This is a translation, provided so that you can read this privacy policy in your own language. The Dutch text is the authoritative one: where a translation and the Dutch differ, the Dutch applies. Read the Dutch text.

About this privacy policy

Hidden Sector Online cares a great deal about your privacy. We therefore process only the data we need for (improving) our services, and we handle the information we have collected about you and your use of our services with care. We never make your data available to third parties for commercial purposes.

This privacy policy applies to the use of the website and the services made available through it by Hidden Sector Online. The effective date of these terms is 28/05/2026; with the publication of a new version, all previous versions cease to be valid. This privacy policy describes what data about you is collected by us, what that data is used for, and with whom and under what conditions that data may be shared with third parties. We also explain to you how we store your data, how we protect your data against misuse, and what rights you have in respect of the personal data you have provided to us.

If you have questions about our privacy policy, you can contact our contact person for privacy matters; you will find the contact details at the end of our privacy policy.

About the processing of your data

Below you can read how we process your data, where we store it or have it stored, what security techniques we use, and to whom the data is visible.

Webshop software - WooCommerce

Our webshop was developed with software from WooCommerce. Personal data that you make available to us for the purposes of our services is shared with this party. WooCommerce has access to your data in order to provide us with (technical) support; they will never use your data for any other purpose. On the basis of the agreement we have concluded with them, WooCommerce is obliged to take appropriate security measures. These security measures consist of the application of SSL encryption and a strong password policy. WooCommerce uses cookies to collect technical information regarding your use of the software; no personal data is collected and/or stored. WooCommerce reserves the right to share collected data within its own group in order to improve its services further.

WooCommerce hosting - Cloud86

Our webshop was developed with software from WooCommerce; for our web hosting we have chosen Cloud86. Personal data that you make available to us for the purposes of our services is shared with this party. Cloud86 has access to your data in order to provide us with (technical) support; they will never use your data for any other purpose. On the basis of the agreement we have concluded with them, Cloud86 is obliged to take appropriate security measures. These security measures consist of the application of SSL encryption and a strong password policy. Back-ups are made regularly to prevent loss of data.

Web hosting - Cloud86

We purchase web hosting and email services from Cloud86. Cloud86 processes personal data on our behalf and does not use your data for its own purposes. This party may, however, collect metadata about the use of the services. This is not personal data. Cloud86 has taken appropriate technical and organisational measures to prevent loss and unauthorised use of your personal data. Cloud86 is bound to confidentiality on the basis of the agreement.

Email and mailing lists - Cloud86

For our regular business email traffic we use the services of Cloud86. This party has taken appropriate technical and organisational measures to prevent misuse, loss and corruption of your and our data as far as possible. Cloud86 has no access to our mailbox and we treat all our email traffic confidentially.

Payment processors - Stripe

For handling (part of) the payments in our webshop we use the platform of Stripe. Stripe processes your name, address and place of residence and your payment details such as your bank account or credit card number. Stripe has taken appropriate technical and organisational measures to protect your personal data. Stripe reserves the right to use your data to improve its services further and, in that context, to share (anonymised) data with third parties. In the event of an application for a deferred payment (credit facility), Stripe shares personal data and information regarding your financial position with credit rating agencies. All of the safeguards mentioned above regarding the protection of your personal data apply equally to those parts of Stripe’s services for which they engage third parties. Stripe does not retain your data for longer than is permitted under the statutory periods.

Reviews - Trustpilot

We collect reviews through the platform of Trustpilot. If you leave a review through Trustpilot you are required to give your name and email address. Trustpilot shares this data with us so that we can link the review to your order. In some cases Trustpilot may contact you to ask you to explain your review. In the event that we invite you to leave a review, we share your name and email address with Trustpilot. They use this data solely for the purpose of inviting you to leave a review. Trustpilot has taken appropriate technical and organisational measures to protect your personal data. Trustpilot reserves the right to engage third parties for the purpose of providing its services; we have given Trustpilot permission for this. All of the safeguards mentioned above regarding the protection of your personal data apply equally to those parts of the services for which Trustpilot engages third parties.

Shipping and logistics - PostNL

If you place an order with us, it is our task to have your parcel delivered to you. We use the services of PostNL to carry out the deliveries. It is therefore necessary that we share your name, address and place of residence with PostNL. PostNL uses this data only for the purpose of performing the contract. In the event that PostNL engages subcontractors, PostNL also makes your data available to those parties.

Shipping and logistics - DHL

If you place an order with us, it is our task to have your parcel delivered to you. We use the services of DHL to carry out the deliveries. It is therefore necessary that we share your name, address and place of residence with DHL. DHL uses this data only for the purpose of performing the contract. In the event that DHL engages subcontractors, DHL also makes your data available to those parties.

Shipping and logistics - GLS

If you place an order with us, it is our task to have your parcel delivered to you. We use the services of GLS to carry out the deliveries. It is therefore necessary that we share your name, address and place of residence with GLS. GLS uses this data only for the purpose of performing the contract. In the event that GLS engages subcontractors, GLS also makes your data available to those parties.

Invoicing and bookkeeping - MoneyBird

For keeping our records and accounts we use the services of MoneyBird. We share your name, address and place of residence and details regarding your order. This data is used for administering sales invoices. Your personal data is transmitted and stored securely; MoneyBird has taken the necessary technical and organisational measures to protect your data against loss and unauthorised use. MoneyBird is bound to confidentiality and will treat your data confidentially. MoneyBird does not use your personal data for purposes other than those described above.

External sales channels

None.

Purpose of the data processing

General purpose of the processing

We use your data solely for the purposes of our services. That means that the purpose of the processing is always directly connected to the instruction you give. We do not use your data for (targeted) marketing. If you share data with us and we use that data to contact you at a later moment - other than at your request - we will ask you for explicit permission to do so.

Your data is not shared with third parties, other than to comply with accounting and other administrative obligations. These third parties are all bound to confidentiality on the basis of the agreement between them and us, or an oath or statutory obligation.

Automatically collected data

Data that is automatically collected by our website is processed for the purpose of improving our services further. We treat this data (for example your IP address, web browser and operating system) as personal data, because an IP address can be traced back to a person.

Cooperation with tax and criminal investigations

In certain cases Hidden Sector Online may be required, on the basis of a statutory obligation, to share your data in connection with a tax or criminal investigation by the authorities. In such a case we are compelled to share your data, but we will resist this within the possibilities the law offers us.

Retention periods

We keep your data for as long as you are a client of ours. This means that we keep your customer profile until you indicate that you no longer wish to use our services. If you tell us this, we will also treat it as a request to be forgotten. It also means that we do not keep your data for longer than two years from the last point of contact or transaction, unless there is a statutory ground justifying it.

On the basis of applicable administrative obligations we are required to keep invoices bearing your (personal) data, so we will keep this data for as long as the applicable period runs. Staff, however, no longer have access to your client profile or to documents we produced in response to your instruction.

What allows us to do this

Every purpose above rests on one of the grounds the GDPR allows. Which one it is, per purpose:

Your account, your commanders and your game state: performance of the contract. Without them there is no game to provide, and providing it is what you asked us for.
Messages, alliance chat and forum posts: performance of the contract, because delivering them to the person they were sent to is the feature itself.
Orders, payments and invoices: performance of the contract for the purchase, and a legal obligation for the invoice, which tax law requires us to keep.
Moderation, the one-account rule and keeping the service standing: our legitimate interest in a game that is playable and fair. We weighed that against your privacy, which is why what we keep for it is a salted fingerprint rather than an address.
The newsletter and any message you asked us to send: your consent, which you may withdraw at any moment without giving a reason and without it costing you anything.

Withdrawing your consent

Where we rely on your consent, you can take it back whenever you like - from your profile for anything the game switches on and off, or by writing to the address at the end of this policy. Withdrawing it does not undo what was lawfully done before you did, and it never affects the parts of the service that rest on the contract rather than on consent.

Data that leaves Europe

Our hosting and our email are in the Netherlands. Some of the parties named above are established in the United States, and where that is so your data is transferred there: Stripe for payments, Trustpilot for reviews, and the WooCommerce and WordPress software our shop is built on. Those transfers take place on the basis of the European Commission’s adequacy decision for the EU-US Data Privacy Framework where the party is certified under it, and on the basis of the Commission’s standard contractual clauses where it is not. You can ask us at the address at the end of this policy for a copy of the safeguard that applies to a given party.

Your rights

Under the applicable Dutch and European legislation you, as a data subject, have certain rights in respect of the personal data processed by us or on our behalf. Below we explain what these rights are and how you can invoke them.

In principle, to prevent misuse, we send transcripts and copies of your data only to the email address already known to us. In the event that you wish to receive the data at a different email address or, for example, by post, we will ask you to identify yourself. We keep a record of requests handled; in the case of a request to be forgotten we record anonymised data. You receive all transcripts and copies of data in the machine-readable data format we use within our systems.

You have the right at all times to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) if you suspect that we are using your personal data in the wrong way.

Right of access

You always have the right to inspect the data that we process, or have processed, which relates to you or is traceable to you. You can make a request to that effect to our contact person for privacy matters. You will then receive a response to your request within 30 days. If your request is granted, we will send you, at the email address known to us, a copy of all data together with an overview of the processors that hold this data, stating the category under which we have stored this data.

Right to rectification

You always have the right to have the data that we process, or have processed, which relates to you or is traceable to you, corrected. You can make a request to that effect to our contact person for privacy matters. You will then receive a response to your request within 30 days. If your request is granted, we will send you, at the email address known to us, a confirmation that the data has been corrected.

Right to restriction of processing

You always have the right to restrict the data that we process, or have processed, which relates to you or is traceable to you. You can make a request to that effect to our contact person for privacy matters. You will then receive a response to your request within 30 days. If your request is granted, we will send you, at the email address known to us, a confirmation that the data will no longer be processed until you lift the restriction.

Right to erasure

You always have the right to have the data that we process, or have processed, which relates to you or is traceable to you, erased. You can make a request to that effect to our contact person for privacy matters, and for your game data you do not have to ask us at all: your profile will delete the account itself. You will receive a response to a written request within 30 days. What we cannot erase is an invoice, which tax law requires us to keep for as long as the statutory period runs; everything else goes.

Right to data portability

You always have the right to have the data that we process, or have processed, which relates to you or is traceable to you, carried out by another party. You can make a request to that effect to our contact person for privacy matters. You will then receive a response to your request within 30 days. If your request is granted, we will send you, at the email address known to us, transcripts or copies of all data about you that we have processed or that has been processed by other processors or third parties on our instruction. In all likelihood we will not be able to continue our services in such a case, because the secure linking of data files can then no longer be guaranteed.

Right to object, and other rights

In certain cases you have the right to object to the processing of your personal data by, or on the instruction of, Hidden Sector Online. If you object, we will immediately cease the data processing pending the handling of your objection. If your objection is well founded, we will make transcripts and/or copies of data that we process, or have processed, available to you and then cease the processing permanently.

You also have the right not to be subjected to automated individual decision-making or profiling. We do not process your data in such a way that this right applies. If you believe that we do, please contact our contact person for privacy matters.

Cookies

Third-party cookies

In the event that third-party software solutions use cookies, this is stated in this privacy statement.

The game itself

Everything above is the company’s privacy policy. What follows is what the game itself keeps about you, why, and what you can do about it. The game is a self-contained WordPress plugin: there are no advertising networks and no analytics trackers in it.

Your account

To play you need an account. Of that we keep a username and an email address. If you sign in with Google or Apple we receive an email address and an account identifier from them; we do not store your real first and last name and we do not use it anywhere. You choose your own display name, and that name is what other players and the rest of the site are shown.

Your commander and your game state

Your planets, fleets, research, points and further progress are stored, because without that data there is no game to come back to. In each realm you have a commander name of your own; it appears on the leaderboards, on the map and on your profile.

Messages, chat and the forum

Private messages, alliance chat and forum posts are stored so that they can be shown to the person they were sent to, and so that a moderator can judge a report about them. Do not put sensitive personal information in them.

Friends and ignored players

Who you have added as a friend and who you have chosen to ignore is stored, because otherwise the list would be empty again the next time you signed in. A player you ignore is never told about it.

Your invite link

Your invite link counts how often it has been clicked and which sign-ups came from it, so that the reward can be paid out. Of a click we keep no IP address, only a salted fingerprint of one, so that the same visitor cannot be counted twice without us being able to see who they were.

Several accounts

The rules of the game allow one account per person per realm. To be able to enforce that, we keep a salted fingerprint of the IP address and of the browser for each session - never the address itself - and we only put a case in front of a moderator when two accounts keep meeting each other.

Cookies and local storage

The game uses functional cookies only: the cookies WordPress sets to keep you signed in, the cookie that remembers whose invite link brought you in, and the cookies WooCommerce and Stripe set during checkout to handle your payment. The game also keeps a small amount of data in your browser (local storage) to remember that you have seen this notice and to confirm a completed purchase between browser tabs. We do not use tracking or advertising cookies.

Children

You have to be at least 13 to have an account, and under 18 you need a parent’s permission - the terms say so and the sign-up form asks you to confirm it. We do not ask for a date of birth, so we hold no more about a young player than about anybody else: an email address, a chosen name, and a game. A parent or guardian can write to the address at the end of this policy to have a child’s account closed and everything about it erased, and we do that without asking why. An account we find to belong to somebody under 13 is closed and erased.

Taking your data with you, or erasing it

On your profile you can download a copy of your game data and have your account deleted, without having to ask us for either. A deletion erases your commanders, your worlds, your fleets, your messages and your friend and ignore lists. Invoices are kept for as long as tax law requires; those we cannot throw away.

Changes to this privacy policy

We reserve the right at all times to change our privacy policy. On this page, however, you will always find the most recent version. If the new privacy policy has consequences for the way in which we process data about you that has already been collected, we will notify you of this by email.

Contact details

Hidden Sector Online
Utrechtsestraat 78
8312BM Creil
Nederland
Email webmaster@hiddensector.online

Contact person for privacy matters

Darwin Valken

Last updated: September 29, 2026.

What is Hidden Sector Online?