Privacy Policy

This policy explains how we process your personal data when you download and use the iOS and Android mobile applications published by HBAgency (the “Apps”). It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”), Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018 (the “Italian Privacy Code”), in particular Article 122 on access to information stored on the device, and the Italian Data Protection Authority’s Guidelines on cookies and other tracking tools of 10 June 2021.

This policy applies to: Sudoku Puzzle, [APP NAME 2] and any other App that links to this page. It does not apply to HBAgency’s websites, which are governed by their own privacy policy, or to apps that HBAgency develops on behalf of clients (see section 7.6).

Processing is based on the principles of lawfulness, fairness, transparency, data minimisation and storage limitation. Simply downloading or using an App does not amount to consent: where consent is required, you are asked for it specifically, freely and revocably through dedicated in-app screens.

For any question about this policy or your data, you can write to the address above, including directly from the “Settings > Privacy” section of the App.

The Apps collect only the data needed for the features you use. The actual categories for each App are also listed in the App Store “App Privacy” section and the Google Play “Data safety” section, which must remain consistent with this policy.

The Apps are not designed to process special categories of data (Article 9 GDPR), such as health or biometric data. Please do not enter such data in free-text fields. If an App ever processes them, this will be stated in a specific notice with a request for explicit consent.

Each processing operation has a specific purpose and a legal basis under Article 6 GDPR.

You can withdraw consent at any time from the “Settings > Privacy” section of the App or from your device settings. Withdrawal does not affect the lawfulness of processing already carried out and does not prevent you from using the App’s core features.

Automated decision-making. Personalised advertising involves profiling based on your interests. It does not produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR.

5.1 Device permissions

The App requests each permission only when the related feature is needed, never at launch without a reason. You can deny or revoke it at any time from your iOS or Android settings; if you do, only the related feature will stop working.

5.2 Third-party SDKs

The Apps include software development kits (SDKs) provided by third parties, which may access device information. SDKs that are not strictly necessary are activated only after you consent.

5.3 Advertising and IAB Europe TCF

HBAgency participates in the IAB Europe Transparency & Consent Framework (TCF) and complies with its Specifications and Policies, with identification number 1431 on the Global Vendor List. In the Apps we use a consent management platform (CMP) registered with IAB Europe, which shows you the purposes and the list of advertising partners the first time you open the App.

Your choice is stored on the device as a TC String in the locations defined by the TCF for apps (SharedPreferences on Android, NSUserDefaults on iOS), so that advertising SDKs can respect it. You can change your choices at any time from “Settings > Privacy > Manage preferences”. If you decline, you will still see ads, but they will not be personalised.

5.4 App Tracking Transparency (iOS)

On iOS 14.5 and later, the App asks for your permission to track through Apple’s ATT system prompt before accessing the IDFA. If you decline, the IDFA is not read. You can change your choice in “Settings > Privacy & Security > Tracking”.

5.5 Advertising ID (Android)

On Android you can reset or delete your Google Advertising ID from “Settings > Privacy > Ads”. Once deleted, the App receives an identifier made of zeros and cannot use it for personalisation.

6.1 Recipients

Your data may be disclosed to: authorised staff of the Controller; providers appointed as processors (Article 28 GDPR), such as hosting and cloud, backend and database, push notification and email delivery, crash reporting and analytics, customer support; Apple and Google, as independent controllers, for distributing the App and handling in-app payments; TCF-participating advertising partners, only within the limits of your consent; judicial and supervisory authorities, where required by law. The up-to-date list of processors is available on request. Your data is not disseminated or sold.

6.2 Transfers outside the European Economic Area

Data is stored primarily on servers located in the EU. Some SDK or cloud providers may also process it outside the EEA, for example in the United States. In that case the transfer relies on a European Commission adequacy decision, such as the EU-U.S. Data Privacy Framework for certified providers, or on Standard Contractual Clauses (Article 46 GDPR) with the necessary supplementary measures. You can request a copy from the Controller.

6.3 Retention

At the end of these periods, data is deleted or irreversibly anonymised.

6.4 Security

We implement appropriate technical and organisational measures under Article 32 GDPR, including: encryption of data in transit (HTTPS/TLS) and at rest; storage of tokens and credentials in protected system areas (Keychain on iOS, Keystore on Android); access to data limited to authorised staff; regular updates of the Apps and their libraries. In the event of a personal data breach, we notify the Italian Data Protection Authority and, where necessary, the data subjects within the time limits of Articles 33 and 34 GDPR.

7.1 Data subject rights

Under Articles 15–22 GDPR you have the right to: access your data and obtain a copy; have it rectified; have it erased (right to be forgotten); restrict its processing; receive it in a structured, machine-readable format (portability); object to processing based on legitimate interest and, at any time, to direct marketing and profiling; withdraw consent. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the authority of the EU country where you live.

To exercise your rights, write to headerbidding.agency@icardoo.com. We reply within one month, which may be extended by two months for complex requests, as provided by Article 12 GDPR.

7.2 Account deletion

You can delete your account and the related data directly from the App, under “Settings > Account > Delete account”, or from the web page [DELETION PAGE URL], without having to reinstall the App. Uninstalling the App does not delete your account. Active subscriptions must be cancelled separately from the App Store or Google Play.

7.3 Children

The Apps are not intended for children under 14, the minimum age for consenting to information society services in Italy (Article 2-quinquies of the Italian Privacy Code). We do not show personalised advertising to users we know to be minors. If we discover that we have collected data from a child under 14 without the consent of the holder of parental responsibility, we delete it promptly. Parents and guardians can contact us at the address above.

7.4 Third-party data

If you share other people’s data through the App, such as contacts or photos, you guarantee that you are entitled to do so and that you have informed them.

7.5 Changes to this policy

We may update this policy, for example when we add new features or SDKs. Material changes will be notified to you through an in-app notice or by email before they take effect and, where necessary, we will ask for your consent again. The date of the last update is shown at the top of this document.