Privacy Policy

Last updated: 2 October 2026

This Privacy Policy explains how XEZEZ.COM (the “Platform”) collects, uses, stores, shares, and otherwise processes personal data when you visit or use the Platform, create an account, play or interact with games, submit ratings or comments, save favourites, contact us, or use other features made available through the Platform.

This Privacy Policy has been prepared with particular regard to Regulation (EU) 2016/679 (the “GDPR”) and other applicable data-protection and privacy laws.

1. Data Controller

The controller responsible for the processing of personal data through the Platform is:

Provider: Maryna Dushkevych
Address: Lublin, Poland
Email: xezezcom@outlook.com
Contact form: https://xezez.com/contact-us

For questions about this Privacy Policy, the processing of your personal data, or the exercise of your data-protection rights, you may contact the Provider using the details above.

2. Personal Data We Process

The categories of personal data processed depend on how you use the Platform.

2.1. Account and registration data

If you create an account, we may process:

  • your email address;

  • your display name;

  • authentication and account credentials;

  • account identifiers;

  • account creation and modification dates;

  • information associated with your account settings;

  • information concerning account status, suspension, deletion, or security; and

  • other information you voluntarily provide in connection with your account.

Authentication credentials are processed only to the extent necessary to provide and secure account functionality.

2.2. Information relating to Platform activity

When you use Platform features, we may process information concerning your interactions, including:

  • games viewed or launched;

  • games added to favourites;

  • ratings submitted;

  • rating-related identifiers used to prevent or manage duplicate interactions;

  • comments and other user contributions;

  • pages visited;

  • search queries submitted through the Platform;

  • interaction with categories, recommendations, articles, or other content;

  • date and time of relevant actions; and

  • information necessary to operate, secure, troubleshoot, or improve Platform functionality.

Where you submit a comment for publication, your display name and the content of the comment may become publicly visible after moderation.

Please do not include sensitive personal information, confidential information, or personal data concerning another person in public comments unless you have a lawful reason and appropriate authority to do so.

2.3. Contact and correspondence data

If you contact us by email, through the contact form, or through another available communication channel, we may process:

  • your first and last name;

  • your email address;

  • the content of your message;

  • information concerning the matter you contact us about;

  • attachments or supporting information you voluntarily provide; and

  • subsequent correspondence relating to your request.

If you submit a complaint, legal notice, rights request, security report, copyright notice, or moderation appeal, we may process additional information reasonably necessary to verify, investigate, and respond to the matter.

2.4. Technical and device information

When you access the Platform, certain technical information may be processed automatically, including:

  • IP address;

  • browser type and version;

  • device type;

  • operating system;

  • language and similar browser settings;

  • referring and requested URLs;

  • date and time of requests;

  • server and application logs;

  • session identifiers;

  • cookie or local-storage identifiers;

  • security-related information; and

  • technical error, diagnostic, and performance information.

This information may be necessary for delivering pages, maintaining sessions, protecting the Platform, identifying technical problems, preventing abuse, and maintaining the security and reliability of the service.

2.5. Information processed through games and third-party content

Some games, videos, media, advertising, or other content available through the Platform may be supplied, hosted, embedded, or operated by third parties.

When you launch or interact with such content, technical information such as your IP address, browser details, device information, identifiers, and interaction data may be transmitted to the relevant third-party provider as technically necessary to deliver the content.

A third-party provider may process additional information under its own privacy policy and may act as an independent controller of that information. You should review the privacy information provided by the relevant third party before providing personal information directly to it.

Where a game opens on an external website, your use of that external website is governed by the privacy practices of its operator.

3. How We Obtain Personal Data

We may obtain personal data:

  1. directly from you, for example when you register, contact us, submit a comment, rate a game, or make a request;

  2. automatically from your browser or device, including through server logs, cookies, local storage, and similar technologies; and

  3. from services involved in delivering Platform functionality, where necessary for hosting, security, technical operation, moderation, or third-party content.

4. Purposes and Legal Bases for Processing

We process personal data only where there is an appropriate legal basis.

Providing the Platform and account services

We process account data, login information, favourites, comments, ratings, and other information necessary to provide requested Platform functions.

Legal basis: Article 6(1)(b) GDPR — processing necessary for the performance of a contract or to take steps at your request before entering into a contract.

Responding to communications and requests

We process contact and correspondence data to respond to questions, technical issues, requests, complaints, and other communications.

Depending on the nature of the communication, the legal basis may be:

  • Article 6(1)(b) GDPR, where the communication concerns the provision of services;

  • Article 6(1)(c) GDPR, where processing is necessary to comply with a legal obligation; or

  • Article 6(1)(f) GDPR, based on our legitimate interest in communicating with users and handling enquiries.

Content moderation and abuse prevention

We may process account data, comments, interaction information, technical information, and reports in order to:

  • moderate user contributions;

  • identify spam or abusive activity;

  • prevent fraudulent or manipulated ratings;

  • enforce Platform rules;

  • investigate complaints;

  • prevent unauthorized access; and

  • protect users, the Provider, and the Platform.

Legal basis: Article 6(1)(f) GDPR — our legitimate interests in maintaining a safe, trustworthy, functional, and secure Platform. Processing may also be based on Article 6(1)(c) GDPR where action is required by law.

Security and technical operation

Technical data may be processed for:

  • cybersecurity;

  • authentication;

  • fraud and abuse prevention;

  • troubleshooting;

  • error detection;

  • service availability;

  • maintaining system integrity;

  • preventing unauthorized access; and

  • protecting the Platform and its users.

Legal basis: Article 6(1)(f) GDPR — our legitimate interests in operating and securing the Platform. Where particular processing is legally required, Article 6(1)(c) GDPR may also apply.

Establishing, exercising, or defending legal claims

We may retain and use information where reasonably necessary to establish, exercise, or defend legal claims, resolve disputes, enforce agreements, or respond to competent authorities.

Legal basis: Article 6(1)(f) GDPR and, where applicable, Article 6(1)(c) GDPR.

Compliance with legal obligations

We may process personal data where necessary to comply with applicable legal, regulatory, court, law-enforcement, tax, accounting, consumer-protection, content-moderation, or other mandatory obligations.

Legal basis: Article 6(1)(c) GDPR.

Consent-based processing

Where applicable law requires consent — including for certain optional cookies, analytics technologies, advertising technologies, or third-party integrations — processing will be based on your consent.

Legal basis: Article 6(1)(a) GDPR.

You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

5. Cookies, Local Storage, and Similar Technologies

The Platform may use cookies, browser storage, and similar technologies.

These technologies may be used for several purposes.

Strictly necessary technologies

Certain technologies may be required to:

  • maintain login sessions;

  • authenticate users;

  • protect accounts;

  • provide requested functionality;

  • maintain security;

  • prevent fraud or abuse; or

  • remember information required for a service specifically requested by you.

Where permitted by applicable law, technologies that are strictly necessary to provide a service requested by the user may operate without consent.

Ratings and interaction functionality

A first-party browser identifier may be used in connection with game ratings, including to recognise a previous rating from the same browser and allow it to be updated rather than repeatedly counted as a new rating.

Similar storage may be used for other requested Platform functions where technically necessary.

Preference technologies

The Platform may use browser storage to remember certain settings or preferences.

Where such storage is not strictly necessary, it will be used subject to any consent requirements imposed by applicable law.

Analytics

The Platform may use analytics technologies to understand how the service is used, diagnose problems, measure performance, and improve content or functionality.

Where applicable law requires consent for analytics cookies or similar technologies, such technologies will be activated only after valid consent has been obtained.

Third-party and embedded content

Games, videos, advertising, and other embedded or third-party content may use cookies, local storage, identifiers, or similar technologies supplied by the relevant third party.

Depending on the integration, information may be transmitted when third-party content is displayed, activated, or launched.

Where consent is legally required before a third-party technology may access or store information on your device, the relevant technology should not be activated until the required consent has been obtained.

You can also control or delete cookies and site data through your browser settings. Disabling strictly necessary technologies may prevent certain Platform features from functioning correctly.

6. Third-Party Games and External Websites

The Platform provides access to browser-based games and other content that may originate from independent developers, publishers, distributors, video platforms, advertising services, or other third parties.

Third-party content may:

  • run within an embedded frame;

  • obtain resources from third-party servers;

  • communicate with an external service;

  • open in another browser window or tab; or

  • be operated entirely by an external provider.

Such providers may process information independently from the Provider and may use their own cookies, identifiers, analytics, advertising technologies, or account systems.

The Provider does not determine the privacy practices of independent external websites. Before entering personal information, payment information, credentials, or other sensitive information into a third-party service, review that provider's privacy policy and other applicable terms.

7. Public Information and User Content

Comments and other content that you intentionally submit for public display may become visible to other users after moderation.

Information made public may potentially be:

  • read by other visitors;

  • indexed or cached by search engines;

  • copied or quoted by other persons; or

  • retained outside our control after it has been lawfully accessed by another person.

You should therefore avoid publishing information that you do not want to become public.

Removing content from the Platform does not necessarily remove copies that were independently stored, cached, quoted, or otherwise processed by third parties before removal.

8. Recipients of Personal Data

Personal data may be disclosed only where reasonably necessary and in accordance with applicable law.

Recipients may include:

  • hosting and server infrastructure providers;

  • cloud and content-delivery providers;

  • security, anti-abuse, and technical service providers;

  • database, backup, and IT-support providers;

  • email and communications service providers;

  • analytics providers, where applicable and subject to required consent;

  • providers of games, video, media, advertising, or embedded content;

  • professional advisers, including legal or accounting advisers where necessary;

  • courts, regulators, law-enforcement bodies, public authorities, or other competent institutions where disclosure is required or permitted by law; and

  • another entity involved in a lawful restructuring, transfer, or succession of the Platform, subject to applicable data-protection requirements.

Service providers that process personal data on our behalf are required to process such information according to our instructions and appropriate contractual and legal safeguards where required by law.

Third-party providers may also process information as independent controllers where they determine their own purposes and methods of processing.

9. International Data Transfers

Some service providers or third-party content providers may operate from, or process information in, countries outside Poland or outside the European Economic Area (EEA).

Where the Provider transfers personal data outside the EEA and the recipient country has not been recognized by the European Commission as providing an adequate level of data protection, we will use an appropriate lawful transfer mechanism where required.

Depending on the circumstances, this may include:

  • European Commission standard contractual clauses;

  • another legally recognized safeguard under Article 46 GDPR;

  • an applicable adequacy decision; or

  • a derogation permitted under the GDPR in a specific situation.

You may contact us if you would like further information about the safeguards applicable to a particular transfer of your personal data.

Independent third-party services may conduct their own international transfers under their respective privacy policies.

10. How Long We Keep Personal Data

We do not retain personal data longer than reasonably necessary for the purposes for which it was collected, subject to applicable legal requirements.

Retention periods depend on the nature of the information and the reason for processing.

In particular:

Account information may be retained while your account remains active. Following account deletion, information may be deleted or anonymized unless further retention is necessary for legal compliance, security, fraud prevention, dispute resolution, backup processes, or legal claims.

Comments and other published contributions may remain available while relevant to the Platform unless removed by you where functionality permits, removed following a valid request, removed through moderation, or no longer required. Content may be anonymized rather than deleted where appropriate and lawful.

Ratings and aggregated statistics may be retained in aggregated or non-identifying form. Browser identifiers associated with rating functionality may remain until their applicable expiry, deletion, or replacement.

Contact correspondence may be retained for the period necessary to resolve the relevant matter and thereafter for an appropriate period where needed to document the communication, meet legal obligations, or establish, exercise, or defend legal claims.

Security and technical records are retained for the period reasonably necessary for security, diagnostics, abuse prevention, service operation, and investigation of incidents.

Where personal data is required in connection with an ongoing dispute, investigation, legal obligation, or claim, it may be retained until the relevant matter is resolved and any applicable retention or limitation period has expired.

Backup copies may remain for a limited additional period until overwritten or securely deleted according to normal backup procedures.

11. Account Deletion

You may request deletion of your account through an available account-deletion function, where provided, or by contacting:

Email: xezezcom@outlook.com
Contact form: https://xezez.com/contact-us

Deleting an account does not necessarily require immediate deletion of every record relating to that account.

Certain information may continue to be processed where retention is required or permitted for:

  • compliance with legal obligations;

  • prevention of fraud or abuse;

  • security and incident investigation;

  • enforcement of legal rights;

  • dispute resolution;

  • legal claims; or

  • temporary technical backup processes.

Where appropriate, public contributions may be deleted, de-identified, or disassociated from the deleted account.

12. Your Data-Protection Rights

Subject to the conditions and limitations provided by applicable law, you may have the following rights under the GDPR:

Right of access

You may request confirmation of whether we process your personal data and obtain access to that data and related processing information.

Right to rectification

You may request correction of inaccurate personal data and completion of incomplete personal data.

Right to erasure

You may request deletion of your personal data in circumstances provided by law.

The right to erasure is not absolute. We may retain information where continued processing is required or permitted by law.

Right to restriction of processing

You may request that processing of your personal data be restricted in circumstances specified by the GDPR.

Right to data portability

Where processing is based on consent or contract and is carried out by automated means, you may have the right to receive personal data you provided to us in a structured, commonly used, machine-readable format and, where technically feasible, request transmission to another controller.

Right to object

Where personal data is processed on the basis of legitimate interests under Article 6(1)(f) GDPR, you may object to that processing on grounds relating to your particular situation.

We will cease the relevant processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms or where processing is required for the establishment, exercise, or defence of legal claims.

Right to withdraw consent

Where processing is based on your consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Right to lodge a complaint

You have the right to lodge a complaint with a competent data-protection supervisory authority.

In Poland, the competent authority is:

President of the Personal Data Protection Office
(Prezes Urzędu Ochrony Danych Osobowych — UODO)
Warsaw, Poland
https://uodo.gov.pl/

You may also have the right to contact the supervisory authority in another EU or EEA country where you habitually reside, work, or where an alleged infringement occurred.

13. Exercising Your Rights

To exercise a data-protection right, contact:

Email: xezezcom@outlook.com
Contact form: https://xezez.com/contact-us

Please describe your request sufficiently clearly so that we can understand and respond to it.

Where reasonably necessary to protect personal data against unauthorized disclosure, we may request additional information to verify your identity.

Requests will be handled within the time limits required by applicable law. Under the GDPR, this is generally within one month after receipt of a valid request, although the period may be extended where permitted for particularly complex or numerous requests.

There is normally no charge for exercising GDPR rights. A reasonable fee may be charged, or a request may be refused, where permitted by law if a request is manifestly unfounded or excessive, particularly because of its repetitive character.

14. Children and Minors

The Platform contains games and entertainment content that may be accessed by users of different ages.

We recognize that children deserve particular protection with regard to their personal data.

Where processing is based on consent in connection with an information-society service and applicable law requires authorization from a parent or legal guardian because the user is under the relevant age, we will not knowingly rely on the child's consent alone.

In Poland, particular requirements may apply to consent-based processing involving persons under 16.

Parents and legal guardians should supervise minors' use of online services and consider whether individual games, external services, or community features are appropriate for them.

If you are a parent or legal guardian and believe that a child has provided personal data in circumstances where parental authorization was legally required, please contact us so that the matter can be reviewed and appropriate action taken.

15. Special Categories of Personal Data

The Platform is not designed to request special categories of personal data such as information about health, biometric or genetic information, religious or philosophical beliefs, political opinions, trade-union membership, racial or ethnic origin, or information concerning a person's sex life or sexual orientation.

Please do not include this type of information in comments, contact messages, or other submissions unless it is genuinely necessary for your request and you have a lawful basis for providing it.

We may remove unnecessary sensitive information where appropriate.

16. Automated Processing

The Platform may use automated technical measures for purposes such as:

  • spam detection;

  • security monitoring;

  • fraud and abuse prevention;

  • duplicate-interaction detection;

  • technical moderation support;

  • organizing or recommending content; and

  • identifying material for human review.

These technical processes may assist with Platform operation and moderation.

The Platform does not use personal data to make solely automated decisions that produce legal effects concerning you or similarly significantly affect you unless such processing is expressly disclosed and a lawful basis and appropriate safeguards are provided.

17. Security

We use reasonable technical and organizational measures intended to protect personal data against:

  • unauthorized access;

  • accidental or unlawful destruction;

  • loss;

  • alteration;

  • unauthorized disclosure; and

  • other unlawful processing.

Security measures may include access controls, authentication mechanisms, system monitoring, backups, software maintenance, security logging, and other measures appropriate to the nature of the Platform.

No method of transmitting or storing information on the Internet can guarantee absolute security. Users should use unique, strong passwords, protect their login credentials, maintain appropriate device security, and notify us if they suspect unauthorized use of their account.

18. External Links

The Platform may contain links to websites and services that are not controlled by the Provider.

Following an external link may result in another organization collecting or processing your personal data according to its own rules.

This Privacy Policy does not govern independent third-party websites merely because they are linked from or accessible through the Platform.

You should review the privacy policy of any external service before providing personal information to it.

19. Legal Disclosures

We may preserve, access, or disclose personal data where reasonably necessary and legally permitted to:

  • comply with applicable law or a binding legal obligation;

  • respond to a lawful request from a court, regulator, law-enforcement authority, or other competent body;

  • protect the rights and legal interests of the Provider;

  • protect users or third parties;

  • investigate fraud, abuse, security incidents, or unlawful conduct;

  • enforce applicable terms and Platform rules; or

  • establish, exercise, or defend legal claims.

We will not disclose personal data to public authorities merely because they request it where there is no valid legal basis for the disclosure.

20. Changes to This Privacy Policy

We may update this Privacy Policy where necessary to reflect:

  • changes to the Platform;

  • introduction, modification, or removal of features;

  • changes in technologies or third-party integrations;

  • changes in processing practices;

  • security developments;

  • changes in applicable law or regulatory guidance; or

  • clarification of existing information.

The current version will be published on the Platform with an updated “Last updated” date.

Where required by law, material changes affecting registered users or consent-based processing will be communicated through an appropriate method, which may include an account notice, prominent Platform notice, or email.

Where a change requires new consent under applicable law, continued use of the Platform will not substitute for that consent.

21. Contact

For privacy questions, requests concerning personal data, or questions about this Privacy Policy, contact:

Maryna Dushkevych
Address: Lublin, Poland
Email: xezezcom@outlook.com
Contact form: https://xezez.com/contact-us