Privacy Policy

Privacy Policy

• Introduction

This Privacy Policy describes how TIBI GAMES S.L.U. (“we”, “our”, “us”) collects and uses certain information (Personal Data) when you use our mobile game Rainbow Rush, available on iOS and Android platforms. When you download, access and/or play our Game, you acknowledge the collection and use of your information in accordance with this Privacy Policy. 

In particular, this Privacy Policy details the steps we take to protect your Personal Data as a User of our Game, the parties to whom we disclose it, and the choices and rights that the Data Subject has regarding how we collect and process their Personal Data

Please read this Privacy Policy carefully. If you have any concerns about providing information to us, or it being used as described in this Privacy Policy, you should not use our Game.

This Privacy Policy is in compliance with the current data protection regulations, such as the European General Data Protection Regulation (GDPR), the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act (2020) and the Organic Law 3/2018 of December 5 on Protection of Personal Data and Guarantee of Digital Rights. 

• Who is the Data Controller?

A data controller is the natural or legal person who determines the purposes and means of the processing of Personal Data.

• Data Controller: TIBI GAMES, S.L.U. 
• CIF: B19925957
• Headquarters: C/ Diputació 303, Primera Planta 08009 Barcelona
• Email: privacy@tibigames.com

 

• Personal Data that we will collect

When you use the Game, we collect certain information about you and your device.

Category (Personal Data type)	Example
Non-Personal Information	Device information (model, type, operating system, unique device identifiers, language) Geolocation (IP address, country, region) Game progress and scores Usage data (time spent in the game, features used)

 

• Where do we collect your data from?

We collect data directly from you or your device when you use our Game. 

• Use of your Personal Data

6.1.  The Personal Data for the users that we may process can fit in the following categories:

Purpose/Activity	Description	Legal Base
To operate and maintain the Game	All activities necessary for the operation and maintenance of the game. This encompasses server administration, the implementation of updates and patches, user account management, and troubleshooting technical issues that may arise.	Execution of the Terms and Conditions
To improve our gaming experience	Collecting and analyzing data related to gameplay, user preferences, and player feedback to make adjustments and improvements to the game.	Legitimate Interest
To provide customer support	Activities related to customer care and assistance. This includes managing inquiries, complaints, and requests for help.	Execution of the Terms and Conditions.
Ensuring security, preventing and detecting fraud, and fix errors	Protecting the integrity of the game and the security of player data. It includes the implementation of security measures such as user authentication, detection and prevention of fraudulent activities, and monitoring suspicious behavior. Additionally, it involves identifying and fixing errors and vulnerabilities in the game to ensure a safe and fair environment for all players.	Execution of the Terms and Conditions.
To analyze usage and trends to improve the Game	Collecting and analyzing data on the usage, trends, and game performance statistics to develop new features and content that better meet the needs and preferences of players can be discovered.	Legitimate Interest
To send you updates, promotions and marketing information	Communicate with Users about game updates, special events, promotions, and exclusive offers, as well as relevant marketing information. This can be done through emails, in-game notifications, and other communication channels.	Consent

WE DO NOT process Personal Data for the purposes described in Article 22 GDPR (“Automated individual decision-making, including profiling”).

Aggregate data

The statistical purpose implies that the result of processing for statistical purposes is not Personal Data, but aggregate data. This means that Personal Data is not used in support of measures or decisions regarding any particular natural person (Recital 162 GDPR).

In addition to the uses detailed above, we may process user data as an aggregate, anonymous and non-individual level, for the following purposes:

• Operate and improve our technology.
• Conduct research and development.

 

• Advertising

Our Game includes advertising for third party products and services.

We and our advertising partners collect and use information about you to improve advertising, targeting and measurement systems so that we can show you relevant third party ads in our Games.

We participate in the IAB Europe Transparency & Consent Framework and comply with its Specifications and Policies. We use the Consent Management Platform (CMP) with the identification number 5.

Where applicable, we use a CMP to gather consent and permissions for our advertising based activity. 

To provide our Games, we use ad identifiers, cookies and similar technologies.

• Retention of your Personal Data

TIBI GAMES will keep your Personal Data to attend and/or carry out the requested and will keep them for the periods of limitation necessary according to the legislation that, in each case, is applicable to meet future liabilities. Once the legal statute of limitations has expired, your personal data will be destroyed.  

However, for each of the processing activities, in the information that we will provide you with at the time of collecting your personal data, we will inform you of the retention period of your respective data. 

We will keep your data for as long as necessary to achieve the purpose(s) for which it was collected (as long as you do not request their deletion or opposition through the means indicated in the section “Your Personal Data Rights”), unless we have to comply with any legal, accounting, or reporting requirements. We will keep personal data for the periods of limitation necessary according to the legislation that, in each case, is applicable to meet future liabilities. Once the legal statute of limitations has expired, your personal data will be destroyed.  We may periodically delete or de-identify inactive accounts or other data in our Game.

We also inform you that we will take all reasonable steps to ensure that your data is rectified or deleted when it is inaccurate.

• How we share your information

In general, TIBI GAMES will not communicate your personal data to third parties, except in the following cases:

1. Competent Authorities and bodies, Courts, Tribunals or any other Third Parties legitimized in accordance with the applicable regulations;
2. We share the Personal Data with other companies operating in the online advertising industry, for the purposes described in Section 6 of this Privacy Policy. In those cases, we may enter data processing agreements with the following categories of data recipients for the indicated purposes below:

Categories of Data Recipients	Purposes
Real Time Bidding Platforms	Managing advertisement campaigns
Advertisers	Retargeting Segmenting
Trackers Data Management Platforms Technology Suppliers	Performance monitoring  Retargeting Segmenting

In addition, we have contracted the provision of certain services (e.g. virtual infrastructure services, cloud computing, customer relationship management, organization of games and contests, management of loyalty programs, sending emails for marketing purposes, etc.) to suppliers, which may have access to and/or process personal data in their capacity as data processors. Some of these suppliers may process and store personal information on servers located outside your country of residence.

• Where will collected Personal Data be processed?

Based on the Services provided, and depending on the user’s location, data transfers to other countries may occur. In such a case, your personal data may be transferred internationally to third parties located outside the European Economic Area (“EEA”), provided that TIBI GAMES has the authority to do so and subject to compliance with the appropriate safeguards set out in Articles 44 to 50 of the GDPR. Such Third Parties shall only access the data to perform their services on behalf and for the account of TIBI GAMES, under an obligation of confidentiality and always following TIBI GAMES’ instructions and without at any time using such data for their own purposes and/or unauthorized purposes.

Whenever we transfer Personal Data out of the EU, EEA, Switzerland & UK we ensure that adequate safeguards are implemented. Those safeguards include among others:

• Adequacy decision: declaration by the European Commission that a non-EU State, offers an adequate level of data protection equivalent to that provided by European data protection legislation, making international data transfer to a third party established in that State outside the EU possible;
• Binding Corporate Rules (also known as “Binding Corporate Rules”): these are applicable to corporate groups or the union of companies engaged in a joint economic activity, which enables the flow of personal data on the basis of a self-regulation accepted and assumed by each of the signatory entities;
• Standard Contractual Clauses: this is a mechanism signed between the exporter of Personal Data from any of the EEA countries and a third country. It is a contractual agreement whose model has been approved and published by the European Commission and aligned with the precepts of the GDPR.
• Code of Conduct or a certification mechanism, together with binding and enforceable commitments made by the recipient regarding the implementation of appropriate safeguards for the protection of the transferred data.
• In the absence of the above, your personal data may exceptionally be transferred to a third country or international organization, in application of the mechanisms that may be recognized in this respect by data protection legislation.  

TIBI GAMES, in order of preference, will carry out international transfers under the following guarantees:

Guarantee	Criteria used by TIBI GAMES
Adequacy Decision	Measure included as preferred by TIBI GAMES. You can find the list of countries subject to an adequacy decision at: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en
Binding Corporate Rules	In the absence of an Adequacy Decision, it will be the preferred security measure that TIBI GAMES will request to the importer of the personal data. You can find the list of entities that have BCR here: https://edpb.europa.eu/our-work-tools/accountability-tools/bcr_en?page=1
Standard Contractual Clauses	As a secondary guarantee mechanism in the absence of the above, we will proceed to subscribe and/or request a copy as appropriate from the importer of the personal data of the signed version of the Standard Contractual Clauses aligned with the European Commission models, available here: https://eur-lex.europa.eu/legalcontent/ES/ALL/?uri=CELEX%3A32021D0914.

 

• Your Personal Data Rights

11.1. Your rights

If you are a resident within the European Economic Area (EEA), UK and Switzerland you will have the following rights: 

• The right to be informed. You have the right to be informed about how we collect and use your Personal Data, how long we plan to keep that data, and who we will share it with. 
• The right of Access. You have the right to know exactly what information SMADEX has collected about you, how we are storing and processing that data, and what we are going to do with it. The right to access the Personal Data that is processed by the Data Controller in accordance with Article 15 GDPR.
• The right to rectification (correction). You have the right to have incomplete data completed and incorrect data corrected. in accordance with Article 16 GDPR.
• The right to erasure. You have the right to have Personal Data permanently deleted, in accordance with Article 17 of the GDPR.  This is also known as the “right to be forgotten.” Please note that this right doesn’t apply if the processing of data that’s subject to an erasure request is necessary to comply with a company’s legal obligations or while the commercial and/or contractual relationship that we have with you remains in force. In that case, there is a series of Personal Data that is necessary for us to process in order to comply with the contract, so while it lasts, we cannot delete them, block them or cancel them, because otherwise it would prevent us from complying with the contract.
• The right to restrict or to the limitation of processing. If you can´t require that we erase your Personal Data, you have the right to restrict our ability to process that data, under certain circumstances indicated in article 18 GDPR.
• The right to data portability. Individuals have the right to obtain and reuse their Personal Data for their own purposes across different services in accordance with Article 20 GDPR. Data subjects can request that data controllers send their Personal Data files electronically to third parties. If technically feasible, companies must provide the data in commonly used, machine-readable formats.
• The right to object. You have the right to object to the processing of your Personal Data in certain circumstances, in particular, to those Processing operations that are based on consent or on the existence of a legitimate interest (including, but not limited to, the sending of commercial communications) in accordance with article 21.2 GDPR. For example, if an organization uses Personal Data for direct marketing, scientific and historical research, or to perform a task in the public interest. However, we may still process the data to establish or defend legal claims, or if we can demonstrate there are legitimate grounds that override individuals’ interests and rights. In those cases in which the Processing is based on the existence of a legitimate interest, the Data Subject shall be entitled to request the weighting report carried out by the Data Controller. In addition, in cases where the Processing is for the purpose of sending own or third party commercial information, the Data Subject may opt-out free of charge and voluntarily to an advertising opt-out mechanism. 
• Right to withdraw consent: given for the performance of the Processing identified in the section Processing based on the Data Subject’s consent, without such revocation having retroactive effect, in accordance with Article 7.3 RGPD. 
• The right to not be subject to automated decision making. You have the right to demand human intervention, rather than having important decisions made by algorithms. Companies are required to inform people that they will be subject to algorithmic decision-making and let them know that they can opt out of it.

To exercise any of these individual Privacy Rights, you can send an email to privacy@tibigames.com with your username and your email address.

California Individual Privacy Rights (California residents can exercise these privacy rights with respect to their Personal Data)

Right to Access Personal Data. You have the right to know (i) the categories of Personal Info we have about you; (ii) the categories of sources from which that Personal Data was collected (iii) Our business or commercial purpose for collecting, selling, or sharing your Personal Data (iv) the categories of third parties to whom we disclose Personal Data(v) the specific pieces of Personal Data we have collected about you. Right to Know What Personal Data is Sold or shared and to Whom. You have the right to know what Personal Data of yours is being sold or shared, and with whom.  Right to Deletion: You have the right to request that we delete the Personal Data that we have collected or maintain about you. There may be circumstances under which we will be unable to delete such Personal Data, such as if we need to comply with our legal obligations.  Right to Correct Inaccurate Personal Data. You have the right to request us if we maintain inaccurate Personal Data about you, taking into account the nature of this Personal Data and the purposes of the processing. To such extent, we shall use commercially reasonable efforts to correct the inaccurate Personal Data. Right to Opt Out of Sale or sharing your Personal Data. You have the “right to opt-out” of sale or sharing of your Personal Data. If you do not affirmatively opt out, and you are not a minor (under 16), your Personal Data may be sold as disclosed in this Privacy Policy. You can submit your request to opt out of the sale or sharing of your Personal Data by completing our “California Right to Opt-Out of the Sale or Sharing Personal Data” request form available here. Right to Limit Use and Disclosure of Sensitive Personal Data. You have the right to limit, at any time, the use and disclosure of your sensitive Personal Data, except when we use such Personal Data in a way reasonably expected by an average consumer.               For information purposes, “sensitive Personal Data”  includes any private information that divulges any of the following: i) personal identification numbers, including social security, driver’s license, passport, or state ID card number; ii) account or debit or credit card numbers combined with passwords or codes that would enable access to the accounts; iii) a user´s exact geolocation; iv) a user’s racial origin, religious beliefs, or union membership; v) a user’s mail, email, or text message content unless the information was intentionally sent to the business; a user´s consumer’s genetic data, such as DNA simples; vi) the processing of any biometric data to identify a consumer, and vii) Personal Data concerning a user’s health or sexual orientation. Right of No Retaliation. If you choose to exercise any of these rights, Entravision will not discriminate against you in anyway.

California Individual Privacy Rights (California residents can exercise these privacy rights with respect to their Personal Data)

Right to Access Personal Data. You have the right to know (i) the categories of Personal Info we have about you; (ii) the categories of sources from which that Personal Data was collected (iii) Our business or commercial purpose for collecting, selling, or sharing your Personal Data (iv) the categories of third parties to whom we disclose Personal Data(v) the specific pieces of Personal Data we have collected about you. Right to Know What Personal Data is Sold or shared and to Whom. You have the right to know what Personal Data of yours is being sold or shared, and with whom.  Right to Deletion: You have the right to request that we delete the Personal Data that we have collected or maintain about you. There may be circumstances under which we will be unable to delete such Personal Data, such as if we need to comply with our legal obligations.  Right to Correct Inaccurate Personal Data. You have the right to request us if we maintain inaccurate Personal Data about you, taking into account the nature of this Personal Data and the purposes of the processing. To such extent, we shall use commercially reasonable efforts to correct the inaccurate Personal Data. Right to Opt Out of Sale or sharing your Personal Data. You have the “right to opt-out” of sale or sharing of your Personal Data. If you do not affirmatively opt out, and you are not a minor (under 16), your Personal Data may be sold as disclosed in this Privacy Policy. You can submit your request to opt out of the sale or sharing of your Personal Data by completing our “California Right to Opt-Out of the Sale or Sharing Personal Data” request form available here. Right to Limit Use and Disclosure of Sensitive Personal Data. You have the right to limit, at any time, the use and disclosure of your sensitive Personal Data, except when we use such Personal Data in a way reasonably expected by an average consumer.               For information purposes, “sensitive Personal Data”  includes any private information that divulges any of the following: i) personal identification numbers, including social security, driver’s license, passport, or state ID card number; ii) account or debit or credit card numbers combined with passwords or codes that would enable access to the accounts; iii) a user´s exact geolocation; iv) a user’s racial origin, religious beliefs, or union membership; v) a user’s mail, email, or text message content unless the information was intentionally sent to the business; a user´s consumer’s genetic data, such as DNA simples; vi) the processing of any biometric data to identify a consumer, and vii) Personal Data concerning a user’s health or sexual orientation. Right of No Retaliation. If you choose to exercise any of these rights, Entravision will not discriminate against you in anyway.

In addition, you may also opt-out of receiving marketing communications from us. If you would like to exercise this right, please write to us at the contact details indicated.

11.2. If you are a resident of California, you may have the following additional rights with regard to the Personal Data we maintain about you:

To exercise your California rights, complete our “California Consumer Request” form available here.

If we are unable to comply with your requests, we will let you know the reason why.

 We will take steps to verify your identity before processing your request, which may include requesting information from you to match with information we already have about you. 

• How do we protect minors?

Our Game is intended for adults and designed primarily with adults in mind. When you access and use the Game, we may ask you to confirm your age to us or your age may otherwise become known to us. If we discover that you are a minor or do not meet an age threshold we apply, we may take steps to limit, suspend, or terminate your access to the Game where we believe that to be necessary due to applicable regulatory or platform requirements or to provide you with an appropriate experience. If your access to the Game is not suspended or terminated, we will limit the use of your personal data to what is necessary for the internal operation of our Game and other uses permitted by applicable laws, regulations, and platform policies.

• Use of cookies and other technologies

We use cookies and other standard web technologies to collect information, which include the following:

Technology	Purpose of Use
“Cookies”: data files that often include a unique identifier and are placed on a visitor’s device or computer.	To operate our technology and collect user information. -For more information about cookies, and how to disable cookies, visit our Cookies Policy.
“Tags and Pixels”: blocks of code that we and our customers may use to track your navigation of websites or apps using our technology, and your browsing behaviour.	To synchronize information that we have collected with information independently collected by our suppliers, advertisers, and other third parties that are interested in providing you with ads.
Other: locally stored objects	to collect user information with the aim of assisting with the delivery of ads and to provide reporting to the advertisers

 

• Links 

This Site may include, display or display links to other websites for your convenience and information. Such websites may operate independently of us. These linked sites may have their own privacy policies, which we strongly encourage you to read when you visit them. To the extent that any linked websites you visit are not owned or controlled by us, we are not responsible for the content of such websites, their use or their privacy practices.

• How long is this Privacy Policy updated?

This Policy may be updated periodically to reflect changes in our processing of personal data. We will post a prominent notice on the Site to notify you of any significant changes to our Policy and will indicate at the bottom of the Policy when it was last updated.

This Privacy Policy is updated as of March, 2025

© 2025 – TIBI GAMES, S.L.U.– Reproduction in whole or in part is prohibited. All rights reserved.

5. Where do we collect your data from?

We collect data directly from you or your device when you use our Game. 

6. Use of your Personal Data

6.1.  The Personal Data for the users that we may process can fit in the following categories:

WE DO NOT process Personal Data for the purposes described in Article 22 GDPR (“Automated individual decision-making, including profiling”).

7. Advertising

Our Game includes advertising for third party products and services.

We and our advertising partners collect and use information about you to improve advertising, targeting and measurement systems so that we can show you relevant third party ads in our Games.

We participate in the IAB Europe Transparency & Consent Framework and comply with its Specifications and Policies. We use the Consent Management Platform (CMP) with the identification number 5.

Where applicable, we use a CMP to gather consent and permissions for our advertising based activity. 

To provide our Games, we use ad identifiers, cookies and similar technologies.

8. Retention of your Personal Data

We will keep your data for as long as necessary to achieve the purpose(s) for which it was collected, including to provide you with the Game or to comply with any legal, accounting, or reporting requirements. We may periodically delete or de-identify inactive accounts or other data in our Game.

After the applicable retention period, we will either delete or de-identify your data or, if neither deletion or de-identification is possible (for example, due to data being stored on a backup server), isolate your data from further processing until deletion or de-identification is possible. We may continue to use data that is not identifiable to you (for example, aggregate data). We will not attempt to re-identify you when using such de-identified data.

9. How we share your information

We do not share your personal information with third parties except in the following circumstances:

• With your consent
• With service providers or other group entities who perform services on our behalf (e.g., analytics, hosting)
• If required by law or to protect the rights and safety of our users and others
• In connection with a merger, sale, or other transfer of all or part of our business.

10. How do we keep your data secure?

We have adopted measures to provide your data a level of security appropriate for the degree of risk involved with the processing activities described in this notice. These measures are designed to protect your data against accidental or unlawful destruction, loss, or alteration as well as unauthorized disclosure or access. The specific measures we employ vary, but typically include, for example, encryption in transit, pseudonymization of identifying data where feasible, controls to limit access to services or systems that contain personal data, and maintaining procedures to handle any suspected security incidents. 

11. Where will collected Personal Data be processed?

Whenever we transfer Personal Data out of the EU, EEA, Switzerland & UK we ensure that at least one of the following safeguards is implemented:

• We may transfer your Personal Data to countries that have been deemed to provide an adequate level of protection for Personal Data by the European Commission. 
• We may transfer data subject to specific contracts approved by the European Commission, which ensures that Personal Data the same protection it has in Europe regardless of where it is processed (Standard contractual clauses 2021).

12. Your Personal Data Rights

12.1. Your rights

If you are a resident within the European Economic Area (EEA), UK and Switzerland you will have the following rights: 

• The right to be informed. You have the right to be informed about how we collect and use your Personal Data, how long we plan to keep that data, and who we will share it with. 
• The right of Access. You have the right to know exactly what information we have collected about you, how we are storing and processing that data, and what we are going to do with it. 
• The right to rectification (correction). You have the right to have incomplete data completed and incorrect data corrected. 
• The right to erasure. You have the right to have Personal Data permanently deleted. This is also known as the “right to be forgotten.” Please note that this right doesn’t apply if the processing of data that’s subject to an erasure request is necessary to comply with a company’s legal obligations.
• The right to restrict processing. If you can´t require that we erase your Personal Data, you have the right to restrict our ability to process that data, under certain circumstances.
• The right to data portability. Individuals have the right to obtain and reuse their Personal Data for their own purposes across different services. Data subjects can request that data controllers send their Personal Data files electronically to third parties. If technically feasible, companies must provide the data in commonly used, machine-readable formats.
• The right to object. You have the right to object to the processing of your Personal Data in certain circumstances. However, we may still process the data to establish or defend legal claims, or if we can demonstrate there are legitimate grounds that override individuals’ interests and rights.
• The right to not be subject to automated decision making. You have the right to demand human intervention, rather than having important decisions made by algorithms. Companies are required to inform people that they will be subject to algorithmic decision-making and let them know that they can opt out of it.

To exercise any of these individual Privacy Rights, you can send an email to privacy@tibigames.com with your username and your email address.

In addition, you may also opt-out of receiving marketing communications from us. If you would like to exercise this right, please write to us at the contact details indicated.

12.2. If you are a resident of California, you may have the following additional rights with regard to the Personal Data we maintain about you:

To exercise your California rights, complete our “California Consumer Request” form available here.

If we are unable to comply with your requests, we will let you know the reason why.

 We will take steps to verify your identity before processing your request, which may include requesting information from you to match with information we already have about you. 

13. How do we protect minors?

Our Game is intended for adults and designed primarily with adults in mind. When you access and use the Game, we may ask you to confirm your age to us or your age may otherwise become known to us. If we discover that you are a minor or do not meet an age threshold we apply, we may take steps to limit, suspend, or terminate your access to the Game where we believe that to be necessary due to applicable regulatory or platform requirements or to provide you with an appropriate experience. If your access to the Game is not suspended or terminated, we will limit the use of your personal data to what is necessary for the internal operation of our Game and other uses permitted by applicable laws, regulations, and platform policies.

14. Use of cookies and other technologies

We use cookies and other standard web technologies to collect information, which include the following:

15. How long is this Privacy Policy updated?

We reserve the right to amend this Privacy Policy at any time to reflect changes to our practices or for other operational, legal or regulatory reasons, which will be posted on this page. Please check this Website periodically for updates.

The date of this Privacy Policy was last revised is identified at the top of the page. 

If we make material changes to how we treat your Personal Data, we will notify you to the e-mail address provided by you or through a notice on the Website home page.  Your continued use of our Website after such amendments will be deemed your acknowledgement and consent of these changes to this Privacy Policy.