//privacy-policy
Privacy Policy
How 3S Game Studio OÜ processes personal data under Regulation (EU) 2016/679 (GDPR) and the Estonian Personal Data Protection Act. Last reviewed 2026-10-08.
Summary
- Controller: 3S Game Studio OÜ, registry code 16279375, Tallinn, Estonia.
- We collect personal data only through the Technical Audit request form and email.
- Lawful basis for the form: Article 6(1)(b) GDPR. No consent tick-box, because consent is not the basis.
- The server is operated by Namecheap, Inc. in the United States, outside the European Economic Area. The transfer rests on Standard Contractual Clauses, Article 46(2)(c) GDPR.
- Form submissions are deleted after 12 months unless they become a contract.
- No analytics, no advertising cookies before consent, no data sold.
1. Who is responsible for your data
The data controller is 3S Game Studio OÜ, Osaühing (OÜ) — Estonian private limited company, entered in the Estonian e-Business Register under registry code 16279375, EU VAT EE102395516, with its registered office at Poordi tn 3-63, 10156 Tallinn, Kesklinna linnaosa, Harju maakond, Estonia. You can reach us at contact@3sgamestudio.com.
We have not appointed a Data Protection Officer, because our processing does not meet the criteria in Article 37 GDPR. Data protection questions go to the address above and are answered by the company.
2. What we collect, why, and on what legal basis
2.1 Technical Audit and consultation request form
The form appears on the home page, the three service pages and the contact page. It is the same form everywhere, it collects exactly the fields below and nothing else, and every field is required for the single purpose of assessing and answering your request.
| Field | Why it is needed | Basis |
|---|---|---|
| Company name | To know which business is asking | Art. 6(1)(b) |
| Your name | To address the reply to the right person | Art. 6(1)(b) |
| Work email | To send the reply | Art. 6(1)(b) |
| Company size | To scope an audit or engagement realistically | Art. 6(1)(b) |
| Service area | To route the request to the right engineer | Art. 6(1)(b) |
| System and problem | To understand what you are asking for | Art. 6(1)(b) |
Legal basis: Article 6(1)(b) GDPR — processing necessary for steps taken at your request before entering into a contract. We do not rely on consent for the form, and it has no consent tick-box: consent is not the basis for answering a business enquiry, and consent required as the price of sending one would not be freely given. Each stored request records the lawful basis that applied and the version of the privacy notice shown beside the form (currently audit-notice-2026-10-08).
2.2 Email
If you write to contact@3sgamestudio.com, we process your address and message to answer you. Legal basis: Article 6(1)(b) GDPR where you are asking about our services, and otherwise Article 6(1)(f) GDPR — our legitimate interest in answering correspondence addressed to us. You may object to that processing under Article 21 GDPR.
2.3 Anti-abuse and security
To stop automated abuse of the form, we store a salted one-way hash of your IP address with a timestamp. The hash cannot be reversed to an address, and the address itself is never written to the database or to our application log. Legal basis: Article 6(1)(f) GDPR — our legitimate interest in keeping the service available and free of abuse. You may object under Article 21. These records expire within a rolling window of minutes.
2.4 What we do not do
We do not sell personal data. We do not share it for anyone else’s advertising. We do not build profiles, and we carry out no automated decision-making within the meaning of Article 22 GDPR. We use no third-party analytics service, CRM, chat widget, social plug-in, content delivery network or externally hosted font.
3. Cookies and Microsoft Consent Mode v2
This site sets no advertising or analytics cookie before you consent. Microsoft Consent Mode v2 is initialised with ad_storage denied by default, before any tag could load, and only your acceptance changes that signal. Every cookie and storage item is listed in the Cookie Policy.
4. Who else sees your data
Your data is handled by 3S Game Studio OÜ and by the hosting provider that operates the server on our instruction under a data processing agreement meeting Article 28 GDPR. We use no other processor for form submissions. Your data is not disclosed to third parties for their own purposes. If you consent to advertising measurement, Microsoft Ireland Operations Limited acts as an independent controller for the measurement data its UET tag collects; that is described in the Cookie Policy.
5. Hosting and international transfers
This website and its API run on a virtual server operated by Namecheap, Inc. in the United States. Everything you submit through the form is stored in a database on that same machine. We identified the provider and country from the network registration of the server’s address on 2026-10-08; we state the country only, not a city, because public geolocation databases disagree about cities for this provider’s address ranges.
The United States is outside the European Economic Area, so storing your data there is a transfer to a third country under Chapter V of the GDPR. We do not rely on the EU-U.S. Data Privacy Framework for it. The transfer rests on Article 46(2)(c) GDPR: the Standard Contractual Clauses adopted by the European Commission, which are incorporated in the hosting provider’s Data Processing Addendum. The server is administered by us; the provider supplies the machine and the network, not access to the database. You may ask us for a copy of the safeguards at the address in section 1.
We do not describe this website as EU-hosted or EEA-hosted, because the machine serving it is in the United States. The company itself, 3S Game Studio OÜ, is registered and established in Estonia.
6. How long we keep it
- Technical Audit requests: 12 months from receipt, unless the request leads to a contract, in which case the correspondence becomes part of the contract file.
- Rate-limiting hashes: a rolling window measured in minutes.
- Your cookie choice: stored in your own browser until you clear it or change it.
Each stored request carries the date on which it must be deleted, and a scheduled job on the server removes expired records daily. Records that Estonian accounting law requires us to keep are kept for the period that law sets and for no other purpose.
7. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you (Article 15);
- have inaccurate data corrected (Article 16);
- have data erased (Article 17);
- restrict processing (Article 18);
- receive your data in a portable format (Article 20);
- object at any time to processing based on our legitimate interests (Article 21);
- withdraw any consent you have given, without affecting processing already carried out.
Write to contact@3sgamestudio.com. We answer within one month, as Article 12(3) GDPR requires, and tell you if we need the extension that article allows. You may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, or to the supervisory authority of the EU country where you live or work.
8. Security
The site is served over HTTPS with HSTS. Form submissions are protected by a double-submit CSRF token and rate limiting. The database listens only on the server’s loopback interface. Access to submitted data is limited to the people at 3S Game Studio OÜ who need it to answer you. The application log records that a submission happened — never its contents.
9. Children
This is a business-to-business website. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has sent us data, write to us and we will delete it.
10. Changes
If this policy changes materially, the revised version is published here with a new review date, and the notice beside the form carries its own version identifier so you can tell which text applied when you submitted.