LGPD — Lei Geral de Proteção de Dados (Brazil)
Version 1.0 · Last updated: March 1, 2026
1. Scope and Applicability
This page describes the rights of individuals located in Brazil under the Lei Geral de Proteção de Dados (LGPD, Law No. 13.709/2018). DeckWorld (“we”, “us”) processes personal data of Brazilian users in accordance with the LGPD when providing access to the DeckWorld.games website and related applications (the “Service”).
The LGPD applies to any processing of personal data carried out in Brazil, or where the data subject is located in Brazil, or where the data was collected in Brazil. DeckWorld complies with these requirements regardless of where our servers are located.
2. Data Controller
DeckWorld Ltd., 1 Stasikratous Street, Nicosia, 1065, Cyprus, acts as the data controller (“controlador”) for the purposes of the LGPD. For questions regarding data processing, contact us at privacy@deckworld.games.
3. Legal Bases for Processing
Under the LGPD (Art. 7), we process personal data based on the following legal grounds:
| Legal Basis | LGPD Article | Application |
|---|---|---|
| Consent | Art. 7(I) | Analytics cookies, advertising cookies, marketing emails, personalization features |
| Performance of contract | Art. 7(V) | Account creation, game services, matchmaking, leaderboards, payment processing |
| Legitimate interest | Art. 7(IX) | Fraud prevention, security logging, service improvement through aggregated analytics |
| Legal obligation | Art. 7(II) | Tax records, responses to judicial or regulatory orders |
4. Your Rights Under the LGPD
As a data subject located in Brazil, you have the following rights under Art. 18 of the LGPD:
- Confirmation of processing — You may request confirmation of whether we process your personal data.
- Access to data — You may request access to all personal data we hold about you. Data is provided in JSON format within 15 business days.
- Correction of incomplete or inaccurate data — You may request that we correct any inaccurate or incomplete personal data. Most profile data can be edited directly in your account settings.
- Anonymization, blocking, or deletion — You may request anonymization, blocking, or deletion of unnecessary or excessive data, or data processed in violation of the LGPD.
- Data portability — You may request transfer of your personal data to another service provider in a structured, machine-readable format (JSON).
- Deletion of data processed with consent — You may request deletion of personal data processed on the basis of your consent, except where retention is legally required.
- Information about sharing — You may request information about public and private entities with which we have shared your data.
- Information about consent refusal — You have the right to be informed about the possibility and consequences of not providing consent.
- Withdrawal of consent — You may withdraw your consent at any time through the cookie settings panel (accessible via the cookie icon in the footer) or through your account settings. Withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal.
5. How to Exercise Your Rights
You may exercise your rights through the following methods:
| Method | Details | Response Time |
|---|---|---|
| Online (recommended) | Profile → My Data. Most requests are processed automatically within 24 hours. | Up to 15 business days |
| Send your request to privacy@deckworld.games. Include: type of request, email associated with your account, and a description of the data concerned. | Up to 15 business days |
For identity verification, logged-in users are verified automatically. For requests submitted by email, we will send a verification code to the email address associated with your account.
6. Data We Collect and Retention Periods
For a complete description of the categories of personal data we collect, the purposes of processing, and retention periods, please refer to our Privacy Policy. Key retention periods applicable to Brazilian users:
| Data Category | Retention Period |
|---|---|
| Account data | Until account deletion + 90 days (backups) |
| Access logs | 45 days |
| Game statistics | Until account deletion |
| Consent records | 5 years |
| Guest data | 365 days from last visit |
7. International Data Transfers
DeckWorld may transfer personal data of Brazilian users to servers located outside of Brazil for the purpose of providing the Service. Such transfers are carried out in compliance with Art. 33 of the LGPD and are subject to appropriate safeguards, including standard contractual clauses and adequacy assessments. We ensure that all international transfers maintain a level of data protection equivalent to that required by the LGPD.
8. Data Security
We implement technical and administrative measures to protect personal data against unauthorized access, destruction, loss, alteration, or any form of improper processing, in accordance with Art. 46 of the LGPD. These measures include:
- Encryption of data at rest (AES-256) and in transit (TLS 1.3+)
- Password hashing with bcrypt and salt
- Access controls based on the principle of least privilege
- Regular security audits and penetration testing
- Incident response procedures with notification to the ANPD and affected data subjects
9. Complaints and Supervisory Authority
If you believe that your data protection rights have been violated, we encourage you to contact us first at privacy@deckworld.games. We are committed to resolving any concerns promptly.
If you are not satisfied with our response, you have the right to file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD):
- Website: https://www.gov.br/anpd
10. Contact
For questions regarding the processing of personal data of Brazilian users:
- Data Protection Officer: dpo@deckworld.games
- Privacy inquiries: privacy@deckworld.games
- Postal address: DeckWorld Ltd., 1 Stasikratous Street, Nicosia, 1065, Cyprus