Privacy Policy.

This policy explains what personal data Spacefwd SRL collects, why we collect it, how long we keep it and what you can ask us to do with it. It covers the spacefwd.com website and Playfwd, our in-game advertising service.

1. Who we are

Spacefwd SRL is a company incorporated in Belgium, with its registered office at Avenue des Anciens Combattants 2B5, 5060 Sambreville, Belgium, enterprise number BE 0770.859.196.

For everything described in this policy, Spacefwd SRL acts as an independent Controller. We decide what data is collected, why, and for how long. We are not acting as a processor on behalf of an advertiser or an agency for this data.

For any question about this policy or about your data, write to privacy@spacefwd.com.

2. Playfwd, our in-game advertising service

Playfwd places advertising inside third-party mobile games. The games are built and operated by other companies. When one of those games shows a Playfwd ad, we receive a limited set of data about the device the ad was shown on, so that we can serve the ad, count it once, check it was not fraudulent and report on the campaign.

3. What data we collect

Through Playfwd we collect:

• Mobile advertising identifiers, meaning the Apple Advertising Identifier (IDFA) on iOS and the Google Advertising ID (AdID) on Android. We only collect these where the player has consented, as described in section 5.
• Coarse country, derived from the IP address the ad request arrives on. We use the IP address to work out the country and we do not store the full IP address alongside the advertising identifier for targeting or profiling.
• Basic device metadata, meaning the operating system and version, the device model, the screen size and the device language.

We do not collect, and do not want to receive:

• names,
• email addresses,
• phone numbers,
• precise GPS location.

Advertising identifiers are pseudonymous. On their own they do not tell us who you are. We still treat them as personal data, and this policy applies to them.

4. Why we collect it

We use the data in section 3 for four purposes and nothing else:

• Ad serving. Deciding which ad to return for an ad request and delivering it.
• Frequency capping. Making sure the same device is not shown the same ad more times than the campaign allows.
• Fraud prevention. Detecting invalid traffic, automated traffic and duplicate impressions, so advertisers are not billed for them.
• Aggregated campaign analytics. Producing reporting on how a campaign performed, such as impressions, reach and completion rates.

We do not build advertising profiles about individuals, we do not enrich this data with data from other sources, and we do not use it to make automated decisions that have a legal or similarly significant effect on anyone.

5. Our legal basis

We rely on the player's explicit consent. That consent is captured before we receive anything, inside the game, through either:

• the consent management platform (CMP) that the game publisher operates, on Android and on the web, or
• Apple's App Tracking Transparency (ATT) prompt on iOS.

If a player has not consented, or has withdrawn consent, we do not receive an advertising identifier for that device and we do not log one. Consent can be withdrawn at any time. Section 6 of our Cookie Policy explains how to do that at the device level.

6. How long we keep it

We keep raw pseudonymous identifiers and impression logs for a maximum of 12 months. At the end of that period they are deleted or irreversibly anonymised.

Beyond 12 months we only keep aggregated statistics that cannot be linked back to a device or a person, such as total impressions per campaign per country. Those aggregates are not personal data.

7. Where it is stored and how we protect it

• Personal data is hosted on servers located in the European Union.
• Data is encrypted in transit using TLS.
• Access is role-based. People only get the access their job requires.
• Multi-factor authentication is required on the accounts that can reach production data.
• Access to EU personal data is limited to users based in the European Union.

8. Who we share it with

Advertisers and agencies receive only aggregated, de-identified campaign results. They never receive device-level personal data from us.

We use a small number of service providers who process data on our instructions and under a written data processing agreement. They fall into these categories:

• cloud hosting and storage providers in the European Union,
• ad serving and ad delivery infrastructure providers,
• invalid traffic and fraud detection providers,
• error monitoring and logging providers,
• the game publishers whose apps carry Playfwd inventory, acting as separate controllers for their own purposes.

A current list of the named processors we use is available on request from privacy@spacefwd.com.

We may also disclose data where we are legally required to, for example to a competent authority acting within its powers.

9. Children

Spacefwd does not knowingly process the personal data of children.

We identify child-directed inventory before we serve into it, using the publisher's store age rating, the COPPA flag passed in the ad request and the IAB kid-directed flag. On traffic identified that way:

• advertising identifiers, IP addresses and location are stripped before anything is logged,
• no behavioural targeting is applied,
• no profiles are created or used.

If you believe we have received a child's personal data despite these controls, contact privacy@spacefwd.com and we will delete it.

10. Your rights

You can ask us to:

• give you access to the personal data we hold about your device,
• correct data that is inaccurate,
• erase your data,
• stop processing it, by objecting or by withdrawing your consent.

Send your request to privacy@spacefwd.com. We answer within 30 days. To find your data we normally need the advertising identifier of the device concerned, because that is the only identifier we hold. Your device settings show it, and we will tell you where to look if you ask.

Data portability does not apply here. The right to portability covers data you have provided to a controller in a structured form. Spacefwd holds no user-provided profile and no account data. What we hold is short-lived pseudonymous log data generated by ad requests, which is not a portable dataset.

If you are not satisfied with how we handled your request, you can lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données, Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels, or with the supervisory authority of the country you live in.

11. The spacefwd.com website

The website itself sets no cookies and runs no analytics, no tag manager and no advertising pixels. The details, and the checks behind that statement, are in our Cookie Policy.

If you email us, at hello@spacefwd.com or any other Spacefwd address, we process the content of your message to answer you and we keep it no longer than we need to for that purpose and for our records.

12. Changes to this policy

When this policy changes we update the "last updated" date at the top of this page. If a change materially affects what we collect or why, we will say so here rather than change it quietly.