Jagex

Jagex is the creator of the MMORPG, RuneScape.

5.1/10

How we calculate ratings →

Handling

Does the policy allow personally-targeted or behavioral marketing? Yes, but you may opt-out

4/10

Does the service allow you to permanently delete your personal data? Yes, by contacting someone

3/5

Even if there is a reasonable delay before the data is fully deleted (as is common), the data still counts as "permanently deleted" and satisfies the parameters for this question.

Score

Yes, by contacting someone

60%

Yes, using an automated mechanism

100%

N/A

The service doesn't collect any personal information.

100%

Citation

This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

Notes

You can request erasure of your data at https://relentless-gdpr-247.relentlessdataprivacy.com/saq/698bf39f-5e25-4af7-aef9-06bf4b6bfcf4

When does the policy allow law enforcement access to personal data? When reasonably requested

3/5

Score

Always

This includes cases in which law enforcement either runs the service or has a known backdoor into (or relationship with) the service.

Not specified

When reasonably requested

60%

Only when required by a court order or subpoena

80%

N/A (no personal data to share)

The service would have no personal data to share with law enforcement.

100%

Never (special legal jurisdiction)

The service operates in a jurisdiction in which sharing data with law enforcement is never required.

100%

Citation

(c) Necessary to comply with a legal obligation; (d) Necessary for our legitimate interests to detect or prevent unlawful acts

Does the service allow third-party access to private personal data? Yes, all parties specified (including non-critical service providers such as advertisers)

3/10

This may come in the form of outright data sharing or by using local third-party analytics software (such as Google Analytics, which collects a plethora of user information).

Note that whether the policy allows sharing aggregated user data does not affect this question.

If the personal data is encrypted when it passes through the third-party, it does not count as third-party access (as the data is inaccessible to that party).

If personal data has been made public by, for example, posting it to a blog, it does not count as private personal information (and is therefore not considered by this question).

Score

Yes

The policy allows sharing personal data with third parties (not just critical service providers), and does not explicitly list the third parties.

Yes, all parties specified (including non-critical service providers such as advertisers)

30%

Yes, not all parties specified (but only to critical service providers)

70%

Yes, all parties specified (only to critical service providers)

80%

100%

Notes

You can see all marketing subprocessors at https://www.jagex.com/en-GB/terms/third-party-partners

Transparency

Does the policy require users to be notified in case of a data breach? Yes, eventually

5/7

Is the policy's history made available? Yes, with revisions or a changelog

5/5

Will affected users be notified when the policy is meaningfully changed? No

0/5

Does the policy outline the service's general security practices? Somewhat

1/3

Score

Somewhat

The policy provides only a very vague overview of its security practices.

30%

Yes

60%

Yes, including audits

"Reviews," "monitoring," etc. also count as audits.

80%

Yes, including independent audits

Independent "reviews," "monitoring," etc. also count as independent audits.

100%

N/A

The service doesn't collect any personal information.

100%

Citation

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered, disclosed or being unavailable. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know on the principle of least privilege (PoLP). They will only process your personal data on our instructions and they are subject to a duty of confidentiality. We periodically review all privacy and security policies and update when necessary in line with changes of the GDPR or when any new technologies are introduced into our business. Where the introduction of new technologies results in a high risk to your data we will perform a data protection impact assessment and will only proceed if meeting the required levels of security standards.

Collection

Is it clear why the service collects the personal data that it does? Yes

10/10

Does the policy list the personal data it collects? Yes, generally

7/10

Score

The policy does not claim to not collect personal data, but it also doesn't provide any meaningful insight into the types of personal data it collects.

Only summarily

The policy uses overly vague language to provide a summary of the types of collected personal data.

30%

Yes, generally

All general categories of collected personal data are listed, though not all types of personal data are explicitly mentioned (for example, the list might use a phrase like 'such as' when listing types of personal data).

70%

Yes, exhaustively

All types of collected personal data are listed specifically

100%

N/A (no personal data is collected)

100%

Citation

Identity Data includes but not limited to first name, last name, username or similar identifier, title and date of birth. Contact Data includes billing address, residential address, email address and telephone numbers. Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us. Technical Data Commonly known as online identifiers and includes internet protocol (IP) address, unique mobile device identification numbers (such as your Media Access Control (MAC) address, Identifier For Advertising (IDFA), and/or International Mobile Equipment Identity (IMEI), type of device, your login data, browser type and version, time zone setting and geo location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website. Profile Data includes your login details, purchases or orders made by you, your interests, preferences, feedback and survey responses. Usage Data includes information about how you use our website, products and services. Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties, news about our products and your communication preferences.

Does the service allow the user to control whether personal data is collected or used for non-critical purposes? On an opt-out basis, for all non-critical data/uses

6/10

Some services allow users to opt-out or opt-in to of non-critical collection or use of personal data, such as collecting data for personalized advertisements.

Score

On an opt-out basis, but only for some non-critical data/uses

30%

On an opt-out basis, for all non-critical data/uses

60%

On an opt-in basis

60%

N/A (no data used for non-critical purposes)

100%

Citation

We will get your explicit opt-in consent before we share your personal data with any company outside Jagex for marketing purposes.

The Identifier For Advertising (IDFA) is a unique, user-resettable ID for advertising, provided by the mobile device’s operating system. We may use this ID to enhance serving and targeting capabilities, re-target specific campaigns, pass the ID to our partners. Advertising ID does not reveal any information about the user or the device.

If you do not want to receive tailored in-application advertisements from third parties that relate to your interests in our games on your mobile device, you may opt- out by: adjusting the ad tracking settings on your device

If you have previously allowed us to access your geolocation data, you can stop making geolocation available to us by visiting your mobile device's settings for the games or the “settings” page for the games.

Does the service collect personal data from third parties? Yes

0/10

Last Updated

May 26, 2021

Sources

Source #1 ↗

Contributors

VukAnd12, doamatto