Privacy Policy

I. Basic provisions

This privacy policy explains how the controller processes the personal data of site visitors, customers, and anyone who contacts the controller through this site or by email.

The data controller is:

Kryštof Brož
Company ID (IČ): 21076031
Registered address: Lhotka 189, 739 47 Lhotka, Czech Republic
Email: hello@upsidedownmuseum.com

The controller has not appointed a data protection officer.

The controller processes personal data in accordance with Regulation (EU) 2016/679 (GDPR) and related legislation.

II. What personal data we process

• Identification and contact data — name and email address given in the order.
• Order data — the product purchased, price, purchase date and payment status. Card details are handled by Polar and never reach us.
• Communication data — the content of emails and support requests.
• Technical data — IP address, browser and device type, time of visit, and cookies where used.

III. Purposes and legal bases

1. Fulfilling the order and delivering the files — performance of a contract (Art. 6(1)(b) GDPR).

2. Accounting and legal obligations — compliance with a legal obligation (Art. 6(1)(c)).

3. Customer support and complaints — performance of a contract or legitimate interest (Art. 6(1)(f)).

4. Protection of legal claims — legitimate interest (Art. 6(1)(f)).

5. Marketing emails — we may send existing customers occasional news about similar products on the basis of legitimate interest, unless they object. Every such email contains a one-click unsubscribe. Anyone else receives marketing emails only with their consent.

6. Analytics and advertising — only if the visitor consents to analytics or marketing cookies (Art. 6(1)(a)). See our Cookie Policy.

IV. Children

Our games are played by children, but this website and our products are sold to and directed at adults — parents and other grown-ups. We do not knowingly collect personal data from children, and no personal data about children is needed to buy or play the game. If you believe a child has provided us with personal data, please contact us and we will delete it.

V. How long we keep personal data

• Order data — for the duration of the contract and then as needed to protect legal claims, as a rule no longer than 10 years.
• Accounting records — for the period required by law.
• Marketing data — until you unsubscribe or object.
• Support communication — as long as needed to handle the matter, and a reasonable period afterwards.
• Cookies — for the periods stated in the Cookie Policy.

VI. Recipients and processors

• Polar (polar.sh), our Merchant of Record. Polar runs the checkout, processes the payment, handles tax and delivers the download files through its customer portal. We never collect or store full card numbers.
• Cloudflare, the hosting and security provider of this website.
• Accounting and tax service providers.
• Email, analytics and advertising providers, where used and where required with your consent.

VII. Transfers outside the European Union

Some of the providers above may process data outside the EU/EEA. Where that happens, the controller ensures the transfer complies with the GDPR, for example on the basis of standard contractual clauses.

VIII. Your rights

Subject to the conditions in the GDPR, you have the right to:

• access your personal data,
• rectification of inaccurate data,
• erasure,
• restriction of processing,
• object to processing,
• data portability,
• withdraw consent at any time, where processing is based on consent,
• lodge a complaint with a supervisory authority.

You can exercise your rights by emailing hello@upsidedownmuseum.com. Requests are answered as a rule within 30 days.

The competent supervisory authority is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic — uoou.gov.cz. If you live in another EU or EEA country, you may also complain to the authority in your country.

IX. Additional rights for US residents (including California)

We do not sell your personal information and do not share it for cross-context behavioral advertising without your consent. We share it only with the service providers needed to deliver what you bought. You can request access to, or deletion of, the personal information we hold about you at hello@upsidedownmuseum.com.

X. Security

The controller applies appropriate technical and organisational measures to protect personal data, in particular by restricting access and selecting trustworthy providers.

XI. Automated decision-making

The controller does not carry out automated decision-making or profiling with legal or similar effects.

XII. Changes to this policy

This policy may be updated. The current version is always available on this site.

This policy is effective from 24 September 2026.