Privacy Policy

1. Who we are

This Privacy Policy explains how we handle personal data on legend-crafters.com (the "Website"), in line with the EU General Data Protection Regulation (GDPR) and Hungarian data protection law (Act CXII of 2011).

The controller is:

  • Legend Crafters Kft.
  • Registered office: 8000 Székesfehérvár, Bodrogi utca 28., Hungary
  • Company registration number: 07-09-034359
  • Tax / EU VAT number: HU32184679
  • E-mail: info@legend-crafters.com — for every privacy question or request

We have not appointed a data protection officer, as we are not required to.

We keep the Website deliberately lean: no advertising, no tracking cookies, no third-party analytics that profile you.

2. At a glance

  • You open a page — Data: technical connection data (IP address, browser, time). Purpose: deliver the page, keep it secure, prevent abuse. Legal basis: legitimate interest, Art. 6(1)(f) GDPR. How long: IP only as a one-way code, deleted within about a day; error logs 30 days.
  • Website statistics — Data: page, click type, time on page, referring site, country, device type; a daily changing code. Purpose: understand which content is useful. Legal basis: legitimate interest, Art. 6(1)(f) GDPR. How long: 365 days (no IP address, no cookies).
  • Contact form — Data: name, e-mail, subject, message. Purpose: answer your message. Legal basis: legitimate interest / steps before a contract, Art. 6(1)(f) and (b) GDPR. How long: 2 years after our correspondence ends, unless you ask us to delete it sooner or the law requires us to keep it longer.
  • Newsletter — Data: e-mail address, time and IP address of your confirmation. Purpose: send the newsletter. Legal basis: consent, Art. 6(1)(a) GDPR. How long: until you unsubscribe.
  • Light / dark mode — Data: your choice, stored in your browser. Purpose: remember the setting you asked for. Legal basis: strictly necessary for the requested function. How long: until you clear your browser data.

We do not sell your data, do not use it for advertising and do not make automated decisions about you.

3. Visiting the Website

Hosting. The Website runs on Microsoft Azure in the European Union (West Europe, the Netherlands). When you open a page, your browser necessarily sends your IP address and basic technical information (browser type, requested page, time). Microsoft processes this on our behalf to deliver the page.

Security and abuse prevention. To stop spam and automated abuse of our forms and services, we count requests per sender for a short time. For this we do not store your IP address itself, only a one-way code derived from it with a secret key, and we delete these counters automatically once their counting period (at most 24 hours) has ended.

Error and availability monitoring. We log technical errors of the Website so we can fix them. These logs contain no IP addresses and are deleted after 30 days. An automated test regularly checks that the Website is reachable; it does not involve your data.

Legal basis: our legitimate interest in running a secure, working website (Art. 6(1)(f) GDPR).

4. Website statistics (without cookies)

We measure how the Website is used with our own, privacy-friendly tool, so we can see which pages and links are useful. It uses no cookies and stores nothing on your device, so it needs no cookie banner.

What we record:

  • the page you view and the website you came from (domain only, e.g. google.com);
  • the type of link or button you click (e.g. menu, footer, shop link, image, form) and its target;
  • how long the page is open in the foreground;
  • your country and device type (desktop, mobile or tablet).

What we do not record: your IP address, cookies, or anything that identifies you. When a page loads, your IP address is used once, on our own server, to look up your country (using a local database, "IP Geolocation by DB-IP"; no third party is contacted) and to create a pseudonymous code that changes every day. This code lets us count unique visitors per day. It cannot be turned back into your IP address, and because it changes daily, you cannot be recognised from one day to the next. Known bots are excluded.

Where and how long: Microsoft Azure database in Germany (EU); deleted automatically after 365 days.

Legal basis: our legitimate interest in improving the Website (Art. 6(1)(f) GDPR). You can object at any time (section 12); as the data cannot be linked to you, the simplest way is to block scripts from legend-crafters.com in your browser — the Website keeps working.

Cloudflare Web Analytics. In addition, we use Cloudflare Web Analytics (Cloudflare, Inc., USA) as a backup counter. It also works without cookies and without identifying individual visitors; it shows us only aggregated figures (page views, countries, devices, referring sites). Cloudflare may process this data in the USA under the EU–U.S. Data Privacy Framework (section 10).

5. Cookies and storage on your device

The Website does not set any cookies for visitors.

It stores one item in your browser's local storage, only if you use the light/dark switch: your chosen mode (lc-theme = light or dark). This is needed to provide the setting you asked for, it never leaves your device, and you can delete it by clearing your browser data.

Embedded videos and the pages we link to may use their own cookies — see section 8.

6. Contact form

If you write to us through the contact form, we receive your name, e-mail address, subject (optional) and message. Before sending, we check whether your e-mail domain can receive mail at all, so we can warn you about a typo; this is a technical lookup of the domain, not of you.

The Website does not store your message: it is forwarded as an e-mail to info@legend-crafters.com, using Microsoft's e-mail service (Azure Communication Services) and our Microsoft 365 mailbox. We use your data only to answer you.

Legal basis: our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR), or steps you request before a contract (Art. 6(1)(b) GDPR), e.g. a business enquiry.

How long: 2 years after our correspondence ends; you can ask us to delete it sooner. We keep it longer only if the law requires it (e.g. if it becomes part of a contract or invoice).

7. Newsletter

You can subscribe to our newsletter about our games, campaigns and events.

How it works (double opt-in): after you enter your e-mail address, we send you a confirmation link that is valid for 1 hour. You are subscribed only if you click it. Until you confirm, we keep your e-mail address and the IP address of the request — for no longer than the link is valid: unconfirmed sign-ups are deleted automatically after 1 hour. Our log keeps only a one-way code of the address, recording that a sign-up was requested and that it expired unconfirmed.

What we store: your e-mail address, and — as proof of your consent — the time and the IP address of your confirmation. We do not ask for your name. Subscribers who signed up on our previous website were transferred together with the record of their original consent.

Unsubscribing: every newsletter contains an unsubscribe link; it opens a page where one click on the Unsubscribe button removes you (the extra button protects you from e-mail security scanners that open links automatically). E-mail programs that show their own unsubscribe button can also use it. You can also write to info@legend-crafters.com asking us to unsubscribe you in your behalf. When you unsubscribe, your record is deleted, not just flagged. We keep a log of subscriptions and unsubscriptions that contains only a one-way code of your e-mail address (not the address itself), so we can prove that we respected your choice. This log is kept for 5 years after its last entry.

Where: Microsoft Azure, West Europe (EU). Newsletters are sent through Microsoft's e-mail service (Azure Communication Services). Backups of the list are kept for 90 days.

Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time without affecting the lawfulness of earlier sending.

8. Embedded videos and links to other sites

YouTube videos. Some pages show YouTube videos in YouTube's privacy-enhanced mode (youtube-nocookie.com). YouTube (Google Ireland Ltd.) does not set tracking cookies until you start a video; once you play it, Google processes your data under its own privacy policy.

Links. Our pages link to other sites: our online shop, crowdfunding campaigns (e.g. Gamefound), and our social media pages (e.g. Facebook, Instagram), etc. When you follow a link, the other site's own privacy policy applies; we have no control over it. Links to our shop carry a source tag (utm_source=legend-crafters.com) so the shop's statistics show that you came from here; it does not identify you.

Fonts and all other files of the Website are served from our own server; we do not load them from Google or other third parties.

9. Our online shop

Our online shop (https://shop.legend-crafters.com/) runs on Shopify, a separate service. Orders, payments, delivery and customer accounts are covered by the shop's own privacy policy, available on the shop's pages. Legend Crafters remains the controller of the order data; Shopify acts as our processor.

10. Who receives your data

We share data only with service providers who process it on our behalf and under our instructions (processors, Art. 28 GDPR), and with authorities where the law requires it.

  • Microsoft Ireland Operations Ltd. — Service: hosting, database, e-mail sending, mailbox (Azure, Microsoft 365). Location of data: EU (Netherlands, Germany). Transfer safeguard: EU Data Boundary; Standard Contractual Clauses and the EU–U.S. Data Privacy Framework for any access from outside the EU.
  • Cloudflare, Inc. — Service: domain name service, Web Analytics (aggregated). Location of data: worldwide, incl. USA. Transfer safeguard: EU–U.S. Data Privacy Framework; Standard Contractual Clauses.
  • Shopify International Ltd. — Service: online shop. Location of data: Ireland / Canada. Transfer safeguard: adequacy decision (Canada); Standard Contractual Clauses.

When you play an embedded YouTube video, Google Ireland Ltd. acts as an independent controller (section 8).

11. How long we keep data, and how we protect it

The retention periods are listed in section 2 and in each section above. After that, data is deleted or made anonymous.

We protect your data with technical and organisational measures, among them: encrypted connections (HTTPS, TLS 1.2+), access to the administration only for named staff with their company Microsoft accounts, secrets kept in a key vault, minimal data collection by design, and regular backups kept in the EU.

12. Your rights

You have the right to:

  • access your data and receive a copy (Art. 15);
  • have it corrected (Art. 16) or erased (Art. 17);
  • restrict its processing (Art. 18);
  • data portability (Art. 20);
  • object to processing based on our legitimate interest (Art. 21) — we then stop unless we have compelling reasons;
  • withdraw your consent at any time (e.g. unsubscribe from the newsletter).

To exercise your rights, write to info@legend-crafters.com. We answer within one month; if we need to confirm your identity, we may ask you for information. Note that for the website statistics we hold no data that identifies you, so we cannot single out your records.

Complaints. You can lodge a complaint with the Hungarian supervisory authority: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), 1055 Budapest, Falk Miksa utca 9–11; postal address: 1363 Budapest, Pf. 9.; phone: +36 1 391 1400; e-mail: ugyfelszolgalat@naih.hu; naih.hu. You may also contact the authority of the EU country where you live or work, or go to court.

13. Other information

Children. The Website is not directed at children under 16, and we do not knowingly collect their data. Newsletter subscription is for persons aged 16 or over.

Automated decisions. We do not make decisions about you based solely on automated processing, and we do not profile you.

Changes. We update this policy when our services change. The current version is always on this page; for significant changes affecting newsletter subscribers, we notify them by e-mail.

Effective date: 15th October 2026.