Latest update: July 10, 2023
Toca Boca Privacy Notice
For Participants of Research Activities
Toca Boca is committed to protecting your privacy and the secure processing of your personal data. Toca Boca strives to limit the processing of personal data as far as possible and does not collect personal data beyond what is necessary.
Needless to say all processing of personal data, including the collection, registration, storing and general handling is governed by applicable privacy legislation, including the General Data Protection Regulation (GDPR). Toca Boca strives to make sure that the processing of personal data done by Toca Boca, as the controller, is done in accordance with applicable legislation.
Should you have any questions related to privacy and/or your rights, you can contact us at privacy@tocaboca.com or if you want to contact our DPO you can send an email to DPO@spinmaster.com. Below you will also find detailed information on how we process your personal data, on your rights and how you can exercise them.
Who Are We?
At Toca Boca, our website (www.tocaboca.com) is just for parents, while our apps are designed for the whole family, including young children with parent supervision. We take privacy seriously at Toca Boca and this notice is designed to share what information we collect and how we use it. When Toca Boca processes your personal information in accordance with this Privacy Notice, we are the “controller” of your data as defined by the GDPR and other applicable legislation.
Our contact details are:
Toca Boca AB
Attn: Privacy Officer
Box 90293
120 24, Stockholm, Sweden
Our email address for all matters related to privacy is: privacy@tocaboca.com
Our DPO can be reached here:
Data Protection Officer
225 King Street West
Toronto, ON M5V 3M2
Or via email at dpo@spinmaster.com
When does this privacy notice apply?
This Privacy Notice applies when we collect, use or otherwise process data in relation to actions related to research activities. This includes information processed when taking part in any research activity. The data which we process is collected directly from you or by monitoring your actions in testing.
PlaytestCloud
If you are partaking in a Research Activity through PlaytestCloud, PlaytestCloud and Toca Boca are joint controllers of your data. Through the PlaytestCloud platform, Toca Boca processes the following data about playtesters (both parents and children):
Playtesters’ gender, age, nationality, country of residence, name/tester nametag - for parents we only process your first name and we can only process the age of your child (if your child is enrolled in PlaytestCloud for testing)
Video and audio recordings (video recordings of playtest with audio from players)
Device types players are using for the playtest (e.g Samsung Galaxy)
Gaming habits (e.g. hours spent playing games, favorite games)
Transcriptions of playtests and interviews
Surveys responses - survey collecting additional information about playtesters which helps us understand our players and support recruitment for research activities (e.g. previous experience with Toca Boca products, knowledge about competitors, information about opinion about in-app purchases)
We are only collecting information about playtesters that are necessary to carry out research activities and/or recruitment of participants.
Self identified ethnicity and self identified disabilities
Toca Boca is all about inclusion, diversity, and the strong belief that every child should be seen and cherished for who they are. It is therefore important for us that participants in our research activities mirror the diversity of our players so that we can make sure that our principle of inclusion can be maintained throughout the development process as we add features to our games and create new games.
For some research activities such as joining the Toca Boca Kids Panel or signing up for a research activity you can therefore choose to fill in your self identified ethnicity or fill in information on if there is anything hindering your child when playing our apps. This is completely optional, but if you do consent to the processing of this type of data we want you to know that we will only process this data in order to make sure that the participants of our research activities mirror the diversity of our players. Toca Boca takes all reasonable measures to ensure that your personal data is treated with an adequate level of protection and in accordance with applicable laws and you can at any time withdraw this consent, just email us at privacy@tocaboca.com.
Whom may we share your data with?
We may share your personal data with the categories of recipients listed below, for the purposes listed below in the section “suppliers and subcontractors”. When we share your personal data, we take all reasonable measures to ensure that your personal data is treated with an adequate level of protection and in accordance with applicable laws.
Suppliers and subcontractors
We process personal data with the help of suppliers and subcontractors, such as such as Google Inc (G Suite for Business, Google Firebase and GCP), Unity (Unity Platform), Apple (Apple TestFlight) and Amazon Web Services (Such as EC2, S3, Cloudfront, RDS, Cloudwatch). Suppliers and subcontractors are companies which only are entitled to process the personal data they receive from Toca Boca on our behalf.
Toca Boca acts as the "data controller" (GDPR) or "business" (The California Consumer Privacy Act, CCPA) for any personal data or information about our users. Toca Boca’s suppliers and subcontractors operate as "data processors" (GDPR) or "service providers" (CCPA).
Authorities
We disclose necessary information to authorities such as the Swedish Authority for Privacy Protection and The Swedish Police or other law enforcing authorities, if we are required to do so by law, or under some circumstances if you have requested us to do so.
Where do we process your personal data?
Our aim is to process your personal data within the EU/EEA. In some situations, such as when we share your personal data with a supplier or subcontractor located outside the EU/EEA, your personal data may however be transferred to, and processed in, a destination outside of the EU/EEA.
We strive to ensure that an adequate level of protection is maintained, and that suitable safeguards are adopted. This means ensuring that the third country or state is subject to an adequacy decision by the European Commission or implementing the European Commission’s standard contractual clauses.
For how long will we store your personal data?
We will retain your personal data for the period necessary to fulfill the purposes outlined in this Privacy Notice. When your personal data is no longer relevant for the purposes for which it has been collected, we strive to erase or anonymize it. We keep regular play tests, interviews and survey responses maximum three years after you and your child's participation. Longer interviews and deep studies we keep a maximum of five years after you and your child have participated.
Your rights
Under the GDPR and UK GDPR (UK General Data Protection Regulation) you have certain rights concerning the processing of personal data by us. The following rights may be applicable for you.
If you would like to access, correct, erase or limit the use or disclosure of any personal data about you that has been collected and stored by Toca Boca or exercise any other right under applicable data protection legislation, please notify us at privacy@tocaboca.com so that we may consider and respond to your request in accordance with applicable law.
Right of information: You have the right to be provided information regarding the processing of your personal data by us.
Right of access: You have the right to obtain confirmation as to whether or not we are processing your personal data and, if this should be the case, access to the personal data.
Right to rectification: You have the right to obtain rectification of inaccurate or incomplete personal data concerning you.
Right to erasure (“right to be forgotten”): Under certain circumstances you have the right to obtain the erasure of personal data concerning you.
Right to restriction: Under certain circumstances you have the right to obtain the restriction of processing.
Right to data portability: Under certain circumstances you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and the right to transmit this data to another controller.
Right to object: Under certain circumstances you have the right to object to the processing of personal data concerning you. This includes but is not limited to the right to object in cases in which we process your personal data based on legitimate interest.
Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority if you consider that Toca Boca’s processing of personal data relating to you infringes the GDPR.
Right to withdraw consent: If a processing of your personal data is based on your consent as set out you have the right to withdraw your consent at any time.
Right to not be subject to a decision based solely on automated processing: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
How we protect your information
We are committed to protecting our users' personal data and are among other things using pseudonymization, encryption and user based access levels to protect your data. We strive to take appropriate technical and organizational measures to ensure the protection of your personal data.
Notice to California Residents:
Under California Civil Code sections 1798.83, California residents are entitled to ask us for a notice describing what categories of Personal Information we share with third parties or corporate affiliates for those third parties or corporate affiliates' direct marketing purposes. Please note that we do not share your Personal Information with any third parties or affiliates for their direct marketing purposes.
CCPA provides consumers who are California residents with specific rights regarding their Personal Information.
Right to Access: If you are a California resident, you have the right to request, up to two times each year, access to categories and specific pieces of personal information about you that we collect, use and/or disclose.
Right to Delete: If you are a California resident, you have the right to request that we delete personal information that we collect from you, subject to applicable legal exceptions.
Right to Opt Out of Sale of Personal Information: As the term is defined by the CCPA, Toca Boca does not sell any personal information.
To make a request regarding your rights as described above, please send an email to privacy@tocaboca.com or write to us, using the address above.
Changes to this Privacy Notice
This privacy notice may be changed from time to time to accommodate new technologies, industry practices, regulatory requirements or for other purposes. We will provide notice to you if these changes are material and, where required by applicable law, we will obtain your consent. Notice may be by email to you at the last email address you provided us, by posting notice of such changes on our sites and applications, or by other means, consistent with applicable law. The date of the last modification is stated at the top of this document.