Legal

Privacy policy

Effective date: 8 September 2026 – version 1.1

1. Who we are

OUT OF THE ORDINARY sp. z o.o., Bluszczańska 76 paw. 6, 00-712 Warsaw, Poland, is the data controller for this website. You can reach our privacy contact at privacy@outoftheordinary.io.

2. What we collect, why, and on what basis

2.1 Contact form and direct e-mail

When you write to us through the contact form or to one of our inboxes we receive what you type: your name, e-mail address, company or outlet (if given) and your message. We use it to answer you and, where it leads to work together, to prepare that work. Legal basis:legitimate interest in answering inbound contact (Art. 6(1)(f) GDPR) and, where you ask for a business relationship, steps prior to a contract(Art. 6(1)(b) GDPR).

2.2 Game pitches

The pitch form asks for the game title, genre, your studio, a contact name, an e-mail address, links to a build and a pitch document, and a message. We use this to evaluate the pitch and reply. Build and document links stay with the people reviewing the pitch and are not shared outside the studio without your agreement. Legal basis: steps prior to a contract (Art. 6(1)(b) GDPR).

2.3 Review-key requests

The review-key form asks for your name, outlet, audience, e-mail address, the game and the platform. We use it to decide on and send keys and to keep track of who has received one. Legal basis: legitimate interest in running press and creator relations (Art. 6(1)(f) GDPR).

2.4 Newsletter

If you subscribe we store your e-mail address and the time of subscription in Cloudflare KV and use it to send studio announcements, release news and beta invitations. Legal basis:consent (Art. 6(1)(a) GDPR). You can withdraw it at any time through the link in every e-mail or by writing to privacy@outoftheordinary.io.

2.5 Spam protection

Every form has a hidden field that real visitors never fill in; submissions that fill it are discarded without being read. The form endpoint also sees the IP address Cloudflare attaches to the request, which is used only to reject abusive traffic and is not stored by us. Legal basis: legitimate interest in keeping the forms usable (Art. 6(1)(f) GDPR).

2.6 Hosting and request logs

The website is served by Cloudflare Workers. Cloudflare processes your IP address, browser user agent, referrer and request time as part of normal operation and DDoS protection, and keeps standard access logs for up to 30 days. SeeCloudflare's privacy policy for details.

2.7 Trailers (YouTube)

Game trailers are embedded from YouTube in privacy-enhanced mode (youtube-nocookie.com). The embed is only loaded after you press play; until then only a thumbnail image is fetched from YouTube's image servers. Once you play a trailer, Google processes your data underGoogle's privacy policy.

2.8 Analytics

We do not run third-party analytics or advertising scripts on this website: no Google Analytics, no Meta Pixel, no session recording. If that changes, this section will be updated before the change goes live.

3. Cookies and local storage

This website sets no cookies of its own. YouTube may set cookies once you start a trailer (see 2.7). The site remembers small display preferences in your browser's local storage; that data never leaves your device.

4. Who processes data for us

We do not sell personal data and we do not share it with anyone else, except where the law requires it or where you ask us to (for example, forwarding a pitch to a co-publisher with your agreement).

5. International transfers

The processors above are based in, or route data through, the United States. Transfers rely on Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework. We do not transfer personal data to countries without an adequacy decision or appropriate safeguards.

6. How long we keep data

7. Your rights

Under the GDPR you can ask us to:

• Access the personal data we hold about you and receive a copy.
• Rectify data that is inaccurate or incomplete.
• Erase your data where we no longer need it.
• Restrict processing while a request is being handled.
• Port the data you gave us in a machine-readable format.
• Object to processing based on legitimate interest.
• Withdraw consent for the newsletter at any time, without affecting earlier processing.

Write to privacy@outoftheordinary.io; we answer within 30 days. You can also complain to the Polish supervisory authority, the President of the Personal Data Protection Office (UODO,uodo.gov.pl), or to the authority in your country of residence.

8. Security and breaches

Form data travels over HTTPS and is handled only by the people who need it to answer you. If a breach is likely to put your rights and freedoms at risk we will notify UODO within 72 hours of becoming aware of it and inform you without undue delay, as Art. 33 and 34 GDPR require.

9. Children

The website and its forms are meant for adults and for professionals in the games industry. We do not knowingly collect data from children under 16; if you believe a child has sent us data, write to us and we will delete it.

10. Our games

Each game collects data separately (device identifiers, gameplay telemetry, crash logs, and in free-to-play titles advertising identifiers). The applicable notice is linked on the game's store page on Steam, the App Store, Google Play or the Nintendo eShop.

11. Changes

We may update this policy; the effective date and version number at the top always show the current one. For material changes we will e-mail newsletter subscribers before the change takes effect.

12. Contact

OUT OF THE ORDINARY sp. z o.o.
Bluszczańska 76 paw. 6
00-712 Warsaw, Poland
privacy@outoftheordinary.io