Privacy policy

1. Data controller

The data controller is Panda2Work v/Guo Yu Pan, a sole proprietorship registered in Denmark under CVR 34003602, Øster Farimagsgade 20, 1. th, 2100 København Ø, Denmark. Phone +45 30 47 81 27, email relations@panda2workvguoyupan.com.

2. What data we collect

• Contact enquiries: your name, email address, phone number if you choose to give it, and the content of your message, including any links or material you send us about a game.
• Business correspondence: contact details and messages exchanged with developers and partners when we discuss or carry out a publishing collaboration.
• Technical data: when you visit the site, our hosting provider and font provider receive your IP address, browser type and the page requested, as is necessary to deliver the website.
• Your cookie choice: stored in your own browser so the site remembers it.
• Advertising measurement (only with consent): if you accept advertising cookies, Microsoft Advertising receives information about your visit, such as pages viewed, a click identifier from an ad, cookie identifiers, IP address and browser information.

3. Purposes and legal bases

Purpose	Legal basis (GDPR)
Replying to your enquiry and handling correspondence	Article 6(1)(b), steps at your request before a contract, and Article 6(1)(f), our legitimate interest in answering messages
Entering into and carrying out publishing agreements	Article 6(1)(b), performance of a contract
Keeping accounting records	Article 6(1)(c), legal obligation under the Danish Bookkeeping Act
Delivering the website securely (hosting and fonts)	Article 6(1)(f), our legitimate interest in running a working, secure website
Measuring visits from our Microsoft Advertising campaigns	Article 6(1)(a), your consent, which you can withdraw at any time

4. How long we keep data

• Enquiries that do not lead to a collaboration: up to 12 months after our last contact.
• Correspondence related to an agreement: for the duration of the agreement and up to 5 years after it ends, to handle any claims.
• Accounting records: 5 years from the end of the financial year, as required by Danish law.
• Your cookie choice: 12 months in your browser, after which we ask again.
• Microsoft Advertising cookies: see our cookie policy for their lifetimes.

5. Who receives data

We do not sell personal data. We share it only with service providers that help us run the business, under data processing agreements where required:

• Website hosting provider
• Email and form delivery provider
• Font delivery service (Google Fonts, provided by Google), which receives your IP address when the page loads fonts
• Accountant and bookkeeping software provider
• Microsoft Advertising (Microsoft Ireland Operations Limited and Microsoft Corporation), which receives advertising and measurement data only if you accept advertising cookies. Microsoft acts as an independent controller for some of this data; see Microsoft’s own privacy statement.

We may also disclose data to public authorities where the law requires it.

6. Transfers outside the EU/EEA

Microsoft and Google may process data in the United States. Both companies are certified under the EU-US Data Privacy Framework, which the European Commission has found to provide an adequate level of protection (Article 45 GDPR). Where a provider is not covered by an adequacy decision, we rely on the European Commission’s standard contractual clauses.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have data erased, where the law allows;
• restrict processing;
• object to processing based on our legitimate interests;
• receive your data in a portable format;
• withdraw consent at any time, without affecting processing that took place before withdrawal. For cookies, use the “Cookie settings” link at the bottom of every page.

To use your rights, email relations@panda2workvguoyupan.com. We will reply within one month.

8. Complaints

You can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, www.datatilsynet.dk. We would appreciate the chance to resolve your concern first, so please feel free to contact us.

9. Automated decisions

We do not make decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on you.

10. Changes

We may update this policy when our practices or the law change. The date at the top shows when it was last updated.