Last updated: 04/03/2025 (March 4th 2025)
This privacy policy sets out how we will process your personal data when you download, access and play our game, PAYDAY 3 (“Game”).
Who are we?
We are New Starbreeze Publishing AB and our registered office address is at PO-Box 7731, 103 95 Stockholm, Sweden
We are a controller of your personal data under data protection legislation which means that we are responsible for how the personal data we hold about you is processed.
How do we collect personal data?
We collect personal data directly from you when you play our game PAYDAY 3.
We may collect your personal data through the platform you access the Game on. We also collect your personal data through our Nebula accounts system, you can review our privacy policy for Nebula accounts here: https://nebula.starbreeze.com/legal/.
We may also collect your personal data through other individuals who may, for example, mention you in any communications they send to us.
Our publisher for the Game is PLAION, you can review their privacy policy here: https://plaion.com/en-en/privacy. If you would like to know more about data processing via our Nebula accounts, you can review our privacy policy here: rb.gy/27i3n
What personal data do we collect?
We collect your user ID from the relevant games platform and your IP address in order to matchmake you for heists in the Game. We also collect your Nebula account ID so we can allow you to play the Game across multiple platforms (where you own copies of the Game on multiple platforms) and give you access to certain virtual items. We may also collect your data in order to issue or maintain a suspension or ban.
We also collect non-personal data related to gameplay to analyse and improve the Game.
What about children?
You must be 15 years old or over to play the Game. However, this will be subject to any restrictions from the platform you access the Game on. Please also check the age rating of the Game in your territory, as the content may not be appropriate for audiences under 18 years old (or whatever the age of majority is in your territory).
We understand we have a special responsibility towards children. We do not knowingly collect the data of children under 15 years old.
How do we use your personal data?
In accordance with data protection laws, we will only process your personal data if we have a lawful basis for doing so.
In respect of your personal data, these bases are: (i) if it is necessary to provide services to you under the performance of a contract we have with you; (ii) if we are required to do so in accordance with legal obligations; (iii) if you have given your consent; and, (iv) if it is in our legitimate interests to process your personal data, provided that none of these prejudice your own rights, freedoms and interests.
The following is a list of the purposes for which we process your personal data, and the lawful basis on which we carry out such processing.
| Purpose | Lawful Basis |
|---|---|
| To allow you to play the Game (including with other players) | Necessary for the performance of a contract |
| Administering a connection between your games platform account and your Nebula account | Necessary for the performance of a contract |
| To allow you to use any player-to-player communication functionality | Legitimate interests of providing player-to-player communication functionality |
| To suspend or ban players who breach the Game’s EULA or other policies | Legitimate interests of providing a fair and safe Game for all players |
| To respond to communications, including customer support queries | Legitimate interests of handling customer communications |
| To record and analyse customer communications for training purposes | Legitimate interests of improving our customer service |
| To send you service messages and updates about the Game | Necessary for the performance of a contract |
| To prepare and analyse statistics relating to the use of the Game and other users, to investigate complaints and to seek and analyse feedback | Legitimate interests of ensuring our services and website are as enjoyable as possible |
| To administer and protect our business and the Game including troubleshooting, data analysis and system testing | Legitimate interests of running our business, provision of administration and IT services, including network security |
We may also process your personal data (a) to comply with a legal obligation we are under; and (b) for additional purposes in the future, but only if such purposes are compatible with those listed above and if we believe that the same lawful basis applies.
In certain circumstances, you may be obliged to provide us with your personal data under a statutory or contractual requirement. This might include, but is not limited to, personal data we require to enter into an agreement with you; for tax and accounting purposes; and to enable us to fulfill our compliance and other obligations under relevant legislation or regulation. Failure to provide us with personal data required under a statutory or contractual requirement may prevent us from entering into or performing our obligations under a contract with you.
When do we disclose your personal data?
We may disclose your personal data to other parties. We may share your personal data with the following parties:
- Service providers we use to help us operate our business, including organisations that provide us with technology related services, such as server hosting, data collection, data warehousing, analytics and customer support.
- With the Game’s publisher, PLAION, in order to develop, support and market the Game.
Contractors we engage to assist us in providing our services.
- Game platforms, when you choose to connect your game platform account with your Starbreeze Nebula account to play the Game.
- Social media platforms to share photos and text that you share via your profiles on these sites, for example, when you tag Starbreeze on a post that you make and we reshare that post via our profile on a social media site. External professional advisors who need to access such information for the purpose of advising us.
- Law enforcement bodies which may have any reasonable requirement to access your personal data, for example, in order to assist with any investigations, when we bring a claim or defend ourselves against a claim that requires the disclosure of personal data.
- Potential purchasers of our business or investors in it (including in the event of insolvency).
Is the data transferred internationally?
When your data is transferred internationally, we are required to ensure you are afforded equivalent protection in respect of your personal data to that provided in the EEA.
Generally, we will put in place appropriate safeguards when making international transfers, for example, by using specific contractual clauses which have been approved by the European Commission together with supplementary measures if we deem it necessary in the circumstances, for example, further contractual commitments or enhanced security.
How long do we keep your personal data for?
We will retain your personal data only for as long as necessary to fulfil the purposes we collect it for, including for the purposes of satisfying any contractual requirements or other legal, accounting, or reporting requirements.
To determine the appropriate retention period for personal data, we consider the purposes for which we process the personal data, the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, whether we can achieve those purposes through other means and the applicable legal requirements.
What are my rights?
You have the following rights under data protection legislation. If you have any questions about your rights, or you wish to exercise any of these rights, please email [email protected]. You can exercise these rights whether you’re an adult or a child.
We may require you to provide forms of identity should you wish to exercise one of your rights below.
- Access: You are entitled to confirmation that we process your personal data and a copy of such personal data
- Rectification: If the personal data we hold about you is incorrect, you have the right for this to be rectified. You may also update your personal data through your account settings.
- Erasure: You can request us to erase your personal data if there is no compelling reason to continue processing.
- Restriction: You may request a restriction on the processing we undertake on your personal data. This will only apply if we have no lawful basis to process your personal data, your personal data is inaccurate or to comply with an objection request (see below).
- Objection: You may object to our processing of your personal data if our processing is carried out on the basis of legitimate interests. Please note, however, that should we determine that our interests are so compelling as to override your objection we may continue to process your personal data. You may object to receiving direct marketing at any time.
- Portability: You have the right to receive some of your personal data in machine readable format. This right extends to you being able to request that such data is sent to a third• party controller.
- Withdrawing consent: If the lawful basis we rely on to process your personal data is consent you have the right to withdraw this consent. Please email [email protected] to withdraw consent for the processing of your personal data.
- Your right to be informed: You can contact us to find out more or to ask any questions you may have about our use of your personal data.
Complaining to a supervisory authority: Further information about your rights can also be obtained from your national data protection regulator – in the UK, this is the Information Commissioner’s Office (https://ico.org.uk/) and in Sweden, this is the Swedish Authority for Privacy Protection (https://www.imy.se/en/). If you have any cause for complaint about our use of your personal data, you have the right to lodge a complaint with your national data protection supervisory authority, although we would ask that you contact us in the first instance.
