Data Privacy Policy

Effective date: May 20, 2018

Starting May 25, 2018, the new European legislation for data protection (GDPR) is in effect. This law requires pretty much every web page in the world to adhere to specific requirements.
In my personal view as administrator of Xu-Fu's Pet Guides, this is a great thing, even though it means that many smaller pages like my own will need to make adjustments even if they were never the target of this legislation. After all, Xu-Fu is a private project that is not aiming to sell you stuff or make profit through or with your data.

Still, this is a good opportunity to work on transparency. Below is everything to know about what the page does and what it doesn't. There is a lot of mandatory parts, some points are directly related to GDPR, and some just for the sake of making all info available that there is :-)

1. Types of Data Collected

1.1 Personal Data

When registering as a user, Xu-Fu gives the option to provide certain personally identifiable information that can be used to contact or identify you ("Personal Data"). Personally identifiable information may include, but is not limited to:

• Your email address

• Cookies and Usage Data

• Personal information provided by you on your account profile

1.2 Usage Data

Xu-Fu may also collect information how the Service is accessed and used ("Usage Data"). This Usage Data includes information such as your computer's Internet Protocol address (e.g. IP address), the pages you visit and the time and date of your visit. All this is done to identify spam bots and prevent their entry.
All this data is erased automatically after 7 days of your visit.

2. Cookies

Cookies are files with a small amount of data which may include an anonymous unique identifier. Cookies are sent to your browser from the website and stored on your device.
You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of the page, for example the setting of a preferred display language (see above).

2.1 Cookies in use:

• Session Cookies. Xu-Fu uses Session Cookies to operate the web page. This ensures that information such as your preferred language is carried over between individual pages when browsing through the page.

• Preference Cookies. Xu-Fu uses Preference Cookies to remember your language setting.

• User ID. Only in use if you register an account and tick "Remember me" upon login. Allows the page to identify your account on later visits to log you in automatically.

• Google AdSense. See below.

2.2 DoubleClick DART Cookie

Google is one of a third-party vendor on our site. It also uses cookies, known as DART cookies, to serve ads to our site visitors based upon their visit to www.wow-petguide.com and other sites on the internet. However, visitors may choose to decline the use of DART cookies by visiting the Google ad and content network Privacy Policy at the following URL – https://policies.google.com/technologies/ads.
Google may use cookies and web beacons. Google AdSense have their own Privacy Policy for their policies on user data: https://policies.google.com/technologies/ads.

2.3 NitroPay / GG Software LP Ads

Advertising on this Website or App is managed by NitroPay / GG Software LP. If GG Software LP publisher advertising services are used, GG Software LP may collect and use certain aggregated and anonymized data for advertising purposes. To learn more about the types of data collected, how data is used and your choices as a user, please visit https://nitropay.com/privacy.

3. Data Minimisation

GDPR requires that only those details are saved that are required to operate the service and only those people have access to it who need it for the service to function.
In terms of access, only the page admin and the web service provider (see below) can access any of the stored data.

This is what Xu-Fu saves about you only when you register a user account:

• Your chosen username

• Your password in a hashed version. Hashing is an irreversible process to mask a password. The masked version cannot be used for anything and your actual password cannot be retrieved from it. Your clear text password is not stored anywhere, only the password hash is.

• Your email address, if you provide one. You can remove it in your account setting at any time and it is only used for password reset emails, nothing else.

• The date of your registration.

• Account preferences. Optional information that modifies how the page works for you, for example: display language, user icon, a connected WoW character, preferences for how specific pages show you information.

• Your profile info. Optional information about yourself, for example: personal description, links to social media, favourite pet etc. - all this can be edited and removed at any time in the profile settings

• If a pet collection is added, this is also gathered and saved from the public WoW armory.

If you signed up using Battle.net authentication, a few more things are stored:

• Your Battle Tag

• A unique access token that allows Xu-Fu to see your Battle Tag and which WoW characters are on your account. This token does not allow access to any other data. You can revoke it at any time in your Battle.net security settings.

• If a pet collection is available through Battle.net, it is from the public armory and saved.

4. Right to Data Deletion

If you did not register an account, all data about your visit is automatically deleted 7 days after the visit.
If you do have a user account, there is an option at the bottom of your account settings to permanently delete your account. It does what it says :-)

5. Right to Access

If you would like a copy of all data stored about your user account, please send an email to [email protected].

6. Data Security

The security of your data is important to us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

7. Service Providers

We employ a third party company to facilitate our Service. This is the Web Service Provider responsible for hosting the web page (InMotion Hosting, https://www.inmotionhosting.com).
This third party has access to your Personal Data only to perform these tasks on our behalf and is obligated not to disclose or use it for any other purpose.

8. Links To Other Sites

Xu-Fu's Pet Guides contains links to other sites that are not operated by us. If you click on a third party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit.
We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

9. Children's Privacy

Xu-Fu's Pet Guides does not address anyone under the age of 18 ("Children").

We do not knowingly collect personally identifiable information from anyone under the age of 18. If you are a parent or guardian and you are aware that your Children has provided us with Personal Data, please contact us. If we become aware that we have collected Personal Data from children without verification of parental consent, we take steps to remove that information from our servers.

10. For California Residents: CCPA Information

10.1 Rights and Choices

The CCPA provides consumers located in the state of California with certain rights regarding their personal information and data. The following section describes those rights and explains how to exercise them:

10.2 Access to Specific Information and Data Portability Rights

You have the right to request that GG Software LP disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable consumer request (as described in the section “Exercising Access, Data Portability, and Deletion Rights”), we will disclose to you:

• The categories of personal information we collected about you.

• The categories of sources for the personal information we collected about you.

• Our business or commercial purpose for collecting or selling that personal information.

• The categories of third parties with whom we share that personal information.

• The specific pieces of personal information we collected about you (also called data portability request)

• If we sold or disclose your personal information for a business purpose, two separate lists disclosing:

=> Sales, identifying the personal information categories that each category of recipient purchased, and
=> Disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained

10.3 Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:

• Deny you goods or services.

• Charge you different prices or rates for goods or services, including through granting discounts or imposing penalties.

• Provide you a different level or quality of goods or services.

• Suggest that you may receive a different price or rate for goods or services or a different level of quality of goods or services.

Any CCPA-permitted financial incentive we offer will reasonably relate to your value and contain written terms that describe the program’s material aspects.

10.4 Exercising Access, Data Portability, and Deletion Rights

To exercise the access, data portability, and deletion rights described above, please submit a verifiable consumer request to us by emailing us at [email protected]

Only you, or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child.

You may only make a verifiable consumer request for access of data portability twice within a 12-month period. The verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.

• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.

Making a verifiable consumer request does not require you to create an account with us. We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

10.5 Information We Collect

Our websites, emails (with your consent, where required by law), and other products, services and platforms collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device (“personal information”). In particular, our websites, apps, emails, and other products, services and platforms may have collected the following categories of personal information from its consumers within the last twelve (12) months:

Category	Collected
A. Identifiers	Yes
B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))	Yes
C. Protected classification characteristics under California or federal law	No
D. Commercial information.	Yes
E. Biometric information.	No
F. Internet or other similar network activity.	Yes
G. Geolocation data.	Yes
H. Sensory data.	No
I. Professional or employment-related information.	No
J. Inferences drawn from other personal information.	Yes

Personal information does not include:

• Publicly available information from government records.

• Deidentified or aggregated consumer information.

• Information excluded from the CCPA’s scope, like:

=> health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data;
=> personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver’s Privacy.

10.6 Use of Personal Information

We may use or disclose the personal information we collect for one or more of the following business purposes:

• To fulfill or meet the reason you provided the information. For example, if you share your name and contact information to request a newsletter or ask a question about our products or services, we will use that personal information to respond to your inquiry. If you provide your personal information to purchase a product or service, we or our third-party service providers will use that information to process your payment and facilitate delivery. We may also save your information to facilitate new product or service orders and requests.

• To provide, support, personalize, and develop our websites, emails, and other products, services and platforms.

• To create, maintain, customize, and secure your account with us.

• To process your requests, purchases, transactions, and payments and prevent transactional fraud.

• To provide you with support and to respond to your inquiries, including investigating and addressing your concerns and monitoring and improving our responses.

• To personalize your website, apps, emails, or other product, service or platform experience and to deliver content and product and service offerings relevant to your interests, including targeted offers and ads through our websites, apps, emails, and other products, services and platforms.

• To help maintain the safety, security, and integrity of our websites, apps, emails, and other products, services and platforms, databases and other technology assets, and business.

• For testing, research, analysis, and product development, including to develop and improve our websites, apps, emails, and other products, services and platforms.

• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.

• As described to you when collecting your personal information or as otherwise set forth in the CCPA.

• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of the Company’s assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by the Company about our Website users is among the assets transferred.

The Company will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

10.7 Sharing Personal Information

The Company may disclose your personal information to a third-party for a business purpose or sell your personal information, subject to your right to opt-out of those sales (see ‘Sales of Personal Information’ below). When we disclose personal information for a business purpose, we enter a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract. The CCPA prohibits third parties who purchase the personal information we hold from reselling it unless you have received explicit notice and an opportunity to opt-out of further sales (see ‘Sales of Personal Information’ below).

We may share your personal information with the following categories of third parties:

• Subsidiaries and affiliates.

• Contractors and service providers.

• Data aggregators.

• Third parties with whom we partner to offer products and services to you.

10.8 Disclosures of Personal Information for a Business Purpose

In the preceding twelve (12) months, the Company has disclosed the following categories of personal information for a business purpose:

• [Category A: Identifiers.]

• [Category B: California Customer Records personal information categories.]

• [Category F: Internet or other similar network activity.]

• [Category G: Geolocation Data.]

• [Category K: Inferences drawn from other personal information.]

10.9 Sales of Personal Information

In the preceding twelve (12) months, the company has not sold any personal information.