Latest update: March 2023
Toca Boca Privacy Notice
For Participants of Toca Play Test
Toca Boca is committed to protecting your privacy and the secure processing of your personal data and we strive to limit the processing of personal data as far as possible and do not collect personal data beyond what is necessary.
Needless to say all processing of personal data, including the collection, registration, storing and general handling is governed by applicable privacy legislation, including the General Data Protection Regulation (GDPR). Toca Boca strives to make sure that the processing of personal data done by Toca Boca, is done in accordance with applicable legislation.
Should you have any questions related to privacy and/or your rights, you can contact us at privacy@tocaboca.com or our Data Protection Officer at DPO@spinmaster.com. Below you will also find detailed information on how we process your personal data, on your rights and how you can exercise them.
Who Are We?
Toca Boca is an award-winning play studio that creates digital toys and everyday products for kids.
Our website (www.tocaboca.com) is just for parents, while our apps are designed for the whole family, including young children with parental supervision. We take privacy seriously at Toca Boca and this notice is designed to share what information we collect and how we use it. When Toca Boca processes your personal information in accordance with this Privacy Notice, we are the “controller” of your data as defined by the GDPR and other applicable legislation.
Our contact details are:
Toca Boca AB
Attn: Privacy Officer
BOX 90293
120 31, Stockholm, Sweden
Our email address for all matters related to privacy is: privacy@tocaboca.com
The contact details to our Data Protection Officer are:
SpinMaster Ltd.
Attn:Data Protection Officer
225 King Street West
Toronto, ON M5V 3M2
When does this privacy notice apply?
This Privacy Notice applies when we collect, use or otherwise process personal data in relation to play tests that Toca Boca conducts. This includes information processed during sign up for the test as well as data collected in surveys, interviews and during the testing.
The technical data which we process is collected directly from you or by monitoring your actions in testing.
Personal data we may process, for what purpose, and based on which legal ground?
| Purpose of the processing | Types of information | Legal grounds for the processing |
| Play Test
We are running user tests for new games and new features for existing games. We do this to evaluate the quality of the games and to ensure consumer engagement. In order for us to learn about your player experience we may also conduct a survey. |
Parent: email, number of children in the household,
Child participating: year of birth, gender, |
Our Legitimate Interest |
| If you participate in a test conducted by Toca Boca we also process the following personal information
|
||
| Customer/Game database game specific data vital to play-experience hosting |
Game specific data vital to play-experience hosting (App-instance ID, IP address) | Our Legitimate Interest |
| Technical optimization of own services and products
user metrics to optimize our services and products |
Technical analytics via App-instance ID (The ID is used to compute user metrics throughout Analytics), IP address | Our Legitimate Interest |
| Customer management
user metrics helping users and parents experiencing issues in the app |
Contact information: Name, Email address | Our Legitimate Interest |
| App stability monitoring user metrics to monitor app stability and solve live issues |
Crashlytics: Firebase crashlytics monitoring and crash reports and Backtrace crash reports |
Our Legitimate Interest |
| Player data analysis
user metrics for – better understanding of player behaviors in general – better understanding of user behavioral patterns across sessions/over time in general – balance and tailor play experience and content offering to users in general – improving UX and UI |
By using App-instance ID, we analyze user In-game behaviors (The ID is used to compute user metrics throughout Analytics) IP address Read more bout App-instance ID here: Firebase App-instance ID |
Our Legitimate Interest |
| Customer Support
– Used to provide customers with in-app functionality to get help or reach FAQ sections through Helpshift |
By using anonymous issue filing through Helpshift we can provide contextual help or customer support through automated responses to common issues in the game. | Our Legitimate Interest |
| Live-ops If we ask your child to participate in a test we will collect user metrics to control live ops events in regions where Firebase is not available |
By using device region settings we get a Coarse Location. (Information that describes the location of a user or device with lower resolution than a latitude and longitude with three or more decimal places, such as Approximate Location Services) |
Our Legitimate Interest |
Whom may we share your data with?
We may share your personal data with the categories of recipients listed below, for the purposes listed below in the section “suppliers and subcontractors”. When we share your personal data, we take all reasonable measures to ensure that your personal data is treated with an adequate level of protection and in accordance with applicable laws.
Suppliers and subcontractors
We share personal data with the suppliers and subcontractors we use, such as Google Inc (Workspace, Google Firebase, BETA test and GCP), Unity (Unity Platform), Amazon Web Services (Such as EC2, S3, Cloudfront, RDS, Cloudwatch) and Qualtrics (Design XM).
Suppliers and subcontractors are companies which only are entitled to process the personal data they receive from Toca Boca on our behalf.
Toca Boca acts as the “data controller” (GDPR) or “business” (The California Consumer Privacy Act, CCPA) for any personal data or information about our users. Toca Boca’s suppliers and subcontractors operate as “data processors” (GDPR) or “service providers” (CCPA).
Authorities
We disclose necessary information to authorities such as the Swedish Authority for Privacy Protection and other authorities if we are required to do so by law, or under some circumstances if you have requested us to do so.
Where do we process your personal data?
Our aim is to process your personal data within the EU/EEA. In some situations, such as when we share your personal data with a supplier or subcontractor located outside the EU/EEA, your personal data may however be transferred to, and processed in, a destination outside of the EU/EEA.
We strive to ensure that an adequate level of protection is maintained, and that suitable safeguards are adopted. This means ensuring that the third country or state is subject to an adequacy decision by the European Commission or implementing the European Commission’s Standard Contractual Clauses.
For how long will we store your personal data?
We will retain your personal data for the period necessary to fulfil the purposes outlined in this Privacy Notice. When your personal data is no longer relevant for the purposes for which it has been collected, we strive to erase or anonymize it.
Your rights
Under the GDPR and UK GDPR (UK General Data Protection Regulation) you have certain rights concerning the processing of personal data by us. The following rights may be applicable for you.
If you would like to access, correct, erase or limit the use or disclosure of any personal data about you that has been collected and stored by Toca Boca or exercise any other right under applicable data protection legislation, please notify us at privacy@tocaboca.com so that we may consider and respond to your request in accordance with applicable law.
If you want to contact our Data Protection Officer directly you can do so at DPO@spinmaster.com.
Right of information: You have the right to be provided information regarding the processing of your personal data by us.
Right of access: You have the right to obtain confirmation as to whether or not we are processing your personal data and, if this should be the case, access to the personal data.
Right to rectification: You have the right to obtain rectification of inaccurate or incomplete personal data concerning you.
Right to erasure (“right to be forgotten”): Under certain circumstances you have the right to obtain the erasure of personal data concerning you.
Right to restriction: Under certain circumstances you have the right to obtain the restriction of processing.
Right to data portability: Under certain circumstances you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and the right to transmit this data to another controller.
Right to object: Under certain circumstances you have the right to object to the processing of personal data concerning you. This includes but is not limited to the right to object in cases in which we process your personal data based on legitimate interest. o
Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority if you consider that Toca Boca’s processing of personal data relating to you infringes the GDPR.
Right to withdraw consent: If a processing of your personal data is based on your consent as set out you have the right to withdraw your consent at any time.
Right to not be subject to a decision based solely on automated processing: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
How we protect your information
We are committed to protecting our users’ personal data and are among other things using pseudonymization, encryption and user based access levels to protect your data. We strive to take appropriate technical and organizational measures to ensure the protection of your personal data.
Notice to California Residents:
Under California Civil Code sections 1798.83, California residents are entitled to ask us for a notice describing what categories of Personal Information we share with third parties or corporate affiliates for those third parties or corporate affiliates’ direct marketing purposes. Please note that we do not share your Personal Information with any third parties or affiliates for their direct marketing purposes.
CCPA provides consumers who are California residents with specific rights regarding their Personal Information.
Right to Access: If you are a California resident, you have the right to request, up to two times each year, access to categories and specific pieces of personal information about you that we collect, use and/or disclose.
Right to Delete: If you are a California resident, you have the right to request that we delete personal information that we collect from you, subject to applicable legal exceptions.
Right to Opt Out of Sale of Personal Information: As the term is defined by the CCPA, Toca Boca does not sell any personal information.
To make a request regarding your rights as described above, please send an email to privacy@tocaboca.com or DPO@spinmaster.com or write to us, using the addresses above.
Changes to this Privacy Notice
This privacy notice may be changed from time to time to accommodate new technologies, industry practices, regulatory requirements or for other purposes. We will provide notice to you if these changes are material and, where required by applicable law, we will obtain your consent. The notice may be sent to you by email to the last email address you provided us with, by posting notice of such changes on our sites and applications, or by other means, consistent with applicable law. The date of the last modification is stated at the top of this document.