Privacy Notice

Kids Web Services

Last updated 31 August 2021

Introduction

Welcome to SuperAwesome. SuperAwesome is committed to protecting your privacy and the privacy of children online. Our mission is to make the internet safer for kids, which we do by building technology that enables companies to responsibly interact with their younger audiences. 

This Privacy Notice explains how SuperAwesome collects, stores and processes your personal information when you interact with our parent verification and consent management platform known as Kids Web Services. We also explain how you can exercise your rights relating to your personal information, including the right to object to certain types of processing we carry out. When we say ‘personal information’, we not only mean information that can identify you, such as your name, email or address, but also any information that could reasonably be linked back to you.

We’ve provided summaries to help you identify key information at a glance. Click on the ‘Learn more’ links for more information.The legal entity responsible for the information that SuperAwesome collects through Kids Web Services is SuperAwesome Trading Limited. SuperAwesome belongs to the Epic Games family of companies. If you have any questions about this Privacy Notice, please see the Contact Us section at the bottom.

What is Kids Web Services?

Kids Web Services is a parent verification and consent management platform.

It’s used by: 

  • Parents and guardians to manage what personal information their children can share online. 
  • Operators of apps, games and other digital services (Apps), who we call our Partners. The end-users of our Partners’ Apps are typically children or minors – that’s why we refer to our Partners’ end-users as children in this Privacy Notice. Kids Web Services enables our Partners to obtain the consent of a parent or guardian before they process certain personal information of children, and to verify that the person providing parent/guardian consent is in fact an adult. This is required by privacy laws in certain countries. 

We provide different types of Kids Web Services to our Partners and parents/guardians. We’ve explained this below. 

Parent Verification

The Parent Verification service enables our Partners to verify that the parents or guardians of their child end-users are adults. 

If you are a parent or guardian and live in the UK or EEA meaning the General Data Protection Regulation (GDPR) applies, we are a joint controller with our Partner of personal information processed as part of the Parent Verification services we provide to that Partner. This means we and our Partner are jointly responsible for how your personal information is used for Parent Verification services. You can see how we’ve allocated responsibility between us and our Partner for complying with data protection law in our Joint Processing Arrangement.

The ParentGraph

Once a parent/guardian has successfully verified they are an adult through Kids Web Services, we remember that they have been verified the next time they use their email address to manage their child’s permissions for other Apps which use Kids Web Services.  This is so that they won’t need to provide their Verification information again. We call this network of verified parents/guardians the ParentGraph. We are solely responsible for how personal information is used for the ParentGraph. 

How to opt-out of the ParentGraph 

The ParentGraph eliminates the need to collect Verification information more than once, minimising personal data collection and providing a safer service to parents/guardians and our Partners. It also furthers our mission to make the internet safer for kids by making it easier for parents/guardians to provide (and our Partners to obtain) verifiable parental/guardian consent. If you are a parent or guardian you can, however, always choose to be removed from the ParentGraph by contacting support.

Learn More

Parent Consent Management

The Parent Consent Management service enables our Partners to obtain parent/guardian permission to the Partner’s processing of children’s personal information in their Apps. It also enables parents/guardians to manage the personal information their child can share online for each Partner App via their designated Parent Portal.

If you are a parent or guardian, we are responsible for how your personal information is used for Parent Consent Management services.

Age Gate and Kid Account Management services

The Age Gate service enables our Partners to identify the country in which an end-user’s device is located and whether they are over/under the applicable age of digital consent in their country or other age specified by the Partner. On occasions, we also provide account management services in respect of our Partner’s end-users who are children, which we call Kid Account Management services. Where our Partners’ child end-users live in the UK or EEA meaning the GDPR applies, our Partners act as a controller for personal information processed as part of the Age Gate services and Kid Account Management services. This means our Partner is responsible under data protection laws for how your personal information is used and you should read the Partner’s privacy notice to understand how the Partner uses your personal information for these services. We are not responsible for the privacy practices of the Partner.

Back to top

Personal information we collect  

The personal information we collect depends on how you interact with Kids Web Services. You may interact with Kids Web Services in any of the following ways: 

  • As a parent or guardian when verifying through Kids Web Services that you are an adult, or providing and managing parent/guardian permissions for your child’s access to features of our Partners’ Apps.    

Learn More

  • As a child that uses one of our Partners’ Apps that uses Kids Web Services. 

Learn More

  • As an employee, contractor or authorised user of one of our Partners, who has been given access by a Partner to that Partner’s Kids Web Services account and control panel. We call these people Partner’s authorised users. 

Learn More

Back to top

Why we collect your personal information and our legal basis for processing

We use the information we collect only when we have a valid reason and legal basis to do so. We determine the legal bases based on the purposes for which we collect your information. 

The legal bases we rely on may include the following: 

  • to provide a service you’ve asked for under a contract we have entered into, or which we are about to enter; 
  • where it is necessary for our legitimate interests provided that your interests and fundamental rights and freedoms do not override those interests;  
  • where we need to comply with a legal or regulatory obligation or to protect your vital interests; 
  • where we ask for your consent to process your information for specific purposes and you have the right to withdraw your consent at any time.

Most commonly, we use your personal information for the following purposes:

Purpose: To provide our services to you
DESCRIPTIONCATEGORIES OF DATALEGAL BASES
We use your information to provide our services to our Partners and the parents/guardians of children using our Partners’ Apps. 

Here are some examples: 
If you are a parent/guardian, we use your Verification information to verify that you are an adult so that you can consent to your child accessing features of our Partners’ Apps. We also use your verified status for the purposes of the ParentGraph
If you are a child, we store your Age information to notify our Partner when you have reached an age where you no longer require parent/guardian consent to the processing of online personal information. 
If you are a Partner’s authorised user, we use your Account information to provide you with access to the KWS Services. 
Parent/guardian data
Account information 
Verification information
Device and usage information
Customer support information
 
Child data
– Age information
Unique ID
Permissions
Country and Language
 
Partners’ authorised user data 
– Account information
– Device and usage information
Customer support information
Performance of our contract with you for the use of our services, or if we have not entered into a contract with you or you are under the age of contractual capacity, our legitimate interest to operate and provide you with services you access or request. 

For the ParentGraph, our legitimate interest in: 
Eliminating the need to collect and process Verification information more than once,  minimising personal data collection and providing a safer service to parents/guardians and our Partners. 
Pursuing our mission to make the internet safer for kids by making it easier for parents/guardians to provide, and children and our Partners to obtain, verifiable parental/guardian consent. The easier it is for parents/guardians to provide – and children and our Partners to obtain – verifiable parental consent,  the more likely that children will be honest about their age.
Purpose: To maintain our services
DESCRIPTIONCATEGORIES OF DATALEGAL BASES
We use your information to ensure our services are operating properly, to troubleshoot and provide customer support.Parent data
– Account information 
– Verification information
– Device and usage information
– Customer support information
 
Child data
– Age information
– Unique ID
– Permissions
– Country and Language
 
Partners’ authorised user data 
– Account information
– Device and usage information
– Customer support information
Performance of our contract with you for the use of our services or if we have not entered into a contract with you or you are under the age of contractual capacity, our legitimate interest to operate, maintain and provide you with services you access or request.
Purpose: To improve and develop new products and services
DESCRIPTIONCATEGORIES OF DATALEGAL BASES
We may sometimes use your information to help us improve and develop products and services, including to develop updates and add new functionality, product and features based upon your comments and feedback and an understanding of how you and others use them. Parent data
Verification information
Device and usage information
Customer support information
 
Partners’ authorised user data 
– Account information
Device and usage information
Customer support information
Our legitimate interest in improving and developing new products and services that make the internet safer for kids, while applying appropriate safeguards that protect your privacy.
Purpose: To promote safety and security
DESCRIPTIONCATEGORIES OF DATALEGAL BASES
We use your information to help protect and improve the safety and security of our services, parents, guardians, our Partners and their end-users. For example, we use information to detect and protect against error, fraud, breach of our terms or policies or criminal or malicious activity.
 
Parent data
Account information 
Verification information
Device and usage information
Customer support information
 
Child data
Unique ID
Country and Language
 
Partners’ authorised user data 
Account information
Device and usage information
Customer support information
Depending on the circumstances, we rely on the following legal bases:
– to comply with legal obligations;
– to protect vital interests; or
– our legitimate interest in providing a secure and safe service and preventing fraud and unauthorised use of our products and services, violations of our terms and policies or other harmful or illegal activity and in protecting our and others’ rights, property and interests, while applying appropriate safeguards that protect your privacy.
Purpose: To communicate with you
DESCRIPTIONCATEGORIES OF DATALEGAL BASES
We use information we collect, like your email address, to interact with you directly. 

Here are some examples: 
If you are a parent/guardian, we may notify you of a new permission request from your child, or email you to let you know that you have been successfully verified. We may also respond to inquiries or other communications from you or inform you of changes to our terms, policies or products or services. We do not send marketing communications to parents/guardians or our Partners’ end-users. 
If you are a Partner’s authorised user, we may use your information to respond to your inquiries or other communications, or inform you of changes to terms or policies or to our products or services. We or our group companies may also use your information to inform you about our, and our group companies’, products and services, including  new products and services. We may ask you to participate in testimonials or press releases.  We may also use it to understand the effectiveness of our marketing campaign. 
Parent data
Account information 
Device and usage information
Customer support information
 
Partners’ authorised user data 
Account information
Device and usage information
– Customer support information
When using, processing or sharing information for this purpose, we do so on the legal basis of performance of a contract or, if we have not entered into a contract with you or you are under the age of contractual capacity, our legitimate interest to operate and provide you with services and/or our legitimate interest in fulfilling and responding to your requests. 
In the case of marketing communications to Partners’ authorised users, we do so based upon our legitimate interests in keeping you informed about and engaged with existing and new features, products and services of SuperAwesome and our group companies, including by tailoring our messages to what we think you’ll be interested in based upon what we know about you or the relevant Partner and in understanding the effectiveness of our marketing campaigns, including through accurate statistics. 
If you are a Partner’s authorised user, we will ask for your consent to participate in testimonials or press releases.

Back to top

Reasons we share your personal information 

SuperAwesome does not share your personal information with others except as described in this Privacy Notice (like to provide, maintain and secure Kids Web Services, or if we’re required to do so by law). We do not sell any of your information to anyone.

We share your information as follows:

  • Service providers. As with most companies, we use third parties to help us provide Kids Web Services, such as IT and hosting providers or payment card processors. For example we share Verification information with payment card processors we use to verify your identity.  Some of these providers may process your personal information on our behalf, for the purposes set out in this Privacy Notice. These providers are subject to contractual obligations governing privacy, data security and confidentiality.

    We maintain a current list of the providers that Kids Web Services uses here.

    We also share personal information in some cases with our professional advisers and other service providers who are sometimes independent ‘data controllers’, such as lawyers, accountants and insurers, e.g. when enforcing our contract with you or in the event of claims against us. 
  • Partners. If you are a parent/guardian or a child using a Partner App, we share your personal information with our Partners to deliver the services which you have requested from either us or our Partners. For example, if you are a parent/guardian and you verify your identity through Kids Web Services, we communicate your verified status to the Partner to enable the Partner to proceed with obtaining your permissions (whether using Kids Web Services Consent Management or otherwise) to their collection of your child’s personal information. 

    If you are a child end-user of a Partner, we may communicate your Age information to the Partner in order to notify the Partner that you have reached an age where you no longer require parent/guardian consent to the collection of your personal information.

    We also provide Partners with updates to the permissions parents/guardians give them through the Parent Portal.
  • Other companies within the SuperAwesome group. We may share your information with our group companies, including companies that we may acquire in the future, but only to the extent necessary to fulfil purposes set out in this Privacy Notice, or otherwise as authorised by you. For example, our group companies assist SuperAwesome in the provision of customer support to our Partners. 
  • Other legal or regulatory process. We may share your personal information if we believe it is reasonably necessary:
    • where required by law; 
    • to comply with legal process; 
    • to permit us to pursue available remedies, including commencing or responding to any claims; 
    • to enforce or apply the SuperAwesome terms;
    • to protect the security or integrity of the SuperAwesome services; 
    • to protect the rights, property, interests or safety of SuperAwesome, our employees, customers or users; or
    • for risk management purposes.

      The categories of information we disclose and our legal basis for doing so depends on the circumstances, but generally it is to comply with legal obligations, to protect vital interests or act in our legitimate interest to provide a secure and safe service and preventing fraud and unauthorised use of our products and services, violations of our terms and policies or other harmful or illegal activity and in protecting our and others’ rights, property and interests, and responding to legal requests from governmental and law enforcement agencies.

  • If SuperAwesome is acquired. If we are involved in a merger, acquisition, or sale of assets, we may share your personal information with the acquiring or receiving entity. We will use reasonable efforts to notify you in advance of any transfer of your personal information. The categories of information we disclose and our legal basis for doing so depends on the circumstances, but would include our legitimate interest in operating, selling and expanding our business, including through such transactions.

  • A note about aggregated data. We may derive aggregated data from your personal information and we may share this information in aggregated form with our Partners as part of our services. For example, we may aggregate Usage information to calculate the percentage of parents/guardians who provide verifiable parental consent to their child accessing a certain feature of one of our Partner’s games.  However, because this data has been through a process to de-identify personal information so that it can no longer be associated in the Partner’s hands with a person, the aggregated data cannot directly or indirectly reveal your identity to the Partner.

Back to top

Keeping your information secure 

SuperAwesome values your trust and maintains a comprehensive information security program designed to protect personal information using administrative, physical, and technical safeguards. 

The specific security measures used are based on the sensitivity of the personal information collected. While we cannot guarantee that loss, misuse or alteration of data will not occur, we have measures in place designed to protect against inappropriate access, loss, misuse, or alteration of personal information under our control. For example: 

  • The SuperAwesome security team regularly reviews our security and privacy practices and enhances them as necessary to help protect the integrity of our systems and your personal information.
  • We work to limit access to your personal information to those employees, agents, contractors and other third parties strictly on a “need to know” basis. 
  • We use secure server software to encrypt personal information, and we only partner with security companies that meet and commit to our security standards. 

Some of the correspondence you receive from us may contain links to third-party websites, online services or mobile applications that are not affiliated to or operated by us, including those of our Partners. We are not responsible and accept no liability for the content, security or privacy practices of those other operators. 

Back to top

Your rights and access to your personal information

While some of these rights apply generally, certain rights apply only in limited cases based on your location (e.g. if you are based in the UK or EEA). 

  • Right of access: You have a right to request access to your personal information and to be provided with a copy of your personal information, including the categories of your personal information we collect and disclose.  
  • Right of deletion: You have the right, in certain cases, to request that we delete your information, provided there are valid grounds for doing so and subject to applicable law. See How to exercise your rights for information on how to delete your personal information. 
  • Right of correction: You have the right to request that we correct inaccurate information about you, though we may need to verify the accuracy of the new data you provide to us.
  • Right to object (legitimate interest): Where we process your personal information based on legitimate interests, you can object to this processing where you feel it impacts on your fundamental rights and freedoms. Unless we have compelling legitimate grounds or where it is needed for legal reasons, we will cease processing your information when you object.
  • Right to object (marketing): We do not send marketing communications to parents/guardians or end-users of our Partners. If you are a Partner’s authorised user, you have the right to object to processing for direct marketing purposes at any time.
  • Right to transfer: You may have the right to receive certain of your information in a structured, commonly used and machine-readable format and to transmit such information to a third party.
  • Right to restrict processing: You have the right, in certain cases, to temporarily restrict the processing of your information by us, provided there are valid grounds for doing so. 
  • Right to withdraw consent: Where you have previously provided your consent, you have the right to withdraw consent at any time where we are relying on consent as the legal basis upon which to process your personal information. However, this will not affect the lawfulness of the processing based on consent before its withdrawal. 
  • Right to complain: If you are concerned that we have not complied with your legal rights or applicable privacy laws, you have the right to lodge a complaint with SuperAwesome’s supervisory authority, the UK Information Commissioner (www.ico.gov.uk), which is the regulator responsible for data protection in the United Kingdom, where SuperAwesome Trading Limited is registered (Registration number Z8630714). You can also lodge a complaint with your local supervisory authority for data protection.
  • Rights relating to your child’s personal information. If you are a parent/guardian, under the Children’s Online Privacy Protection Act in the US (known as COPPA), you have certain rights over how we handle the personal data of your child. This includes a right for you to review, access, or delete the personal information that has been collected by us (in our capacity as a controller) from that child, and to refuse at any time to permit the collection from that child of such personal data. If you withdraw your consent, your child may lose access to certain apps, games or other digital services.  We will advise you if this is the case at the time you withdraw your consent.

Back to top

How to exercise your rights

If you want to exercise any of your rights and are not able to do so using our privacy control tools, you can Contact Us at any time. 

Before we process such requests, we may ask you to verify your identity (like by logging-in to your account or providing us with certain information). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. No payment is usually required to exercise your rights. However, we may request payment where allowed by law (for example, if your request is manifestly unfounded or excessive).

If you are a California resident, refer to the California residents section below for more information on your legal rights.

Back to top

Privacy controls for parents/guardians of their child’s personal information 

The very reason Kids Web Services exists is to give parents/guardians a choice over what personal information their child can share online. Please refer to our FAQs to see the tools that are available to parents/guardians to do just that.

Back to top

Our retention of personal information

You can delete some personal information whenever you like. For example, if you are a parent or guardian, you can delete your Parent Portal (see Privacy Controls for parents/guardians). If you are a Partner’s authorised user, you can delete your account through the KWS Developer Portal. 

Other times, SuperAwesome retains personal information for as long as necessary to fulfil the purposes we collected it for, or for other legitimate purposes such as complying with our legal obligations, resolving disputes, and enforcing our agreements or protecting our rights. Retention periods vary significantly depending on the different data types, the purposes for which they were collected and the context of our interactions with you. To determine the appropriate retention period, we consider:

  • the amount, nature and sensitivity of the data;
  • the potential risk of harm from unauthorised use or disclosure of the data;
  • the purposes for which we process the data and whether we can achieve those purposes through other means;
  • applicable legal, regulatory, tax or accounting requirements.

For example:

Parents

TYPE OF DATARETENTION PERIOD
Parent/Guardian Account information
Lifetime of the account. Certain account information is retained for accounting purposes for 6 years thereafter. 
Verification information (excluding your email address)Deleted within 48 hours of successful or unsuccessful verification.
Verified status and hashed email addressWe retain this in the ParentGraph (including if your Parent Portal is deleted) for future verification purposes involving Kids Web Services until you ask us not to do so. This eliminates the need to re-verify that you are an adult, and minimises personal information collection. Parents/guardians will automatically be removed from the ParentGraph if their ParentGraph record has not been accessed for 4 years. Parents can ask to be removed from the ParentGraph at any time.

Partner’s authorised users

TYPE OF DATARETENTION PERIOD
Partner’s authorised users Account information Lifetime of the account. Certain account information is retained for accounting purposes for 6 years thereafter. 

Back to top

International transfer of personal information 

We transfer your personal information in the following ways:

  • As we explain above, we share your personal information within the SuperAwesome group of companies. Our group companies are located in the United States and other countries outside the UK, Switzerland and EEA. 
  • As we explain above, we use third party service providers to help us provide Kids Web Services, such as hosting providers or payment card processors. Some of these providers, including their servers, are based outside the UK, Switzerland and EEA.
  • As we explain above, we also provide your information to Partners. Some of these Partners are based outside the UK, Switzerland and EEA.

Countries which are outside the UK, Switzerland and EEA may not offer the same level of data protection as in your home country. For example there is currently no adequacy decision in respect of the United States. We use specific contracting frameworks approved by the UK Government and European Commission which are designed to give personal information protection essentially equivalent to that in the UK and EEA. We may also need to transfer your information to provide Kids Web Services to you in accordance with our existing agreements with you, such as the KWS Developer Terms and Terms of Use.  

Back to top

Cookies 

A cookie is a small piece of text sent to your browser by a website you visit. We and other organisations use necessary cookies to make the KWS Services work. We may also set analytics cookies that help us make improvements by measuring how you use the KWS Services. You can set your browser to block or alert you about these cookies, but some parts of the KWS Services may not then work. This table explains the cookies we use and why. 

Do Not Track

Your browser settings may allow you to automatically transmit a “Do Not Track” signal to online services you visit. There is no industry consensus as to what site and app operators should do with regard to these signals. Accordingly, unless and until the law is interpreted to require us to do so, we do not monitor or take action with respect to “Do Not Track” signals.  For more information on “Do Not Track,” visit http://www.allaboutdnt.com. 

Location-specific rules 

Depending on where you are resident, specific rules apply. 

United States 

If you are a resident of the United States and believe that we have not responded to your inquiry or your inquiry has not been satisfactorily addressed, please contact ESRB Privacy Certified at privacy@esrb.org or by using their online contact form at: https://www.esrb.org/privacy/contact

California residents

This additional section applies to California residents because of the specific privacy laws in that state. It explains the additional rights and details required by the California Consumer Privacy Act of 2018 and its implementing regulations (CCPA). For the purposes of this section, ‘personal information’, ‘business’, and ‘service provider’ have the meanings given to them under the CCPA.

Learn More

Nevada residents

Nevada residents have the right to direct a business not to sell certain kinds of personal information that the business has collected about them. SuperAwesome does not sell personal information. If you are a Nevada resident and wish to submit a request relating to your compliance with Nevada law, please email us at privacy@superawesome.com.

Back to top

Contact us 

If you have general questions or concerns about Kids Web Services  (such as trouble accessing your Kids Web Services account, bugs or other technical problems), please refer to the Community Support Forums.

SuperAwesome works hard to ensure that the processing of your personal information is carried out fairly and lawfully. If you have any questions regarding SuperAwesome’s privacy practices, need information or require assistance, please contact us at:

Attn: Chief Privacy Officer

SuperAwesome Trading Limited, 2-4 Packhorse Road, Gerrards Cross, Buckinghamshire, England SL9 7QE, United Kingdom

Email: privacy@superawesome.com

If  you are located inside the European Economic Area (EEA) you can still contact us using the details above or, if you prefer, you contact our representative in the EEA at:

Attn: SuperAwesome GDPR Representative

Mason Hayes and Curran Professional Services Limited, South Bank House, Barrow Street, Dublin 4, Ireland

Email: SuperAwesomeGDPRrepresentative@mhc.ie

Back to top

Changes to this Privacy Notice

We may modify this Privacy Notice at any time. When we do, we will update the ‘Last updated’ date on this Privacy Notice or, if the change is material, we will place a notice on the KWS Developer Portal or KWS Parent Portal by revising the link to read as ‘Updated Privacy Notice’ or similar term for a reasonable period of time.

If you object to any changes, you may delete your account or your personal information as described in How to exercise your rights. 

Back to top