EvoPixel

Privacy Policy

EvoPixel Privacy Policy

Last updated:

1. Controller and scope

EvoPixel is the controller for personal data processed for evopixel.ro and its own services that link to this policy, including the shared account and Music, Books, Games and Radio websites. For questions or rights requests, contact contact@evopixel.ro. Connected communities and servers are covered insofar as they use these services; external platforms also apply their own policies.

2. Data we process

  • Website visits: IP address, browser and device information, requested addresses, access times and technical errors in operational and security logs. An IP address can be personal data.
  • Accounts: email, username, a hashed password, sign-ins, sessions, roles and preferred language. Depending on what you enter, your profile may include your name, avatar, phone, country, address or birth date. Linked external accounts provide an identifier and the profile information permitted by that platform; we do not receive their passwords.
  • Contact, requests and careers: your name, email, message and the experience, projects and requested role you choose to provide. Avoid sensitive information or unnecessary information about other people.
  • Catalogues and collaborations: author and artist names or pseudonyms, credits, descriptions, images, recordings, social links and release information intended for publication; contact, contractual and payment information needed for services and legal records.
  • Communities and media: for connected gaming features, Steam identifiers, public names and avatars, statistics and rankings from the server. Playing radio or media makes technical requests to the server supplying the stream or file. Webmail for authorised users processes messages, recipients, attachments and contacts needed for email services.
  • Official app: media playback and browsing use technical device information and requested resources. Firebase Cloud Messaging notifications use an installation token and subscription to EvoPixel notifications. You can disable them in operating-system settings.

3. Purposes and legal bases

  • Contract or steps requested before a contract, GDPR Article 6(1)(b): creating and using your account, handling service requests, collaborations, requested services and considering your job application.
  • Legitimate interests, Article 6(1)(f): security, abuse prevention, troubleshooting, responding to general messages, community administration and displaying game statistics. Country-based language selection supports accessible presentation. These interests must be balanced against your rights; you may object as provided by law.
  • Legal obligations, Article 6(1)(c): mandatory records, lawful authority requests and applicable tax or accounting duties.
  • Consent, Article 6(1)(a): optional features requiring it, including notifications and non-essential technologies if enabled. Consent is requested separately and can be withdrawn. A visit is not blanket consent to every use of your information.

Information requested for an account, application or order is necessary for that feature; without it we may be unable to provide the feature. Optional profile fields are not required to browse public pages.

4. Public information and recipients

Public names, credits, project information, team members and community statistics may be visible to visitors and indexed by search engines. Public information remains protected by GDPR. Form messages are not automatically published.

Internal access must be limited to the team handling the request or service. Hosting, email, infrastructure, distribution and payment providers receive information needed for their role. Distributors receive materials and credits required for agreed publication. Authorities may receive data as required by law, and relevant advisers may receive information needed for a dispute. We do not sell personal data for advertising. Google/Firebase provides app notification infrastructure where enabled.

5. Cookies and external services

  • Accounts and preferences: session and persistent sign-in cookies and local settings support login and website features. Some remain after the browser closes. You can clear them in your browser and sign out; blocking necessary cookies may prevent login.
  • country.is: when the account language is not used, code may send your IP address to country.is to identify your country and select a language. This feature is not used for GPS location.
  • Google reCAPTCHA: protects forms against abuse and may load Google resources, process IP and browser information and set cookies, including _GRECAPTCHA. The script may also load on pages without a visible form. See Google's privacy policy.
  • External platforms and content: sign-in, avatars, radio playback, externally hosted media and opening shop or social links may send technical information to the relevant provider. A simple social link is not an advertising pixel.
  • Analytics and advertising: the current website configuration does not integrate Google Analytics, Google AdSense or advertising pixels. Introducing non-essential technologies requires updating this notice and the choice mechanism before use. This policy is not a substitute for consent where the law requires it.

6. International transfers and security

Some providers may process data outside the European Economic Area. Transfers subject to GDPR must rely on an applicable adequacy decision or appropriate safeguards, such as standard contractual clauses, with additional measures where needed. Contact us for details of the recipients and safeguards relevant to your data; using a provider is not treated as your consent to a transfer.

We use technical and access measures to protect services, including hashed passwords and permission checks. No system can promise absolute security. Do not send passwords in messages or forms.

7. Retention

Retention depends on the purpose; there is no single period for every category. Account information supports the active relationship; a deletion request is assessed to distinguish what can be deleted from information required for legal obligations or legal claims. Requests and applications are kept as needed to handle them and substantiate the outcome; keeping them for future recruitment requires a separate legal basis.

Published materials follow the agreed publication period and rights. Contractual and financial records follow applicable statutory periods. Technical logs are retained according to diagnostic and security needs; an incident may justify longer retention of relevant evidence. Backups are removed through their rotation cycle and must not be used to reactivate erased data without a lawful basis. You may request the criteria and period applicable to a specific data category.

8. Your rights

Subject to GDPR conditions, you can request access, rectification, erasure, restriction and portability, and object to legitimate-interest processing. Withdrawing consent does not affect earlier lawful processing. Rights are not absolute, for example where records must be retained by law.

Contact us identifying your account and request, without sending your password. We may request proportionate information to verify identity. We normally respond within one month; a lawful extension of up to two further months must be explained within the first month. You can complain to ANSPDCP or the competent authority in your country and seek a judicial remedy.

Rankings are calculated from gaming activity. If an automated measure affects service access, you may ask for reasons and human review through the contact address, without limiting applicable rights concerning automated decisions.

9. Minors and updates

Services must be used in accordance with platform age requirements and rules protecting minors. Do not request or publish children's sensitive information through forms or profiles. A legal representative may contact us about clarification or deletion of information, as provided by law.

Changes are published with the update date. For significant processing changes, we will provide the necessary notice and obtain fresh consent where legally required. This policy is interpreted in accordance with the General Data Protection Regulation.