Privacy Policy & Data Protection Notice

1. Data Controller & Contact Information

Mimesis Studios Ltd ("Mimesis Indie", "we", "us", or "our") is the Data Controller responsible for your personal data collected and processed through indie.mimesis-studios.com.

2. Our Data Protection Principles

We adhere strictly to the core principles set out in Article 5 of the UK GDPR. Your personal data is:

• Processed lawfully, fairly, and in a transparent manner (Lawfulness, Fairness, Transparency).
• Collected solely for specified, explicit, and legitimate business purposes (Purpose Limitation).
• Adequate, relevant, and limited to what is necessary for our services (Data Minimisation).
• Accurate and kept up to date (Accuracy).
• Kept in a form permitting identification for no longer than necessary (Storage Limitation).
• Processed securely using appropriate technical and organisational safeguards (Integrity and Confidentiality).

3. Categories of Personal Data We Collect

We collect and process the following categories of personal data:

4. Lawful Bases & Processing Purposes (UK GDPR Article 6)

5. Third-Party Sub-Processors & Data Sharing

We do not sell, rent, or trade your personal data. We share data only with trusted enterprise service providers under strict Data Processing Agreements:

6. International Data Transfers & Global Personnel

While our primary database and core servers are situated in secure UK and EU data centres, Mimesis Studios Ltd collaborates with qualified international specialists, contractors, and global personnel outside the UK/EEA to deliver multidisciplinary game development services.

Whenever personal data, ticket briefs, or repository credentials are accessed by or transferred to personnel or service providers located outside the United Kingdom or European Economic Area (EEA), we ensure robust safeguards are implemented in strict accordance with Chapter V of the UK GDPR. These safeguards include:

• UK International Data Transfer Mechanisms: Utilizing the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses (SCCs) or the UK International Data Transfer Agreement (IDTA).
• Strict Role-Based & Least-Privilege Access: Repository credentials, code branches, and ticket assets are provisioned on a strictly needed basis and isolated between clients.
• Binding Confidentiality & Security Obligations: All international specialists and contractors execute legally binding non-disclosure, IP assignment, and data protection agreements prior to undertaking any client work.
• Adequacy Decisions: Transferring data to jurisdictions recognized under UK adequacy regulations where applicable.

7. Technical & Organisational Security Safeguards

We implement robust industry-standard technical and organisational security measures to protect personal data:

• Secure Data Access Controls: All database queries and data mutations are strictly authenticated, authorized, and restricted through secured server-side controls with zero direct client access.
• Encryption at Rest & In Transit: Sensitive credentials, integration tokens, and all network transmissions are protected using strong, modern cryptographic standards and secure communication protocols.
• Strict Multi-Tenant Isolation: Robust logical isolation ensures accounts, projects, tickets, and financial data are strictly segmented and accessible only by verified authorized users.
• Role-Based Access & Least Privilege: Studio personnel and collaborators only access the specific information required to scope, execute, and verify contracted deliverables.

8. Data Retention Schedules & Erasure

• Active Account Data: Retained for the duration of your registration to provide continuous platform and ticket services.
• Development Credit & Ticket History: Retained for the 12-month validity period plus active project lifecycle for accounting transparency.
• Financial & Billing Records: Invoices, payment transaction IDs, and tax ledgers are retained for six (6) full financial years in compliance with UK HMRC statutory corporate tax requirements.
• Account Deletion: Upon account closure and verified written request, non-statutory personal data, repository access credentials, and profile records are permanently erased within 30 days.

9. Cookies, Tracking & Opt-In Consent Policy

We operate a privacy-first platform with zero advertising, third-party remarketing, or cross-site profiling beacons. The baseline cookies placed automatically on your device are strictly essential for authenticating your account session, maintaining CSRF protection, and facilitating secure Stripe checkout transactions.

Interactive customer support tools (such as our HubSpot chat widget) and related session attribution cookies are loaded exclusively after you provide explicit affirmative opt-in consent via our cookie consent banner.

For a complete technical breakdown and granular cookie inventory, please consult our dedicated Cookie Policy.

10. Your Statutory Data Subject Rights (UK GDPR)

Under Chapter III of the UK GDPR, you have the following rights regarding your personal data:

To exercise any of these statutory rights, please contact our data privacy team at support@mimesis-studios.com. We will acknowledge and respond to all verified requests within one (1) calendar month free of charge.

11. Right to Lodge a Complaint with the ICO

If you believe our processing of your personal data infringes UK data protection laws, you have the statutory right to lodge a complaint with the UK supervisory authority:

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect technological updates, operational adjustments, or evolving UK legal requirements. Clients and visitors are advised to check this page regularly for any updates.