Privacy Notice

1. Controller and scope

The controller responsible for the processing described in this Notice is K. Verhoeven, operating the independent, community-run hobby projects under the public names DK-United and DK-Ezyro from the Netherlands. Privacy requests can be sent to DK-United: privacy@darkedenunited.com · DK-Ezyro: privacy@dkezyro.com.

This Notice covers the project domains, account/UCP and Closed Beta modules, public rankings, downloads, galleries, suggestions, bug reports, support functions, portal/ACP administration and connected service-security records.

2. Personal data processed

Passwords should be stored only as secure one-way hashes. The public websites must not display passwords, password hashes, private administrator details or private security logs.

3. Sources

Data comes directly from you, from your interaction with the services, from game/account systems connected by the operator, and from hosting, email and security infrastructure used to operate the services. The project does not purchase data-broker profiles.

4. Purposes and legal bases

• Service performance: account creation, authentication, UCP features, Closed Beta access, downloads and support requested by you.
• Legitimate interests: security, fraud/abuse prevention, service diagnostics, moderation, enforcing rules, server-side caching/session operation and improving reliability, balanced against user rights.
• Legal obligations: responding to valid legal requests, maintaining required records and handling rights requests.
• Consent: optional non-essential cookies, future newsletters, optional marketing or other processing where consent is the appropriate basis. Consent can be withdrawn.

5. Public data

Selected character, guild and ranking information may be public. Support messages, account email, IP logs and private reports are not intentionally published. Public data may remain visible in search-engine or third-party caches for a limited period after removal.

6. Recipients and processors

Data may be processed by the operator and authorised administrators/moderators who need it for their role. Necessary data may also be handled by hosting, email, backup, security, content-delivery or technical service providers acting under appropriate instructions or contractual safeguards.

Redis, Varnish and RAM-disk caching used within the hosting environment are operated as server-side infrastructure and are not separate browser-tracking providers. The project does not sell personal data. At the date of this Notice, it does not use personal data for cross-site behavioural advertising.

7. International transfers

Some technical providers may process data outside the European Economic Area. Where GDPR transfer rules apply, the operator will use an available lawful mechanism such as an adequacy decision, approved contractual clauses or another permitted safeguard, and will provide relevant information on request.

8. Retention targets

• Active account and linked game data: while the account is active; normally up to 24 months after closure for recovery, integrity and dispute handling.
• Routine web/security logs: normally up to 90 days; material abuse or incident records may be retained up to 12 months or longer when necessary.
• Support, ticket and moderation records: normally up to 24 months after closure of the matter.
• Closed Beta access/audit records: normally up to 24 months after the relevant beta ends.
• The dk_consent_gate_v25_clean3 cookie: 1 year. Its localStorage copy remains until removed or replaced because browser local storage has no automatic expiry.
• Public ranking caches: normally refreshed or removed within 30 days after the source data changes, subject to external caches.

These are operational targets and may be extended where necessary for an active dispute, security incident, legal requirement or valid preservation request. If a technical system cannot enforce a stated target, the target must be corrected or the deletion routine implemented before relying on it.

9. Your rights

Depending on applicable law, you may request access, correction, deletion, restriction, objection, portability or withdrawal of consent. You may also complain to the Dutch Autoriteit Persoonsgegevens or another competent supervisory authority. Send requests to DK-United: privacy@darkedenunited.com · DK-Ezyro: privacy@dkezyro.com. The operator may request reasonable verification and may retain limited evidence of the request and response.

10. Security

Reasonable technical and organisational measures may include access controls, password hashing, protected configuration files, least-privilege administration, rate limiting, private audit logs, backups, encryption in transit, self-hosted caching/session controls and DK-Guard security controls. No online system can promise absolute security.

11. Age restriction

The services are intended for adults aged 18 or older. The operator does not knowingly offer accounts to children. If data relating to a person below the required age is discovered, contact the privacy address so access and data can be reviewed and removed where appropriate.

12. California and other United States residents

The project does not currently sell personal information, share it for cross-context behavioural advertising, or knowingly use sensitive personal information to infer characteristics. Regardless of whether a particular state privacy law threshold applies, residents may contact the privacy address to request access, correction or deletion. A request may be limited where an exception applies, identity cannot be verified or retention is needed for security or legal reasons.

13. Future features

Before activating analytics that are not strictly necessary, advertising, newsletters, AI-assisted support, social-media inbox integrations, payments, marketplaces, subscriptions or public APIs, this Notice and the relevant consent/contract information must be updated to identify the provider, data, purpose, legal basis, retention and transfer details.

14. Updates

The “Last updated” date identifies the current version. Material changes will be announced where reasonably possible.