1. About this Policy

This Privacy Policy explains how [OPERATOR NAME - AUSTRALIA] (ABN [ABN]) and [OPERATOR NAME - KOREA] (Korean business registration number [KOREAN BUSINESS REGISTRATION NUMBER]) ("we", "us") handle personal information in Dragon Raja One, its website and its game servers (the "Service").

We handle personal information in line with the Australian Privacy Act 1988 and the Australian Privacy Principles, and the Korean Personal Information Protection Act, and other privacy laws that apply to us.

2. Personal information we collect and why

1. Account: account ID, email address, password (stored only as a PBKDF2 hash, never in readable form), registration date. Purpose: to create and manage your account, identify you, recover your account and find your account ID, and send service notices.
2. Game data: characters and their data, items, chat logs and play logs on the game servers. Purpose: to provide the game, keep it fair and secure, investigate cheating, abuse and reports, and restore data after errors.
3. Purchases: order records (amount, coin package, date, payment provider reference number, refund status) and the IP address used to order. Purpose: to deliver coins, handle refunds and disputes, prevent fraud, and keep records required by law. We do not receive or store card numbers: card and PayPal details are handled by Stripe and PayPal.
4. Website activity: IP addresses of logins, orders and posts. Purpose: security, fraud prevention, and handling abuse.
5. Screenshots and posts: screenshots you upload and what you post on the boards. Uploaded images are re-encoded and camera and location metadata are removed. Purpose: to display them on the screenshot board.
6. Contact messages: your name or account ID, email address and the content of messages you send through the contact form. Purpose: to answer you and handle complaints.
7. Cookies: a session cookie. See section 9.

We collect this information directly from you or automatically when you use the Service. We do not collect sensitive information (such as health or political information) and we ask you not to send it to us. Because the Service needs an account, it is not practicable to use it anonymously, but you may use a nickname as your account ID and character names.

3. Legal basis and consent

We process personal information when it is necessary to provide the Service you signed up for (performing our contract with you), when the law requires us to (for example, keeping payment records), to protect the security of the Service and its users, and, where the law requires consent, with your consent, which we ask for when you register. You may withdraw consent at any time, but we may then be unable to provide some or all of the Service.

We do not use your personal information for advertising, we do not sell it, and we do not use it for any purpose other than those above unless you agree or the law allows it.

4. How long we keep it

• Account information: while your account exists, and for 30 days after it is closed (to handle mistakes, disputes and security issues), then deleted.
• Order and payment records, including records of refunds and withdrawals: 5 years, as required by the Korean Act on Consumer Protection in Electronic Commerce.
• Login, order and post IP logs, and game chat and play logs: 1 year.
• Contact-form messages and complaint records: 3 years.
• Screenshots and posts: until you or we delete them. When a screenshot is deleted, its image files are deleted too.

When a retention period ends, we delete the information in a way that cannot be restored, unless another law requires us to keep it longer, in which case we keep it separately and only for that purpose.

5. Who we share it with

We do not give your personal information to others except as described below, or where the law requires it (for example, a lawful request from a court or authority), or to protect someone's life or safety.

• Payment providers (independent recipients): Stripe (including Stripe Managed Payments, where Stripe acts as the reseller of card sales and handles sales tax) and PayPal receive order details, your email address and the information you enter at checkout, to process payments, refunds and disputes and to prevent fraud. They handle that information under their own privacy policies.
• Service providers who process information for us: a hosting provider (stores the website, database and game servers) and an email delivery provider (sends account recovery and notice emails). They may only use the information to provide their service to us.

6. Transfers outside your country

Your personal information may be transferred to, stored in and accessed from countries other than the one where you live, including Australia and Korea, where we operate.

• Stripe: United States and other countries. Items: order details, email address, checkout and payment information. When: when you make a payment or a refund is processed, over an encrypted connection. Kept: under Stripe's policy and the law.
• PayPal: United States and other countries. Items, timing and retention as for Stripe.
• Hosting provider: United States and other countries. Items: all information described in section 2. When: continuously while you use the Service. Kept: for the periods in section 4.
• Email delivery provider: United States and other countries. Items: email address, account ID and the content of the email. When: when an email is sent. Kept: for the period needed to send it and under the provider's policy.

We will update this list with the names and countries of our hosting and email providers when they are chosen. We take reasonable steps, such as contractual terms, so that recipients protect your information. If you do not want your information transferred abroad, you can refuse by not creating an account or by closing it, but you will not be able to use the Service, because these transfers are necessary to provide it.

7. Your rights

You may ask us to:

• give you access to your personal information;
• correct information that is wrong or out of date;
• delete your information or close your account;
• stop (suspend) processing your information, or withdraw your consent.

You can make a request through the contact form or by email to [CONTACT EMAIL]. A legal guardian or a person you authorise may also make a request for you. We may need to confirm your identity. We will respond within a reasonable time and, at the latest, within the period the law requires. If we refuse a request, for example because the law requires us to keep the information, we will tell you why.

8. How we protect it

• Passwords are stored only as salted PBKDF2 hashes.
• The website uses encrypted connections (HTTPS).
• Access to personal information is limited to staff who need it, protected by passwords, and logged.
• We do not store card numbers.
• Uploaded images are re-encoded and their camera and location metadata are removed.

No system is completely secure. If a data breach is likely to cause serious harm, we will notify you and the relevant regulators as the law requires.

9. Cookies

We use only a session cookie, which keeps you logged in and protects forms against misuse. It is deleted when you log out or close your browser. We do not use advertising, tracking or analytics cookies. If you block cookies, you will not be able to log in.

10. Children

Minors may use the Service only with the consent of a parent or legal guardian. Where the Korean Personal Information Protection Act requires it, we obtain the consent of a legal guardian before processing the personal information of a child under 14. If we learn that we hold a child's information without required consent, we will delete it. A parent or guardian may contact us to exercise the child's rights.

11. Privacy officer and complaints

• Privacy officer: [PRIVACY OFFICER NAME]
• Email: [CONTACT EMAIL]
• Address: [BUSINESS ADDRESS]

If you have a question or complaint, please contact our privacy officer first. We will respond within 30 days. If you are not satisfied with our response, you can complain to:

• Australia: the Office of the Australian Information Commissioner (OAIC), www.oaic.gov.au
• Korea: the Personal Information Protection Commission (PIPC); the Personal Information Infringement Report Center run by the Korea Internet & Security Agency (KISA), privacy.kisa.or.kr, phone 118; or the Personal Information Dispute Mediation Committee, www.kopico.go.kr

12. Changes to this Policy

We may update this Policy. We will post the new version on the website with its effective date, at least 7 days in advance, and we will ask for your consent again where the law requires it.

Draft notice: This is a draft prepared for review by a lawyer. It is not final and should not be relied on until it has been reviewed.