Who we are and what this Policy covers
Harbour Lane Limited, a company incorporated in Hong Kong, with registration number 81439941 and registered office at 7/F, MW Tower, 111 Bonham Strand, Sheung Wan, Hong Kong, trading as Brand2Game (we, us or our), is the controller of the personal data described in this Policy where we determine why and how it is processed.
Brand2Game is an AI assisted studio creating branded browser games for promotional campaigns, corporate events and HR activities; games for exhibition stands and conferences; and branded team stickers and emoji. We adapt existing formats and undertake separately scoped projects for agencies. Deliverables may be used on websites, within applications or internal systems, or at events. This Policy explains our handling of personal data collected through our website https://www.brand2game.com (the “Website”), enquiries and related business communications, including subsequent emails, telephone discussions and meetings. It is not limited to communications conducted online. It also explains the distinction between our own processing and processing carried out on a client’s instructions.
Privacy contact: info@brand2game.com.
The sections referring to the EU General Data Protection Regulation (GDPR) describe processing to which that law applies. Other applicable data protection laws may provide additional rights.
Personal data we collect and its sources
When you complete our contact form, we collect your first name, surname, telephone number and email address, together with the contents of your enquiry. We may also receive your company name, professional role, project requirements and other information that you choose to provide in correspondence.
When you fill in an order form on Brand2Game, we collect your contact and order information to prepare your checkout and match your order to the payment. Stripe hosts the payment page, collects your billing details there and processes the payment. We share an order reference with Stripe to match your payment to your form. We use Stripe’s payment confirmation to release the order to our fulfilment team. See the Stripe Privacy Policy for information about Stripe’s processing.
Project materials may also contain personal data, such as the name, image or likeness of an identifiable employee or another individual, or an identifiable person’s business contact details within a brand brief. A logo or company name is not automatically personal data; this Policy applies to information relating to identifiable individuals. Please provide only the personal data needed for the agreed purpose and ensure that you are entitled to disclose it. Our role in processing personal data supplied for a deliverable must be determined for each project.
When a business relationship develops, we may process business contact details, communications, proposal and contract records, billing contact information and information necessary to administer that relationship. We obtain these data from you, from your organisation or from a person authorised to introduce or involve you in a project. Where we receive your details from someone else, we will provide any additional information required by applicable law.
Please do not include sensitive personal data, identity document copies, passwords or other unnecessary personal information in a project enquiry. Where a project genuinely requires additional categories of personal data, we will address those separately before collection.
Why we use personal data and our legal basis
Responding to enquiries and preparing proposals. We use contact details, enquiry contents and related correspondence to respond, arrange discussions and assess project requirements. Where you are personally a prospective contracting party and the processing is necessary to take steps at your request before entering a contract, the legal basis is Article 6(1)(b) GDPR. Where you represent a business or are making a general enquiry, the legal basis is Article 6(1)(f): our legitimate interests in communicating with prospective clients and responding to requests, balanced against your rights and reasonable expectations.
Managing client and supplier relationships. We use business contact and project administration data to communicate, organise delivery and maintain business records. For a contract with you personally, necessary processing is based on Article 6(1)(b). For representatives of corporate clients or suppliers, it is based on Article 6(1)(f): our legitimate interests in administering those relationships and providing our services.
Legal compliance. Where applicable legislation requires us to retain accounting records, respond to a lawful authority request or fulfil another legal obligation, we rely on Article 6(1)(c). The obligation and retention period depend on the law applicable to the relevant record.
Security and legal claims. Where relevant to the actual processing, we use proportionate technical records and correspondence to protect the Website and communications, prevent misuse, investigate incidents and establish, exercise or defend legal claims. We rely on Article 6(1)(f): our legitimate interests in protecting our systems, business and legal rights, subject to the necessary balancing of interests.
We do not rely on consent merely because you have read this Policy or submitted an enquiry. Where we do rely on consent, we will explain the specific activity and request that consent separately.
Whether you have to provide information
You are not legally required to send us an enquiry. We need sufficient contact information and a description of your request to respond meaningfully. Required fields will be identified on the form; other fields are optional. If you do not provide information necessary for a requested service or a legal obligation, we may be unable to proceed with that service and will explain why.
Who receives personal data
Access is limited to people and organisations that need the relevant data for the stated purposes. Depending on the services actually used, recipients may include authorised personnel and contractors; Website and cloud hosting providers; email, communications and customer relationship management providers; IT and security support providers; professional advisers; and public authorities where disclosure is legally required or otherwise lawful.
Providers acting as processors must process data under appropriate contractual terms and on documented instructions. Some professional advisers or authorities act as independent controllers under their own legal obligations.
If a proposed merger, acquisition or transfer of our business requires disclosure, we will limit the data shared, apply appropriate safeguards and provide further notice where required by law.
AI and personal data
The use of AI in game development does not itself mean that contact form data is used to train AI models. Any processing of identifiable information through an AI service must have a defined purpose, appropriate legal basis and relevant safeguards.
Data relating to players of client games
A game embedded in a client’s website or internal system may involve personal data, for example if that particular implementation collects participant details, records scores linked to identifiable players or uses tracking technology. This Policy does not imply that every game collects those data.
Where the client determines the purposes and essential means of that processing, the client is the controller and must provide an appropriate player privacy notice. The same allocation of roles may apply to identifiable employee information used to create team assets, or attendee and participant information processed for an exhibition or corporate event. Where we access, host or otherwise process player or other project personal data solely on that client’s instructions, we act as its processor under a separate data processing agreement. That agreement must address the processing scope, security, subprocessors, assistance with rights requests and deletion or return of data.
If you have a request about data held in a client’s game, contact the organisation operating the game in the first instance. Where we act as processor and receive a request directly, we will refer it to the relevant client and assist as required by our agreement and applicable law.
If we determine our own purposes for any player data, including data in a demonstration operated by us, we must provide an appropriate additional notice before collection. This Website Policy alone does not describe unconfirmed player data processing.
International transfers
Where GDPR applies and data is transferred outside the European Economic Area, we must comply with its international transfer requirements. Depending on the arrangement, safeguards may include a relevant European Commission adequacy decision or applicable Standard Contractual Clauses, together with any supplementary measures required following an assessment of the transfer.
You may contact info@brand2game.com for information about the safeguards applicable to your data and to obtain a copy, subject to proportionate redaction necessary to protect confidential information. Different safeguards will be specified where another applicable law requires them.
How long we keep personal data
We retain personal data only for as long as necessary for its stated purpose, taking account of legal obligations and the establishment, exercise or defence of claims. We then delete or anonymise it, subject to any justified legal hold. Data remaining in backups must be protected and removed through the applicable backup cycle.
Security
We must implement technical and organisational measures appropriate to the nature of the processing and its risks. These measures must be reviewed as our systems and risks change. No internet transmission or storage method can be guaranteed to be completely secure.
Your rights
Where GDPR applies, and subject to its conditions and exceptions, you may request access to your personal data and a copy of it; correction of inaccurate or incomplete data; erasure; restriction of processing; and portability of data processed by automated means on the basis of consent or a contract.
Where processing is based on legitimate interests, you may object on grounds relating to your particular situation. We must stop that processing unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing is needed for legal claims. You may object to processing for direct marketing, including related profiling, at any time, and that processing must stop.
Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal. If applicable, you also have safeguards concerning solely automated decisions with legal or similarly significant effects, including the rights provided by Article 22 GDPR.
To exercise a right, contact info@brand2game.com. We may request proportionate information to verify your identity. We will normally respond within one month of receiving your request. Where GDPR permits an extension because of complexity or the number of requests, we may extend that period by up to two further months and will explain the extension within the first month. Requests are normally free of charge; any permitted fee or refusal will be explained.
You may complain to a competent supervisory authority, in particular in the EU Member State of your habitual residence, place of work or an alleged infringement. You do not have to contact us first.
Cookies and similar technologies
Where prior consent is required for optional technologies, those technologies must remain disabled until consent is given. You must be able to refuse optional technologies and withdraw consent through an accessible control at the cookie’s settings section on the Website. Consent to optional tracking must not be inferred merely from continued browsing or acceptance of the Terms of Use.
Expo remarketing. With your consent, we use Google Ads to show Brand2Game Expo ads to people who visited our Expo pages in the past 30 days. For this purpose, we share information about Expo page visits, relevant cookie or advertising identifiers, and whether an Expo enquiry was submitted. We use the enquiry event to exclude people who have already submitted a request. You can withdraw your consent at any time in Cookie settings. How Google uses this information
QR Promo advertising. With your consent in Cookie settings, we use Google Ads to measure enquiries from QR Promo ads and may show QR Promo ads for up to 30 days after a visit. For these purposes, Google receives information about QR Promo page visits, relevant cookie or advertising identifiers and whether you submitted a QR Promo enquiry. We use the enquiry event to exclude people who have already submitted a request. You can withdraw your consent at any time in Cookie settings on the QR Promo page. How Google uses this information
Children
Our business enquiry facilities and commissioned development services are directed towards businesses and their representatives. They are not intended to invite children to submit their personal data. If you believe a child has provided personal data through our business contact facilities, contact info@brand2game.com so that we can assess the circumstances and take appropriate action.
Changes and contact
We may update this Policy to reflect changes in actual processing or applicable law. The current version will show its effective date. Where a change requires additional notice or a new legal basis, including fresh consent where necessary, we will address that before starting the relevant processing. Publication of a revised Policy does not itself authorise a new use of personal data.
For questions about this Policy or our handling of your personal data, contact info@brand2game.com or write to Harbour Lane Limited, 7/F, MW Tower, 111 Bonham Strand, Sheung Wan, Hong Kong.