Privacy Policy
How we handle personal data, including information relating to children and parent accounts.
1. Who is responsible and what this notice covers
HEARTWING MEDIA LTD, registered in Cyprus, is the controller for the processing described here across www.ginaheartwing.com, ginaheartwing.com and play.ginaheartwing.com. Office address: 25 Voukourestiou Street, Neptune House, 1st Floor, 3045 Limassol, Cyprus. Company number: HE 499988. Contact privacy@ginaheartwing.com for privacy enquiries and rights requests. This notice covers website visitors, adult family-account holders, child profiles, purchasers and people contacting support. Independent payment providers and external websites may be controllers for their own purposes and issue separate notices.
We explain relevant processing when information is collected. This notice is information, not blanket consent. Optional activities require their own lawful choice. The Children and Parents Notice gives a shorter explanation for families.
2. Information and sources
Information comes from you or the adult managing the family account, your browser and device during use, and providers that confirm payments or deliver necessary account services. Depending on the feature used, it includes:
- Adult account email, account identifier, sign-in and security records and any contact or billing details supplied.
- Child-profile identifier, nickname, chosen avatar or companion, preferences and any age band collected for an explained purpose. Do not provide a child’s full name, school, home address or contact details in a nickname or creative text.
- Game and Academy progress, achievements, Sparks transactions, purchased entitlements, selected activities, Tree House arrangements and creations that you choose to save.
- Order reference, product, price, currency, payment status, refunds and tax records. Where a payment provider is used, it handles the payment credentials required by its service and is identified at checkout.
- IP address, browser and operating-system information, request timestamps, device or session identifiers and error and security logs. An IP-based country estimate can support currency selection and fraud prevention and is not an exact location.
- Support correspondence, information you volunteer and records of consent, parental authorisation and acceptance of terms.
Guest settings or progress may remain in browser storage; account-linked progress may be sent to our servers for synchronisation. Do not assume that all progress remains solely on the device. For features such as Star Explorers, a manually chosen city is different from device geolocation. Star Explorers lets you choose a city or request your device location through the browser. The location control rounds latitude and longitude to three decimal places and uses them in the open app session to calculate the sky view. You may refuse permission and choose a city instead. Your browser or operating-system provider handles its own location service under its privacy terms.
3. Purposes and legal grounds
| Purpose and information | Legal basis and limits |
|---|---|
| Adult family-account administration, requested sign-in, order fulfilment, adult support and delivery of paid access. | Performance of our contract with the adult, or steps requested before a contract, where objectively necessary. |
| Limited child-profile operation, saved progress and requested learning or creative features. | Our legitimate interests in providing the limited, adult-requested family activities, remembering progress and maintaining continuity, subject to necessity, data minimisation and the particular rights and interests of children. This does not extend to unrelated advertising, public disclosure or optional tracking. Where a feature requires consent, we rely on separately obtained valid consent, including parental authorisation where required, instead. The adult’s contract is not treated as the child’s contractual legal basis. |
| Security logs, abuse prevention, account protection and investigation of disputed activity. | Legitimate interests in keeping users and systems safe, subject to necessity and balancing against individual rights, particularly children’s rights; legal obligation where a specific duty applies. |
| Invoices, tax records and compliance with valid legal requirements. | Compliance with the legal obligations applicable to us. |
| Essential fault diagnosis and service reliability. | Legitimate interests in a functioning, secure service where necessary and proportionate. Optional tracking is not treated as essential diagnosis merely by labelling it analytics. |
| Optional analytics or newsletters, if offered. | Consent where required, separately obtained and withdrawable. No optional tracking before the relevant valid permission. |
| Handling legal claims and preserving relevant evidence. | Legitimate interests in establishing, exercising or defending claims, or compliance with a specific legal obligation. |
We identify the applicable purpose and basis before introducing a materially different use. We do not use acceptance of the Terms to obtain consent to marketing. Where processing relies on legitimate interests, you may object on grounds relating to your situation; we will apply the statutory test. Objection to direct marketing is unconditional.
4. Children and parental involvement
Gina is designed for family and child use. Adult-managed accounts do not remove our duties towards children whose information is processed. We seek only information necessary for the relevant feature and provide appropriate notices and safeguards. Where consent is the basis for an information-society service offered directly to a child, Cyprus Law 125(I)/2018 sets the threshold at 14; below that age, consent must be given or authorised by the holder of parental responsibility. Other countries may apply a different threshold. This is a data-consent rule, not permission for a child to enter every paid contract.
Where required, we take reasonable steps to verify parental authorisation proportionate to the processing and applicable law. A simple declaration or control of an email address is not necessarily sufficient for every jurisdiction. We explain any verification information requested and keep it no longer than necessary. If we learn that processing requiring authorisation occurred without it, we will restrict the affected processing and take appropriate steps to obtain authorisation or delete the information, preserving only records lawfully needed.
Child-profile information is used for the purposes explained in this notice. We do not authorise its sale, behavioural advertising directed at children or unrelated AI-model training. Any new use requires its own lawful basis and appropriate notice; acceptance of our Terms does not authorise it.
5. Visibility, creative work and location
A family-account holder may view and manage information associated with that family’s child profiles. Other people using the same signed-in device may see the selected profile and progress. Sign out of shared devices and keep adult controls secure. A nickname is still personal data where it can be linked to a child.
The ranking interface displays a nickname, rank and gameplay score to people who can access that interface. Do not use a child’s real name in a nickname. Contact us if you want help with a nickname or the display of profile information. A family account does not make every ranking entry private. Sending a support screenshot may disclose information shown on it; remove unnecessary personal details first. We will not treat a creative-content licence as consent to unrelated public use of a child’s information.
6. Providers and other disclosures
We disclose relevant information to providers that deliver hosting, backups, email, payments, security or other identified operational services. Processors act under appropriate contractual instructions and safeguards. Payment providers may also act independently for payment execution, fraud prevention and legal compliance. Professional advisers and authorities may receive information where necessary and lawful. We disclose only what is relevant to the purpose.
In a proposed or completed business transfer, information may be shared under confidentiality and other appropriate safeguards and transferred where lawful. A new operator must respect applicable rights and provide any required notice. A corporate transaction is not permission for an undisclosed, incompatible use of children’s information.
Our website infrastructure uses Google Cloud hosting. The production hosting region is London, United Kingdom. Hosting processes site requests and account information needed to operate the service. Email delivery and support involve the relevant mail systems. Any payment service offered at checkout is identified there, together with its applicable privacy information; this notice does not imply that a particular payment provider is connected.
7. International transfers
Where processing involves a transfer outside the EEA, we use the applicable lawful transfer mechanism. This may be an adequacy decision covering the recipient and transfer or appropriate safeguards such as the European Commission’s standard contractual clauses, together with the necessary assessment and supplementary measures. We do not assume that an EEA server region excludes overseas support access. Ask privacy@ginaheartwing.com for information about the relevant safeguards or a copy, with confidential material appropriately redacted.
Production hosting in the United Kingdom involves processing outside the EEA. The applicable mechanism must cover the recipient and processing concerned; adequacy applies only where a current decision covers the transfer. You can ask us for the transfer information and safeguards relevant to your information.
8. Retention and deletion
We keep information only for as long as necessary for its identified purpose. Active account and saved-progress records support the requested account service; closure or a valid deletion request triggers review and deletion or anonymisation of data no longer needed. Financial and legal records are retained separately for the applicable statutory or claims period, with restricted use. Security logs have a limited operational period unless an incident requires relevant records to be preserved.
Backup copies can outlast the active record. Information retained solely for recovery is not intended for ordinary use; deletion requests must also be taken into account when backup data is restored. We can explain the handling of a particular deletion request, including any lawful retention exception. Truly anonymised information may be retained where individuals cannot reasonably be identified. Pseudonymised records remain personal data.
Retention is determined by the purpose rather than a single period for all records. Account and progress information is needed while the family uses the account. For closure or deletion requests, we assess which records are no longer needed and which must be retained for a legal obligation, an unresolved transaction, security incident or legal claim. Support records are assessed against the enquiry and any related dispute; financial records against applicable accounting and tax duties; and security evidence against investigation needs. Browser data may remain until you clear it. Ask us for the retention criteria applying to a particular record.
9. Your rights
Subject to applicable conditions, you may request access and a copy, correction, erasure, restriction, and portability of information provided where processing is automated and based on consent or contract. You may object to legitimate-interest processing and to direct marketing. You may withdraw consent at any time without affecting the lawfulness of earlier processing. Withdrawal may affect a feature that genuinely depends on that consent, but does not justify unrelated penalties.
Contact privacy@ginaheartwing.com and identify the account or processing concerned. We may request proportionate verification to protect the information. A parent or guardian may act for a child where legally entitled, taking account of the child’s rights, age and capacity. We do not disclose another person’s information merely because a requester claims a family connection.
We normally respond without undue delay and within one month. Where legally permitted because of complexity or number of requests, this may be extended by up to two further months; we will explain the extension within the initial month. Requests are normally free; the limited statutory exceptions for manifestly unfounded or excessive requests apply. If we refuse all or part of a request, we explain the grounds and available complaint rights.
10. Required information, automated decisions and security
Information necessary to authenticate an account, deliver an order or meet a legal obligation is required for that purpose. If it is not provided, the relevant feature may be unavailable. Optional information and choices are identified separately. We do not assume that information is necessary merely because it would be useful commercially.
Gameplay scores, rewards, access checks and currency selection can operate automatically. They are not an individual educational or medical assessment. You may ask support to review a disputed access or account decision. Where a decision falls within Article 22 GDPR, the applicable restrictions and rights, including human intervention where required, are preserved.
We use technical and organisational measures appropriate to the risks, including controls over access, transmission, maintenance and recovery. No system is completely secure. Where a breach occurs, we assess it and notify competent authorities and affected people as required by law. Do not send passwords, sign-in links or full payment-card details in a privacy request.
11. Complaints and updates
You may contact us about a concern or complain directly to the Cyprus Commissioner for Personal Data Protection, whose current contact details are available at https://www.gov.cy/dataprotection/, or another competent supervisory authority, including in your habitual residence, place of work or place of the alleged infringement where applicable. Contacting us first is not mandatory.
We update this notice when our practices or legal duties change. Material changes will receive appropriate notice before new processing begins, and fresh consent where required. A revised notice does not itself authorise a new incompatible use. The publication date and version appear at the beginning.