Privacy Policy

1. Who is responsible for your data

The controller is AverageGamesStudio I/S, Interessentskab (I/S) — Danish general partnership, L.A. Rings Vej 145, 3. tv, 5230 Odense M, Denmark, CVR 43415638, EU VAT DK43415638. You can reach us by e-mail at info@averagegamesstudio.com. We are not required to appoint a data protection officer and have not appointed one; data-protection enquiries go to the address above and are handled by the partners.

2. What this policy covers

It covers the website at averagegamesstudio.com and the correspondence that follows from it. It does not cover third-party storefronts where our titles are listed — those platforms are separate controllers with their own policies.

3. What we collect, and why each field is necessary

This is the complete inventory. Every field below exists on a live form and in our database, and there are no optional fields on either form: under Art. 6(1)(b) only what is necessary for the requested step can be processed, and an optional field cannot be necessary by definition.

3.1 Developer pitch portal (/submit-pitch)

Legal basis: GDPR Art. 6(1)(b) — steps taken at your request prior to entering into a contract. Retention: 24 months from the last message about the submission, then deletion.

3.2 Contact form (/contact)

Legal basis: GDPR Art. 6(1)(f) — our legitimate interest in answering business correspondence. Our interest is in answering business correspondence addressed to us; we have balanced it against your interests and consider a reply to your own message to be within your reasonable expectations. You may object at any time under Art. 21. Retention: 12 months from the last message in the thread, then deletion.

3.3 Technical data

Our web server writes an access log entry for each request containing the IP address, timestamp, requested path, HTTP status, referrer and user agent. This is necessary to operate the service securely and to investigate abuse — Art. 6(1)(f). Access logs are kept for 30 days and then rotated out. We also keep a short-lived counter of submissions per IP address to rate-limit the forms; it holds no message content and expires within the hour.

3.4 What we do not collect

No tracking pixels, no advertising or analytics cookies, no fingerprinting, no profiling, no automated decision-making within the meaning of Art. 22, no purchased contact lists, and no special-category data. We do not ask for and do not want personal data about anyone other than the person writing to us.

4. Consent, and why this site does not ask for it

Neither form relies on consent. Assessing and answering a pitch is a step taken at your request before entering into a contract, and answering an enquiry is our legitimate interest — Art. 6(1)(b) and 6(1)(f) respectively. A mandatory “I agree” box on such a form would misdescribe the basis, and consent you must give in order to submit would not be freely given under Art. 7(4). So we inform you at the point of collection instead, immediately above the submit button, and there is nothing for you to withdraw.

Consent is used for one thing only: non-essential cookies, which this site does not currently set. See the Cookie Policy.

5. Who else sees your data

Your data is not sold and is not disclosed to any third party for that party’s own purposes. It is processed by us, and by the service providers that operate our website and e-mail on our documented instructions under Art. 28 processing agreements. Naming a processor is not the same as sharing your data with a third party for its own use — but it is still a disclosure, so we name them:

• E-mail: Namecheap Private Email (MX: mx1/mx2.privateemail.com), United States. Mail sent to and from our published addresses passes through this provider.
• Website hosting: Namecheap, Inc. (virtual private server), Phoenix, Arizona, United States.

We will also disclose data where we are legally required to, for example to a competent authority acting within its powers.

6. International transfers

Data is processed in United States (Phoenix, Arizona), which is outside the European Economic Area. Both processors named in §5 — the hosting provider and the mail provider — are the same company operating in the same country, so this is the only transfer involved.

No European Commission adequacy decision is relied upon for this transfer. The EU–US Data Privacy Framework covers only organisations that have certified to it, and our provider makes no such claim. The transfer therefore takes place under the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914, Module Two (controller to processor), as incorporated in Namecheap’s published Data Processing Addendum. In practice that means the provider is contractually bound to process the data only on our documented instructions, to keep it secure, to assist us with your rights requests, and to tell us if it is required to disclose data to a public authority. You may ask us for a copy of the safeguards by writing to info@averagegamesstudio.com, and the addendum itself is published by the provider at namecheap.com/legal/universal/data-processing-addendum.

We record how we established the location rather than taking an IP-lookup service at its word, because those services disagree with one another: measured from inside the server on 2026-08-17, round-trip times were 27 ms to Dallas, 84 ms to Ashburn, 143 ms to Amsterdam and 191 ms to Singapore, with the upstream network belonging to the provider’s own autonomous system.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you, and receive a copy of it;
• have inaccurate data corrected;
• have data erased, where the conditions in Art. 17 are met;
• restrict processing, in the circumstances set out in Art. 18;
• data portability for data you provided to us where processing is based on contract or consent and is carried out by automated means;
• object at any time to processing based on our legitimate interests, under Art. 21 — including the handling of a contact-form message.

Write to info@averagegamesstudio.com. We answer within one month. There is no charge unless a request is manifestly unfounded or excessive.

You may also complain to the Danish Data Protection Agency, Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark — datatilsynet.dk.

8. Security

The site is served over HTTPS. Form submissions are validated on the server, rate-limited per address, and stored in a database that accepts connections only from the application itself. Access to submissions is limited to the partners. We keep no payment data of any kind on this site.

9. Retention in practice

Retention is not just a promise on this page: the deletion of pitch submissions after 24 months and of contact messages after 12 months is enforced by scheduled jobs in the database itself. You can ask for earlier deletion at any time.

10. Changes

If this policy changes we update the date at the top and, for anything material, say what changed. Nothing here reduces the rights the GDPR gives you.