Last updated on: March 6th, 2023
Who are we?
Hello! We’re Systemic Reaction, one of three creative divisions that make up Avalanche Studios Group. If the name rings a bell, it may be from the explosive combination of 80’s hairstyles and giant killer robots that is Generation Zero. The spikey, mutant dinosaurs of Second Extinction. Or perhaps our unique take on the folklore-steeped roguelite in Ravenbound. Either way, thanks for exploring those massive open worlds with us!
Across all three of Avalanche Studios Group’s divisions – Avalanche Studios, Expansive Worlds, and Systemic Reaction – we take player privacy and security very seriously. And no wonder, because it’s the bedrock for all the fun stuff we build on top. It’s also exactly what we’ll discuss below. So if you’re anything like us (and our lawyers,) you’re surely chomping at the bit to get started!
But before we get into the nitty-gritty, a few details for the record. Avalanche Studios Group is based in Stockholm, New York, Malmö, and Liverpool. Our home base is our Stockholm office in Sweden, which is located at Västgötagatan 5 in beautiful Södermalm. The postal code is 118 27 if you ever want to send us a cheeky love letter. For the purposes of this document, Systemic Reaction AB is the data controller.
Now let’s talk definitions! Personal Data is any information that can identify an individual, directly or indirectly. This could be your name, location, or online identifiers (like IP address, web browser version, that sort of thing). The purpose of this document, then, is to help you make sense of how we collect, store, use, transfer, or disclose your Personal Data.
If you live within the European Economic Area or the United Kingdom (hello, neighbor!) you have some crucial rights: the right to access, correct, update, or request deletion of your Personal Data. You may also have the right to object to the processing of your Personal Data, ask us to restrict the processing of your Personal Data, request portability of your Personal Data or withdraw consent to the processing of your Personal Data. If you wish to exercise any of the above rights regarding your Personal Data as mentioned above, please contact us at [email protected].
If you have concerns regarding the processing of your Personal Data, we hope you can work with us to solve them. However, you can also decide to contact the Swedish Data Protection Authority or your local Data Protection Authority. The Swedish Data Protection Authority can be reached through the following address:
Phone: +46 (0)8 6576100
Mail: Integritetsskyddsmyndigheten, Box 8114, SE-10420 Stockholm, Sweden
Email: [email protected]
We understand that you may be located in a country where you are granted similar rights in relation to your Personal Data.
Below, we describe the Personal Data we collect and how we collect it. We also explain why and how we process your Personal Data.
We collect Personal Data about you and the devices you use to access and interact with us and our Properties:
a) We collect Identity Data. This includes your names, usernames, or similar identifiers as well as your titles and preferred genders.
b) We collect Contact Data if or when you decide to contact us. This includes your home address (for example if we need to send you a replacement product), email address, phone number and other data you may provide in order to stay in touch. We don’t ask about your pet’s name, but if you tell us it’s Baby Panay, we might scribble a note of it.
d) We collect Technical Data. This includes your IP address, session identifiers, login data, browser type and version, product version, hardware information, time zone setting and location, browser plug-in types and versions, operating system, and other technology on the device you use to access the Properties or communicate with us. Should our Properties malfunction on your device, technical data may also include specific device information, such as the location of the file on your device.
e) We collect Profile Data. This is another way of saying “data connected to your Avalanche Apex Connect account", including user name, e-mail address, friends list and password.
f) We collect Usage Data. This includes information about how you use the Properties, such as where the game was purchased, how many robots you shot right in the CPU, where in the world they met their demise, as well as total time spent playing. Don’t worry, we won’t share that final number with your significant other.
g) We collect Marketing and Communication Data. This includes your choice about receiving marketing and communications from us and our third-party partners.
h) We collect Aggregated Data. This includes statistical or demographic data derived from all users’ Personal Data. This is not considered Personal Data in the eyes of the GDPR legal framework since this data can no longer be used to directly or indirectly reveal your identity. This may consist of information from the other data categories but in an aggregated and anonymized form.
i) We collect Publicly Available Data. This includes publicly available information shared on third-party platforms, such as Twitter.
Generally speaking, we collect Personal Data to provide, maintain and improve our Properties, to communicate with you, and for marketing. More specifically, collected Personal Data may be used in the following ways:
a) We process your Identity, Contact, Transaction, Profile, Usage, Marketing and Communications and Technical Data for the Purpose of delivering relevant Properties’ content as well as related advertisements to you. We also use it to measure or understand the effectiveness of the advertising we serve you. This helps us to define different types of players and to keep the Properties updated. This, in turn, can help us develop better games, inform our marketing and growth strategy, and grow our business. Our legal basis for this processing is: Necessary for our legitimate interests.
b) We process your Identity and Contact Data for the Purpose of registering you as a user of the Properties. In other words, to deliver the entertainment that we have promised, and that you’re hopefully keen to experience. Our legal basis for this processing is: Performance of a contract with you.
c) We process your Identity, Contact, Transaction and Marketing and Communications Data for the purpose of verifying your identity and details of your purchase(s), and communicating with you regarding related topics. Our legal basis for this processing is: Performance of a contract with you, Necessary for our legitimate interests.
e) We process your Identity, Contact, Technical and Usage Data for the purpose of administrating and protecting our business and our services through support, reporting and hosting data, data analysis, system maintenance, testing and troubleshooting. Our legal basis for this processing is: Necessary to comply with a legal obligation, Necessary for our legitimate interests.
f) We process your Contact, Identity, Technical, Usage and Aggregate Data for the purpose of tweaking, improving and correcting the Properties, bug-fixing, improving performance for different devices and operating systems, and to ensure optimal use. Our legal basis for this processing is: Necessary for the performance of a contract with you, Necessary for our legitimate interests.
g) We process your Publicly Available Data (such as reviews, opinions, comments and more that you may post to publicly available sources) to understand the community sentiment surrounding the Properties. Our legal basis for this processing is: Necessary for our legitimate interests.
We may share your Personal Data with third parties as described below:
b) With partners engaged by Avalanche Studios Group or its creative divisions to provide you with goods or services you have requested.
c) With platform operators, and other partners who provide services in relation to the Properties.
d) With other users of the Properties by showing information, such as usernames, leaderboards, and chat messages.
e) With third-party service providers who have been appointed as data processors to perform functions and services on our behalf. These parties will be provided only with the necessary data to perform those services (e.g. web hosting services, payment processing, information technology systems, customer relationship management, crash report analysis, publisher or developer revenue calculation and reporting, marketing, measuring the effectiveness of our advertising, auditing and administration).
f) With operators of external accounts or services, if or when you decide to link your Avalanche Apex Connect account with them.
g) With our advisors or insurers in the event of a claim, dispute or otherwise when deemed necessary.
h) With law enforcement authorities or government officials if we are required to do so by law, pursuant to legal process, or to comply with any applicable rules or regulations. This includes, but is not limited to, stock exchange market rules.
Please note that any information, including Personal Data, that you reveal on a bulletin board, message board, chat room, or in other public forums is publicly viewable and accessible.
Any third parties that you interact with through the Properties may have different privacy practices than us, so you should review those privacy policies before you share your Personal Data with them. In fact, that’s really useful advice for life on the internet in general.
We may share Aggregated Data with our third-party publishers, developers, and service providers. This Aggregated Data does not contain Personal Data and consists of statistics including usage of the Properties, event attendance, and event participation.
We transfer and share your information to third parties (including service providers operating on our behalf) which are located in countries outside the European Union (“EU”) and/or the European Economic Area (“EEA”) which may not have the same level of data protection laws as those in the country where you are located. When your data is sent to a country outside the EU/EEA that is not subject to an adequacy decision by the EU Commission, the transfers will only occur if we have entered into EU Commission-approved standard contractual clauses with the receiving entity, which is deemed to offer sufficient safeguards with respect to the protection of the privacy and fundamental rights and freedoms of individuals, and we judge that your Personal Data enjoys equivalent protection as if in the EU/EEA.
We care about privacy and security. To that end, we have implemented the appropriate technical and organizational measures to ensure that your Personal Data is collected, processed, and stored as securely as possible. For instance, we have implemented various policies including pseudonymization, encryption, access, and retention policies to guard against unauthorized access and unnecessary retention of Personal Data. On top of this, we enforce contractual measures by way of non-disclosure agreements, data processing agreements, and other contractual clauses designed to keep your Personal Data safe in accordance with the GDPR legal framework.
However, there is no such thing as perfect security. Complete online or offline security can never be guaranteed by anyone, so you should always exercise reasonable care when sharing your information online.
We will only retain information where we still have a critical and legitimate need to use your Personal Data – for example to resolve disputes, enforce our user agreements according to our EULA, or comply with legal requirements.
If we learn that we have collected and processed Personal Data of a child under the age of 13 years, we will take reasonable steps to ensure the erasure of the Personal Data from our systems. This may require us to delete the child’s account to the Properties.
Systemic Reaction AB
SE-10061 Stockholm, Sweden