Privacy Policy

Last updated: 10 September 2026

This Privacy Policy explains how Sealman Studio Kft. ("we", "us", "our") processes personal data in connection with the operation of our physical venue in Budapest, Hungary, our website and online platform (side-quest.bar), and our tournament platform (gg.side-quest.bar), in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable Hungarian laws.

1. Data Controller

• Legal entity name: Sealman Studio Kft.
• Registered address: 1072 Budapest, Klauzál utca 30., Hungary
• Email: [email protected]

2. Physical Venue – Video Surveillance (CCTV)

Our venue operates a video surveillance system for safety and security purposes.

Data processed

• Video recordings of individuals present in monitored areas

Purpose

• Protection of guests, staff, and property
• Prevention and investigation of incidents

Legal basis

• Legitimate interest (Art. 6(1)(f) GDPR)

Retention

• Footage is retained for a maximum of 3 days
• Extended retention only if required for an incident or legal obligation

Additional notes

• No audio recording is performed
• Access is limited to authorized personnel only
• Clear signage is displayed in accordance with Hungarian data protection requirements

3. Online Platform – User Accounts

Users may create accounts on our website to access interactive features.

3.1 Account Data

Data collected

• Username
• Email address
• Encrypted password
• Optional profile information
• User-generated content (e.g. scores, achievements)

Purpose

• Account creation and authentication
• Arcade score tracking
• Participation in social features
• Platform moderation and security

Legal basis

• Performance of a contract (Art. 6(1)(b) GDPR)
• Legitimate interest (Art. 6(1)(f) GDPR)

3.2 Arcade Scores & Loyalty Program (XP, Levels, Medals, Quests & Rewards)

Accounts are used for arcade score tracking and our loyalty program, in which members earn experience points (XP), progress through levels, collect medals, complete quests, and receive redeemable rewards.

Data processed

• Arcade scores and achievements
• XP balance and an XP transaction history (amount, reason — e.g. visit, quest, medal, promotion, correction — date, and, where relevant, the staff member who recorded the entry)
• Current level and unlocked perks (e.g. discount tier)
• Medals earned and quests completed, with award dates
• Rewards granted to you (name, source, validity period) and their status (available, redeemed, revoked, or expired), including the redemption date
• Event and tournament participation records, including those reported by our own connected tournament platform
• High-level consumption indicators (e.g. the number of qualifying drinks)
• Optional notification preferences (e.g. level-up and reward emails)

⚠️ We do not store detailed consumption data, such as specific food or drink items.

Staff access: when you show your member QR code at the venue, our staff can view your profile, level, medals, and redeemable rewards in order to record XP grants and redeem rewards. Staff actions on your account are logged for audit and abuse-prevention purposes.

Purpose

• Operating the loyalty program (XP, levels, medals, quests, and rewards) and leaderboards
• Recording XP grants and redeeming rewards at the venue
• Sending optional level-up and reward notification emails (only if enabled in your account settings)
• Correcting errors, preventing fraud and abuse, and auditing
• Enhancing the customer experience

Legal basis

• Performance of a contract (Art. 6(1)(b) GDPR)
• Legitimate interest (Art. 6(1)(f) GDPR)

3.3 Tournament Platform

Our tournament platform (gg.side-quest.bar) lets members register for and take part in tournaments we host in person at our venue.

Single sign-on

You access the tournament platform using your existing SideQuest account — no separate registration is required. When you sign in, the platform receives your basic account profile (username / display name, email address, and avatar image) from your SideQuest account via single sign-on (SSO). Both services are operated by the same data controller (see Section 1), so this is not a transfer to a third party.

Data processed

• Tournaments and teams you create, join, or manage
• Team membership and free-agent ("looking for a team") listings
• Match results and self-reported scores, including confirmations and disputes
• Comments you add to matches and messages you include with invitations or join requests
• Leaderboard standings, medals, and podium placements
• Login session data (IP address, browser / device information) for the platform

Public display

Your username, avatar, team name, match results, standings, medals, and podium placements are displayed publicly on tournament pages, leaderboards, and automatically generated social share images. Private and invite-only tournaments are visible only to their participants, invitees, and managers.

Purpose

• Organising in-person tournaments, matches, brackets, and leaderboards
• Enabling team formation, invitations, and join requests
• Maintaining the competitive record and medal tallies
• Moderation, fairness, and platform security

Legal basis

• Performance of a contract (Art. 6(1)(b) GDPR)
• Legitimate interest (Art. 6(1)(f) GDPR)

4. Website Usage & Security Logs

When accessing our website, limited technical data may be processed.

Data

• IP address
• Browser and device information
• Date and time of access
• Requested pages

Purpose

• Website security
• Abuse and fraud prevention
• Technical diagnostics and auditing

Retention

• Stored only for a limited period necessary for security and audit purposes

5. Analytics

We use Umami, a privacy-focused analytics tool hosted on our own servers.

Key characteristics

• No cookies and no browser storage are used
• No personally identifiable information collected
• All data is anonymised and aggregated – individual users are never tracked
• IP addresses are anonymised
• Data remains on our own infrastructure and is never shared with third parties

What we measure

• Aggregate usage statistics such as pages visited, referrers, and approximate device and browser type
• Anonymous interaction events (for example, which buttons or links are used) to understand how the site is used
• Anonymous performance metrics (Core Web Vitals, such as page load speed and responsiveness) to monitor and improve site performance

None of this information identifies you or is linked to your account.

Legal basis

• Legitimate interest (Art. 6(1)(f) GDPR)

6. Cloudflare – Proxy, Security & CAPTCHA

We use Cloudflare, Inc. as a reverse proxy and security provider.

Cloudflare provides:

• Secure proxying of website traffic
• DDoS protection
• Web application firewall
• Turnstile CAPTCHA for automated abuse prevention

Data processed

• IP address
• Request metadata
• Security-related technical information

Purpose

• Ensuring website availability and security
• Preventing malicious traffic and abuse

Cloudflare acts as a data processor and processes data in accordance with GDPR.

7. Email Communications

7.1 Transactional Emails

Transactional emails (account verification, password resets, service notifications) are sent via Infomaniak Network SA, our email service provider based in Geneva, Switzerland.

Infomaniak operates under Swiss jurisdiction and applies data protection standards equivalent to GDPR. Any emails you send to us are likewise stored by Infomaniak as our email hosting provider.

Data processed

• Email address
• Email content necessary to deliver the service

Legal basis

• Performance of a contract (Art. 6(1)(b) GDPR)

7.2 Newsletter & Marketing Emails (Optional Opt-In)

Users may optionally opt in to receive our newsletter and marketing communications. These emails are sent through MailerLite (operated by UAB "MailerLite", based in Vilnius, Lithuania, EU), which acts as a data processor on our behalf.

When you subscribe, your email address, name, and subscription status are stored and processed by MailerLite for the purpose of delivering these emails. MailerLite processes data in accordance with GDPR.

Data processed

• Email address
• Name
• Newsletter / marketing preferences

Purpose

• Newsletters
• Promotions
• Events
• Special offers and updates

Legal basis

• Explicit consent (Art. 6(1)(a) GDPR)

✔️ Marketing emails are never sent without consent ✔️ Consent can be withdrawn at any time via the unsubscribe link in any email or via your account settings

8. Hosting & Infrastructure

Our services are hosted by Hetzner Online GmbH.

• Hosting within the EU
• GDPR-compliant data processing agreements
• Appropriate technical and organizational safeguards

9. Data Sharing

We do not sell, rent, or share personal data with any third parties.

Personal data may be disclosed only to public authorities where we are legally required to do so.

10. Data Retention

11. Your Rights

Under GDPR, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Request erasure
• Restrict or object to processing
• Data portability
• Withdraw consent at any time
• Lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH)

Authority: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) Website: https://www.naih.hu

12. Data Security

We implement appropriate technical and organizational measures, including:

• Encryption
• Access controls
• Network and application security
• Regular security reviews

13. Changes to This Privacy Policy

If we make material changes to this Privacy Policy:

📧 We will notify registered users by email at least 30 days in advance 📄 The updated policy will also be published on our website