1. INTRODUCTION
This Privacy Policy describes how the lvlbox project collects, uses, stores, protects and shares your personal data on https://lvlbox.eu/ and related resources, including the digital advent calendar "Santa's Workshop" at https://lvlbox-advent.pages.dev/ ("we", "our", "the project").

This Policy follows the EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) and EU law on privacy and electronic communications.

Data Controller: Mariia Zhukova.
Email: gameboxlvl@gmail.com
Country of business: Spain.

2. WHAT DATA WE COLLECT
We may collect the following personal data:
2.1. Data you provide yourself:
- first name, last name;
- email;
- phone number;
- address (where relevant for an order or payment);
- a child's details (name, age) for enrolment in lessons.
2.2. Technical data:
- IP address;
- cookies, device identifiers;
- browser and operating system details;
- time of visit and pages viewed.
2.3. Payment data:
Information needed to process payments through Stripe. We do not receive or store bank card details; Stripe does this.
2.4. Digital product purchase data (advent calendar):
- from Stripe we receive the buyer's name and email, the amount, payment date and any promotion code used;
- the purchase code and personal access link;
- for each device where the calendar is opened (no more than 3): a random device identifier, connection date and browser and operating system type. This data is needed to apply the device limit and to protect the purchase from being passed on to others.
2.5. Data stored only on your device:
The player's name, chosen elf, language, level and progress in the calendar are saved in the browser's memory (localStorage) on your device and are not sent to us. You can delete them with the "Start again" button in the game profile or by clearing your browser data.

3. WHY WE COLLECT YOUR DATA
We use data for the following purposes:
3.1. Running the website and personal account.
So that you can register, log in and use the website.
3.2. Communicating with you.
To answer requests, inform you about schedule changes and send confirmations.
3.3. Processing payments.
To make secure payments through Stripe.
3.4. Providing access to digital products.
To open the calendar you paid for, connect it on your devices, help restore access and give refunds when needed.
3.5. Improving the website.
Analysing visitor behaviour to improve the service.
3.6. Meeting legal obligations.
Including accounting and tax records.

4. LEGAL BASES FOR PROCESSING (GDPR)
We process Users' personal data only where there is a legal basis under Article 6 of Regulation (EU) 2016/679 (GDPR), in particular:
- registration on the website and use of the personal account: processing is necessary for the performance of a contract to which the User is a party;
- enrolment in lessons, provision of services and interaction within the lvlbox project: processing is necessary for the performance of a contract;
- purchase of digital products, purchase codes and device records: processing is necessary for the performance of a contract;
- processing of payment data: processing is necessary for the performance of a contract and financial obligations (payment data is processed by the payment provider Stripe);
- keeping payment records for accounting and tax purposes: compliance with a legal obligation;
- sending notifications, organisational messages and replies to User requests: processing is necessary for the performance of a contract;
- sending newsletters and other emails (where applicable): processing is based on the User's consent, which can be withdrawn at any time;
- use of analytics cookies and similar technologies: processing is based on the User's consent.

4a. CHILDREN'S DATA
A child's data (name, age, work, results of participation) is processed on the basis of a contract with the parent or legal guardian, who confirms their consent to the child's participation.
Children's work is published on the website under a nickname. Photos, videos and the child's real name are published only with the parent's separate consent, which is given voluntarily and can be withdrawn at any time by writing to gameboxlvl@gmail.com. After consent is withdrawn, the materials are removed from the website within a reasonable time.
The advent calendar does not collect any data about the child: the player's name and progress stay on the device (clause 2.5).

5. COOKIES AND SIMILAR TECHNOLOGIES
The lvlbox website uses cookies and similar technologies to make the website work properly, make it easier to use and analyse traffic.
We use the following categories of cookies:
- strictly necessary cookies: provide basic website functions, including navigation and access to protected areas. These cookies do not require the User's consent;
- functional cookies: remember the User's settings and improve the user experience;
- analytics cookies: used to analyse traffic and User behaviour on the website to improve the service. These cookies are used only with the User's consent.
On the first visit, the User sees a cookie consent banner that lets them:
- accept all cookies;
- reject non-essential cookies;
- set cookie preferences.
The User can change or withdraw cookie consent at any time:
- in their browser settings;
- with the cookie management tools on the website (where available).
The calendar website https://lvlbox-advent.pages.dev/ uses only strictly necessary cookies (access by purchase code and device identifier) and the browser's memory (localStorage) to save game progress. It has no analytics or advertising cookies.

6. SHARING DATA WITH THIRD PARTIES
We may share Users' personal data with third parties only where this is necessary to perform a contract or meet legal obligations, including with:
- the payment provider Stripe (Stripe Payments Europe, Ltd., Ireland);
- hosting and technical support providers: Tilda (lvlbox.eu website), Cloudflare, Inc. (calendar website and storage of purchase codes);
- the email provider Google (Gmail) when you write to us;
- public authorities: when legally required;
- video call services used for lessons;
- online platforms used in lessons.
We share personal data with third parties only where there is a proper legal basis and appropriate technical and organisational safeguards are in place.

7. TRANSFERS OUTSIDE THE EU / EEA
Some providers (for example, Cloudflare and Google) may process data outside the European Economic Area (EEA). Such transfers take place only with the safeguards provided for by the GDPR, including the European Commission's adequacy decision (EU-U.S. Data Privacy Framework) and Standard Contractual Clauses.

8. HOW WE PROTECT YOUR DATA
We use technical and organisational measures to protect data against:
- unauthorised access;
- destruction or loss;
- alteration.
This includes secure connections (HTTPS), encryption, security updates and access control.

9. HOW LONG WE KEEP DATA
We keep Users' personal data no longer than necessary for the purposes of processing, namely:
- account and registration data: while the website is used and up to 3 years after the last interaction with the User;
- contact data (email, messages, requests): up to 3 years after the last contact;
- data related to paid services, purchases and payments: up to 5 years, as required by accounting and tax law;
- data about devices connected to the calendar (clause 2.4): for the period of access to the calendar, then deleted;
- data processed on the basis of consent: until the User withdraws consent;
- cookie data: for the periods set for each type of cookie.
After these periods, personal data is deleted or anonymised.

10. YOUR RIGHTS
Under the GDPR, you have the right to:
- request access to your data;
- correct or update your data;
- restrict processing;
- request deletion of your data;
- receive a copy of your data (data portability);
- withdraw your consent;
- lodge a complaint with a data protection authority. In Spain this is the Agencia Española de Protección de Datos (AEPD), https://www.aepd.es.
To exercise your rights, contact us at: gameboxlvl@gmail.com.

11. CONSENT
Data processing for providing services and digital products is based on a contract (section 4). Where processing is based on consent (analytics cookies, newsletters, publication of a child's work), consent is given by a separate action and can be withdrawn at any time.

12. CHANGES TO THIS PRIVACY POLICY
We may update this Policy.
The date of the last update is always shown at the top of the document.
We will notify you of significant changes through the website or by email.
The Policy is also published in English and Spanish. In the event of any discrepancy between the translations, the Russian version prevails.

13. CONTACT
If you have questions about data processing or wish to exercise your rights, contact us:
email: gameboxlvl@gmail.com
Country of business: Spain