Privacy notice

1. Who's responsible for your data

Data controller: Anna Hansen, acting in a personal capacity and trading as Island Logic Editions. Contact for any privacy request: hello@cypruslogic.com. These terms and any dispute arising from them are governed by Cypriot law.

2. What we collect

Playing the game on its own collects nothing that identifies you. You can pick a card, write an answer and submit it without an account, a login or an email address. For each play we store a randomly generated session ID (not linked to your identity), which cards you were shown and which you chose, your answer, and — if you arrived by QR code — which flyer and location the code came from. This tells us which cards people enjoy. It does not tell us who you are.

If you go on to enter the competition or ask to hear from us, we also collect:

• The entry text submitted for the competition
• The name, initials or handle you choose to give — optional, and needed only if you want to be credited
• Your email address — used only to contact you if you win, or for the newsletter if you separately opted in
• Your consent choices — which boxes you ticked, and whether you asked to be credited or published anonymously

Nothing is pre-ticked, and submitting a card never subscribes you to anything.

3. Why we process it

• To run the competition — reviewing, judging and, if your entry wins, crediting and publishing it in line with the competition terms. Legal basis: consent, Art. 6(1)(a) GDPR.
• To contact you if you win. Legal basis: consent, Art. 6(1)(a) GDPR.
• To send newsletter and event updates — only with a separate opt-in. Ticking the competition box never doubles as marketing consent. Legal basis: consent, Art. 6(1)(a) GDPR.
• To tell us which cards work — the anonymous gameplay data described above. Legal basis: legitimate interests, Art. 6(1)(f) GDPR. Our interest is knowing which cards people enjoy so the deck can be improved; the data is not linked to your identity, is never used to profile or target you, and cannot be traced back to you, so the impact on your privacy is minimal.

4. Where it's stored, and who else sees it

Entries are stored in Notion (Notion Labs, Inc.), acting as our data processor. No personal data is sold, and none is shared with third parties for their own marketing purposes.

• Analytics: [provider — and whether it sets cookies. If a cookieless tool such as Plausible is used, say so: it removes the need for a cookie banner.]
• Email provider: [provider]

Notion Labs is US-based, so entries stored in Notion are transferred outside the EEA. That transfer is covered by Notion's Data Processing Addendum, which incorporates the European Commission's Standard Contractual Clauses. [Before launch: accept Notion's DPA in the workspace settings and keep a copy on file — the safeguard has to actually be in place, not just described here.]

5. How long we keep it

• Entries that are not selected — deleted 12 months after the competition closes.
• The winning entry — kept for as long as the card remains in print, since it is published as part of the deck.
• Competition contact details — kept for 12 months after the competition closes, for record-keeping and to contact the winner.
• Newsletter subscribers — kept until you unsubscribe.
• Anonymous gameplay data — kept indefinitely; it contains nothing that identifies you.

You can ask us to delete your data sooner at any time — see section 7.

6. What we do with entries

Entries are private by default and go into a moderation queue. Nothing is published automatically. If your card is shortlisted for the First Edition we will contact you — where we have an email address — before publishing, and we will honour your credit preference.

7. Your rights

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent at any time. Withdrawing consent does not undo the publication of an entry already selected as a winner before the withdrawal. Every email we send has an unsubscribe link.

To exercise any of these, contact hello@cypruslogic.com. You also have the right to complain to a supervisory authority — in Cyprus, the Office of the Commissioner for Personal Data Protection.

8. Children

We do not knowingly collect data from anyone under 18, in line with the minimum age set in the competition terms.

9. Cookies and local storage

The game uses your browser's session storage to remember your session within a visit, and local storage while it is in test mode. Neither is used to track you across sites. [Update once the analytics tool is chosen — if it sets cookies, a consent banner is required before it loads.]

Last updated: 24 September 2026 · Version: draft 0.5 — controller, legal bases, retention periods, processor and EEA transfer resolved. Outstanding: the analytics and email providers, which are named once chosen. Legal review still pending before publication.