Privacy policy

1. Who is responsible

HEARTWING MEDIA LTD, Cyprus company HE 499988, is the controller for personal data processed through HeartwingHollow.com. Our correspondence address is 25 Voukourestiou Street, Neptune House, 1st Floor, 3045 Limassol, Cyprus. Contact info@heartwinghollow.com for privacy enquiries and rights requests.

This notice covers this website, its contact form, essential technical records and your choices. It does not describe family-account or gameplay processing as if it occurred on this website. Those features operate on the Gina application under its separate privacy policy. This notice provides information; reading it or accepting website terms does not amount to consent to unrelated processing.

2. Information we process

• Contact enquiries: your name, email address, selected enquiry topic and the message you choose to send.
• Technical records: IP address, request time, browser information, requested pages and security or error information generated by the hosting and mail systems.
• Form security: a random session identifier and anti-forgery token; a keyed, one-way representation of your network address is used to limit repeated submissions. The application’s rate-limit file does not store the raw IP address or message.
• Your privacy choice, its date and policy version, stored in your browser. If you accept optional preferences, your selected landscape and motion preference can also be saved in that browser.

We obtain this information from you and from your device’s requests. Contact fields are needed to understand and reply to your enquiry; if you do not provide the required information, the form cannot submit. You may email us instead. Do not send passwords, payment-card details, identity documents or unnecessary information about a child.

3. Why we use it and our legal grounds

We use enquiries to respond, provide requested information and deal with concerns. Where you ask us to take steps towards a contract, Article 6(1)(b) GDPR applies to necessary processing. For general enquiries and service administration, we rely on our legitimate interests in communicating and operating a reliable website, subject to your rights and reasonable expectations.

Proportionate security measures and abuse prevention rely on our legitimate interests in protecting the website, visitors and mailbox. Legal obligations and the establishment, exercise or defence of claims may require processing on the applicable legal basis.

Optional preference storage is based on your permission, which you can withdraw through Cookie settings. We do not use this website’s contact form to subscribe you to marketing. The website does not use advertising trackers, analytics tags, profiling or automated decisions producing legal or similarly significant effects.

4. Who receives information

Enquiries are delivered to our info@heartwinghollow.com mailbox and are accessible to authorised people dealing with them. Hosting, technical support and email providers process necessary information to provide their services. Professional advisers or authorities may receive information where necessary for legal advice, compliance or claims. We do not sell contact details or disclose them for third-party advertising.

Where a provider processes personal data on our behalf, appropriate contractual and security arrangements are required. If personal data is transferred outside the EEA, we use an applicable adequacy decision or appropriate safeguards, such as standard contractual clauses, and any additional measures required by law. Contact us for information about safeguards relevant to your enquiry.

5. How long information is kept

Routine enquiry correspondence is normally reviewed for deletion within 24 months after the matter closes. Longer retention may be necessary for a continuing relationship, a complaint, a legal obligation or an actual or reasonably anticipated claim. We retain only what remains necessary for that purpose.

The contact session expires after 30 minutes of inactivity, subject to the browser and hosting session-cleanup settings. The form’s anti-abuse counters contain a maximum 24-hour activity window; expired counters are removed on subsequent form activity. Hosting access and mail logs are separate security records, retained according to the hosting service’s configured retention and any incident or legal requirement. You may ask us for the applicable period.

Cookie choices and optional display preferences expire after 180 days. You can clear browser storage sooner or withdraw optional preferences using Cookie settings. Backup copies are retained for recovery and are removed through the relevant backup rotation rather than individually altered each time a record changes.

6. Your rights

Subject to the GDPR’s conditions, you may request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. You can withdraw consent at any time without affecting processing lawfully carried out beforehand. An objection to direct marketing is unconditional.

We normally respond to a rights request within one month. Where a lawful extension is needed, we will explain it within that period. We may request proportionate information to verify identity, but will not ask for unnecessary documents. You can complain to the Cyprus Commissioner for Personal Data Protection or another competent supervisory authority. You do not have to contact us first.

7. Children and families

Children may browse the stories, activities and music with appropriate adult guidance. The contact form is for adults, including parents, carers and professional enquiries. It does not create a child account or seek a child’s contact details. If a child needs help, they should ask a trusted adult to contact us. If you believe unnecessary child information has been submitted, tell us so that we can assess and remove it where appropriate.

We minimise children’s information and do not use the form to profile children. Where consent is required for an information-society service offered directly to a child, applicable parental-authorisation requirements must be met; an adult checkbox is not treated as verification for an unrelated child service.

8. Media, links and security

Music, images and videos on this website are served as local media files, rather than third-party embedded players. Following an external link sends you to that website, whose own practices apply. Media does not require an advertising or analytics account.

We use measures proportionate to the information involved, including form validation, anti-forgery protection and restricted server-side processing. No internet service or ordinary email can be guaranteed completely secure. Use the form only for the information necessary for your enquiry.

9. Changes and contact

We may update this notice to reflect changes in the website or legal requirements. Material new uses requiring additional notice or permission will be explained appropriately. For any question, write to info@heartwinghollow.com.