1. Controller

The controller responsible for the processing of personal data on this website and in connection with our products is:

City Games Vienna KG

Alsegger Straße 59/1/9

1180 Vienna

Austria

Email: comeplay@citygames.wien

Phone: +43 676 6414574

Website: www.citygames.wien

Company register number: FN 484385 g

Commercial register court: Commercial Court Vienna / Handelsgericht Wien

VAT ID: ATU73976637

We have not appointed a data protection officer because, based on our current assessment, we are not legally required to do so. For privacy requests, please use the contact details above.

2. Scope of this Privacy Policy

This Privacy Policy explains how we process personal data when you:

·       visit our website,

·       place an order in our webshop,

·       create a customer account,

·       use our physical city games and the digital story layer,

·       use our app or digital experiences,

·       contact us by email, contact form, social media or WhatsApp,

·       subscribe to our email newsletter or WhatsApp channel,

·       submit reviews, photos, comments or feedback,

·       participate in competitions, events, surveys, workshops or playtests.

Personal data means any information relating to an identified or identifiable natural person, such as name, address, email address, phone number, order data, payment status, IP address or communication content.

3. Legal bases

We process personal data in particular on the following legal bases under the General Data Protection Regulation (GDPR):

·       Article 6(1)(b) GDPR: performance of a contract or pre-contractual steps, e.g. orders, delivery, customer service, digital access.

·       Article 6(1)(c) GDPR: compliance with legal obligations, e.g. tax and accounting retention duties.

·       Article 6(1)(a) GDPR: consent, e.g. newsletters, WhatsApp marketing, non-essential cookies and tracking tools.

·       Article 6(1)(f) GDPR: legitimate interests, e.g. secure website operation, fraud prevention, internal analysis, legal claims, answering general enquiries, improving our products.

·       Section 165(3) Austrian Telecommunications Act 2021 (TKG 2021): storing information on your device or accessing information on your device, where relevant for cookies, pixels, local storage or similar technologies.

Where processing is based on consent, you may withdraw your consent at any time with effect for the future.

4. Sources of personal data

We receive personal data in particular from the following sources:

·       directly from you, e.g. when you place an order, create an account, contact us, subscribe to a newsletter or submit content;

·       automatically through our website and services, e.g. technical data, cookies, log data, cart and checkout data;

·       from service providers, where they process data in connection with contract performance, payment, delivery, analytics, security or communication;

·       from platforms or third parties, e.g. payment providers, app stores, social media platforms, WhatsApp/Meta or Shopify, where this is required for the relevant function or where you interact with us there.

We use such data only for the purposes described in this Privacy Policy and on the legal bases stated.

5. Website visits and technical data

When you visit our website, technically necessary data is processed so that the website can be displayed, operated securely and improved technically. This may include:

·       IP address,

·       date and time of access,

·       pages visited and files requested,

·       referrer URL,

·       browser, operating system and device type,

·       technical log data and security events.

Purposes: providing the website, security, error analysis, prevention of abuse and fraud, technical stability.

Legal basis: Article 6(1)(f) GDPR; for technically necessary storage or access on your device, also Section 165(3) TKG 2021.

Retention: log data is generally stored only as long as necessary for security, troubleshooting and traceability; longer storage only occurs in case of security incidents or legal necessity.

6. Webshop, orders and customer account

If you place an order or create a customer account, we process in particular:

·       name,

·       billing and shipping address,

·       email address,

·       phone number, where provided or required for delivery/customs,

·       order data, products, language, prices, discounts and vouchers,

·       payment method, payment status and transaction data,

·       shipping status, tracking data, returns and complaints data,

·       customer account and login data, if an account is created,

·       communication relating to the order.

Purposes: processing your order, forming and performing the contract, delivery, payment, invoicing, customer service, returns, statutory warranty, fraud prevention, compliance with legal duties.

Legal bases: Article 6(1)(b) GDPR; Article 6(1)(c) GDPR; Article 6(1)(f) GDPR.

We use Shopify as our e-commerce platform. Payment is processed through the payment providers offered at checkout, such as Shopify Payments/Stripe, PayPal, Klarna, credit card providers, Apple Pay, Google Pay, Shop Pay or bank transfer. Depending on your chosen payment method, payment data is also processed by the relevant payment provider as an independent controller. We generally do not receive full credit card details, but payment status, transaction references and accounting information.

7. Shopify as shop platform

Our website and webshop are operated through Shopify. Shopify provides the e-commerce platform, checkout, shop functions, security functions and certain analytics, privacy and marketing functions.

Information that you enter in the webshop, or that arises in connection with your use of the shop, is transmitted to Shopify and to service providers used by Shopify where this is necessary to operate and improve the shop. In many areas Shopify processes personal data for us as a processor. In certain areas, however, Shopify may process personal data as an independent controller, in particular where Shopify provides its own services, security functions, privacy choices, fraud prevention, payment/checkout functions or enhanced features.

Where we use Shopify features that combine data from your interactions with our shop, with other merchants or with Shopify, Shopify may be responsible for that processing. Details are available in Shopify's privacy information. Depending on your place of residence and the activated functions, you may also be able to exercise rights relating to certain Shopify processing through the Shopify Privacy Portal.

8. Shipping, customs and returns

For delivery, returns and customs handling where applicable, we share necessary data with shipping providers and involved parties, in particular:

·       name,

·       shipping address,

·       email address and phone number where required for delivery or notification,

·       order and parcel data,

·       customs information for deliveries outside the EU.

Recipients: in particular Österreichische Post and, where applicable, other shipping, logistics, customs or fulfilment providers.

Legal bases: Article 6(1)(b) GDPR; Article 6(1)(c) GDPR; Article 6(1)(f) GDPR.

9. Physical city games and digital story layer

Our physical Monster Hunt packs work mainly offline: read the map, solve riddles, find places, use scratch cards. If you use the digital story layer, e.g. by entering a code or opening a website/URL, technical access data may be processed.

Important distinction: The physical game packs and the web-based story layer do not collect GPS or location data from players during play. Gameplay is guided by the printed map, scratch cards and codes. We therefore do not know where you are while playing.

However, when you use links, QR codes, websites or embedded content, the usual technical website data may arise, such as IP address, browser data, access time and content accessed.

Purposes: providing story content, technical security, error analysis, improving content.

Legal bases: Article 6(1)(b) GDPR; Article 6(1)(f) GDPR.

10. App and digital experiences

We operate and/or develop digital experiences, including the Monster Hunt: Cities app and messaging-based games such as Cow Chat Crime. Depending on the product, data flows may differ from the physical game pack.

When you use the app, depending on your use and device settings, the following data may be processed:

·       technical device data,

·       app usage data,

·       crash and error data,

·       language, city, game status or progress,

·       optional location data if you activate a GPS/on-location feature and grant the corresponding device permission,

·       data relating to app store downloads and in-app purchases, where these are processed by Apple or Google.

Location data is only processed where required for an actively used app function and where you have granted the corresponding device permission.

Map, Street View or similar functions may include services from Google or other map providers. These providers may carry out their own processing.

Purposes: providing app functions, game mechanics, error analysis, security, improving the app, processing in-app purchases.

Legal bases: Article 6(1)(b) GDPR; Article 6(1)(a) GDPR for consent-based functions; Article 6(1)(f) GDPR.

11. Contact and customer service

If you contact us by email, contact form, phone, social media, WhatsApp or otherwise, we process the data you provide, such as:

·       name and contact details,

·       content of your message,

·       order number or customer data, where relevant,

·       date and communication history,

·       attachments or photos you send us.

Purposes: answering your enquiry, customer service, handling orders, complaints, partnerships or other matters, documentation.

Legal bases: Article 6(1)(b) GDPR where the enquiry relates to a contract; otherwise Article 6(1)(f) GDPR; Article 6(1)(c) GDPR where legal duties apply.

Please do not send us special categories of personal data, such as health data, political opinions or highly private information, unless absolutely necessary.

12. Email newsletter

If you subscribe to our email newsletter, we process in particular:

·       email address,

·       name, if provided,

·       language and interests, if provided or inferred,

·       consent time and opt-in evidence,

·       opening, click and delivery data, where captured by the newsletter tool,

·       unsubscribe status.

Purposes: sending news, offers, product information, event announcements, game updates and community content.

Legal basis: your consent under Article 6(1)(a) GDPR and Section 174 TKG 2021.

Withdrawal: you can unsubscribe at any time using the unsubscribe link in the newsletter or by contacting us.

We use in particular Mailchimp and/or Shopify newsletter functions as newsletter service providers where these are activated.

13. WhatsApp communication and WhatsApp marketing

If you communicate with us via WhatsApp or subscribe to our WhatsApp channel or WhatsApp newsletter, we process in particular:

·       phone number,

·       WhatsApp profile name and, if applicable, profile picture,

·       message content,

·       consent and opt-in data,

·       interaction and delivery data,

·       tags, segmentation or campaign assignments, where used.

Purposes: customer communication, game and community communication, sending news, offers, reminders, event information or game-related messages where you have consented.

Legal bases: Article 6(1)(a) GDPR for marketing messages; Article 6(1)(b) GDPR for contract-related communication; Article 6(1)(f) GDPR for general communication and documentation.

For WhatsApp we use services of Meta/WhatsApp and, where applicable, Chatarmin as WhatsApp marketing and automation tool. Meta/WhatsApp also processes certain data as an independent controller. Please also see WhatsApp/Meta's privacy information.

You can unsubscribe from WhatsApp marketing at any time, e.g. through an unsubscribe function, a message such as "STOP" or by contacting us.

14. Reviews, photos, feedback and user-generated content

If you submit reviews, comments, photos, videos, suggestions or feedback to us, we process the data you provide, such as name, content, image material, date, product reference or communication channel.

Purposes: publishing reviews, showing player experiences, improving our products, customer communication, marketing, documenting feedback.

Legal bases: Article 6(1)(a) GDPR where we ask for consent, in particular for photos/videos of people; Article 6(1)(f) GDPR for simple product reviews, moderation and internal analysis; Article 6(1)(b) GDPR where feedback relates to contract performance or warranty.

Please do not send us photos of children or other people unless you are authorised to submit and publish them. For publication of photos or videos in which people are recognisable, we will where possible obtain separate consent.

15. Competitions, events, workshops and tests

If you participate in competitions, events, workshops, playtests or surveys, we may process, depending on the activity:

·       name and contact details,

·       participation and communication data,

·       age or age group, where required for the activity,

·       answers, feedback and test results,

·       photo/video recordings only after separate information and consent, where required.

Purposes: conducting the activity, communicating with participants, evaluation, prize notification, improving our games and offers.

Legal bases: Article 6(1)(b) GDPR; Article 6(1)(a) GDPR where consent is obtained; Article 6(1)(f) GDPR.

16. Cookies, tracking and similar technologies

Our website uses technically necessary cookies and similar technologies so that the shop works, e.g. cart, checkout, language settings, login, security and consent management.

In addition, where activated and only after your consent, analytics and marketing tools may be used, e.g. Shopify Analytics, Google Analytics, Google Tag Manager, Meta Pixel, Google Ads or similar services.

Technically necessary technologies: Article 6(1)(f) GDPR and Section 165(3) TKG 2021.

Analytics/marketing/tracking: Article 6(1)(a) GDPR and Section 165(3) TKG 2021.

You can change or withdraw your consent at any time via the cookie settings on the website. Non-essential cookies and similar technologies may only be set after your consent.

A detailed cookie list should be displayed in the Cookie Policy or Shopify cookie settings.

17. Personalised advertising, privacy choices and Global Privacy Control

Where we use analytics, marketing or advertising functions, we use them only with your consent where consent is legally required. This may include personalised advertising, reach measurement, remarketing or analysis of shop interactions.

You can withdraw or change your consent at any time through the cookie or privacy settings on our website. Depending on your place of residence and the activated Shopify functions, additional privacy choices may be available, such as an opt-out from certain forms of targeted advertising or data sharing through Shopify privacy functions.

If your browser sends a supported Global Privacy Control signal, Shopify may - depending on your location, the activated Shopify functions and the technical settings - treat this as an opt-out signal for certain data-based advertising or sharing activities. We do not sell personal data in the ordinary sense; however, certain advertising and tracking activities may be considered a "sale", "sharing" or "targeted advertising" in some jurisdictions.

18. Social media

We operate profiles on social media platforms, e.g. Instagram, Facebook, TikTok, LinkedIn or YouTube. If you visit our profiles or interact with us on these platforms, depending on the platform and interaction, we process:

·       publicly visible profile information,

·       comments, likes, messages and interactions,

·       statistical data provided by the platform,

·       communication content.

The platform operators also process data in their own responsibility. We have only limited influence on their processing. Please see the privacy notices of the respective platforms.

Purposes: public relations, community communication, answering messages, promoting our products, analysing reach.

Legal bases: Article 6(1)(f) GDPR; Article 6(1)(a) GDPR for consent-based platform functions.

19. Recipients and processors

We share personal data only where necessary for the purposes described, where there is a legal basis or where you have consented. Recipients may include in particular:

·       Shopify as shop and e-commerce platform,

·       payment providers, e.g. Shopify Payments/Stripe, PayPal, Klarna, credit card providers, Apple Pay, Google Pay, Shop Pay,

·       shipping providers, in particular Österreichische Post,

·       IT, hosting, security and maintenance providers,

·       newsletter and marketing tools, e.g. Mailchimp, Shopify Email or similar providers,

·       WhatsApp/CRM tools, e.g. Chatarmin and Meta/WhatsApp,

·       analytics and tracking providers, where activated and consented to,

·       app development partners and technical service providers for digital experiences,

·       tax advisors, accounting providers, banks, payment institutions,

·       legal advisors, authorities, courts or other bodies where legally required or necessary for legal claims;

·       acquirers, legal successors, advisors or competent bodies in connection with a business restructuring, sale, merger, insolvency or similar process, where legally permissible and necessary.

Where required, we enter into data processing agreements with processors under Article 28 GDPR.

20. International transfers

Some service providers may process personal data outside the European Economic Area (EEA), in particular in the United States, Canada or other countries. This may concern international services such as Shopify, Google, Meta/WhatsApp, Mailchimp, PayPal, Stripe or app/analytics providers.

A transfer only takes place where suitable safeguards or legal bases exist, e.g.:

·       adequacy decision by the European Commission,

·       EU Standard Contractual Clauses,

·       EU-U.S. Data Privacy Framework, where the provider is certified,

·       your explicit consent in certain cases,

·       necessity for contract performance.

Please note that, despite safeguards, international transfers may involve a level of data protection different from that in the EU.

21. Retention periods

We store personal data only as long as necessary for the relevant purposes or as long as legal retention duties apply. Typical retention periods are:

·       Order, invoice and accounting data: generally 7 years due to tax and business law duties.

·       Contract, warranty and complaint data: for the duration of contract processing and thereafter within statutory limitation periods.

·       Product and safety documentation: where required up to 10 years or longer if necessary for product safety, legal defence or legal duties.

·       Contact enquiries: as long as needed to handle the enquiry, then depending on the content for an appropriate documentation period.

·       Newsletter data: until unsubscribe or withdrawal, thereafter only suppression/evidence data where required.

·       WhatsApp and community data: until unsubscribe, deletion or withdrawal, unless longer retention is required for evidence, contract or legal duties.

·       Cookie and tracking data: depending on the relevant tool and your cookie settings.

When data is no longer required, it is deleted or anonymised.

22. Your rights

Under the GDPR, you have in particular the following rights:

·       right of access,

·       right to rectification,

·       right to erasure,

·       right to restriction of processing,

·       right to data portability,

·       right to object to processing based on legitimate interests,

·       right to withdraw consent with effect for the future,

·       right not to be subject to a decision based solely on automated processing, including profiling, where the legal requirements are met.

To exercise your rights, please contact us at comeplay@citygames.wien. We may request proof of identity where necessary to protect your data from unauthorised access. If you appoint an authorised person to exercise your rights on your behalf, we may request appropriate proof of authorisation.

23. Right to lodge a complaint

If you believe that the processing of your personal data violates data protection law, you have the right to lodge a complaint with a supervisory authority. In Austria, this is:

Austrian Data Protection Authority

Barichgasse 40-42

1030 Vienna

Austria

Email: dsb@dsb.gv.at

Website: www.dsb.gv.at

24. Children and teenagers

Our products are family-friendly, but the contracting party in the webshop must be of full age and legal capacity. Where children or teenagers use our games, this is the responsibility of their parents or legal guardians.

For digital services: in Austria, minors aged 14 and above can validly consent to information society services. For children under 14, consent of the parents or legal guardians is generally required where consent is used as the legal basis.

We do not direct our webshop contracts directly at children and do not knowingly collect data from children under 14 without required consent.

25. Automated decision-making

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Depending on your payment method, creditworthiness or fraud checks may be carried out by payment providers; their own privacy information applies.

26. Security

We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure, alteration or destruction. Depending on the system, these include access restrictions, encrypted transmission, secure passwords, permission concepts, backups and selection of suitable service providers.

Please note that no technical or organisational measure can guarantee absolute security. Where possible, do not use insecure communication channels such as unencrypted email or ordinary messenger messages for particularly confidential information.

27. Changes to this Privacy Policy

We may update this Privacy Policy if our data processing, tools, products or the legal situation changes. The version published on our website applies.

Last updated: 18 June 2026