This Privacy Policy explains what personal data DRAGO BROS LTD (“Drago2”, “we”, “us”) collects when you create an account, play the Game or use our Websites, why we collect it, who we share it with, and the rights you have over it. Drago2 is a private limited company registered in England and Wales under company number 16604927, with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. We are the data controller for the personal data described here.
The Services are offered in eleven languages to players worldwide. We apply a single standard everywhere: the UK GDPR, the EU General Data Protection Regulation, and, for players in Türkiye, Law No. 6698 on the Protection of Personal Data (KVKK). Where these regimes grant different rights, we apply the one most favourable to you, wherever you live. If you are in a country whose law grants you additional rights, those rights apply on top of what is described here.
1. What data we collect
1.1 Data you give us when you register
To create a Drago2 account we ask for:
| Data | Why we need it | Legal basis |
|---|---|---|
| Account name | Identifies your account and is used to sign in. Displayed to other players only through your in-game characters, never as your account name. | Performance of a contract |
| Full name | Used to verify ownership when you lose access to your account or ask us to recover it, and to distinguish between people making competing claims to the same account. | Performance of a contract; legitimate interests in preventing account theft |
| Email address | Sign-in identity, password reset, security notifications and service announcements. Only the owner of the registered email address may use the account. | Performance of a contract |
| Password | Protects your account. Stored only as a cryptographic hash — we cannot read it, and we will never ask you for it. | Performance of a contract; legal obligation to secure data |
| Phone number | Used solely to verify that you are the account owner when you request account recovery or a security change, and to detect mass registration of accounts by a single person. We do not use it for marketing and we do not send promotional messages to it. | Legitimate interests in preventing fraud and multi-accounting |
| Deletion code | A secret you set at registration which is required to close your account. It prevents someone who has temporarily gained access to your session from destroying your account. | Performance of a contract; legitimate interests in account security |
| “How did you hear about us?” | Optional. Tells us which channels bring players to Drago2 so we can decide where to spend effort. Analysed only in aggregate. | Consent |
1.2 Data created when you play
Playing the Game necessarily creates data associated with your account: your characters and their names, level, class, empire and appearance; your inventory, equipment, costumes and currency; your guild membership; your rank and tournament results; your progress through dungeons and events; your chat messages and private messages; your trades and marketplace listings; your support tickets and any evidence attached to them; and records of penalties applied to your account.
1.3 Data collected automatically
When you connect to the Game or the Websites we record your IP address, connection times, client version, device and operating system information, browser type and language, and technical logs of errors and disconnections. We also record identifiers used to detect automation, third-party software that modifies the Game client, and the use of multiple accounts by one person.
Cookies and similar technologies are described separately in our Cookie Policy.
1.4 Payment data
Where you make a purchase or a donation in connection with the Services, payment is processed by an external payment provider. We do not receive or store your full card number, CVV or bank credentials. We receive only a transaction reference, the amount, the currency, the date, the status of the payment and, where the provider supplies it, the billing country and the last four digits of the payment instrument. We keep this for accounting, refund handling and fraud prevention. The payment provider is an independent controller for the data you submit directly to it, and its own privacy policy applies to that processing.
1.5 Data we do not want
Do not send us special category data — information about health, religion, ethnicity, political opinions, trade union membership, biometrics or sexual orientation — in support tickets, chat or forum posts. We do not ask for it and we have no lawful basis to process it. If you send it to us anyway, we will delete it once the ticket is resolved.
2. Age of players
The Services are not intended for children under 16. By creating an account you confirm that you are 16 or older. If you are between 16 and 18, you should review these documents with a parent or guardian before you register.
If we learn that we hold data about a child under 16, we will delete the account and its associated data without undue delay. If you believe a child under 16 has registered, write to [email protected] and we will investigate.
3. Why we process your data
We process personal data in order to:
- Provide the Services — create and maintain your account, run the Game world, save your progress, deliver items you have acquired, operate the forum and the guide. Legal basis: performance of a contract.
- Keep the Services fair and secure — detect and act on cheating, automation, exploitation of bugs, account theft, real-money trading and multi-accounting; investigate reports made by other players; apply and review penalties. Legal basis: legitimate interests in maintaining a fair and secure game.
- Support you — respond to tickets, recover accounts, investigate lost items and technical faults. Legal basis: performance of a contract.
- Comply with the law — retain accounting records, respond to lawful requests from authorities, and defend legal claims. Legal basis: legal obligation; establishment or defence of legal claims.
- Improve the Services — understand which features are used, where players stop playing, and where errors occur. Legal basis: consent, for analytics cookies.
- Communicate with you — service announcements, maintenance notices and security alerts. Legal basis: performance of a contract. Optional news and event emails are sent only with your consent, which you can withdraw at any time.
4. Who we share data with
We do not sell your personal data, and we do not share it with advertising networks. We share it only as follows:
- Infrastructure providers — Cloudflare (network protection and content delivery for drago2.com and board.drago2.com) and BunnyCDN (content delivery for guide.drago2.com). These process connection data on our behalf.
- Analytics — Google Analytics, as described in our Cookie Policy, and only where you have consented.
- Payment providers — where you make a purchase, to take the payment and handle refunds and chargebacks.
- Other players — only your character names, guild, ranking position, public chat and forum posts are visible to other players. Your real name, email address, phone number and IP address are never shown to other players.
- Authorities and legal advisers — where we are legally required to disclose data, or where disclosure is necessary to establish, exercise or defend legal claims.
- A successor — if the Services are transferred to another operator, your data may transfer with them, subject to this Privacy Policy remaining in force until you are notified otherwise.
5. International transfers
We are established in the United Kingdom and our players are located worldwide. Some of our processors operate outside the UK, the EEA and Türkiye. Where personal data is transferred outside those areas, we rely on an adequacy decision where one exists, and otherwise on Standard Contractual Clauses or the UK International Data Transfer Addendum, together with technical measures such as encryption in transit. You may request a copy of the safeguards in place by writing to us.
6. How long we keep data
| Data | Retention period |
|---|---|
| Account and character data | While your account is open. Deleted within 30 days of you closing it, except where a longer period is required below. |
| Inactive accounts | We do not delete accounts for inactivity. Your account and its characters remain available for as long as the Services operate, however long you are away. You can close your account yourself at any time. |
| Chat and private messages | 12 months, so that reports of harassment or scam attempts can be investigated. |
| Connection and security logs | 12 months. |
| Penalty records | For the duration of the penalty, plus 24 months, so repeat offences can be identified and appeals reviewed. |
| Permanent bans | An irreversible identifier is retained indefinitely so that a permanently banned person cannot simply re-register. Associated account content is deleted. |
| Support tickets | 24 months from closure. |
| Payment and accounting records | 7 years, as required by UK company and tax law. |
| Analytics data | 14 months. |
7. Your rights
You have the right to:
- Access the personal data we hold about you, and receive a copy of it, within the scope described below;
- Rectify registration data that is factually inaccurate or incomplete, subject to the limits below;
- Erase your data, where we no longer have a lawful reason to keep it, subject to the limits below;
- Restrict processing while a dispute about accuracy or lawfulness is resolved;
- Object to processing carried out on the basis of our legitimate interests, including profiling used for cheat detection;
- Portability — receive the data you provided to us — your registration details — in a structured, machine-readable format. This right covers data you supplied, not data the Game generated about your play;
- Withdraw consent at any time, where processing is based on consent. Withdrawal does not affect processing carried out before you withdrew;
- Not be subject to a solely automated decision that produces legal or similarly significant effects, without human review.
Under KVKK you additionally have the right to learn whether your data is processed, to request notification of corrections to third parties, and to claim compensation for damage caused by unlawful processing.
7.1 What an access request covers
If you ask for a copy of your data, we provide the information that identifies you and that we hold about you as a person: your registration details (account name, full name, email address, phone number), your account status and any penalties applied to it, your support correspondence with us, your payment records, and the character names associated with your account.
An access request is not a request for a copy of the game database. The Game generates a very large volume of technical and operational records — every item transaction, combat log, position update, drop roll and server event. This material is not held in a form that can be assembled per player, is not personal data in any meaningful sense, and reproducing it would require disproportionate effort. Data protection law does not require us to provide it, and we do not. Article 12(5) of the GDPR and the equivalent provisions of the UK GDPR and KVKK allow us to refuse or charge for requests that are manifestly unfounded or excessive, in particular where they are repetitive.
If you need a specific fact from your game history — whether an item was traded on a particular date, or why a penalty was applied — ask us for that specific fact and we will look it up. Targeted questions we can answer; open-ended extraction requests we cannot.
7.2 Limits on rectification and erasure
Rectification applies to factual errors in the identifying data you gave us — a misspelled name, an out-of-date email address or phone number. It is not a route to change your game state. Character names, levels, items, currency, guild history, ranking positions and penalty records are the outcome of play and of our decisions; they are not inaccurate personal data, and we correct them only where we establish that a fault in the Services produced a wrong result.
Erasure is not absolute, and the law says so. We will close your account and delete your identifying data on request, but we will continue to hold data where we are permitted or required to:
- where processing is necessary to perform our contract with you, for as long as your account is open;
- where we have a legal obligation to keep records — payment and accounting data for seven years;
- where the data is needed to establish, exercise or defend legal claims, including records of penalties and the evidence supporting them;
- where erasure would compromise the integrity of the Game for other players — trades, guild history, tournament results and marketplace transactions involve other people’s accounts, and removing one side of a shared record would corrupt the other side. Data of this kind is disassociated from your identity rather than destroyed; and
- where an identifier must be kept to enforce a permanent ban, as described in the retention table above.
These limits come from Article 17(3) of the GDPR, the equivalent provisions of the UK GDPR, and Article 7 of the KVKK together with Article 28. They are not a discretion we have granted ourselves. Where we refuse a request in whole or in part, we will tell you which ground we rely on and inform you of your right to complain to a supervisory authority.
7.3 How to make a request
Write to [email protected] from the email address registered to your account, or open a ticket through the support system on drago2.com while signed in, stating which right you wish to exercise. We respond within 30 days. If your request is complex we may extend this by a further two months and will tell you why. We do not charge a fee unless a request is manifestly unfounded or excessive.
We may ask you to confirm your identity before we act, so that we do not disclose your data to someone impersonating you.
8. Automated decisions and anti-cheat
We use automated systems to detect automation software, unauthorised client modification, exploitation of bugs and real-money trading. These systems can automatically suspend an account.
A permanent ban is never applied by automation alone. Where an automated system flags an account, a member of the team reviews the evidence before a permanent penalty is imposed. You may contest any penalty by writing to [email protected], you are entitled to a human review, and you may state your case before the decision is finalised.
9. How we protect your data
Passwords are stored as salted cryptographic hashes and are never recoverable in plain text. Connections to our Websites are encrypted in transit using TLS. Access to player data is limited to team members who need it for their role, and administrative access is logged. Our network is protected against denial of service and automated attack by Cloudflare.
No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office within 72 hours of becoming aware of it, and we will notify you directly without undue delay where the risk to you is high.
10. Your responsibilities
Keep your account credentials confidential and do not share, sell or transfer your account — account sharing is prohibited by our Terms of Service and makes it impossible for us to protect your data. Use a password you do not use elsewhere. If you believe your account has been accessed by someone else, tell us immediately.
11. Changes to this Privacy Policy
We may update this Privacy Policy. The effective date at the top of this page always shows the current version. Where a change materially affects your rights or how we use your data, we will notify you through the Services or by email before it takes effect.
12. Contact and complaints
For any privacy question, or to exercise your rights, contact [email protected] or write to DRAGO BROS LTD, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.
If you are dissatisfied with our response you may complain to a supervisory authority:
- United Kingdom — Information Commissioner’s Office, ico.org.uk
- European Economic Area — the data protection authority of the country where you live or work
- Türkiye — Kişisel Verileri Koruma Kurumu, kvkk.gov.tr