VGLoot Privacy Policy

At VGLoot, your privacy is our priority.

We take the protection of your personal data very seriously. That is why we have designed our registration process to request only the essential information needed to provide our services:

• No sensitive data: We do not request sensitive data such as phone numbers, postal addresses, full dates of birth, identity documents or financial information
• Minimal registration: We only ask for name, nickname, email, region and preferred currency to personalise your experience
• No data sharing: We never sell, rent or share your personal information with third parties for commercial purposes
• Security: We implement technical and organisational security measures to protect your information
• Full control: You can delete your account and your data at any time

Our philosophy is simple: Our philosophy is simple: less data means less risk. We only collect what is necessary for you to enjoy VGLoot — nothing more.

1. Information We Collect

1.1 Personal Data Requested at Registration

When you register with VGLoot, we collect ONLY the following data:

• Name: To identify you as a real person
• Nickname: Your public alias visible to other users
• Email address: To verify your account, recover your password and send essential service communications
• Region: Your general geographic area (Europe, United States or Japan) to personalise relevant content
• Preferred currency: To display prices in your currency (EUR, USD, GBP or JPY)
• Password: Stored in encrypted form (we never store passwords in plain text)

IMPORTANT: We do NOT request or store: phone numbers, full postal addresses, exact dates of birth, identification numbers (ID/passport), banking or credit card information, or any other sensitive data.

1.2 Data You Provide Voluntarily

During use of the service, you may optionally provide:

• Information about video games in your personal collection
• Gaming platforms you own
• Game ratings and reviews
• Profile picture (avatar)
• Public profile information (biography, gaming social networks)
• Content requests to add to the database

1.3 Technical and Infrastructure Data

VGLoot does not actively collect or store users' IP addresses as part of the ordinary operation of the Service. However, the hosting infrastructure (Ionos) may automatically log certain technical data at the web server level beyond VGLoot's direct control — such as the originating IP address of connections — for the sole purpose of network security and integrity.

VGLoot does collect and process the following technical data of its own:

• Session and preference cookies: Small text files required for the site to function (see section 7)
• Language preference: Stored in a cookie and session to remember the selected language
• Aggregated usage data: Anonymous, aggregated information about feature usage, with no link to identified users

2. How We Use Your Information

We use the information collected exclusively to:

• Provide the service: Create and maintain your account, manage your game library
• Essential communication: Account verification emails, password recovery, security notifications
• Personalisation: Display prices in your currency, relevant content for your region
• Security: Detect and prevent fraud, bots, spam and malicious activity
• Service improvement: Anonymous usage analysis to improve the platform
• Legal compliance: Responding to legal requirements, court orders or competent authorities

We do NOT use your data for:

• Sale or rental to third parties
• Third-party marketing
• External targeted advertising
• Invasive profiling
• Transfer to new owners with binding commitments on data use — in the event of a change of ownership of VGLoot, current operators are exempt from all responsibility for how the new owner handles your information (see section 3.2)

3. Information Sharing

We do not sell, rent or share your personal data with third parties for marketing or advertising purposes.

We share information only in very limited circumstances:

3.1 Essential Service Providers

We may share data with providers who help us operate the service:

• Web hosting (Ionos): To store and serve the website
• Email service (SMTP): To send verification and recovery emails
• CDN and cache: To improve performance

These providers are contractually obliged to protect your data and may only use it to provide services to us.

3.2 Business Transfers

In the event of a merger, acquisition, asset sale, corporate reorganisation, cessation of activity or any other business transfer, your personal data may be transferred as part of the company's assets to the new owner or successor.

THE CURRENT OPERATORS OF VGLOOT ASSUME NO RESPONSIBILITY REGARDING THE PROCESSING THAT THE NEW OWNER OR SUCCESSOR MAKES OF YOUR PERSONAL DATA ONCE THE TRANSFER IS COMPLETE. The new owner may apply their own privacy policy, which may differ from this one. VGLoot does not guarantee prior notification, that the buyer will assume the same data protection commitments, or the possibility of deleting your account before the transfer.

We recommend reviewing this policy periodically and staying alert to communications from the Service in the event of ownership changes. If you have concerns about this, you may delete your account at any time from your profile.

3.3 Legal Requirements

We may disclose information if legally required:

• Court order or subpoena
• Request from law enforcement or governmental authorities
• Protection against illegal activity or fraud
• Defence of VGLoot's legal rights

3.4 Public Information

Certain information you choose to make public is visible to other users:

• Nickname and avatar
• Game library (if configured as public)
• Public reviews and ratings
• Public profile information

You control what information is public through your privacy settings.

3.5 Links to Third-Party Sites and Partners

VGLoot may contain links to third-party websites, partners or external platforms (game stores, social networks, affiliate services, etc.).

WE ARE NOT RESPONSIBLE FOR:

• The privacy policies of third-party websites
• Data you voluntarily provide to those external sites
• How those third parties handle your information
• The security or data protection practices of partners
• Any damage, loss or harm arising from your interaction with third-party sites

IMPORTANT: When you click on external links or interact with partner sites, you leave VGLoot and become subject to the privacy policies of those third parties. We recommend reading the privacy policies of any website you visit. VGLoot has no control over these sites and is not responsible for their content or practices.

4.1 Security Measures We Implement

VGLoot implements the following technical security measures over which it has direct control:

• Password encryption: Hashed using bcrypt; never stored in plain text
• HTTPS: Encrypted communications between your browser and our servers via SSL/TLS certificate
• Restricted operational access: Access to personal data is limited to VGLoot operator(s) with a legitimate need

Additionally, the hosting platform (Ionos) may provide infrastructure-level security measures (firewall, intrusion detection, backups, etc.) outside VGLoot's direct control. VGLoot does not guarantee or certify the existence, scope or effectiveness of such measures.

4.2 DISCLAIMER OF SECURITY LIABILITY

DESPITE OUR EFFORTS, VGLOOT CANNOT AND DOES NOT GUARANTEE THE ABSOLUTE SECURITY OF YOUR PERSONAL DATA.

YOU EXPRESSLY ACKNOWLEDGE AND AGREE THAT:

• No system is 100% secure: The Internet and computer systems carry inherent security risks
• Breaches are possible: Security breaches, hacks, cyberattacks or unauthorised access may occur despite our protective measures
• Data leaks: Your data could be exposed, leaked, stolen or compromised in the event of a successful attack
• Use at your own risk: You use the service assuming all security risks inherent to the Internet

4.3 WE ARE NOT RESPONSIBLE FOR:

TO THE MAXIMUM EXTENT PERMITTED BY LAW, VGLOOT SHALL NOT BE LIABLE FOR:

• Security breaches caused by third parties, hackers, cybercriminals or attackers
• Leaks or exposure of personal data resulting from cyberattacks
• Unauthorised access to your account through credential theft, phishing or social engineering
• Loss, corruption, destruction or alteration of data
• Interception of communications during transmission over the Internet
• DDoS attacks, ransomware, malware or viruses
• Zero-day vulnerabilities or unknown exploits
• Failures of third-party service providers (hosting, email, CDN)
• Natural disasters, infrastructure failures, power outages
• Any direct, indirect, incidental or consequential damage arising from a security breach

IN THE EVENT OF A SECURITY BREACH:

• We will make reasonable efforts to notify you if there is evidence that your data was compromised
• We will cooperate with competent authorities as required by law
• We will implement reasonable corrective measures to mitigate future risks
• BUT WE SHALL NOT BE LIABLE FOR ANY DAMAGES, LOSSES OR HARM RESULTING THEREFROM

4.4 Your Security Responsibility

You are responsible for:

• Keeping your password confidential
• Using strong, unique passwords
• Not sharing your credentials with third parties
• Notifying us immediately if you suspect unauthorised access
• Implementing your own security measures (two-factor authentication, password managers, etc.)
• Keeping your software and browser up to date

CRITICAL REMINDER: By using VGLoot, you accept these inherent security risks and release VGLoot from all liability for breaches, leaks or security compromises that may occur.

5. Data Retention

We retain your personal data for as long as your account is active and as necessary to provide the service.

Retention periods:

• Active account: We keep all your data for as long as you use the service
• Deleted account: We delete your personal data within 90 days of account deletion
• Usage data / logs: Retained for up to 12 months for security and analysis
• Legal obligations: We may retain data for longer if required by law
• Backups: Data may persist in backups for up to 30 additional days

You may request deletion of your account and data at any time by contacting us.

6. Your Data Protection Rights (GDPR)

Under the EU General Data Protection Regulation (GDPR), you have the following rights:

• Right of access: Request a copy of all data we hold about you
• Right of rectification: Correct inaccurate or incomplete data
• Right of erasure ("right to be forgotten"): Request deletion of your personal data
• Right to restriction of processing: Restrict how we process your data
• Right to data portability: Receive, in a structured, commonly used format, the personal data you provided to us directly and that is subject to automated processing, to the extent technically feasible
• Right to object: Object to the processing of your data for certain purposes
• Right to withdraw consent: Withdraw your consent at any time
• Right to lodge a complaint: File a complaint with the Spanish Data Protection Agency (AEPD)

To exercise these rights, contact us at: privacy@vgloot.com

We will respond to your request within 30 days. We may request identity verification before processing personal data requests.

7. Cookies and Tracking Technologies

VGLoot currently uses only strictly necessary cookies required for the site to function:

• Session cookie (vgloot_session): Keeps your user session active
• Security cookie (XSRF-TOKEN): Protection against CSRF attacks
• Preference cookie (vgloot_locale): Remembers the selected language
• Consent cookie (cookie_consent): Remembers your cookie acceptance preference

We do not currently use tracking, analytics or advertising cookies, nor any third-party web analytics service.

VGLOOT RESERVES THE RIGHT TO ADD ANALYTICS, PERSONALISATION OR ADVERTISING COOKIES IN THE FUTURE (including, without limitation, web analytics services, advertising networks or affiliate programmes). Should new cookie categories be introduced, VGLoot will update this policy, notify users via a notice on the Service and, where required by law, request the User's prior consent through the cookie panel.

You can control or delete cookies through your browser settings. However, some site features may not work correctly without essential cookies.

For more information, see our full Cookie Policy.

8. International Data Transfers

Our servers are located in the European Union (Germany — Ionos Data Centre).

If you access the service from outside the EU, your data may be transferred, stored and processed in the EU. By using the service, you consent to these transfers.

We implement appropriate GDPR safeguards to ensure your data is protected in accordance with this privacy policy.

9. Children's Privacy

VGLoot is NOT directed at persons under 18 years of age.

We do not knowingly collect personal information from persons under 18. If we discover that a minor has provided us with personal data, we will immediately delete that information.

If you are a parent or guardian and believe your child under 18 has provided us with personal information, please contact us immediately at privacy@vgloot.com.

10. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do:

• We will update the "Last updated" date at the top
• For significant changes, we will notify you by email or via a prominent notice on the site
• Changes take effect immediately upon publication

We recommend reviewing this policy periodically to stay informed about how we protect your information.

For any questions about this Privacy Policy, exercising rights or privacy concerns:

Email: info@vgloot.com
Website: www.vgloot.com

Supervisory Authority:
Spanish Data Protection Agency (AEPD)
C/ Jorge Juan, 6, 28001 Madrid, Spain
www.aepd.es