{% extends '__layout__.html' %} {% block title %}Privacy Policy{% endblock %} {% block head %} {% endblock %} {% block content %}

# Privacy Policy

Last amended: 22/07/2026

This Privacy Policy ("Policy") describes how NEXIUM ("we," "us," or "our") collects, uses, and protects the personal information you provide when accessing or using the NEXIUM website (the "Website"). It is written to comply with the EU General Data Protection Regulation (GDPR) and, where applicable, the UK GDPR.

## 1. Who We Are

1.1. NEXIUM is the data controller responsible for your personal data processed through the Website. For any privacy-related request, contact us at kaitlyn@chadthundercock.com or via our Discord server.

## 2. Data We Collect

2.1. Account data. Username, hashed password, email address (if provided, e.g. for password resets), account creation date, and account activity (such as login times and login history).

2.2. Technical & security data. IP address, device type, operating system, and browser version, collected to secure the Website, prevent abuse, and enforce these Terms.

2.3. Discord account data. If you choose to link a Discord account, we receive your Discord user ID, username, and avatar via Discord's OAuth "identify" scope, so we can offer Discord-linked features such as membership perks.

2.4. Payment data. If you make a purchase, our payment processors (Cryptomus, Ko-fi) handle your payment details directly. We only receive confirmation of payment, the amount, and a transaction reference — we do not receive or store your full card or wallet details.

2.5. User-generated content. Anything you create or upload on the Website, such as your avatar, profile description, chat messages, group content, trades, and forum-style posts.

2.6. Cookies & similar technologies. See Section 4 below.

## 3. How We Use Your Data & Legal Basis

3.1. We only process your personal data where we have a valid legal basis to do so under the GDPR:

- To provide the Website (account creation, login, gameplay, trading, purchases): necessary for the performance of a contract with you (our Terms of Service).
- To secure the Website and prevent fraud, cheating, or abuse: our legitimate interest in keeping the Website safe and functional.
- To run analytics on Website usage (Google Analytics): your consent, or our legitimate interest in understanding how the Website is used, where permitted in your jurisdiction. You can decline non-essential cookies as described in Section 4.
- To respond to legal requests or enforce our Terms: compliance with a legal obligation, or our legitimate interest in protecting our rights.

3.2. We do not use your personal data for automated decision-making, including profiling, that produces legal or similarly significant effects on you without human review.

## 4. Cookies and Tracking Technologies

4.1. We use the following categories of cookies and similar technologies:

- Strictly necessary: a session/authentication cookie required to keep you logged in and secure your session. The Website cannot function without this cookie.
- Security: Cloudflare Turnstile, used on login/signup forms to detect bots and abuse.
- Analytics: Google Analytics, used to understand aggregate usage of the Website.

4.2. Strictly necessary and security cookies are essential and cannot be disabled without breaking core functionality. Analytics cookies are not essential; you can block them using your browser's cookie settings or an extension, and doing so will not affect your ability to use the Website.

4.3. Third-party services listed in this section set their own cookies and are governed by their own privacy policies, which we encourage you to review.

## 5. Information Sharing and Disclosure

5.1. We do not sell or rent your personal information to third parties.

5.2. We share personal data with the following categories of recipients, only to the extent necessary for them to provide their service to us:

- Payment processors (Cryptomus, Ko-fi) — to process purchases.
- Discord — if you choose to link your Discord account.
- Cloudflare — for security, bot protection, and content delivery.
- Google (Google Analytics) — for aggregate usage analytics.
- Hosting and infrastructure providers — to operate the Website.

5.3. We may disclose your personal information if required by law, or if we believe in good faith that disclosure is necessary to comply with a legal obligation, protect our rights and property, or ensure the safety of our users or the public.

## 6. International Data Transfers

6.1. Some of the recipients listed in Section 5 (such as Discord, Cloudflare, and Google) may process data outside the European Economic Area, including in the United States. Where this occurs, we rely on the safeguards those providers make available, such as the EU Standard Contractual Clauses, to ensure your data remains protected.

## 7. Data Retention

7.1. We retain your account data for as long as your account is active. If you delete your account, we will delete or anonymize your personal data within a reasonable period, except where we are required to retain certain data (such as transaction records or moderation logs) for longer to comply with legal, tax, security, or fraud-prevention obligations.

7.2. Technical logs such as IP addresses and login records are retained only as long as necessary for security purposes and are then deleted or anonymized.

## 8. Data Security

8.1. We implement reasonable technical and organizational security measures — such as password hashing and access controls — to protect your personal information against unauthorized access, alteration, disclosure, or destruction.

8.2. However, please note that no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security.

## 9. Your Rights Under the GDPR

9.1. If you are located in the EU/EEA or UK, you have the following rights regarding your personal data:

- Access: You have the right to request access to the personal data we hold about you.
- Rectification: You may request that we correct inaccurate or incomplete personal data.
- Erasure ("Right to be forgotten"): You may request that we delete your personal data under certain circumstances.
- Restriction of processing: You may request that we limit the processing of your data.
- Data portability: You have the right to receive your data in a structured, commonly used, machine-readable format.
- Objection: You may object to our processing of your personal data where we rely on legitimate interests as the legal basis.
- Withdrawal of consent: Where we process data based on your consent (e.g. analytics cookies), you can withdraw that consent at any time, without affecting the lawfulness of processing before withdrawal.

9.2. To exercise any of these rights, contact us at kaitlyn@chadthundercock.com or via our Discord server. We will respond within one month, as required by the GDPR.

9.3. You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement. In Poland, this is the Urząd Ochrony Danych Osobowych (UODO).

## 10. Children's Privacy

10.1. The Website is not intended for use by individuals under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13 without appropriate consent, we will take steps to delete that information from our systems.

## 11. Links to Third-Party Websites

11.1. The Website may contain links to third-party websites or services. We are not responsible for the privacy practices or the content of those third-party websites. We encourage you to review the privacy policies of those websites before providing any personal information.

## 12. Changes to this Privacy Policy

12.1. We may update this Privacy Policy from time to time. Material changes will be highlighted on the Website and the "Last amended" date above will be updated. Your continued use of the Website after such changes take effect constitutes your acknowledgment of the updated Policy.

## 13. Contact Us

13.1. If you have any questions or concerns about this Privacy Policy or our data practices, contact us at kaitlyn@chadthundercock.com or via our Discord server.

By accessing or using the NEXIUM Website, you acknowledge that you have read and understood this Privacy Policy.

{% endblock %}