SKY MAVIS PRIVACY POLICY
Sky Mavis Pte. Ltd. (“Sky Mavis,” “we,” “us,” or “our”) is a software development company that builds virtual worlds and the infrastructure that makes them possible.
This Privacy Policy (“Privacy Policy”) is designed to inform you about how we collect, use, process, and share your Personal Data (as defined below) in connection with use of any of our products, services, or applications (collectively the “Services”); and visit or use of our website (“Site”) to the extent related to the Services. By using our Services, you agree to the collection and use of your Personal Data in accordance with this Privacy Policy. Unless otherwise defined in this Privacy Policy, any terms used in this Privacy Policy will have the same meanings as set forth in our Terms of Use.
Please note that our Services and Site are not intended for minors below 18 years of age, and we do not knowingly collect data relating to minors.
1. SKY MAVIS’ ROLE WITH YOUR DATA
1.1. Data Controller. Sky Mavis Pte. Ltd., a company incorporated in Singapore, is the controller of your Personal Data, and we are responsible for handling your Personal Data related to the use of our Services.
1.2. Data Protection Offer. We have appointed a Data Protection Officer (“DPO”) who shall be responsible for overseeing questions relating to this Privacy Policy. If you have any questions or concerns related to this Privacy Policy or our privacy practices, or want to exercise your legal rights, please contact our DPO at: DPO@skymavis.com .
1.3. Changes to your Personal Data. We may periodically update our Privacy Policy. It is your responsibility to review and ensure that you have read and understand any new versions of the Privacy Policy that we may update from time to time. It is important that the Personal Data we hold about you is accurate and up-to-date, so please keep us informed if your Personal Data changes during your relationship with us.
1.4. Third-Party Links. Our Site, app, and any applicable browser or browser extension required to access the Services may include links to third-party websites, plug-ins, and applications (“Third-Party Sites”). If you click on those links or enable those connections, you may allow third parties to collect or share data about you. We do not control these Third-Party Sites and therefore are not responsible for their privacy statements or policies. When you leave our Site, you should read the privacy policy or statement of every Third-Party Site you visit or use.
2. PERSONAL DATA WE COLLECT
2.1. General. The categories of Personal Data we collect depend on how you interact with us, our Services, and the requirements of applicable laws. We collect information that you provide to us, information we automatically obtain when you use our Services, and information from other sources such as third-party services and organizations, as described below.
2.2. Definition of Personal Data. Personal Data, or personal information, means any information that relates to an identified or identifiable living individual (collectively, all “Personal Data” as described in this section). This is a broad definition which includes the specific pieces of personal data which we describe in further detail below. However, Personal Data does not include data which cannot be used to identify an individual person, such as a company registration number.
A Data Subject (“Data Subject”) is an individual who can be identified, directly or indirectly, by Personal Data. This is usually by reference to an identifier, such as a name, identification number, location data, an online identifier, or one or more other factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person. Different pieces of information, if collected together, may also lead to the identification of a particular person, and therefore also is Personal Data. However, Personal Data does not include data where the identity has been removed (anonymous data). For more information about Personal Data, please refer to the European Commission’s definition here.
2.3. Kinds of Personal Data We May Collect. Below are different kinds of Personal Data about you that we may collect, use, store, and transfer:
| Personal Data Category | Examples of this Category of Personal Data |
|---|---|
| Identity Data |
|
| Contact Data |
|
| Financial Data |
|
| Transactional Data |
|
| Investment Data |
|
| Technical Data |
|
| Profile Data |
|
| Usage Data |
|
| Marketing and Communications Data |
|
| Other special categories of Personal Data | There are certain types of sensitive Personal Data that are subject to additional protection under applicable laws. These are called “special categories” of Personal Data. Currently the Services do not include processing of special categories of Personal Data (such as personal data revealing racial or ethnic origin, political opinions, religious, or philosophical beliefs). |
2.4. Refusal to Provide Personal Data. If you refuse to provide Personal Data where we need to collect Personal Data by law, or under the terms of an agreement we have with you, we may not be able to perform the agreement we have or are trying to enter into with you (e.g. to provide you the Services). In this case, we may cancel a product or Service you have with us, but we will notify you if this is the case at that time.
2.5. Biometric Data and Identity Verification (KYC). To ensure the security of our platform, prevent financial fraud, and comply with applicable anti-money laundering (AML) and counter-terrorist financing (CTF) regulations, we require identity verification during user registration.
- Data Collected: When you undergo identity verification, we collect biometric data, specifically facial data, facial geometry, images (selfies), and video captures of your face, alongside your government-issued identification documents.
- Purpose of Use: This facial data is used strictly for "liveness detection" (to ensure you are a real person) and identity verification (to mathematically compare your selfie against the photograph on your government-issued ID). This ensures that you are who you claim to be and protects your account from unauthorized access.
- Third-Party Sharing & Storage: We do not perform this verification directly. Your face data is processed and securely transmitted to our trusted vendor, Sumsub (Sum&Substance), who acts as our data processor. Sumsub securely stores this data on encrypted servers. Neither we nor Sumsub will ever sell, lease, trade, or utilize this data for marketing or advertising purposes.
- Data Retention: In accordance with Singapore MAS regulatory requirements, your facial data and identity verification records will be retained for a period of three (3) years from the date your account is closed or the business relationship is terminated, after which it will be permanently and securely destroyed.
3. HOW WE COLLECT YOUR DATA
3.1. General. The aforementioned categories of Personal Data we collect depend on how you interact with us, our Services, and applicable law requirements. We collect data and information that you provide to us, information we obtain through automated technologies or interactions when you use our Services, and information from third parties or other sources, as described below.
3.2. Methods of Collecting Data. Sky Mavis uses different methods to collect information from and about you, including through:
- Information you directly provide to us – you may give us your Identity Data, Contact Data, Financial Data, Investment Data, Profile Data, and Marketing and Communications Data when you directly interact with us, including by filling out forms, by email, or any other method or form. This includes Personal Data you provide when you:
- Visit our Site;
- Use or apply to use our Services;
- Create an Account;
- Request marketing materials to be sent to you, for example, by subscribing to our newsletters;
- Enter a giveaway, competition, or contest, including through social media channels;
- Provide us with Submissions or otherwise contact us.
- Information collected from automated technologies or interactions – as you interact with and/or use our Site, we may automatically collect Technical Data about your equipment, browsing patterns, actions, and habits. We collect this Personal Data by using server logs, cookies, and similar technologies. We may also collect Transactional Data, Investment data, and Usage Data through your use of our Site. Finally, we may also receive Technical Data and Marketing and Communications Data about you if you visit other websites using our cookies. On our main Site, you will be informed about how we use cookies through the Cookies Policy.
- Information collected from third parties or other sources – we also obtain information about you from third parties or other sources. These sources may include public blockchains or other publicly available information on the Internet (e.g. websites, articles, social media; etc.)
4. HOW WE USE YOUR DATA
4.1. General. We will only use your Personal Data according to applicable laws. Thus, we must ensure that there is a legal basis for using your Personal Data. Common examples of when we will use your Personal Data include:
- Contract performance – we may process your Personal Data when it is necessary for us to perform a contract to which you are a party, or to take steps at your request prior to entering into a contract (e.g. this is the basis for the provision of our Services);
- Legitimate interests – we may process your Personal Data for our interests, or those of a third party, when we ensure we use this basis does not override or is otherwise in conflict with your interests and individual rights;
- When you have given consent – we may process your Personal Data where you have freely given your consent, which is based on your informed and clear indication by a statement or clear affirmative action that indicates your agreement to the processing of your Personal Data; there may be certain circumstances where this consent needs to be explicit, and we will properly request for your consent in those circumstances.
4.2. Purposes for Processing Your Personal Data. In the table below, we describe the various ways we plan to use your Personal Data and the legal bases we rely on to do so. Where applicable, we have also identified our legitimate interests. We may process your Personal Data for more than one legal basis, depending on the specific purpose for which we are using your data. Please contact us if you need more details about the specific legal basis that we are relying on to process your Personal Data.
| Purpose for Processing Your Personal Data | Categories of Personal Data | Legal Basis for Processing |
|---|---|---|
| Registration of you as a new customer |
|
|
| Processing and delivery of our Services to you, including the management, processing, and execution of any instructions or orders you make |
|
|
| Prevention of abuse of our Services and promotions |
|
|
| Management of our relationship with you, which may include keeping you informed about our business and product development |
|
|
| Maintenance and updates of our records and to study how our customers use our Services |
|
|
| Management, processing, collection, and transfer of payments and fees |
|
|
| Compliance to applicable laws and regulations, including responding to and resolving complaints |
|
|
| Facilitation of your participation in giveaways, contests, and other competitions |
|
|
| Gathering market data for studying customers’ behavior, including their preference, interest, and how they use our Services, determining our marketing campaigns, and growing our business |
|
|
| Administration and protection of our business, our Site, and social media channels, including troubleshooting, data analysis, testing, system maintenance, support, reporting, bans, and data hosting |
|
|
| Delivery of relevant website content and advertisements to you, and analyzing or understanding the advertisement’s effectiveness |
|
|
| Use of data analytics to improve our website, Services, marketing, customer relationships, and overall experience |
|
|
| Giving you suggestions or recommendations about Services or products that you may be interested in |
|
|
| Use of social media or advertising platform services, some of which may use your Personal Data for their own purposes, such as marketing |
|
|
4.3. Change of Purpose. We will only use your Personal Data for the purposes we have collected it for unless we reasonably consider that we will need it for another reason which is also compatible with the original purpose and in accordance with applicable laws. If we need to use your Personal Data for an unrelated purpose, we will notify you of this intent and explain the legal basis for allowing us to do so.
4.4. Marketing. If you have requested information from us and consented to receive marketing communications, you will receive marketing communications from us. We will use your Contact Data and Marketing and Communications Data for our respective activities.
4.4. Third-Party Marketing. Regarding third-party marketing, we will get your consent prior to sharing your Personal Data with any third party for marketing purposes.
4.5. Opting Out. You may opt out, or ask us to stop sending you marketing messages, at any time by directly emailing us at: DPO@skymavis.com. Please note that opting out of receiving marketing messages will not apply to services messages directly related to the use of our Services (e.g. maintenance or updates, changes in terms of use; etc.).
4.6. Cookies. You may set your browser to allow or refuse all or some browser cookies, or to alert you when websites set or access cookies. If you refuse or disable cookies, some parts of the Services or Site may become inaccessible or not properly function. Please review the Cookies Policy for more information about the types of cookies we may use.
5. HOW WE TRANSFER YOUR DATA
5.1. Transferring Within our Group Companies. We may share your Personal Data within our group companies. This may involve transferring your Personal Data outside the European Economic Area (EEA) or the UK.
5.2. Transferring to Third Parties. Many of our external third parties are based outside the EEA or UK regions. Thus, their processing of your Personal Data will involve a transfer of data outside the EEA or the UK.
5.3. How We Transfer Your Personal Data. Whenever we transfer your Personal Data out of the EEA and the UK, we ensure a similar degree of protection that is afforded to it by ensuring at least one of the following safeguards is implemented:
- The country where we transfer your Personal Data to has been deemed to provide an adequate level of protection for personal data by the European Commission (for more information, please refer here);
- There are Standard Contractual Clauses in place. Standard Contractual Clauses are a specific contract approved by the European Commission that provides safeguards to the processing of personal data. Please note that there may be future changes to the Standard Contractual Clauses for transfers from the UK. When these are implemented, we will comply with the guidance provided by the respective UK supervisory authority.
6. HOW WE DISCLOSE YOUR DATA
6.1. General. We may share your Personal Data with various third parties, including our third-party service providers, agents, subcontractors, and other associated organizations, our group companies, and affiliates to provide Services to you on our behalf and complete other related tasks. When using third-party service providers, they are required to respect the security of your Personal Data and must treat it in accordance with the law.
6.2. Disclosure of Personal Data. We may disclose your Personal Data to the following third parties:
- Companies and other organizations that assist in providing any of the Services you have requested, including verifying your transactions;
- Anyone to whom we may lawfully transfer our rights and duties under the relevant terms and conditions governing the use of any Services; and
- Law enforcement and regulatory authorities, whether they are inside or outside of the EEA, under applicable law.
7. DATA SECURITY
7.1. General. We have implemented appropriate security measures to prevent your Personal Data from being accidentally lost, used, damaged, altered, disclosed, or accessed in an unauthorized or unlawful way or manner. We also limit access to your Personal Data to those employees, agents, contractors, and other third parties who have a legitimate business reason. They will only process your Personal Data in accordance with our instructions, and they are subject to a duty of confidentiality.
7.2. Risk of Data Breaches. You understand and accept that there is an inherent risk in any data being shared over the Internet against your wishes, and that there is no security system that is impenetrable. Thus, we cannot guarantee the security or our systems or those of our vendors. If there is any information under our custody and control that is compromised as a result of a breach of our security, we will take steps to investigate and remediate the situation, and in accordance with applicable laws and regulations, may notify the individuals whose Personal Data may have been compromised.
7.3. Your Responsibilities. You are solely responsible for the security of your methods of transmitting Data via our Services, including but not limited to any Account(s), as applicable, digital wallet and any Personal Data, including any transactions, relating to or arising thereof. We strongly encourage you to take measures to ensure that your mediums of data transmission, whether by hardware, software or otherwise, remain secure. If at any time you discover an issue related to your transmission of data, please contact the relevant service provider.
8. DATA RETENTION
8.1. General. We consider a variety of factors in determining the appropriate retention period for your Personal Data. This includes the amount, nature, and sensitivity of the Personal Data; the potential risk of harm from unauthorized use or disclosure of your Personal Data; the purposes for which we may process your Personal Data and whether we can achieve those purposes through other means; and any applicable legal, regulatory, tax, accounting, or other requirements.
8.2. Removal or Deletion of Personal Data. If your Personal Data is no longer necessary for the purpose(s) for which it may be lawfully processed, we will remove any details that will identify you, or we will securely destroy the relevant records.
8.3. Retention of Data. In order to adhere to applicable laws, we may need to maintain records for a significant period of time after you cease being our customer. We may also be subject to certain anti-money laundering laws that may require us to retain the following for a period of time after our business relationship with you has ended:
- A copy of the records we used in order to comply with any required or applicable customer due diligence obligations; and
- Supporting evidence and records of transactions with you, and your relationship with us.
We may also keep your Personal Data for a longer period if we cannot delete it for legal, regulatory, or technical reasons.
8.4. Marketing Communications Obligations. If you have opted out of receiving marketing communications from us, we will retain your details on an opt-out list so that we know you do not want to receive these communications.
9. YOUR LEGAL RIGHTS
9.1. General. There are legal rights that are available to you regarding your Personal Data that we process. We have outlined these below. You may request to exercise these rights, subject to any limitations provided for under applicable data protection laws.
9.2. Access. You may ask us to confirm whether we are processing your Personal Data, and if so, what information we process and to provide you with a copy of that information.
9.3. Rectification. You may request for us to rectify your Personal Data by providing us with the information you think is inaccurate or incomplete, and then providing us with the new and updated information. We may need to verify the accuracy of the new data you provide to us.
9.4. Deletion. You may ask us to delete your Personal Data. However, we may not be able to comply with your deletion request for specific legal or technical reasons (e.g. we are unable to delete your Personal Data that is published on a public blockchain).
9.5. Processing Restrictions. You may request for us to restrict the processing of your Personal Data by asking us to suspend the processing of your Personal Data for the following reasons:
- if you want us to establish the data accuracy;
- where our use of your Personal Data is unlawful but you do not want it erased;
- where you need us to hold the Personal Data even if we no longer require it as you need it to establish, exercise, or defend legal claims; or
- if you have objected to our use of your Personal Data, but we need to verify whether we have overriding legitimate grounds to use it.
9.6. Objection. You may object to the processing of your Personal Data, where we are relying on a legitimate interest (or those of a third party) and there are certain circumstances which make you want to object about the particular processing as you feel it impacts your fundamental rights and freedoms. In certain situations, we may demonstrate that we also have compelling legitimate grounds to process your Personal Data which override your rights and freedoms. As stated above, you also have the right to object where we are processing your Personal Data for direct marketing purposes.
9.7. Transfers. You may request us to transfer your Personal Data to you or to a third party, and we will provide to you or the third party you have chosen (where technically feasible) your Personal Data in a structured, commonly used, machine-readable format. This right only applies to automated information that you initially provided consent for us to use or where we used the information to perform an agreement with you.
9.8. Automated Decision-Making and Profiling. You may require us to reconsider decisions if they are solely made by automated means (without human involvement). Please note that we will do our best to notify you if decisions are made solely on an automated basis so that you may have the opportunity to exercise this right.
9.9. Complaints. You may complain to our DPO or any relevant authority about any perceived violation and seek compensation for damages in the applicable courts.
9.10. Withdrawal of Consent. You can withdraw your consent at any time where we are relying on consent to process your Personal Data. However, this will not affect the legality of any processing carried out prior to your withdrawal of consent. If you withdraw your consent, we may not be able to provide certain Services or products to you.
9.11. Potential Fees. Usually, you will not have to pay a fee to access your Personal Data or to exercise any of the rights mentioned in this Privacy Policy. However, we may charge a reasonable fee if your request is clearly unfounded or excessive. In this situation, we may also refuse to comply with your request.
9.12. Statutory Period for Replying to Legitimate Requests. The statutory period under the GDPR for us to reply to a legitimate request is one (1) month. This period may be extended by two (2) additional months where necessary and considering the complexity and number of requests. Please note that we may request that you provide some details necessary to verify your identity when you request to exercise a legal right regarding your Personal Data.
10. MISCELLANEOUS
10.1. Privacy When Using Digital Assets and Blockchains. Your use of Digital Assets may be recorded on a public blockchain. Public blockchain are distributed ledgers that are intended to immutably record transactions across wide networks of computer systems. Many blockchains are open to forensic analysis, which can lead to re-identification of the individuals who make transactions as well as the revelation of Personal Data, especially when blockchain data is combined with other data.
Because blockchains are decentralized or are third-party networks that are not controlled or operated by us, we are not able to erase, modify, or alter Personal Data on such networks.
10.2. Minors and Children. Our Services and the Site are not intended for persons under the age of 18, and we do not knowingly collect data relating to minors. If we learn that we have inadvertently processed Personal Data from a minor or child, we will take legally permissible measures to remove that data from our records. We may also require the minor user to close their account and will not allow the use of our Services or Site. If you are a parent or guardian of a minor and you become aware that a minor has provided Personal Data to us, please contact us.
SKY MAVIS COOKIES POLICY
This Cookies Policy (“Cookies Policy”) is designed to inform you about how we use cookies and other similar technology to collect and store the information we automatically collect about your computer, device, and use of the Site operated by us. This Cookies Policy should be read in conjunction with our Privacy Policy. Unless otherwise defined in this Cookies Policy, any terms used in this Cookies Policy will have the same meanings as set forth in the Privacy Policy. This Cookies Policy may be updated from time to time.
Please note that our Services and Site are not intended for minors below 18 years of age, and we do not knowingly collect data relating to minors.
1. COOKIES
1.1. General. Cookies are small, often encrypted text files, containing small amounts of information and downloaded to your device when you visit a certain website such as our Site (“Cookies”). Cookies are then sent back to the originating website on each subsequent visit or to another webpage that recognizes the Cookie. Cookies are widely used to make websites work better for users and to provide information to the website’s owners or operators. For example, Cookies may allow you to navigate more efficiently between webpages, remember your preferences, and improve your overall user experience.
1.2. Types of Cookies. Generally, there are two categories of Cookies: (1) first party Cookies, and (2) third party Cookies. First party Cookies are provided directly by us to your device. Third party Cookies, which are provided by a third party on our behalf, are used by us for functionality, performance and analytics, and advertising and social media purposes.
1.3. Cookie Behaviors. Cookies may remain on your device for different periods of time. Some Cookies only exist while your browser is open and are automatically deleted once you close your browser. Other Cookies survive after you close your browser and can be used by our Site to recognize your device when you reopen your browser.
2. SKY MAVIS’ USE OF COOKIES
2.1. How We Use Cookies. Sky Mavis uses Cookies for various purposes, including:
- Monitoring the performance of our Sites and to continually improve them;
- Tracking Site traffic flow and user/visitor patterns;
- Understanding the number of visitors to our Site on an ongoing basis and the types of internet browsers used by our visitors;
- Customizing and enhancing your online experience with us; and
- Enabling Sky Mavis and third parties to advertise both on and off our Site.
2.2. What Types of Cookies We Use. Sky Mavis uses several types of Cookies regarding our Site and Services. We have categorized these types of Cookies below:
| Type of Cookie | Purpose |
|---|---|
| Necessary Cookies | These cookies are essential or necessary for our Site and/or App to function and cannot be switched off in our system. They are usually only set in response to actions made by which amount to a request for services, such as setting your privacy preferences, logging into your Account, or completing forms. Opting out of these necessary cookies may disallow us to provide you access to our Site and/or Services. |
| Performance / analytics Cookies | These Cookies help us understand how our users and visitors interact with our Site by collecting and reporting information about your visit, including the pages you viewed and accessed, and time spent on the website. |
| Functionality Cookies | These Cookies record information about choices you make and allow us to tailor our Site to your specific needs and desires. When you continue to use our Site, we can then provide you with our Services as you have customized according to your preferences. |
| Advertising and tracking Cookies | These Cookies enable us and third-party companies, including advertising companies, to track your activity across various sites where we or they display ads and record your activities so we or they can show ads that we or they consider relevant to you and your purported interests. These Cookies are anonymous and store information about the content you are browsing but not about who you are. |
| Social media Cookies | Third parties that provide applications through our Site may set their own anonymous Cookies to track the success of their applications or customize their applications for you. Because of how Cookies work, we cannot access or control these Cookies, nor can the third parties access the data in Cookies we use. Some pages of our Site may also contain embedded content, such as video content from Twitch, and these third-party websites may set their own Cookies as well. |
3. YOUR RIGHT TO COOKIES
3.1. General. You have the right to determine whether to accept the Cookies on our Site. However, you understand that if you choose to refuse Cookies, you may not be able to use the fully functional version(s) of our Site and/or Services.
3.2. Browser Options. Most browsers, such as Google Chrome, Safari, and Firefox, will allow you to change your Cookie settings. These settings will usually be found in the “Settings” or “Preferences” menu of your respective browser. Below are some helpful links to more commonly used browsers:
If you do not use one of the browsers mentioned above, please use the “Help” option in your browser for more details. Please note that our Site or Services may not recognize any automated browser signals regarding tracking mechanisms, such as “do not track” instructions.
3.3. Third Party Cookies Limitation. As mentioned above, we do not control and therefore cannot limit third party Cookies. If you want to limit third party Cookies, you can turn off or disable such Cookies by visiting the following links:
| Performance/Analytics Cookies | |
|---|---|
| Google Analytics | Google Analytics Opt-Out |
| Microsoft Analytics | Microsoft Privacy Statement |
| Advertising Cookies | |
| Google Advertisements Opt-Out | |
| Microsoft | Microsoft Personalized Ads Opt-Out |
| Facebook Ads Preferences | |
| TikTok | TikTok Cookie Policy |
| Twitch | Twitch Privacy Controls |
Please note that this is a non-exhaustive list of Cookies, and there are many more companies listed on any of the websites mentioned in this Cookie Policy than those that use Cookies via our Site.
3.4. Opting Out of Our Cookies. You may opt out of our Cookies through the aforementioned methods and also through our Cookies preference center. If you have disabled one or more Cookies, we may still use information you provided prior to your particular Cookie disabling preference(s) being set. However, we will stop using the disabled Cookie to collect any further information.
3.5. Other Opt-Out Methods. You may also submit an industry-wide opt-out request for internet-based advertising through other organizations, including the following:
4. MISCELLANEOUS
4.1. Changes to the Cookie Policy. We may update our Cookies Policy periodically. It is your responsibility to review and ensure that you have read and understand any new versions of the Privacy Policy that we may update from time to time.
4.2. Contacting Us. If you have any questions or concerns related to this Cookies Policy, please contact us at: DPO@skymavis.com.