On
https://www.pathofexile.com/account/create in Terms of use there are:
7, Restrictions:
i. Reverse engineer, de-compile or disassemble the Website
It is not clear to me what this is saying wrt what usually makes up a website game (generally javascript and html). There is no way to send compiled code or assembly language. I think they are trying to say I am not allowed to press f12 (Dev Tools), but I do not think it does.
And: PATH OF EXILE - PRIVACY POLICY
3. Use of Information:
iv: to market products and services to you, including contacting you via email that you may choose (or opt in) to receive. You can stop receiving Grinding Gear Games’ promotional emails by following the unsubscribe instructions included in those emails;
This is, in GDPR terms, a request for consent for a purpose outside of that required to play the game. This should be opt in. It is actually a breach to have a pre-filled checkbox for this, but it is certainly a breach to require a separate action like following instructions in an email (that requires consent to send).
PATH OF EXILE - PRIVACY NOTICE: EU/UK GDPR TERMS
5: International transfer of data:
Some of the personal data Grinding Gear Games collects is processed by us and/or third-party data processors in other countries. These third-party data processors are set out at
https://www.pathofexile.com/legal/third-parties. For personal data processed in countries that have not been determined as ensuring an adequate level of protection for personal data under the applicable EU/UK Data Protection Laws, Grinding Gear Games has entered into Standard Contractual Clauses as published by the European Commission with its third-party processors. The Standard Contractual Clauses provide specific guarantees around transfers of personal data and Grinding Gear Games rely on the Standard Contractual Clauses in transferring personal data to these third-party processors.
This is very unlikely to be done well unless they have spent a lot more on GDPR lawyers than they have on contract lawyers. For
Lawyer Monthly:
However, the most significant effect of the Schrems II ruling is arguably related to the much-used EU standard contractual clauses (SCC) adopted by the EU Commission, which is also the most obvious alternative to the EU-US Privacy Shield for transfers to the US. While the CJEU found the SCC still valid, in order for the data exporter and data importer to rely on SCC they must verify that there is no reason to believe that any laws or practices applicable to the data importer hinders the data importer in fulfilling its obligations under the SCC. Thus, the CJEU has put a heavy burden on businesses to assess the surveillance and security laws of the third countries they transfer personal data to.