Data Protection and Privacy Policy
Everwood Farm
Demetar Company Kft. | Last updated: August 19, 2026
1. Overview
This Data Protection and Privacy Policy ("Policy") describes how Demetar Company Kft. collects, uses, stores, discloses, and protects personal data in connection with the game Everwood Farm, the website everwood.farm, and all related accounts, gameplay features, purchase and payout flows, and support channels (the "Platform").
We process personal data in accordance with Regulation (EU) 2016/679 ("GDPR"), applicable Hungarian data protection law, and other applicable privacy requirements.
We do not sell your personal data, and we do not use it for third-party advertising.
2. Data Controller
The controller responsible for your personal data is:
Demetar Company Kft. Registered address: 1043 Budapest, Bocskai út 26. Fsz. 8. ajtó, Hungary Website: https://everwood.farm Email: support@everwood.farm
3. Categories of Personal Data We Collect
Depending on how you use the Platform, we may process:
(a) Account data — email address, user ID, login and authentication data, account settings, account status, and registration date.
(b) Gameplay data — your farm and save data: game progress, level, map state, buildings, crops, animals, machines, inventory, quest state, energy, and your Gold and Gem balances.
(c) Transaction data — records of Gem purchases, in-game spending relevant to your balances, payout and reverse-conversion requests and their statuses, refunds, chargebacks, payment status, billing identifiers, and transaction history.
(d) Payment data — payment method identifiers, partial card details, payment confirmations, failed payment records, and fraud-prevention signals received from our payment providers. We do not store full card numbers; card data is handled by compliant payment providers.
(e) Payout data — where you use the payout function: the cardholder name you provide, masked card details (the first six and last four digits only), payment-ownership signals, sanctions screening results, payout request history and statuses, and related records. The full card number you enter to receive a payout is used once to send the payment and is never stored by us.
(f) Support data — messages you send us, complaints, refund and payout enquiries, and our responses.
(g) Device and technical data — IP address, browser type and version, operating system, language, time zone, request logs, error and crash data, cookies, and local storage identifiers.
(h) Security and anti-fraud data — login attempts, suspicious-activity and bot-detection signals, account risk indicators, chargeback risk data, and fraud-prevention logs.
(i) Preference data — settings such as communication preferences and opt-in/opt-out status where marketing is offered.
(j) Legal and compliance records — data we must keep for accounting, tax, consumer protection, sanctions, dispute, and other regulatory purposes.
4. How We Collect Personal Data
Directly from you — when you register, play, make a purchase, request or receive a payout, or contact support.
Automatically — technical, gameplay, and transaction data generated while you use the Platform, including through cookies and similar technologies.
From third parties — such as payment processors, fraud-prevention and sanctions screening providers, hosting providers, banks and card networks, and public authorities, where relevant to the purposes below.
5. Purposes and Legal Bases
We process personal data only with a lawful basis under Article 6 GDPR:
(a) Account and game provision — registering and authenticating you, saving your farm, operating gameplay features and balances. Basis: contract performance.
(b) Purchases — processing Gem purchases, receipts, and transaction records. Basis: contract performance; legal obligation; legitimate interests. Card payments are additionally protected with 3D Secure authentication (Visa Secure / Mastercard Identity Check).
(c) Payouts and reverse conversion — assessing payout eligibility, reviewing and approving requests, verifying payment ownership, sending approved payments to the card you provide, and keeping required records. Basis: contract performance; legal obligation; legitimate interests.
(d) Sanctions screening and fraud prevention — screening transactions and payout requests, preventing misuse, chargeback abuse, and unlawful activity. Basis: legal obligation; legitimate interests.
(e) Support and dispute handling — responding to enquiries, resolving complaints, processing refunds. Basis: contract performance; legitimate interests; legal obligation.
(f) Security and platform integrity — protecting accounts, detecting bots and cheating, monitoring faults, securing the Platform. Basis: legitimate interests; contract performance.
(g) Service improvement — analysing technical logs and aggregated gameplay data to fix issues, balance the game, and develop features. We do not use third-party advertising or cross-site tracking. Basis: legitimate interests.
(g1) Site analytics — measuring visits and usage of the Platform with Google Analytics to improve the Services. Basis: consent (given via the cookie banner and withdrawable at any time).
(h) Communications — sending service messages (receipts, payout status updates, security notices, policy updates); optional marketing only with your consent or as otherwise permitted by law. Basis: contract performance; consent; legitimate interests.
(i) Legal compliance and claims — accounting, tax, regulatory, and legal-claim obligations. Basis: legal obligation; legitimate interests.
6. Required and Optional Data
Some data is necessary to provide the Platform: without account data we cannot operate your farm; without payment data we cannot process purchases; without the card details you enter in the payout flow we cannot send an approved payout; without records required by law we cannot complete certain transactions. Optional data (such as marketing preferences) can be changed or withdrawn at any time.
7. Cookies and Similar Technologies
We use cookies and local storage as described in our Cookie Policy. Strictly necessary technologies are always used — supporting login, session security, payment flows, and basic operation. Google Analytics is used only with the user's consent, given via the cookie banner as described in the Cookie Policy. You can withdraw consent at any time via the 'Cookie settings' link in the footer.
8. Disclosure of Personal Data
We may share personal data, where necessary, with the following categories of recipients:
(a) hosting, database, infrastructure, and cloud service providers; (b) payment processors, payment service providers, banks, and card networks; (c) sanctions screening and fraud-prevention providers; (d) email delivery and communication providers; (e) technical monitoring and error-tracking providers; (f) professional advisers — legal, tax, accounting, audit, and compliance; (g) courts, regulators, tax authorities, law enforcement, and other public authorities where required or permitted by law; (h) business successors in connection with a merger, acquisition, restructuring, or transfer of business; (i) analytics providers (Google Analytics).
All service providers process personal data on our documented instructions under data processing agreements with appropriate confidentiality and security obligations.
9. International Transfers
Personal data is processed primarily in the European Economic Area. Where a provider processes data outside the EEA, we rely on appropriate safeguards: an adequacy decision of the European Commission, Standard Contractual Clauses with supplementary measures where needed, or another lawful transfer mechanism under Chapter V GDPR.
10. Data Retention
We keep personal data only as long as necessary for the purposes above:
(a) account and gameplay data — while your account is active, and for a limited period after closure for security, dispute, and legal purposes; (b) purchase, payout, accounting, and tax records — 8 years, as required by Hungarian accounting law; (c) sanctions and compliance records — for the retention period required by applicable compliance law, which may extend several years after the relevant transaction; (d) support correspondence — as long as needed to resolve the matter and keep a record of it; (e) security and server logs — for a limited period, unless needed for an investigation or legal claim.
Full card numbers entered in the payout flow are not retained at all: they are used once to send the payment and then discarded, with only the last four digits (and, in payout records, a masked number showing the first six and last four digits) kept.
When data is no longer required, we delete or anonymise it, or securely archive it where the law requires continued retention.
11. Security
We apply appropriate technical and organisational measures: encrypted connections (HTTPS), access controls, role-based permissions, logging and monitoring, secure development practices, and due diligence of service providers. Payout requests are reviewed from a separate administrator account, and administrators never see the full card numbers entered by players. No online service is completely secure — keep your credentials confidential and tell us immediately at support@everwood.farm if you suspect your account is compromised.
12. Your GDPR Rights
Subject to legal conditions and exemptions, you have the right to: access your data; rectify inaccurate data; erase your data; restrict processing; object to processing based on legitimate interests (including any direct marketing); data portability; and withdraw consent where processing is based on consent.
To exercise your rights, contact support@everwood.farm. We may need to verify your identity, and we respond within the timeframes set by the GDPR (normally one month).
13. Automated Processing
We may use automated tools to detect fraud, bots, payment risk, sanctions risk, and suspicious account behaviour, and to diagnose technical issues. We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you, unless permitted by law and accompanied by appropriate safeguards, including the right to human review. In particular, every payout request is reviewed and approved or declined individually by a human administrator.
14. Children
The Platform is intended only for users aged 18 and over. We do not knowingly process personal data of minors. If we learn that a person under 18 has created an account, we will restrict the account and delete the data, subject to legal retention requirements.
15. Communications and Marketing
We send service communications necessary to operate the Platform: purchase receipts, payout status updates, security notices, and policy updates. Marketing messages, if offered, are sent only where permitted by law, and you can opt out at any time via the unsubscribe link or by emailing support@everwood.farm.
16. Supervisory Authority
If you are not satisfied with how we handle your personal data, you may lodge a complaint with the Hungarian supervisory authority:
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) 1055 Budapest, Falk Miksa utca 9–11, Hungary https://www.naih.hu/
You may also contact the supervisory authority of your EU country of residence or workplace.
17. Changes to This Policy
We may update this Policy to reflect changes in our practices, features, providers, or legal requirements. The current version is always available on the Platform; material changes will be announced on the Platform or by email where appropriate.
18. Contact
Demetar Company Kft. Registered address: 1043 Budapest, Bocskai út 26. Fsz. 8. ajtó, Hungary Website: https://everwood.farm Email: support@everwood.farm