Privacy notice
Version: 2026-10-21
This installation has not completed its privacy disclosures. The administrator must complete the Privacy and GDPR section in Setup before production use.
Controller and contact
The controller is University of Naples Parthenope. Privacy contact: prg32@uniparthenope.it.
Data, purposes, and lawful bases
| Data | Purpose | Typical lawful basis | Retention |
|---|---|---|---|
| The controller has not configured processing records. This deployment is not ready for production. | |||
Recipients, transfers, and sources
Recipient categories have not been configured.
No international transfers are configured by the Cartridge Store itself.
Most data comes directly from you or your PRG32 client. Identity data can also come from a configured LDAP, OpenID Connect, SAML, or linked Construction Kit service.
Account email and authentication data are required to provide an account; without them an account cannot be created.
Cookies, logs and multiplayer
The Store sets one strictly necessary session cookie when you sign in or submit a form. It uses no analytics, advertising or tracking cookies, so it asks for no cookie consent.
To keep the service secure, the Store records sign-ins, failed sign-ins, administrative changes and server errors in an event log that only administrators can read. Entries name the public handle of the account involved, never an email address or the name typed at a failed sign-in, and are deleted after 90 days. Downloads record the cartridge, a keyed pseudonym of the network address and a coarse client type (console, browser or tool), and are deleted after 90 days.
Multiplayer rooms exist only in memory while a game runs. A console's device identifier is replaced by a keyed pseudonym before it is used; the original value and the game snapshots are not stored.
Your rights
Subject to the conditions and exceptions in applicable law, you may request access, rectification, erasure, restriction, portability, or object to processing. The service does not make decisions producing legal or similarly significant effects solely by automated means. Signed-in users can download a machine-readable copy or erase their account from the Privacy page. Contact the controller for other requests; it must normally respond within one month and may verify identity.
Security and changes
The Store uses role-based access, hashed passwords and access tokens, signed HttpOnly SameSite cookies, retention deletion, data export, and account erasure controls. The operator remains responsible for HTTPS, access reviews, encrypted backups, incident response, processor agreements, records of processing, and any required impact assessment. Material notice changes use a new version date.