Privacy Policy

This Privacy Policy describes the policies and practices of MBC Game Studio (“MGS”, “we”, “us”, or “our”) regarding the collection and use of your personal data and sets out your privacy rights.

This Privacy Policy has been prepared in accordance with applicable data protection law, including the Personal Data Protection Law of the Kingdom of Saudi Arabia and its Implementing Regulation (“PDPL”). Where it applies to you, we also comply with the EU/UK General Data Protection Regulation (“GDPR”) and the California Consumer Privacy Act (CCPA). Where one of these laws is more protective than the other, we apply a higher standard to your personal data.

We recognize that information privacy is an ongoing responsibility, and we will update this Privacy Policy from time to time as we adopt new personal data protection practices or to reflect legal changes. When we do, we will make the revised Privacy Policy available online together with the date of its last update.

We may process your personal data in the following situations:

1. You are an existing or potential client, supplier or vendor of MGS;
2. You visit our website;
3. You have linked your profile or otherwise interacted with MGS profiles on social media;
4. You participate in an event, trade show or meeting organized by or involving MGS (for example, a game demo or community activation);
5. You use or play our games, test our games, or take part in other initiatives related to the research, evaluation, development or promotion of games developed or published by MGS;
6. You have agreed to receive our newsletter or other materials and information.

If you would like us to further clarify the purposes for which we process your personal data, please contact us by filling out our contact form.

The controller of your personal data is:

MBC Game Studio Limited (MGS), Riyadh, Kingdom of Saudi Arabia.

Please send any questions regarding the processing of your personal data by filling out our contact form.

The scope and purpose of processing your personal data depend on the relationship between you and us.

If you are an existing or potential client, supplier or vendor of MGS

We may process your personal data for the following purposes:

1. to perform a contract to which you are party, or to take steps at your request before entering into a contract (GDPR Art 6(1)(b); PDPL: performance of a contract);
2. to comply with the legal obligations to which we are subject (GDPR Art 6(1)(c); PDPL: legal obligation);
3. to protect our legitimate interests, including defending and exercising legal claims (GDPR Art 6(1)(f); PDPL: legitimate interest).

If you visit our website

We may process personal data contained in essential cookies based on our legitimate interests (GDPR Art 6(1)(f)). Our legitimate interest here is to make our website available, ensure its security, and gather basic statistical data. The data collected may include your IP address, the country of origin of your IP address, the referring website, and browser or platform you use for access. We may also process your personal data in connection with giving you the opportunity to visit and use our website.

We may process personal data in cookies other than essential cookies based on your freely given and informed consent (GDPR Art 6(1)(a); PDPL: consent), which you can withdraw at any time using our cookie consent tool.

If you have linked your profile or interacted with MGS on social media

We may process your profile/account name, e-mail address, and other data you make available through your activity on or correspondence with our social media profiles, based on our legitimate interests, which include informing you about MGS activities, promoting our games, conducting correspondence, verifying identity, and defending and exercising legal claims.

We have limited influence over the processing of data by social media operators. Each operator manages its own infrastructure, maintains its own privacy policy, and is responsible for your data on its platform. Please review the privacy policy of the relevant operator for more information.

If you participate in an event, trade show or meeting

We may process your identity data and contact details (e-mail and, if you provide it, phone) in order to facilitate your participation in the event, to perform any agreement relating to your participation, to defend and exercise legal claims, and for statistical and record-keeping purposes.

If you use or play our games, test our games, or take part in related initiatives

Using our games may involve processing personal data such as your username, e-mail address, game platform identifiers, and technical information about the devices you use to access our games (including IP address, operating system, browser or other software, and hardware information). We may process this data based on our legitimate interests in order to communicate with you, ensure the proper functioning of our games (including troubleshooting), compile statistics and reports, and improve or modify our games.

If you test our games or take part in research, evaluation or promotional initiatives, we may also process the data you provide to qualify for and participate in those initiatives — for example your name, contact details, and feedback, video/audio recordings of gameplay and chat records where relevant, and, only where applicable and with your consent, payment details if participation is paid. In exceptional cases and only with your explicit consent, we may process sensitive data. We process this data to conclude and perform the agreement for your participation. The data of people who do not qualify is deleted promptly.

Depending on the platform on which you preorder, buy, or use our games, the platform owner may collect different data about you. Please see the relevant platform for more information.

If you have agreed to receive our newsletter or other information

We process your e-mail address and, if you choose to provide it, your mobile number, based on your freely given consent (GDPR Art 6(1)(a); PDPL: consent), in order to send you our newsletter and other materials and information, including marketing, by e-mail and, if you opted in, by WhatsApp. Providing your mobile number is optional. Every marketing message identifies us as the sender and includes an easy way to unsubscribe, which is as simple as signing up.

If you have sent us a message

We may process the personal data contained in any correspondence you send us. The scope of that data depends on what you choose to share and the subject of your message.

We do not take automated decisions based on your data. With your consent, we use pseudonymous identifiers and attribution data to measure and optimize our marketing; this can involve profiling for advertising purposes, which you can switch off at any time using our cookie consent tool.

In most cases, providing your personal data is voluntary, but it may be necessary to do the thing you are asking us to do: to cooperate with us as a client, supplier or vendor; to make our website function; to interact with our social media profiles; to take part in an event; to use, test or take part in initiatives relating to our games; or to receive our newsletter. Where data is provided on the basis of your consent, providing it is always voluntary, and choosing not to provide it will not disadvantage you (for example, the optional mobile number for SMS).

Depending on the law that applies to you, you have the right to:

1. access your personal data and obtain a copy of it;
2. correct or update your personal data;
3. withdraw your consent at any time by filling out our contact form. Withdrawal applies to data processed on the basis of that consent and does not affect the lawfulness of processing carried out before withdrawal;
4. request that your personal data be deleted (the right to be forgotten) where it is no longer needed;
5. restrict the processing of your personal data;
6. object to processing carried out on the basis of our legitimate interests; and
7. where the GDPR applies, request the transfer (portability) of your personal data.

We will verify your identity before acting on a request, and we will respond within the period required by the applicable law. You also have the right to lodge a complaint with the competent supervisory authority—in the Kingdom of Saudi Arabia, the competent authority (SDAIA); in the EU/UK, your local data protection authority—if you believe your data protection rights have been breached.

We store your personal data only for as long as necessary for the purpose for which it was collected and then delete or anonymize it. In particular:

• data processed on the basis of consent (such as newsletter/marketing data) is kept until you withdraw your consent or unsubscribe, after which it is deleted, subject to a short wind-down period;
• data processed on the basis of our legitimate interests is kept for no longer than necessary for that interest, or until you successfully object, whichever is earlier;
• data processed to perform a contract is kept for as long as necessary to perform it and to handle any related claims; and
• data processed to meet a legal obligation is kept for the period required by law, including the period for which records of processing must be retained.

Only authorized personnel who have a business need to know have access to your personal data, and they are bound to keep it confidential. We apply reasonable technical, contractual, administrative and physical measures to protect your personal data against unauthorized use or disclosure, loss or theft, including encryption where appropriate. Authorized personnel may use your personal data only in accordance with this Privacy Policy, our internal policies, and applicable law.

We take special care to comply with applicable law regarding the privacy of minors. Our website and newsletter are not directed at children, and we use an age-confirmation step. We do not knowingly collect personal data from minors below the applicable age of consent without the consent of a parent or guardian. If you believe we have done so, please contact us and we will delete the data.

If you apply for a position at MGS through our careers page or otherwise, we process the personal data you provide in your application: such as your name, contact details, CV/resume, work history, education, and any other information you choose to share, in order to assess your application, communicate with you during the recruitment process, and take steps at your request prior to entering into an employment contract. We may also process this data to protect our legitimate interests, including improving our recruitment process and defending and exercising legal claims. We use Workable, a recruitment platform provider, to receive, store and manage applications on our behalf. If your application is unsuccessful, we retain your data only for up to 3 months after the recruitment process ends, unless you consent to us keeping it on file for future opportunities, after which it is deleted.

We do not sell your personal data or make it available for third-party advertising. We disclose your personal data only to service providers who process it on our behalf, under contract and on our instructions, and always treat it as confidential. With your consent, we share certain data with advertising and measurement partners so we can deliver, measure, and improve our marketing campaigns. If you do not consent to marketing or performance technologies, we do not share your data for these purposes. What we share with these partners is limited and protected. We also share event details to identify page access and your consent information.

Our service providers currently include:

Processors acting on our behalf

• Amazon Web Services (AWS): secure cloud hosting and storage;
• OneTrust: cookie and consent management and consent records;
• RudderStack: collection and routing of website/sign-up event data and consent signals;
• Braze: delivery of our e-mail and WhatsApp newsletters and management of marketing communications;
• Zendesk: customer service and support platform and self-service help center;
• Workable: recruitment platform used to receive, store and manage job applications;
• SurveyMonkey: surveys and questionnaires;
• Dentsu: advertising and customer experience management;

Advertising & measurement partners

• Meta (Instagram, Meta APIs, WhatsApp): conversion measurement and optimization for Meta/Instagram/WhatsApp advertising;
• Reddit: conversion measurement;
• Snapchat: conversion measurement;
• TikTok: conversion measurement;
• Google (Google Ads, CM360/Floodlight, DV360): ads and campaign management;
• The Trade Desk: media delivery/measurement;
• Amazon DSP: media delivery/measurement;

Our data and analytics providers:

• Google Analytics: website analytics;
• YouTube: video analytics;

We require every provider to protect your data, use it only for the services they provide to us, keep it confidential and secure, and delete or return it when no longer needed. We may also disclose personal data where required by law or in response to a valid request from a competent authority.

International transfers. Some of our service providers store and process data outside your country.

Where this happens:

• for data protected by the PDPL, we transfer or store personal data outside the Kingdom of Saudi Arabia only where necessary or the conditions of the PDPL are met, including a legitimate purpose, no prejudice to the Kingdom’s interests, an adequate level of protection (or appropriate safeguards) at the destination, and limiting the transfer to the minimum necessary;
• for data protected by the GDPR, we use a lawful transfer mechanism such as an adequacy decision or the European Commission’s Standard Contractual Clauses, together with appropriate safeguards.

In all cases, we transfer only the minimum data needed and keep records of our transfers. You can contact us for more information about the safeguards we use.

California law requires that we make certain disclosures about your data. The following disclosures are made pursuant to the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (“CCPA”).

Categories of personal information we collect. We collect the following categories of personal information: identifiers (such as IP address, pseudonymous online identifiers, and, only when you complete a signup, your email address and phone number as one-way hashes); internet or other electronic network activity (such as pages viewed, referring website, and campaign and attribution parameters); and commercial information (such as newsletter sign-up). We collect this information from you directly and from your device and browser as you use our sites. We use it for the purposes described elsewhere in this Privacy Policy, including operating and securing our sites, measuring performance, and, with your consent, marketing.

Sale and sharing of personal information. We do not sell or share your Personal Data as those terms are defined under the CCPA. MBC Games Limited has no actual knowledge of selling or sharing the Personal Data of minors under 16 years of age.

Your rights. California residents have the right to: know and access the personal information we have collected; delete it; correct inaccurate information; opt out of the sale or sharing of personal information; limit the use of sensitive personal information (see below); and not be discriminated against for exercising any of these rights.

How to opt out of sale/sharing. You can opt out at any time using the "Your Privacy Choices" link in our website footer, or through our cookie preference center via Cookie Settings. We also recognize and honor the Global Privacy Control (GPC) signal sent by your browser as a valid request to opt out of sale/sharing for that browser or device.

Sensitive personal information. We do not sell or share the Personal Data of California residents as those terms are defined by the CCPA, nor do we collect or process sensitive Personal Data for the purpose of inferring characteristics about you. We also do not use sensitive Personal Data for purposes other than those specified in Section 7027(m) of the California Privacy Rights Act regulations promulgated by the California Privacy Protection Agency. Therefore, we do not offer you the option to opt out or to limit the use of your sensitive Personal Data.

How to exercise your other rights. To make a request to know, delete, or correct, contact us by filling out our contact form. We will verify your identity before responding and will not discriminate against you for making a request. You may use an authorized agent to submit a request on your behalf, subject to verification.