Right to withdraw consent at any time. Where processing is based on consent, the data subject can withdraw his or her consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. To exercise the right to withdraw consent, the data subject shall contact Xsolla via the following email: support@xsolla.com.

Right to lodge a complaint with a supervisory authority. When Article 77 of the General Data Protection Regulation (the GDPR) applies, the data subject can lodge a complaint with a supervisory authority, in particular in the member state of the European Union of his or her habitual residence, place of work or place of the alleged infringement.

The most important aspects of the data processing

Data subjects shall pay special attention to the following information on the processing of their personal data which has the most impact on them and processing which could surprise them:

  1. Xsolla processes personal data for marketing purposes including targeted advertisement and profiling and discloses personal data to different third parties to let them process personal data for the same purposes. For details please refer to the following sections of this Privacy Policy:

    Categories of personal data concerned

    Purposes and legal basis for the processing

    Recipients of the personal data

    Automated decision-making including profiling

  2. Xsolla transfers personal data to the countries that provide different level of protection of natural persons with regard to the processing of personal data. For details please refer to the Transfers to third countries section of this Privacy Policy.

  3. Xsolla stores personal data for a certain period of time. For details please refer to the Storage period section of this Privacy Policy.

    Data subjects shall also pay special attention to the most important consequences of the processing of their personal data by Xsolla for them:

    • Data subjects may receive advertisements from many companies from different countries based on a deep knowledge of their personal preferences, interests, behavior and other personal aspects.

Legitimate interests pursued by Xsolla and third parties

When processing personal data for the purposes listed above, Xsolla pursues the following legitimate interests:

  • improvement of design and functions of the website;
  • conventional direct marketing and other forms of marketing or advertisement;
  • enforcement of legal claims including debt collection via out-of-court procedures; prevention of fraud or misuse of services; IT and network security; marketing research.

Categories of personal data concerned from third-party sources

Xsolla can receive personal data both directly from the users and indirectly from the third parties such as developers and publishers of the software and payment processors.

Personal data, which may be provided to Xsolla directly from the user are:

  • identity and contact details of the user (full name, email address, country, transaction ID, position (gamer, developer, manager etc.);
  • type of the request (new business, billing questions).

Xsolla processes the following categories of personal data from third-party sources:

  • identity and contact details of the user (full name, date of birth, age, sex, nickname, profile picture, email address, home or mobile telephone number, address, postal code, PayPal account, bank account and credit card number and billing information);
  • the user’s Internet Protocol address (IP address), geolocation, a unique user ID, version of software installed, system type, the content and pages accessed on the website, dates and times of visits of the website, time zone, the user’s accounts in social networks (including profile picture and information on education, job, marital status); tokens for access to the user’s accounts in social networks, accounts in social networks of friends of the user (including nicknames, profile pictures), history of payments with the use of the website, fingerprint of the user’s device and IP (identification of position) at the time of a payment;
  • “cookies information” of the user (session and persistent cookie files), see our Cookie Policy here.

Recipients of the personal data

Xsolla discloses personal data to the following recipients:

  • developers and publishers of the software licensed by Xsolla to the users of the website (the developers and publishers may be located anywhere in the world but mainly they are located in the European Union and the United States of America);
  • payment processors retained by Xsolla to process payments of the users of the website (the processors may be located anywhere in the world but mainly they are located in the European Union and the United States of America);
  • providers of hosting, maintenance, and security services retained by Xsolla to run the website (the providers of these services may be located anywhere in the world but mainly they are located in the European Union and the United States of America);
  • advertising and marketing companies that aggregate personal data from different sources to evaluate certain personal aspects relating to the data subject, to perform marketing research and to provide advertising and marketing services to third parties (these companies may be located anywhere in the world but mainly they are located in the European Union and the United States of America);
  • government authorities including tax authorities and police (it may be government authorities of any country but mainly it is government authorities of the European Union and the United States of America).
  • the companies of Xsolla when it is necessary to perform the contract to which the data subject is party.

Transfers to third countries

Xsolla transfers personal data to the following countries that, under decisions of the European Commission, ensure an adequate level of protection of natural persons with regard to the processing of personal data (adequacy decision under Article 45 of the GDPR):

ArgentinaDecision 2003/490/EC of 30 June 2003, available here
Canada (commercial organisations)Decision 2002/2/EC of 20 December 2001, available here
IsraelDecision 2003/490/EC of 30 June 2003, available here
JapanDecision 2001/497/EC of 15 June 2001, available here
New ZealandDecision 2003/490/EC of 30 June 2003, available here
SwitzerlandDecision 2003/490/EC of 30 June 2003, available here
USACommission Implementing Decision (EU) 2016/1250 of 12 July 2016; available here

Xsolla also transfers personal data to the following countries on the basis of standard data protection clauses adopted by the European Commission (standard data protection clauses under Article 46.2 of the GDPR):

  • Albania
  • Algeria
  • Armenia
  • Australia
  • Belarus
  • Bolivia
  • Bosnia and Herzegovina
  • Brazil
  • Chile
  • China
  • Colombia
  • Costa Rica
  • Dominican Republic
  • Ecuador
  • Egypt
  • Georgia
  • Greenland
  • Guatemala
  • Hong Kong
  • Iceland
  • India
  • Indonesia
  • Iran
  • Iraq
  • Jordan
  • Kazakhstan
  • South Korea
  • Kyrgyzstan
  • Lebanon
  • Malaysia
  • Martinique
  • Mexico
  • Moldova
  • Mongolia
  • Montenegro
  • Morocco
  • Nepal
  • Nicaragua
  • Pakistan
  • Paraguay
  • Peru
  • Philippines
  • Russia
  • Saudi Arabia
  • Singapore
  • Serbia
  • South Africa
  • Taiwan
  • Thailand
  • Tunisia
  • Turkey
  • Ukraine
  • United Arab Emirates
  • United States of America
  • Uzbekistan
  • Vietnam
  • Venezuela

Please note that the countries listed above are the countries of the developers and (or) payment system providers place of operating. Your personal data will be transferred to one of these countries only if the developer of the software you have chosen, or payment system provider operates in this country.

You may get a copy of the guarantees used from gdpr@xsolla.com.

Storage period

Xsolla stores personal data for as long as required to achieve the purposes of their processing, as well as no more than five years after that in anonymous form in order to combat fraud and for reporting purposes. To provide fair processing of personal data, Xsolla regularly reminds data subjects that Xsolla processes their personal data and that they have legal remedies to stop this processing.

Requirement to provide information

To enter into a contract with Xsolla and to let Xsolla perform a contract with him or her, the data subject shall provide Xsolla with the following personal data:

  • full name;
  • email address;
  • PayPal account;
  • home or mobile telephone number;
  • bank account and credit card number.

If the data subject does not provide these personal data to Xsolla, Xsolla cannot enter into and perform an agreement with him or her.

Source of personal data

Xsolla receives personal data not only from data subjects themselves, but also from payment systems, games developers, social networks, Google Analytics (web analytics service offered by Google), and other privately held sources in the field of internet services.

Automated decision-making including profiling

Xsolla may use automated decision-making as a part of functionality of Publisher Account (https://publisher.xsolla.com/) for providing you with supporting emails aimed to assist you in project management or to carry out anti-fraud checks on the transactions you perform. For example, we automatically match the information you provide with our databases and use a probability approach in order to detect fraud. However, if you are in the European Union, you have the right to object the automated decision and have it manually reviewed based also on information that you can provide.

You can contact us at the details below to exercise your right.

You will not be subject to decisions that will have a significant impact on you based solely on automated decision making, unless we have a lawful basis for doing so and we have notified you.

In any case, you will be notified of this before the start of the processing of your data for these purposes by receiving a request from Xsolla to give an appropriate consent.

Children’s Privacy

Xsolla does not process personal data of children under the minimum legal age under local legal requirements in the state, province, or jurisdiction of residence and takes appropriate measures to ensure that they do not use its services. If you find out that a child under age has provided Xsolla with his or her personal data, please contact Xsolla at support@xsolla.com.

California Privacy Rights

Under Section 1798.83 of California Civil Code, data subjects that are California residents can ask Xsolla to provide information on disclosure of their personal data to third parties for direct marketing purposes of these third parties. To make such a request, California residents can contact Xsolla via the following email support@xsolla.com.

Changes to this Privacy Policy

Xsolla may change this Privacy Policy from time to time at its sole discretion. If so, Xsolla notifies the users of the websites about these changes by a pop-up line on the website.