Privacy statement

Who is responsible

VCRShop B.V., Vijzelweg 44C, Lelystad. Questions about privacy: info@vcrshop.nl.

What data and why

• Account: your name in the game, your password (only encrypted with Argon2id, never readable), your character, motto, profile text, friends and guestbook. Needed to make the game work (performance of the contract).
• E-mail address and date of birth: stored encrypted and never visible to other players. We only use your e-mail address to help you with your account (for example if you lost your password) and to prevent duplicate accounts; your date of birth to know whether you are old enough (from 8), whether you need permission from a parent (under the age limit in your country: 13 in the Netherlands, Belgium, the United Kingdom and Sweden; 14 in Austria and Italy; 15 in France; 16 in Germany) and which protections apply to you. If you are under that age limit, your own e-mail address is not needed.
• E-mail address of your parent or carer (only for younger players): stored encrypted and only used to ask for permission; your parent can give or withdraw permission or have the account deleted on the page from the e-mail (GDPR article 8). We also keep when and which choice was made. The president can see your e-mail address for support; police and mayor only see your age. We don’t send advertising.
• Uitnodigingen: who invited whom and which reward was given for it, and an encrypted (hashed) fingerprint of the IP address at sign-up to recognise abuse of invitations.
• Spel: your house, items, play money, tasks and school progress.
• Chat: messages in rooms are not stored. If you play with someone who uses another language (for example via maketoo.de or maketoo.fr), we send the text of your message (without your name or other details, and after removing phone numbers and links) to DeepL SE (Cologne, Germany) to translate it. DeepL does not keep the text and does not use it for learning (data processing agreement, DeepL API Pro). Only with a report do the last lines of that room go to Maketoo’s police. Private messages are stored encrypted in the database.
• Beveiliging: your IP address is used briefly to prevent abuse (for example too many login attempts). For payments we only keep it encrypted (hashed).
• Betalingen: package, amount, date, status and payment method. Mollie processes your bank details; we don’t see them. We keep payment data for 7 years because the law requires it (tax retention obligation).
• Management log: what the police, the mayor and the president do, so that it can always be checked.

Your profile on the internet

Your profile is only on the public website if you turn that on yourself under “Edit profile”. You can always turn it off again.

Cookies and storage

We don’t use advertising or tracking cookies and no trackers. Your browser only keeps your login key and your preferences (such as your sound and display settings).

Who we share data with

• Mollie B.V. (Amsterdam) for payments.
• TransIP (Netherlands) as hosting provider of the server.
• DeepL SE (Germany) for translating chat messages between players who use different languages.

We never sell data. Data stays in the European Union.

How long

• Your account we keep as long as you play. After 2 years without logging in you get an e-mail, and 30 days later we automatically delete the account with your house, items, pets, friends and messages.
• Young players who need permission from a parent and never got it: automatically deleted after 60 days (and 30 days not logged in).
• Privéberichten: 2 years. Handled reports with the chat lines: 1 year. Log of the administrators: 2 years. Sent e-mails in the queue: 90 days.
• Payments we keep for 7 years, because the law requires it for the accounts.

Your rights

You can always download your data yourself and delete your account yourself in the game under Me > Account. For other questions (for example having something corrected, or an objection) you can e-mail us or use the meldformulier (choose "A request about my data"). You may also file a complaint with the Dutch Data Protection Authority.

Under the age limit?

If you are younger than the age limit in your country (13 in the Netherlands, Belgium, the United Kingdom and Sweden; 14 in Austria and Italy; 15 in France; 16 in Germany), you need permission from a parent or carer to chat and make friends. Parents can ask us which data we have about their child and have it deleted.

Your rights

You may view, correct or delete your data, and object. Send your request to info@vcrshop.nl. If you’re not happy with how we handle your data, you can file a complaint with the Dutch Data Protection Authority.