Privacy Notice

1. Scope and purpose of this notice

This Privacy Notice explains how Flow Group AB, org. no. 559183-6027, Sweden (“Flow Group”, “we”, “us”, “our”), processes personal data when you use the Gameward mobile application (the “App”) and any services provided through the App.

The purpose of this Notice is to provide information required under Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) and applicable national data protection laws, including information about: (i) categories of personal data processed, (ii) purposes and legal bases, (iii) recipients and international transfers, (iv) retention periods, and (v) your rights.

This Notice is provided in a layered format and should be read together with any supplementary notices presented at the point of collection. Supplementary notices form part of this Notice and do not override it.

2. Controller and contact details

Flow Group AB is the controller for the processing of personal data described in this Notice.

Contact details:

Email: [email protected]

If a Data Protection Officer (DPO) or representative is appointed, contact details will be published in an updated version of this Notice or on our website.

3. Data subjects

This Notice applies to users of the App. The App is not directed to children under 13 years of age (or the higher age threshold applicable in your jurisdiction). We do not knowingly process personal data relating to such children. Where we become aware that personal data has been collected from a child below the applicable threshold without valid consent, the data will be deleted.

4. Categories of personal data

“Personal data” means any information relating to an identified or identifiable natural person. We process the following categories:

4.1 Identity and profile data

Name, display name/username, date of birth, gender, account credentials, and information received from third-party login providers (e.g., Google, Facebook, BankID) such as name, email address, and verification status. Where required for compliance or specific payout methods, we may process government-issued identification data (e.g., national ID number or equivalent identifier).

4.2 Contact data

Email address and, if applicable, phone number where required for verification or payout methods.

4.3 Device and technical data

Device identifiers (including advertising identifiers such as IDFA/GAID and other device IDs), device model, manufacturer, operating system version, app version, device language, IP address, time zone, network provider, log and diagnostic data, and device security/integrity signals (e.g., App Attest / Play Integrity) indicating rooting, jailbreaking, emulator use, or unauthorized modification.

4.4 Usage and gameplay data

App usage data: interactions in the App, offers viewed or clicked, screens visited, time stamps, and session duration.
Gameplay activity data: data received through our rewards SDK (currently Adjoe) concerning partner games installed via the App, playtime, required milestones, and achievement confirmations. We do not monitor or collect data from unrelated apps on your device.
Financial and payout data: virtual currency balance, reward/redemption history, withdrawal requests, transaction dates and amounts, and payout method data (e.g., PayPal email address, bank account/IBAN, phone number for mobile-money payouts, gift-card delivery details). For regulated or high-value payouts we may also process identity verification outcomes.

4.5 Aggregated data

Statistical or demographic data that does not identify individuals. If aggregated data is combined with personal data so identification becomes possible, it is treated as personal data.

4.6 Biometric data — identity & liveness verification (special category)

Where you complete an identity/liveness check in the App (for example, before certain withdrawals), we process biometric data — a special category of personal data under Article 9 GDPR — solely to confirm you are a real, live person and to prevent one person from registering multiple accounts (fraud prevention).

What we process: a selfie, short face videos, an identity document where required, and a face template — a numeric representation of your facial geometry. The template is not a photograph and your face cannot be reconstructed from it, but it remains biometric data.
Legal basis: your explicit consent (Article 9(2)(a) GDPR), which you give on the verification screen before any capture. You may withdraw it at any time (see below). Legitimate interest is not used for this processing.
Who processes it: Flow Group AB is the controller. The verification is operated on our behalf by a processor and stored encrypted on servers in the EU (Frankfurt, Germany). Biometric data is never used for advertising or profiling and is never sold.
Retention: selfie and video media are deleted after 30 days; the face template is deleted 12 months after your last verification. Data linked to detected fraud may be retained longer where the law permits (Article 17(3)(e) GDPR).
Withdrawing consent: you can withdraw your biometric consent at any time directly in the App, under More → Settings → Privacy → Identity & data. Withdrawing consent invalidates your verification: your balance remains in your account but is locked, and you will not be able to withdraw earnings until you verify again. We erase your biometric data within one month of the request, except data we must retain to prevent or investigate fraud.

5. Sources and methods of collection

5.1 Data provided directly by you

We collect data you provide when you register, sign in, complete profile information, participate in offers, request a payout, contact support, or participate in optional promotions or surveys.

5.2 Data collected automatically in the App

The App collects device, usage, and gameplay data automatically via SDKs, APIs, and server logs:

Adjoe SDK for partner-game detection, playtime measurement, and milestone reporting for reward calculation.
Analytics and attribution tools (e.g., Branch, Firebase) for app event logging and attribution measurement.
Crash/error reporting (e.g., Sentry) for diagnostics and stability monitoring.

5.3 Permissions and mobile tracking technologies

iOS ATT / IDFA: We request permission under Apple’s AppTrackingTransparency framework. If permission is granted, IDFA may be used for attribution and personalization. If permission is not granted, IDFA is not accessed and attribution may rely on SKAdNetwork.
Android Usage Access / GAID: Usage Access enables measurement of partner games for reward purposes. Without this permission, play-to-earn tracking may not function. GAID may be used for attribution and analytics. Advertising identifiers can be reset or limited in device settings.
On-device Storage: We use storage on your device to maintain your session, save your preferences, and ensure the App functions correctly. This storage is strictly necessary for the operation of the App.

5.4 Third-party sources

We may receive personal data from login providers, reward partners, analytics/attribution partners, identity verification services, and payment processors, limited to what is necessary for the purposes described in Section 6.

6. Purposes of processing and legal bases

We process personal data only where a legal basis under Article 6 GDPR (or equivalent law) applies. Processing purposes and bases are:

Account creation and authentication
Categories: Identity and profile data; contact data.
Legal basis: Article 6(1)(b) GDPR (performance of a contract).
Provision of App services and play-to-earn functionality
Categories: Identity and profile data; device and technical data; usage and gameplay data.
Legal basis: Article 6(1)(b) GDPR (performance of a contract) and Article 6(1)(f) GDPR (legitimate interests) in operating, measuring, and improving the service.
Reward redemption and payout processing
Categories: Financial and payout data; identity and profile data; device and technical data (fraud signals).
Legal basis: Article 6(1)(b) GDPR (performance of a contract), Article 6(1)(c) GDPR (legal obligations, e.g., accounting, AML/KYC where applicable), and Article 6(1)(f) GDPR (fraud prevention and service integrity).
Note: withdrawals may be subject to integrity review and are typically processed within three (3) business days; in certain cases, processing may take longer where additional verification, security checks, or legal compliance measures are required.
Security, fraud prevention, and enforcement of terms
Categories: Device and technical data (including integrity signals); usage and gameplay data; identity and profile data where relevant.
Legal basis: Article 6(1)(f) GDPR (legitimate interests) and, where applicable, Article 6(1)(c) GDPR (legal obligations).
Service communications and support
Categories: Identity and profile data; contact data; usage data relevant to the request.
Legal basis: Article 6(1)(b) GDPR (performance of a contract) and Article 6(1)(f) GDPR (legitimate interests).
Product analytics and service improvement
Categories: Device and technical data; usage and gameplay data; aggregated data.
Legal basis: Article 6(1)(f) GDPR (legitimate interests).
Compliance with legal obligations and lawful requests
Categories: Relevant to the obligation (e.g., payout records, verification status).
Legal basis: Article 6(1)(c) GDPR (legal obligation).

6.1 Marketing communications

We may send non-essential promotional communications only where permitted by law. You may opt out of such communications at any time. Service/transactional communications necessary to provide the App (e.g., security notices, payout confirmations, policy updates) may still be sent regardless of marketing preferences.

7. Recipients of personal data

We do not sell personal data. We disclose personal data only to the extent necessary for the purposes described in this Notice.

7.1 Processors (service providers acting on our instructions)

We use third-party service providers to help us operate the App. These providers act as processors and may only process your data in accordance with our instructions.

Adjoe GmbH: Provides our rewards SDK, measures partner-game playtime, and assists with fraud prevention.
Branch Metrics: Provides attribution and deep linking services to help us understand where our users come from.
Google Firebase / Google Cloud: Provides analytics, hosting infrastructure, and backend services.
Sentry (Functional Software, Inc.): Provides crash reporting and error monitoring to help us maintain App stability.
Communication providers: We use third-party services to send emails and push notifications.

Note: This list is subject to change. We will update this notice if we engage new material sub-processors.

7.2 Independent controllers

Payment processors (e.g., PayPal, banks or other payout partners) receive payout information necessary to execute your withdrawal and act as independent controllers for that transaction.

7.3 Other disclosures

Professional advisors (lawyers, auditors, insurers) where necessary.
Successor entities in the event of a merger, acquisition, or restructuring.
Authorities or third parties where disclosure is required by law or necessary to protect rights.

8. International transfers

Personal data may be processed outside the EEA. Where transfers are made to jurisdictions without an adequacy decision, we implement appropriate safeguards, including:

EU Standard Contractual Clauses (SCCs);
EU-U.S. Data Privacy Framework where applicable; or
other lawful transfer mechanisms under GDPR Chapter V.

Details of safeguards may be requested by contacting [email protected].

9. Retention

We retain personal data only for as long as necessary for the purposes in Section 6 and to meet applicable legal requirements.

Account data: retained while the account is active.
Inactive accounts: may be deleted or anonymized after extended inactivity (e.g., 24 months), subject to notice and legal retention requirements.
Financial/payout data: retained for statutory accounting and tax periods (typically 5–7 years).
Verification data: retention of verification status and audit references for fraud prevention/legal defense (typically up to 3 years unless longer is required by law).
Biometric data: selfie and video media deleted after 30 days; the face template deleted 12 months after your last verification; data linked to detected fraud may be retained longer where permitted (Art. 17(3)(e) GDPR). See Section 4.6.
Support/dispute data: retained as long as necessary to resolve the matter or defend claims.

10. Security

We implement appropriate technical and organizational measures to protect personal data, including encryption in transit, hashed passwords, access controls, logging, monitoring, and security testing. If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify you and the relevant authority as required by law.

11. Your rights

Subject to the conditions and limitations set out in GDPR, you have the right to:

access your personal data;
rectify inaccurate or incomplete data;
request erasure;
object to processing based on legitimate interests or for direct marketing;
request restriction of processing;
request data portability; and
withdraw consent where processing is based on consent.

Requests can be submitted to [email protected]. We may verify identity before responding.

12. Complaints

You may lodge a complaint with your local supervisory authority. Flow Group’s lead supervisory authority is the Swedish Data Protection Authority (Integritetsskyddsmyndigheten).

13. Definitions

Controller: the entity determining purposes and means of processing.

Processor: the entity processing personal data on behalf of the controller.

Personal data: information relating to an identified or identifiable natural person.

Aggregated data: data that does not identify individuals unless combined with other data.

Legitimate interests: processing necessary for our interests, balanced against your rights.

EEA: European Economic Area.

Last Updated: 15.07.2026