Privacy Policy

Privacy Policy

This Privacy Policy is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (the "GDPR") and Italian Legislative Decree no. 196/2003 (the Data Protection Code, as amended by Legislative Decree no. 101/2018). It describes how Emerals S.R.L. collects and processes the personal data of users of the Emerals website and related services (the "Services"), including the portal features, authentication, the purchase of perks and the connection to the game server.

Please read this document carefully before using the Services. For the terms of use, please refer to the Terms and Conditions; for the company's full corporate details, please refer to the Legal Notice.

In case of any discrepancy between the language versions, the Italian version prevails.

1. Data Controller

The controller of the personal data is:

Emerals S.R.L. Via Sile 41, 31056 Roncade (TV), Italy VAT no. / Tax code: 05512280263 REA: TV - 450261 Certified email (PEC): [email protected]

Legal representative: Michele Mangiacotti.

The Controller has not appointed a Data Protection Officer (DPO), as the conditions making such appointment mandatory under Article 37 GDPR are not met.

For any request relating to the processing of personal data and for the exercise of the rights described below, you may write to: [email protected].

2. Scope

This Privacy Policy applies to the processing of personal data carried out through the Emerals website and Services. It does not apply to third-party websites, applications or services that may be linked or referenced, which are subject to their own privacy policies. We encourage you to review the privacy policies of the third-party providers referenced in this document.

3. Categories of personal data processed

In connection with the Services, the following categories of personal data may be processed:

• Account data: name or username, email address and profile picture (avatar) imported from Discord at the time of authentication.
• Social / OAuth account identifiers: user identifiers of the providers used to sign in (Discord, Google, Twitch) and the related access and refresh tokens, retained to keep the session and the account connection active.
• In-game identifiers: data relating to the connection of the account with the FiveM server, identifiers such as Steam ID, license and Discord ID, as well as the IP address collected when redeeming codes and perks within the game.
• Technical and session data: IP address, user-agent (browser and device information), date and time of access, technical and system logs necessary for the operation and security of the Services.
• Purchase data: amounts, transaction identifier, payment method and products purchased. Payment card data is handled directly by Tebex and is not stored by Emerals. Emerals only receives the confirmation and the non-financial details required to deliver the purchased perks.
• Emerals Coins balance: the internal virtual currency associated with the account and its related transactions.
• Affiliate program data: creator code associated with the user and data relating to earnings accrued, for those who join the program.
• Quests and progress: data relating to quests, objectives and progress accrued within the Services.
• Support communications: the content of messages sent through the contact form (delivered via Resend) and through the live chat (Tawk.to), including the contact details provided and any technical data collected by such tools.
• Discord bot data: see section 3-bis.

Providing the data strictly necessary to create the account, deliver the Services and manage purchases is mandatory: failure to provide it makes it impossible to use the Services or part of them.

3-bis. Discord bot "Emerals BOT"

Emerals S.R.L. operates a Discord bot ("Emerals BOT", Discord application ID 1082287022212923453) in the Emerals Roleplay Discord server (server ID 700433820402581594). The bot provides the support ticket system and related staff tools. This section describes the processing carried out through the bot.

Data processed by the bot

• Discord user ID, username, display name and server roles of the members who open tickets or interact with the bot.
• Content of the messages written inside ticket channels (text, mentions, references to attachments) and the reason given when closing a ticket.
• Voice channel connection state of staff members, only when an administrator runs the meeting attendance check.
• Ticket statistics (number of tickets opened/closed, average handling times), without personal data.

Purposes and legal basis

• Providing support through tickets and keeping a record of the conversation (performance of a contract / legitimate interest, Art. 6(1)(b) and (f) GDPR).
• Automated first-line answers inside tickets: the messages written by the ticket opener are sent to Anthropic, PBC (Claude API) to generate a draft answer based on our rules and FAQs. The assistant does not take decisions with legal or similarly significant effects; a human staffer can intervene at any time and takes over sensitive requests (bans, permadeath, refunds). Message content is not used to train or fine-tune AI models.
• Staff tooling (attendance check, role management, ticket statistics) - legitimate interest in organising the community.

Where the data is stored and for how long

• Ticket transcripts (HTML) are posted in a staff-only Discord channel and sent to the user who opened the ticket. They are not stored on our servers.
• A log of the assistant's interactions (the player's question, the assistant's answer, confidence score, ticket category, escalation reason and staff rating) is stored on servers controlled by Emerals S.R.L. in the European Union for 30 days to review and improve the assistant, then deleted or anonymised.
• Server member data (IDs, roles, voice state) is read at the moment a command is executed and is not stored.
• Ticket statistics contain no personal data and are kept indefinitely.
• Data processed by the bot is encrypted in transit; access is limited to the bot process and to authorised administrators.

Recipients

• Discord Inc. (platform).
• Anthropic, PBC (AI inference on ticket messages). Transfers to the United States are covered by the safeguards described in section 7.
• Hosting provider of the bot.

Your rights

You can ask for access to or deletion of the data processed by the bot (including the assistant log and any transcript we still hold) by writing to [email protected] or by opening a ticket in the Discord server. Requests are handled within 30 days. Leaving the server does not delete data already logged: ask for deletion explicitly.

The bot does not read messages outside ticket channels, does not use the Discord Presence intent and does not sell, rent or share data for advertising.

4. Sources of the data

Personal data is collected, pursuant to Articles 13 and 14 GDPR:

• Directly from the user, when creating an account, using the Services, making a purchase, redeeming a code or contacting us.
• From the authentication (OAuth) providers Discord, Google and Twitch, when the user chooses to sign in or link their account through such services: in this case we receive the identifiers and profile data made available by the provider based on the authorizations granted.
• From Tebex, the provider that handles payments, from which we receive the purchase data needed to deliver the perks (excluding card data, which remains handled by Tebex).

5. Purposes of processing and legal bases

Personal data is processed for the purposes and on the legal bases set out in the following table:

Purpose	Legal basis (Art. 6 GDPR)
Account management, provision of the Services and delivery of perks	Performance of a contract - Art. 6(1)(b)
Processing of payments through Tebex	Performance of a contract - Art. 6(1)(b)
Compliance with tax and accounting obligations (retention of invoices and documents)	Legal obligation - Art. 6(1)(c)
Fraud prevention, security of the Services and enforcement of bans	Legitimate interest - Art. 6(1)(f)
Non-essential / statistical cookies and any marketing communications	Consent - Art. 6(1)(a)
Establishment, exercise or defense of a legal claim	Legitimate interest - Art. 6(1)(f)

Where processing is based on legitimate interest, the Controller has carried out a balancing test between its interest and the rights and freedoms of the data subjects; the user may at any time exercise the right to object as described in paragraph 9.

6. Recipients of the data and data processors

In order to provide the Services, personal data may be disclosed to third parties acting as data processors or as independent controllers, including:

• Tebex - payment processing (Merchant of Record).
• Discord, Google and Twitch - authentication and sign-in via OAuth.
• Resend - sending of the emails generated by the contact form.
• Tawk.to - live chat service.
• Anthropic, PBC - AI assistant for support tickets on the Discord server.
• Hosting provider - infrastructure on which the website and Services are hosted.
• FiveM / Cfx.re game infrastructure - platform on which the game server operates.
• Emerals backend services (for example discorddata.emeralsrp.it) - internal systems supporting the provision of the Services.

Data may also be disclosed to public authorities, judicial bodies or professional advisors, where necessary to comply with legal obligations or to establish, exercise or defend a legal claim.

We recommend reviewing the respective privacy policies of the third-party providers to understand how they process personal data.

7. Transfers of data outside the European Union

Some of the providers indicated above may process personal data outside the European Economic Area (EEA), for example in the United States. In such cases, the transfer takes place in compliance with Chapter V of the GDPR, on the basis of an adequacy decision of the European Commission or of appropriate safeguards, such as the Standard Contractual Clauses (SCC) adopted by the European Commission, where appropriate supplemented by additional measures. You may request further information on the safeguards applied by writing to [email protected].

8. Retention periods

Personal data is kept for as long as strictly necessary to achieve the purposes for which it was collected and, in particular:

• Account data and data related to the Services: for as long as the account is active and for a reasonable period after the account is closed, in order to handle any disputes, security needs and enforcement.
• Tax and accounting data (invoices and purchase documents): for 10 years, in compliance with legal obligations.
• Technical and session logs: for a limited period, proportionate to security and diagnostic purposes.

At the end of the retention periods, the data is deleted or irreversibly anonymized, unless further retention is required by law.

9. Rights of the data subject

As a data subject, pursuant to Articles 15 to 22 of the GDPR, you have the right to:

• Access (Art. 15): obtain confirmation as to whether processing is taking place and a copy of your personal data.
• Rectification (Art. 16): obtain the correction of inaccurate data or the completion of incomplete data.
• Erasure (Art. 17): obtain the deletion of your data, in the cases provided for by law.
• Restriction (Art. 18): obtain the restriction of processing in the cases provided for.
• Portability (Art. 20): receive the data you provided in a structured, commonly used and machine-readable format, and transmit it to another controller.
• Objection (Art. 21): object to processing based on legitimate interest.

To exercise these rights, simply send a request to [email protected]. The Controller will respond within the time limits set by law. The exercise of these rights is free of charge, except in cases of manifestly unfounded or excessive requests.

10. Withdrawal of consent

Where processing is based on consent (for example for non-essential or statistical cookies or for any marketing communications), the user may withdraw it at any time, as easily as it was given and without affecting the lawfulness of processing carried out before the withdrawal. Cookie preferences can be changed at any time through the "Cookie preferences" panel.

11. Automated decision-making and profiling

The Controller does not carry out automated decision-making, including profiling, that produces significant legal effects or that similarly significantly affects the user, within the meaning of Article 22 GDPR. Any automated checks may be carried out solely for fraud prevention and security purposes, without giving rise to significant decisions based solely on automated processing.

12. Cookies

The website uses cookies and similar technologies. For detailed information on the types of cookies used, their purposes and durations and how to manage and withdraw consent, please refer to the Cookie Policy.

13. Security measures

The Controller adopts appropriate technical and organizational measures to protect personal data against unauthorized access, loss, destruction or disclosure, including encryption of data in transit, access control, privilege limitation and the adoption of procedures aimed at ensuring the confidentiality, integrity and availability of the data. No system can, however, guarantee absolute security.

14. Minors

The Services are intended for users who are at least 16 years of age. The Controller does not knowingly collect personal data from minors under the age of 16 without the consent of the holder of parental responsibility. Should we become aware of the processing of a minor's data without a valid legal basis, we will delete it without undue delay.

15. Right to lodge a complaint

Without prejudice to any other administrative or judicial remedy, a data subject who considers that the processing of their personal data infringes the GDPR has the right to lodge a complaint with the supervisory authority:

Garante per la protezione dei dati personali (Italian Data Protection Authority) Piazza Venezia 11, 00187 Rome, Italy www.garanteprivacy.it

16. Changes to this Privacy Policy

The Controller reserves the right to amend or update this Privacy Policy, including in order to align it with new legal provisions or changes to the Services. Changes will be published on this page with an indication of the date of the last update. Users are invited to consult this document periodically.

17. Contacts

For any questions relating to this Privacy Policy or to the processing of personal data, you may contact the Controller at [email protected].

Last updated: 09/09/2026.