Privacy policy

1. Who we are

This website is run by Equilibrarium Tech Limited, a company incorporated in the Republic of Cyprus. We are a software development company and game development studio specialising in educational technology (EdTech). In this policy, ‘Equilibrarium Tech’, ‘we’, ‘us’ and ‘our’ mean Equilibrarium Tech Limited.

For the personal data described in this policy, we are the ‘controller’. This means we decide why and how the data is used, and we are responsible for protecting it under the EU General Data Protection Regulation (Regulation (EU) 2016/679, the ‘GDPR’) and the Cyprus law on the protection of natural persons with regard to the processing of personal data (Law 125(I)/2018).

Our contact details are:

We handle all enquiries, including privacy questions and requests, by email.

2. What this policy covers

This policy applies to the website equilibrarium.com, in both its English and Greek versions. It also applies to emails you send to us and to our replies.

‘Personal data’ means any information that relates to you and identifies you, or could be used to identify you. Examples are your email address and, in some cases, your IP address.

Our educational games, the Equilibrarium Finance Education App and the Equilibrarium Theory of Games App, are still in development and have not been released. This policy does not cover them. Before each game is released, we will publish a separate privacy notice explaining how that game handles personal data, and we will update this policy where needed.

This policy sits alongside our Terms of use, which set out the rules for using the website.

This policy is published in English and Greek, and both versions are intended to have the same meaning. If the two versions ever differ, we will apply the meaning that is more favourable to you, and we will correct the other version. If you notice a difference, please tell us at info@equilibrarium.com.

3. Information we collect

We handle personal data in only two ways: through standard server logs when you visit the website, and when you email us. There are also two optional display settings, which never leave your device.

Server logs. The website runs on servers operated by our hosting provider. Each time your browser asks for a page, the server automatically records standard technical information that your browser sends as a normal part of how the web works. It includes:

• your IP address (the number that identifies your connection on the internet);
• the date and time of the request;
• the page or file requested;
• information your browser sends about itself and your device, such as the browser type and version and the operating system;
• the address of the page that linked you to us, if your browser sends it.

Emails you send us. If you write to info@equilibrarium.com, we receive what you choose to send us:

• your email address;
• your name, if you give it;
• your message and any attachments;
• the technical details that come with every email, such as the date and time it was sent.

Writing to us is entirely your choice. Please include only what we need to help you, and avoid sending sensitive information such as health details, identity documents or bank details.

Display settings. If you change the appearance or pause the animations, your browser remembers that choice on your own device. We do not receive it. The section ‘Cookies and browser storage’ explains how this works.

We do not obtain personal data about you from other sources, such as data brokers or advertisers. The only exception is if someone who writes to us mentions you in their message. We then handle that information in the same way as the rest of their message, and only to deal with their enquiry. Separately, we have a company page on LinkedIn. If you follow it or message us there, LinkedIn’s own privacy policy applies, and we see only the information that LinkedIn shows to page owners (see ‘Links to other websites’).

No law or contract requires you to give us personal data. To show you the website, your browser has to share your IP address and the technical details listed above, so the website cannot be visited without them. Emailing us is optional. If you prefer not to share your email address with us, the only consequence is that we cannot reply to you.

4. Cookies and browser storage

The website does not set any cookies, either our own or anyone else’s.

The website has two optional display settings: appearance (light or dark) and pausing the animations. If you change either of them, your browser saves your choice in its ‘local storage’, a small storage area on your own device, under the names eq-theme and eq-motion. This means the website looks the way you chose when you come back. If you do not use these settings, nothing is saved.

These settings stay on your device. They are never sent to us or to anyone else. You can delete them at any time by clearing the stored data for equilibrarium.com in your browser settings. The website will then go back to its default settings.

This storage is used only to provide a feature you have asked for, and for nothing else. Under the EU ePrivacy rules (Directive 2002/58/EC), as applied in Cyprus, storage that is strictly necessary to provide a feature you have asked for does not need your consent. That is why the website has no cookie banner.

5. What we do not do

The website has no user accounts, forms, comments, newsletter, chat, payments or software downloads. In addition, we do not:

• use cookies of any kind;
• use analytics, visitor statistics or session recording tools, including the statistics tools that web hosting control panels can run on server logs;
• show advertising or work with advertising networks;
• use tracking pixels, web beacons or similar tracking methods;
• add social media buttons or plugins;
• load fonts, scripts, maps, videos or any other content from third-party services, because everything on the website is delivered from our own web hosting;
• profile you or make decisions about you by automated means;
• sell, rent or trade your personal data.

Newsletter. We plan to offer a newsletter or mailing list in future. If we do, joining will be optional and based on your consent, which you will be able to withdraw at any time, for example through the unsubscribe link in every email. Before we start taking sign-ups, we will update this policy with the details, including which provider sends the emails and whether it measures opens or clicks. We will not add anyone to the list without their consent, including people who have emailed us.

6. Purposes and legal bases

The GDPR allows us to use personal data only where we have a valid legal reason, called a ‘legal basis’. Here is what we use personal data for, and the legal basis for each purpose.

• Keeping the website secure and working. We use server logs to run the website, to detect and stop misuse and attacks, and to find and fix technical problems. Legal basis: our legitimate interests in operating a safe and reliable website (GDPR Article 6(1)(f)). We do not use the logs to analyse how individual visitors behave or to build profiles.
• Replying to your emails. We use the details in your email to answer your message and deal with any follow-up. Legal basis: our legitimate interests in answering people who contact us (Article 6(1)(f)). If you write to us about entering into a contract with us, our legal basis is taking steps at your request before a contract is made (Article 6(1)(b)).
• Meeting legal obligations. Where the law requires us to keep certain records or to give information to an authority, our legal basis is compliance with a legal obligation (Article 6(1)(c)).
• Protecting our legal rights. If it ever becomes necessary, we may use relevant information to establish, exercise or defend legal claims. Legal basis: our legitimate interests (Article 6(1)(f)).

Where we rely on legitimate interests, we have weighed them against your interests, rights and freedoms, and we are satisfied that yours do not override them. The data involved is limited, is used only in ways you would reasonably expect and is kept only for as long as needed.

Your right to object. Wherever we rely on legitimate interests, you can object at any time, on grounds relating to your particular situation, by emailing info@equilibrarium.com. We will then stop using your data for that purpose, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims.

We do not currently rely on your consent for any of our processing. If that changes, we will ask you clearly first, and you will be able to withdraw your consent at any time. Withdrawing it will not affect anything we did before you withdrew it.

We do not use your personal data for any purpose that is incompatible with the purposes above.

7. Who we share information with

We share personal data only where necessary, and only with:

• our hosting provider, which runs the servers for the website and keeps the server logs;
• our email service provider, which handles messages sent to and from info@equilibrarium.com.

When these providers act for us, they are our ‘processors’. This means they may use the data only on our instructions and only to provide their services to us, and they must keep it confidential and secure. If you would like to know which providers we use, please ask us.

These providers may also use some of the data for their own purposes, such as protecting their networks and services against attacks, spam and abuse, or meeting their own legal obligations. For that use, each provider is a separate controller, and its own privacy notice applies.

Where the law requires it, or where it is necessary to establish, exercise or defend legal claims, we may also share information with our professional advisers, such as lawyers or accountants, who must keep it confidential. In the same circumstances, we may share it with courts, the police, regulators or other public authorities.

We do not share your personal data with advertisers, data brokers or social networks, and we never sell or rent it.

8. International transfers

We are based in Cyprus, within the European Economic Area (the ‘EEA’).

Our hosting provider or email service provider may store or process personal data outside the EEA, for example in the United States. If so, we make sure the transfer is protected in a way the GDPR allows. Either the European Commission has decided that the destination offers an adequate level of protection (for companies in the United States, this applies to those certified under the EU-US Data Privacy Framework), or we rely on another safeguard recognised by the GDPR, such as the European Commission’s standard contractual clauses, together with any extra measures needed.

You can ask us at info@equilibrarium.com where your data is processed, which safeguard applies and, where relevant, for a copy of it.

9. How long we keep information

We keep personal data only for as long as we need it for the purposes described in this policy.

• Server logs are kept by our hosting provider for no longer than 30 days, to keep the website secure and working, for example to spot and look into an attack or a technical fault. They are then deleted automatically.
• Emails and our replies are kept only for as long as we need them to deal with your enquiry and any follow-up, and are then deleted. If an email records something that continues to matter, such as a permission we have given you, we keep it for as long as it remains relevant. Deleted emails may remain in our email provider’s systems for a limited time, until the provider removes them under its own retention rules.
• Display settings stay in your own browser until you clear them. We cannot see them or delete them ourselves.

We keep information for longer only where the law requires us to, for example to meet record-keeping duties, or where we need it to establish, exercise or defend a legal claim. In those cases we keep only what is needed, and only for as long as it is needed.

10. Security

We take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access, change or disclosure. For example:

• the website is served over an encrypted (HTTPS) connection;
• access to our hosting account and our mailbox is restricted to those who need it;
• we choose providers that offer appropriate security and are bound to protect the data;
• the website has no accounts, forms or third-party code, so there is very little personal data to protect in the first place.

We work hard to protect the little personal data we handle, but no online service can promise that a security problem will never happen. Ordinary email is not always fully encrypted, so please do not send sensitive information by email.

If a personal data breach ever happens, we will act as the GDPR requires. If the breach could put people’s rights and freedoms at risk, we will report it to the Office of the Commissioner for Personal Data Protection, where possible within 72 hours of becoming aware of it. If it is likely to put you at high risk, we will also tell you without undue delay: directly where we can, or otherwise through a clear notice on the website, as the GDPR allows.

11. Your rights

Under the GDPR you have the following rights over your personal data. Some of them apply only in certain situations.

• Access: you can ask whether we hold personal data about you and ask for a copy.
• Rectification: you can ask us to correct data that is wrong or to complete data that is incomplete.
• Erasure: you can ask us to delete your data where there is no good reason for us to keep it.
• Restriction: you can ask us to limit how we use your data, for example while we check a question you have raised.
• Objection: you can object to our use of your data based on legitimate interests, as explained in ‘Purposes and legal bases’.
• Portability: if we use data you gave us on the basis of your consent or a contract, and by automated means, you can receive it in a common, machine-readable format or ask us to send it to another organisation. Given how little data we hold, this will rarely apply.

We do not make decisions about you based solely on automated processing, including profiling.

To use any of these rights, email us at info@equilibrarium.com and tell us what you would like us to do. You do not need to use a special form or particular wording.

We will reply without undue delay and within one month of receiving your request. If a request is complex, or if we receive many requests, we may extend this by up to two further months. If so, we will tell you within the first month and explain why.

To protect your data, we may need to confirm that a request really comes from you, usually by replying to the email address concerned. We will ask only for the minimum we need, and we will use it only for this purpose.

Using your rights is normally free of charge. If a request is clearly unfounded or excessive, for example because it is repeated, the law allows us to charge a reasonable fee or to refuse the request.

If we decide not to act on a request, we will tell you why within one month, and remind you that you can complain to a supervisory authority or go to court.

Server logs do not contain names, so we usually cannot link them to a particular person. If your request is about server logs, it helps if you tell us the IP address you used and roughly when you visited. Please note that the logs may already have been deleted under our retention rules.

12. Complaints

If you are concerned about how we handle your personal data, we would like to hear from you at info@equilibrarium.com. We will do our best to put things right.

You also have the right to complain to a data protection supervisory authority at any time, and you do not have to contact us first. In Cyprus, this is the Office of the Commissioner for Personal Data Protection (www.dataprotection.gov.cy). You can also complain to the supervisory authority in the EU or EEA country where you live or work, or where you believe the problem happened.

You also have the right to go to court if you believe your data protection rights have been infringed. You can bring a claim in the courts of Cyprus or of the EU or EEA country where you usually live.

13. Children

The website is a company information website. It does not ask visitors of any age for personal data.

We do not knowingly collect personal data from children. Server logs are created automatically for every visitor, and they do not tell us anyone’s age.

If you are under 18, or a parent or guardian, and believe that a child has emailed us personal data, please contact us at info@equilibrarium.com. We will delete it unless the law requires us to keep it.

14. Links to other websites

The website contains links to other websites: our company page on LinkedIn, and the website of the data protection authority mentioned in this policy. These are ordinary links, not social media plugins: nothing about you is sent to another website unless you choose to follow a link. If you do, that website receives the usual technical information from your browser, such as your IP address, and may learn that you came from equilibrarium.com.

Our LinkedIn page. If you visit or follow our company page on LinkedIn, or message us there, LinkedIn handles your data under its own privacy policy. LinkedIn gives us statistics about visits to the page that do not identify individual visitors. For those statistics, LinkedIn Ireland Unlimited Company and we are joint controllers, and LinkedIn has agreed to take primary responsibility for them, including for requests to use your rights. If you follow the page, we can see your public LinkedIn profile in the list of followers. If you message us there, we handle your message in the same way as an email, as this policy describes. For anything we hold about you from LinkedIn, you can use your rights by writing to info@equilibrarium.com.

If you follow a link, you leave the website, and the other website’s own privacy policy applies. We are not responsible for how other websites handle personal data, so please read their policies.

15. Changes to this policy

We may update this policy from time to time, for example when we release a game, change a service provider or need to reflect a change in the law. The ‘Last updated’ date at the top shows when the policy last changed.

If we make an important change, we will make it clear on the website. Where the law requires further steps, such as asking for your consent, we will take them.

Previous versions of this policy are available on request from info@equilibrarium.com.

16. Contact us

If you have any questions about this policy or your personal data, or if you would like to use any of your rights, please email us at info@equilibrarium.com.