PRIVACY POLICY
Dead Astronauts AB — HAEX and deadastronauts.games
Last updated: June 1, 2026
This Privacy Policy explains how Dead Astronauts AB (“we”, “us”, “our”) collects and processes personal data when you visit our website or sign up for our newsletter, and what rights you have. We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and applicable Swedish data-protection law.
This Privacy Policy supplements our End User License Agreement (EULA) for the game HAEX. It is a separate document and forms part of your relationship with us.

1. Who is responsible for your data (controller)
   The controller responsible for your personal data is:
   Dead Astronauts AB Organisation number: 559479-1534 Registered address: Stortorget 3, 211 22 Malmö, Sweden Email: legal@deadastronauts.games
   We are a small studio and are not required to appoint a Data Protection Officer. If you have any questions about this Policy or about how we handle your personal data, you can reach us at the email address above.

2. What this Policy covers
   This Policy covers personal data we collect:
   when you visit or interact with our website at deadastronauts.games, haexgame.com; and
   when you subscribe to our newsletter.
   We deliberately keep our data collection to a minimum. We do not sell your personal data, and we do not use it for any purpose other than those described below.
   Purchases and gameplay through storefronts. If you buy or play HAEX through a third-party storefront (for example Steam, the Epic Games Store, or GOG), your purchase, account, and any in-game data are collected and controlled by that storefront under its own privacy policy, not this one. We do not receive or collect personal data about your gameplay beyond what (if anything) those storefronts make available to us in aggregated or limited form, which we describe here only to the extent it applies.

3. The personal data we collect, why, and the legal basis
   3.1 Newsletter
   What we collect: your name and email address, and basic records of whether our emails are delivered and opened.
   Why: to send you our newsletter with news and updates about HAEX and Dead Astronauts.
   Legal basis: your consent (Article 6(1)(a) GDPR). You give consent when you sign up, and you can withdraw it at any time (see below).
   Retention: until you unsubscribe or otherwise withdraw your consent, after which we delete your subscription data within a reasonable period (subject to any short technical back-up retention).
   How to opt out: click the “unsubscribe” link in any newsletter, or email us at the address in Section 1. Withdrawing consent does not affect the lawfulness of processing before withdrawal.
   3.2 Website usage and server logs
   What we collect: technical information that your browser sends automatically, which may include your IP address, browser and device type, referring page, the pages you view, and the date and time of your visit.
   Why: to operate, secure, and maintain the website, to keep it working correctly, and to detect and prevent misuse or security incidents.
   Legal basis: our legitimate interest (Article 6(1)(f) GDPR) in running a secure and functional website.
   Retention: server logs are kept for a limited period of [e.g., up to 12 months] and then deleted or anonymised.
   3.3 Cookies and similar technologies
   Our website may use cookies and similar technologies. Cookies that are strictly necessary for the website to function are used on the basis of our legitimate interest and do not require your consent. Any other cookies — for example analytics or measurement cookies — are only used with your consent, which we request through a cookie banner and which you can change or withdraw at any time. See Section 4 for more detail.
   3.4 If you contact us
   If you email us or otherwise get in touch, we process the contact details and the content of your message in order to respond and to handle your request. The legal basis is our legitimate interest in answering enquiries (or your consent, or the steps necessary in connection with a contract, depending on the context). We keep this correspondence only for as long as needed to deal with the matter.

4. Cookies
   A cookie is a small file stored on your device. We use:
   Necessary cookies — required for the website to work (for example to remember your cookie choices). These are always active.
   Optional cookies (e.g., analytics) — used only if you consent. [If used, name your analytics provider here, e.g., a privacy-friendly analytics tool, and what it measures.]
   You can accept or reject optional cookies through our cookie banner, and you can withdraw your consent at any time through the cookie settings on the website or by adjusting your browser settings. Setting your browser to block cookies may affect how the website works.

5. Who we share your data with
   We share personal data only where necessary, and only with:
   Service providers (processors) acting on our behalf, such as our website host, our newsletter/email provider EmailOctopus, and any analytics provider we use. These providers may only process your data on our instructions and under a data-processing agreement.
   Authorities or advisers where we are required to do so by law, or to establish, exercise, or defend legal claims.
   Where you reach us through a storefront or social platform (for example Steam, Epic, GOG, or Discord), those services are independent controllers of the data they collect, governed by their own privacy policies.
   We do not sell your personal data or share it for third-party advertising.

6. International transfers
   We aim to keep your personal data within the EU/EEA. If a service provider we use processes personal data outside the EU/EEA, we will ensure the transfer is protected by an appropriate legal mechanism under Chapter V of the GDPR — that is, either an adequacy decision by the European Commission (including, for certified US providers, the EU–US Data Privacy Framework) or appropriate safeguards such as the European Commission’s Standard Contractual Clauses, together with any additional measures required. You can ask us for more information about the safeguards we use.

7. How long we keep your data
   We keep personal data only for as long as necessary for the purposes described in this Policy:
   Newsletter data — until you unsubscribe or withdraw consent.
   Server logs — for a limited period up to 12 months and then deleted or anonymised.
   Correspondence — for as long as needed to handle and document your request.
   When data is no longer needed, we delete or anonymise it.

8. Your rights
   Under the GDPR, you have the right to:
   access the personal data we hold about you, and receive a copy;
   request rectification of inaccurate or incomplete data;
   request erasure of your data (“right to be forgotten”) in certain circumstances;
   request restriction of processing in certain circumstances;
   object to processing based on our legitimate interests;
   data portability — receive data you provided to us in a structured, commonly used, machine-readable format, where processing is based on consent or a contract and is carried out by automated means; and
   withdraw consent at any time where processing is based on consent (such as the newsletter), without affecting the lawfulness of processing before withdrawal.
   We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects on you.
   To exercise any of these rights, contact us at the address in Section 1. We will respond within the time limits set by the GDPR (normally within one month). Exercising your rights is free of charge in normal cases.

9. Right to complain
   If you believe we have not handled your personal data correctly, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with the Swedish supervisory authority:
   Integritetsskyddsmyndigheten (IMY) Box 8114, 104 20 Stockholm, Sweden Email: imy@imy.se · Telephone: 08-657 61 00 · Website: www.imy.se
   If you live in another EU/EEA country, you may also contact the supervisory authority in your country.

10. Security
    We take appropriate technical and organisational measures to protect personal data against loss, misuse, and unauthorised access, alteration, or disclosure, taking into account the nature of the data and the risks involved.

11. Children
    Our website and newsletter are not directed at young children. If you are under the age of digital consent that applies in your country (13 in Sweden), you should only provide personal data, or sign up for the newsletter, with the consent of a parent or guardian. We do not knowingly collect personal data from children below that age without the required consent, and we will delete any such data if we become aware of it.

12. Changes to this Policy
    We may update this Privacy Policy from time to time, for example if our website or our service providers change, or to reflect changes in the law. We will post the updated version here with a new “Last updated” date and, where the change is significant, we will take reasonable steps to inform you. Where the law requires it, we will ask for your renewed consent.

13. Contact
    For any questions about this Privacy Policy or your personal data, contact:
    Dead Astronauts AB Organisation number: 559479-1534 Stortorget 3, 211 22 Malmö, Sweden Email: legal@deadastronauts.games