Privacy

The controller is Tomáš Kolesár, a sole trader, IČO 74883593, with registered office at Slavojova 1729/8a, 128 00 Praha 2 – Nusle, Czech Republic. For anything about your data, write to help@getplasticout.com.

To play

Your browser keeps your results, the round in progress, your settings, a friend’s challenge score if you open one, and a random id it makes up the first time you play. They stay on your device until you clear this site’s data. Each tap sends the date, the question number, the point you tapped and that random id to our server, and says whether you came from a friend’s challenge or from a link with a campaign name. The server scores the tap and sends back the answer. You do not have to give us anything, but without these the game cannot score your taps.

Our server keeps, for each tap, the date and time, the question number, the points, the distance in kilometres and a scrambled form of the random id that cannot be turned back into it. It does not keep the point you tapped. When you finish a round it keeps your total. We use this to show how everyone did and to make sure the first guess on each question is the one that counts. We delete it after 35 days. This rests on our legitimate interest in running a fair game (GDPR art. 6(1)(f)).

To see how the game is doing, our server also counts page views, clicks on the Play buttons, on our own banners and on the stories’ source links, and visits from links that carry a campaign name (such as ?src=instagram). These are daily totals with no identifier, no IP address and no cookie, and nothing extra is kept on your device. From the play data above, it also works out how many of each day’s players played the day before or in the week before, and keeps only those totals. This rests on the same legitimate interest (GDPR art. 6(1)(f)).

This site and getplasticout.com are hosted by Hostinger International Ltd (Cyprus), our processor. Its servers log your IP address and browser details with every request, to keep the sites running and secure, for as long as Hostinger needs them for that. Hostinger may use sub-processors outside the EEA, under Standard Contractual Clauses. This rests on our legitimate interest in a secure site (GDPR art. 6(1)(f)).

If you write to us, we use your email address and message to reply, on our legitimate interest in answering you (GDPR art. 6(1)(f)), and keep them only as long as the matter needs.

Ads

Ads pay for the game. They come from Google AdSense. Google and its partners may use cookies to show you ads based on your visits to this and other websites. Google decides how it uses that data, as an independent controller: see how Google uses information from sites that use its services and Google’s privacy policy. Google may process the data in the United States, under the Data Privacy Framework. Showing Google’s ads rests on our legitimate interest in paying for a free game (GDPR art. 6(1)(f)). You can turn off personalised ads in Google’s My Ad Center.

In the EEA, the UK and Switzerland, Google’s consent message asks first. It offers Consent, Do not consent and Manage options, where you can decide purpose by purpose and partner by partner. What you agree to rests on your consent (GDPR art. 6(1)(a)). Google keeps your choice on your device for up to 13 months. To change it, open Cookie choices in the menu. Google’s code also runs on getplasticout.com, so its consent message can appear there too.

If you do not consent, you may still see ads. Google calls them limited ads: they are not personalised, and they may use cookies or similar storage, but only to detect fraud. Your IP address still reaches Google, as it must to deliver an ad. Google also relies on its legitimate interest to choose ads from limited data, measure how ads perform, understand audiences and improve its services. You can object to these under Manage options in the message.

In some US states, Google shows a Do Not Sell or Share My Personal Information link. If you use it, Google stops showing you ads here based on your past behaviour. In states whose law requires it, Google does the same when your browser sends a Global Privacy Control signal.

Elsewhere, for example in Australia, there is no message and ads load straight away. Google may personalise them.

Your rights

You can ask for access, correction, deletion and restriction of your data, and withdraw consent at any time without affecting what happened before. Our server holds only a scrambled form of your browser’s random id, so we can find your play data only if you send us that id. Write to help@getplasticout.com; we answer within one month. For the ads, Google answers for its own data under its privacy policy above.

You can object at any time to what we do on our legitimate interest: the play data on our server and the hosting logs. Write to the same address. We will stop unless we have compelling grounds that override your interests, or need the data for legal claims. To stop ads based on your profile, use Manage options in Google’s message or Google’s My Ad Center.

You can complain to a data protection authority where you live, or to ours: the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz).