1. In short
- This notice covers data we control: this website, enquiries, sales, contracts, account management and support. Player data inside a customer's Gamira deployment is controlled by that customer, not by us.
- We do not sell your data, use it for advertising or build profiles about you.
- When you visit the site, our server and Cloudflare process technical data such as your IP address to deliver pages and keep the site secure. Our server logs are kept for 14 days.
- When you send a request through a form or by email, we use your details only to reply. Requests that do not lead to a contract are deleted 12 months after our last exchange.
- Optional cookies and embedded YouTube videos run only with your consent. See the Cookie Policy.
- Depending on the circumstances, you can ask us to show, correct or delete your data, or object to how we use it.
2. Who we are
"Evocoding" LTD is a company registered in the Bulgarian Commercial Register under EIK 204167034, with its registered office at 38 Lyuben Karavelov St, 8000 Burgas, Bulgaria. It operates the Gamira brand and this website ("Gamira", "we", "us").
We have not appointed a Data Protection Officer. Privacy enquiries can be sent to [email protected] and are handled directly by our management. We periodically review whether appointing a Data Protection Officer is required under applicable law.
This notice is provided under Art. 13 and 14 of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Bulgarian Personal Data Protection Act.
3. Scope of this notice
This Privacy Notice primarily explains how "Evocoding" LTD processes personal data in connection with the Gamira website (gamira.tech), enquiries, sales, contracts, account management and support.
Gamira is primarily provided as software deployed in infrastructure selected and controlled by our customers. When a customer uses Gamira to process player or end-user data in its own infrastructure, the customer normally determines the purposes and means of that processing and acts as the data controller. We do not receive such data by default unless a specific service, integration or support activity requires it. If you are a player of a game that uses Gamira, the privacy notice of that game's operator applies to you.
4. Controller and processor roles
We act as a controller when we process personal data for our own purposes, including website operation, enquiries, sales, contract administration, invoicing, security and customer relationship management.
Where a customer instructs us to process personal data on its behalf — including during managed support or troubleshooting of a Gamira deployment, or when the customer runs Gamira in our private cloud offering — we act as a processor. We then process that data only on the customer's documented instructions and under an applicable Data Processing Agreement (Art. 28 GDPR).
Nothing in this Privacy Notice changes the controller and processor roles agreed in a customer contract or Data Processing Agreement.
5. Gamira software and player data
Customers receive Gamira as container images from a private Docker registry and run them in infrastructure they select and control. By default, self-hosted Gamira deployments do not transmit player data to "Evocoding" LTD.
If a customer asks us to access its Gamira deployment for installation, maintenance, troubleshooting or support, or hosts Gamira in our private cloud offering, our authorised personnel may process application data or technical logs that contain personal data. We do so on behalf of the customer, under its documented instructions and the applicable Data Processing Agreement. Depending on the customer's configuration, this may include technical identifiers, IP addresses, account or player identifiers, session information, matchmaking records, logs and diagnostic information.
Customers are responsible for giving appropriate privacy information to their players and end users, choosing an appropriate lawful basis, configuring retention periods and meeting any requirements concerning children or minors.
6. What we process and why
| When | Data | Purpose | Legal basis | Kept for |
|---|---|---|---|---|
| You visit the site | IP address, date and time, requested page, referring page, browser and device type, response status | Delivering pages, keeping the site secure, finding errors and stopping abuse | Legitimate interest in a secure, working website (Art. 6(1)(f)) | 14 days in our server logs, then deleted automatically, unless needed longer for legal claims |
| Delivery through Cloudflare | IP address and the same technical request data; security cookies depending on the Cloudflare security features triggered | Fast delivery, encryption (HTTPS) and protection against attacks | Legitimate interest (Art. 6(1)(f)) | According to Cloudflare's data processing terms |
| You make a cookie choice | Your choices, the date, a consent-policy version and a random consent ID | Remembering and demonstrating your choice | Legal obligation to respect and demonstrate consent (Art. 6(1)(c), Art. 7(1)) | 6 months, stored only in your browser |
| You send a contact or call request | Work email, full name, company (optional), your message (optional), how you heard about us (optional), the page and form used, campaign tags in the page address, time | Replying, asking about your project, arranging a call, preparing a proposal | Steps you asked for before a contract, where you act for yourself (Art. 6(1)(b)); otherwise our legitimate interest in answering business enquiries (Art. 6(1)(f)) | 12 months after our last exchange, unless a contract follows or a longer period is needed for legal claims |
| You email us | Your email address, name, signature details and the content of your message | Answering and keeping track of the conversation | Art. 6(1)(b) or (f), as above | 12 months after the conversation ends, unless a contract follows or a longer period is needed for legal claims |
| You are a customer, partner or supplier contact | Names, role and business contact details of the people we deal with, company details, contract, order and support records | Administering the business relationship, communicating about services, support, account security | Contract (Art. 6(1)(b)) where you are personally party to it; otherwise our legitimate interests (Art. 6(1)(f)) | Contract term plus 5 years (general limitation period), unless a longer period is required by law or for legal claims |
| Invoicing and accounting | Billing details, invoices, payment records | Invoicing, accounting and tax compliance | Legal obligation (Art. 6(1)(c)) | As long as accounting and tax law require, generally up to 10 years |
| You allow analytics | Page, referring site, campaign tags in the address, browser, device type, screen size, language, country; the IP address only transiently (not stored) | Understanding which pages and posts are useful, with cookieless Umami Cloud statistics (Umami Software, Inc., as our processor) | Your consent (Art. 6(1)(a)) | 6 months |
| You allow external media | Data processed by YouTube when you play an embedded video | Playing the video | Your consent (Art. 6(1)(a)) | See the Cookie Policy |
Where we rely on legitimate interest, we have weighed it against your rights and kept the processing to the minimum. You can object to it at any time (see Your rights).
7. Contact and call requests
The "Contact us" and "Request a call" forms send your details through our form provider, Web3Forms, which delivers them by email to our team inbox at [email protected]. Web3Forms acts as our service provider for this purpose.
- Required fields. Your email address and name are needed so we can reply. Company and message are optional. If you prefer not to use the form, you can simply email us.
- Spam protection. The form uses a hidden field that people never fill in and a minimum time to complete it.
- No marketing. We do not add you to newsletters or mailing lists. We will only send you marketing if you clearly ask for it, and you can stop it at any time.
- Deletion. We delete requests 12 months after our last exchange. If a contract follows, the data moves to our customer records (section 8).
8. Customers and business contacts
For individuals who are personally party to a contract with us, we process data where necessary to perform that contract (Art. 6(1)(b) GDPR).
Where we process the business contact details of employees, officers or representatives of a corporate customer, partner or supplier, we rely on our legitimate interests (Art. 6(1)(f) GDPR) in administering the business relationship, communicating about services, providing support and maintaining account security.
We process invoicing, accounting and tax records where necessary to comply with legal obligations (Art. 6(1)(c) GDPR). Where needed, we may check your company's details in public registers such as the Bulgarian Commercial Register. In that case the source of the data is that register (Art. 14 GDPR).
9. Support and technical access
When providing installation, maintenance, troubleshooting or support, our personnel may temporarily access customer-controlled systems. Depending on the issue being investigated, this access may expose us to technical logs, player identifiers, usernames, IP addresses, session identifiers, matchmaking records, crash information or other application data.
We access such information only where necessary to provide the requested service, only for as long as reasonably required, and subject to contractual confidentiality, access controls and the applicable Data Processing Agreement. Access is authorised by the customer, limited to named engineers and to the minimum needed, and the credentials are revoked when the work is complete. We do not copy customer data outside the customer's environment unless the task requires it, and we securely delete any temporary copies afterwards.
10. Recipients and subprocessors
We never sell or rent personal data. We disclose it only where necessary for the purposes described in this notice: to service providers acting on our behalf, to professional advisers bound by confidentiality, or where disclosure is required by law, including to public authorities and courts or to establish, exercise or defend legal claims.
Our service providers may include infrastructure, security, email, form delivery, support, monitoring, backup and other technology providers. A current list, with each provider's purpose and processing location, is on our Subprocessor and Service Provider List.
If you allow external media and play a video, Google Ireland Ltd (YouTube) acts as an independent controller under its own privacy policy.
Where a provider processes personal data on our behalf, we require appropriate contractual and security protections in line with Art. 28 GDPR.
11. International transfers
Some of our service providers may process personal data outside the European Economic Area. Where this occurs, we use a transfer mechanism permitted by applicable data-protection law. Depending on the recipient and destination, this may include:
- an adequacy decision adopted by the European Commission (Art. 45 GDPR);
- the EU–US Data Privacy Framework, where the recipient is validly certified and the framework applies;
- the European Commission's Standard Contractual Clauses (Art. 46 GDPR); or
- another transfer mechanism permitted by applicable data-protection law.
Where required, we also assess whether supplementary technical, contractual or organisational safeguards are appropriate. The mechanism used for each provider is shown on the Subprocessor List, and you can ask us for more information.
12. Retention and backups
We retain personal data only for as long as necessary for the purposes for which it was collected, taking into account contractual requirements, legal obligations, security needs, dispute resolution and applicable limitation periods.
- Server logs: 14 days, then deleted automatically.
- Contact and call requests, emails: 12 months after our last exchange, unless a contract follows.
- Cookie choice: 6 months in your browser. We keep no copy on our server.
- Customer and contract records: for the term of the contract and afterwards for the general limitation period of 5 years under the Bulgarian Obligations and Contracts Act.
- Invoices and accounting records: as long as the Bulgarian Accountancy Act and tax laws require, generally up to 10 years.
- Support data processed for customers: as set out in the customer's Data Processing Agreement; temporary copies are deleted when the support case is closed.
Each period applies unless a longer retention period is required by law or reasonably necessary to establish, exercise or defend legal claims. When a period ends, we delete or anonymise the data.
Backups. When personal data is deleted from active systems, residual copies may remain in encrypted or access-controlled backups until those backups are automatically rotated or overwritten under our backup-retention schedule. Backup copies are not used for ordinary business purposes and are restored only where necessary for disaster recovery or system restoration.
13. Security
We apply appropriate technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss or destruction. These measures include access controls, least-privilege permissions, system hardening, encryption where appropriate (all traffic to this site uses HTTPS), secure administrative access, logging and backup protections. Security measures are reviewed and updated as our systems, risks and services evolve.
If a personal data breach is likely to put you at risk, we will inform the supervisory authority and, where required, you (Art. 33 and 34 GDPR). Where we act as a processor, we notify the affected customer without undue delay.
15. Children
Our commercial website and business-facing services are directed to businesses and are not intended for children.
Gamira customers may operate games or services used by minors. Where player information is processed within a customer-controlled Gamira deployment, the customer is responsible for determining the lawful basis for that processing and for complying with applicable requirements concerning children, parental consent, age verification and transparency.
"Evocoding" LTD does not knowingly collect player data from children directly unless a specific service arrangement explicitly requires it and appropriate legal and contractual safeguards are in place. If you believe a child has sent us data through this website, contact us and we will delete it.
16. Automated decision-making
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects, and we do not profile website visitors (Art. 22 GDPR).
Gamira provides technical functionality that customers use to automate game operations, such as matchmaking, region selection based on player pings and session allocation. "Evocoding" LTD does not independently make decisions about individual players through those customer-configured systems unless expressly agreed otherwise.
17. Your rights
Depending on the circumstances and applicable law, you may have the right to:
- access your personal data and get a copy (Art. 15);
- rectify inaccurate or incomplete data (Art. 16);
- request deletion of your data (Art. 17);
- restrict processing (Art. 18);
- receive certain personal data in a portable format: where the conditions of Art. 20 GDPR apply, you may receive personal data you provided to us in a structured, commonly used and machine-readable format and, where technically feasible, have it transmitted to another controller;
- object to processing based on our legitimate interests, and always to direct marketing (Art. 21);
- withdraw consent where processing is based on consent, for example in . Withdrawing does not affect processing done before.
These rights are subject to the conditions and exemptions provided by applicable law. To use any of them, write to [email protected]. It is free of charge. We answer within one month; for complex requests we may extend this by two more months and will tell you why. We may ask for information to confirm your identity before we act.
If your request concerns player data in a customer's Gamira deployment, where we act only as a processor, we will forward it to that customer and assist them, rather than answering it ourselves.
18. Complaints and contact
You have the right to lodge a complaint with the Bulgarian supervisory authority, the Commission for Personal Data Protection (КЗЛД), 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, www.cpdp.bg, or with the authority in the EU country where you live or work. We would appreciate the chance to resolve your concern first.
For privacy questions or requests relating to your personal data: [email protected] · "Evocoding" LTD, 38 Lyuben Karavelov St, 8000 Burgas, Bulgaria.
19. Changes to this notice
We may update this Privacy Notice from time to time. The "Last updated" date at the top shows when it was most recently revised. Where a change materially affects how we process personal data, we will provide additional notice where appropriate, and we will email customers about material changes that affect their contracts or Data Processing Agreements.