Last updated on: March 6th, 2023
Who are we?
Hello! We’re Systemic Reaction, one of three creative divisions that make up Avalanche Studios Group. If the name rings a bell, it may be from the explosive combination of 80’s hairstyles and giant killer robots that is Generation Zero. The spikey, mutant dinosaurs of Second Extinction. Or perhaps our unique take on the folklore-steeped roguelite in Ravenbound. Either way, thanks for exploring those massive open worlds with us!
Across all three of Avalanche Studios Group’s divisions – Avalanche Studios, Expansive Worlds, and Systemic Reaction – we take player privacy and security very seriously. And no wonder, because it’s the bedrock for all the fun stuff we build on top. It’s also exactly what we’ll discuss below. So if you’re anything like us (and our lawyers,) you’re surely chomping at the bit to get started!
But before we get into the nitty-gritty, a few details for the record. Avalanche Studios Group is based in Stockholm, New York, Malmö, and Liverpool. Our home base is our Stockholm office in Sweden, which is located at Västgötagatan 5 in beautiful Södermalm. The postal code is 118 27 if you ever want to send us a cheeky love letter. For the purposes of this document, Systemic Reaction AB is the data controller.
What’s a Privacy Policy exactly?
We’ve already mentioned that your privacy matters to us, but how does this Privacy Policy help ensure it?
When we discuss your privacy throughout the Privacy Policy, that includes our entire company group and any affiliates. That means our company (whose legal name is Systemic Reaction AB) and any of our affiliates.
Now let’s talk definitions! Personal Data is any information that can identify an individual, directly or indirectly. This could be your name, location, or online identifiers (like IP address, web browser version, that sort of thing). The purpose of this document, then, is to help you make sense of how we collect, store, use, transfer, or disclose your Personal Data.
This Privacy Policy applies to the video games we bring you as the player. It also applies to related services such as our customer service, our websites and the Avalanche Apex Connect service. We’ll call these games and services “Properties” throughout this document.
Ready to proceed to level 2? Sorry, chapter 2. Just one more thing. We reserve the right to change this Privacy Policy at any time by posting an updated version to our Properties (again, games and services). We might do this to adapt to changing legal, technical, or business requirements. Please review the Privacy Policy from time to time so that you’re aware of any changes. It can help to check the “Last updated” line at the top of the document.
If we make an especially important change to the Privacy Policy, we’ll provide you with a notice through the Properties or by email. Those are not our favorite emails to receive either, so we’ll try to keep them to a minimum.
If you live within the European Economic Area or the United Kingdom (hello, neighbor!) you have some crucial rights: the right to access, correct, update, or request deletion of your Personal Data. You may also have the right to object to the processing of your Personal Data, ask us to restrict the processing of your Personal Data, request portability of your Personal Data or withdraw consent to the processing of your Personal Data. If you wish to exercise any of the above rights regarding your Personal Data as mentioned above, please contact us at [email protected].
If you have any questions about your privacy, your rights, or how to exercise them, please contact us using the information provided to you in the “How to contact us” section of this Privacy Policy.
If you have concerns regarding the processing of your Personal Data, we hope you can work with us to solve them. However, you can also decide to contact the Swedish Data Protection Authority or your local Data Protection Authority. The Swedish Data Protection Authority can be reached through the following address:
Phone: +46 (0)8 6576100
Mail: Integritetsskyddsmyndigheten, Box 8114, SE-10420 Stockholm, Sweden
Email: [email protected]
We understand that you may be located in a country where you are granted similar rights in relation to your Personal Data.
Below, we describe the Personal Data we collect and how we collect it. We also explain why and how we process your Personal Data.
We collect Personal Data about you and the devices you use to access and interact with us and our Properties:
a) We collect Identity Data. This includes your names, usernames, or similar identifiers as well as your titles and preferred genders.
b) We collect Contact Data if or when you decide to contact us. This includes your home address (for example if we need to send you a replacement product), email address, phone number and other data you may provide in order to stay in touch. We don’t ask about your pet’s name, but if you tell us it’s Baby Panay, we might scribble a note of it.
c) We collect Transaction Data. This includes details around products and services you have accessed or used throughout the Properties, as well as purchases or orders made by you. We don’t process or store any credit or debit card information or details on our servers. Such payments and information are processed by our trusted third parties on their payment servers – so their privacy policy applies for those payments.
d) We collect Technical Data. This includes your IP address, session identifiers, login data, browser type and version, product version, hardware information, time zone setting and location, browser plug-in types and versions, operating system, and other technology on the device you use to access the Properties or communicate with us. Should our Properties malfunction on your device, technical data may also include specific device information, such as the location of the file on your device.
e) We collect Profile Data. This is another way of saying “data connected to your Avalanche Apex Connect account", including user name, e-mail address, friends list and password.
f) We collect Usage Data. This includes information about how you use the Properties, such as where the game was purchased, how many robots you shot right in the CPU, where in the world they met their demise, as well as total time spent playing. Don’t worry, we won’t share that final number with your significant other.
g) We collect Marketing and Communication Data. This includes your choice about receiving marketing and communications from us and our third-party partners.
h) We collect Aggregated Data. This includes statistical or demographic data derived from all users’ Personal Data. This is not considered Personal Data in the eyes of the GDPR legal framework since this data can no longer be used to directly or indirectly reveal your identity. This may consist of information from the other data categories but in an aggregated and anonymized form.
i) We collect Publicly Available Data. This includes publicly available information shared on third-party platforms, such as Twitter.
Generally speaking, we collect Personal Data to provide, maintain and improve our Properties, to communicate with you, and for marketing. More specifically, collected Personal Data may be used in the following ways:
a) We process your Identity, Contact, Transaction, Profile, Usage, Marketing and Communications and Technical Data for the Purpose of delivering relevant Properties’ content as well as related advertisements to you. We also use it to measure or understand the effectiveness of the advertising we serve you. This helps us to define different types of players and to keep the Properties updated. This, in turn, can help us develop better games, inform our marketing and growth strategy, and grow our business. Our legal basis for this processing is: Necessary for our legitimate interests.
b) We process your Identity and Contact Data for the Purpose of registering you as a user of the Properties. In other words, to deliver the entertainment that we have promised, and that you’re hopefully keen to experience. Our legal basis for this processing is: Performance of a contract with you.
c) We process your Identity, Contact, Transaction and Marketing and Communications Data for the purpose of verifying your identity and details of your purchase(s), and communicating with you regarding related topics. Our legal basis for this processing is: Performance of a contract with you, Necessary for our legitimate interests.
d) We process your Identity, Contact, Profile and Marketing and Communications Data for the purpose of providing you access to the Properties, notifying you about changes to our terms of use or privacy policy, asking you to leave a review or take a survey, or investigating complaints. Our legal basis for this processing is: Performance of a contract with you, Necessary to comply with our legal obligations, Necessary for our legitimate interests, Consent.
e) We process your Identity, Contact, Technical and Usage Data for the purpose of administrating and protecting our business and our services through support, reporting and hosting data, data analysis, system maintenance, testing and troubleshooting. Our legal basis for this processing is: Necessary to comply with a legal obligation, Necessary for our legitimate interests.
f) We process your Contact, Identity, Technical, Usage and Aggregate Data for the purpose of tweaking, improving and correcting the Properties, bug-fixing, improving performance for different devices and operating systems, and to ensure optimal use. Our legal basis for this processing is: Necessary for the performance of a contract with you, Necessary for our legitimate interests.
g) We process your Publicly Available Data (such as reviews, opinions, comments and more that you may post to publicly available sources) to understand the community sentiment surrounding the Properties. Our legal basis for this processing is: Necessary for our legitimate interests.
We will never share or sell your Personal Data to another company, except as described in this Privacy Policy. Do read on, it’s not sinister.
We may share your Personal Data with third parties as described below:
a) With other members of the Avalanche Studios Group, or our affiliated companies, which may use this data to offer products and services to you consistent with this Privacy Policy.
b) With partners engaged by Avalanche Studios Group or its creative divisions to provide you with goods or services you have requested.
c) With platform operators, and other partners who provide services in relation to the Properties.
d) With other users of the Properties by showing information, such as usernames, leaderboards, and chat messages.
e) With third-party service providers who have been appointed as data processors to perform functions and services on our behalf. These parties will be provided only with the necessary data to perform those services (e.g. web hosting services, payment processing, information technology systems, customer relationship management, crash report analysis, publisher or developer revenue calculation and reporting, marketing, measuring the effectiveness of our advertising, auditing and administration).
f) With operators of external accounts or services, if or when you decide to link your Avalanche Apex Connect account with them.
g) With our advisors or insurers in the event of a claim, dispute or otherwise when deemed necessary.
h) With law enforcement authorities or government officials if we are required to do so by law, pursuant to legal process, or to comply with any applicable rules or regulations. This includes, but is not limited to, stock exchange market rules.
i) We reserve the right to transfer your Personal Data to an actual or potential buyer (and its agents and advisers) in connection with any actual or proposed purchase, merger, or acquisition of any part of our business. Should this happen, we will instruct the buyer that they should use your personal information only for the purposes disclosed in this Privacy Policy.
Please note that any information, including Personal Data, that you reveal on a bulletin board, message board, chat room, or in other public forums is publicly viewable and accessible.
Any third parties that you interact with through the Properties may have different privacy practices than us, so you should review those privacy policies before you share your Personal Data with them. In fact, that’s really useful advice for life on the internet in general.
We may share Aggregated Data with our third-party publishers, developers, and service providers. This Aggregated Data does not contain Personal Data and consists of statistics including usage of the Properties, event attendance, and event participation.
Systemic Reaction, our affiliates and our partners, such as marketing partners and analytics providers, may use tracking technologies such as cookies, beacons, tags, scripts, and/or similar technologies on our websites to analyze trends, administer the website, track users’ movements around the website, tailor content and marketing, gather information about our user base, remember users’ settings, for authentication, and to improve and adjust user experiences. This allows us to gauge the effectiveness of certain communications and the effectiveness of our marketing campaigns. For more information about our use of cookies, please see our Cookie Policies on each respective website, which are also incorporated by reference into this Privacy Policy and made part of this Privacy Policy. Users can control the use of cookies at the individual browser level. If you reject cookies, you may still use our websites, but your ability to use features or areas of our websites may be limited.
We transfer and share your information to third parties (including service providers operating on our behalf) which are located in countries outside the European Union (“EU”) and/or the European Economic Area (“EEA”) which may not have the same level of data protection laws as those in the country where you are located. When your data is sent to a country outside the EU/EEA that is not subject to an adequacy decision by the EU Commission, the transfers will only occur if we have entered into EU Commission-approved standard contractual clauses with the receiving entity, which is deemed to offer sufficient safeguards with respect to the protection of the privacy and fundamental rights and freedoms of individuals, and we judge that your Personal Data enjoys equivalent protection as if in the EU/EEA.
We care about privacy and security. To that end, we have implemented the appropriate technical and organizational measures to ensure that your Personal Data is collected, processed, and stored as securely as possible. For instance, we have implemented various policies including pseudonymization, encryption, access, and retention policies to guard against unauthorized access and unnecessary retention of Personal Data. On top of this, we enforce contractual measures by way of non-disclosure agreements, data processing agreements, and other contractual clauses designed to keep your Personal Data safe in accordance with the GDPR legal framework.
However, there is no such thing as perfect security. Complete online or offline security can never be guaranteed by anyone, so you should always exercise reasonable care when sharing your information online.
We will not retain or keep any Personal Data for longer than necessary for the purposes outlined in this Privacy Policy. If you terminate your contract with us, withdraw your consent, or ask us to delete your Personal Data in accordance with this Privacy Policy, we will do that.
We will only retain information where we still have a critical and legitimate need to use your Personal Data – for example to resolve disputes, enforce our user agreements according to our EULA, or comply with legal requirements.
We do not knowingly collect Personal Data from children under 13 years of age in the Properties or in connection with them. We believe it’s important to safeguard the privacy of children and encourage parents to regularly monitor their children’s use of online activities. If you are a parent and believe that we have unintentionally collected their children’s other personal information, please contact us through the mailing address at the end of this Privacy Policy, and we will work to delete that account and any such personally identifiable information.
If we learn that we have collected and processed Personal Data of a child under the age of 13 years, we will take reasonable steps to ensure the erasure of the Personal Data from our systems. This may require us to delete the child’s account to the Properties.
If you have any questions, complaints, or comments regarding how we process your Personal Data or about our Privacy Policy, please contact us at:
Systemic Reaction AB
Box 11238
SE-10061 Stockholm, Sweden
[email protected]