GDPR Compliance Guide
WISHGATE LTD ("Data Controller")
Contact: privacy@wishgate.io
Last reviewed: July 1, 2026
This document describes how Wishgate complies with the EU General Data Protection Regulation (GDPR) and related data protection laws.
1. Data Controller
WISHGATE LTD, a company incorporated in Bulgaria (UIC 208871609) with its registered office at ul. Stefan Peshev 76, fl. 1, 5400 Sevlievo, Gabrovo Province, Bulgaria, is the Data Controller for personal data processed through the platform. If you have questions about how your data is handled, contact us at privacy@wishgate.io.
2. Lawful Bases for Processing
| Processing Activity | Lawful Basis | Notes |
|---|---|---|
| Account registration and authentication | Performance of contract (Art. 6(1)(b)) | Necessary to provide the service |
| Organization profile and game listings | Performance of contract (Art. 6(1)(b)) | Core service functionality |
| Partnership management, chat, audit logs | Performance of contract (Art. 6(1)(b)) | |
| Social platform data fetching (YouTube, Twitch, TikTok) | Legitimate interest (Art. 6(1)(f)) + Contract | Creator initiates linking; necessary for platform matching |
| Payment processing via Stripe | Performance of contract (Art. 6(1)(b)) | |
| In-app notifications | Legitimate interest (Art. 6(1)(f)) | Essential platform communication |
| Email digest notifications | Consent (Art. 6(1)(a)) | User-configurable; opt-out available in Settings |
| Legal record keeping (payment records, audit logs) | Legal obligation (Art. 6(1)(c)) | 7-year retention for financial records |
| Platform abuse prevention | Legitimate interest (Art. 6(1)(f)) |
3. Data Subject Rights
Under GDPR, you have the following rights. To exercise them, email privacy@wishgate.io with subject "GDPR Request — [Right Type]". We respond within 30 days.
Right of Access (Art. 15)
You may request a copy of all personal data we hold about you. We will provide it in a commonly used electronic format (JSON or CSV).
Right to Rectification (Art. 16)
You may correct inaccurate personal data at any time via your account settings or by contacting us.
Right to Erasure (Art. 17)
You may request deletion of your personal data. We will comply unless retention is required by:
- Legal obligation (e.g., 7-year financial record keeping)
- Legitimate interest in fraud prevention
- Contractual obligations to other users (e.g., partnership audit records that protect other parties)
Deleted account data is anonymized within 30 days. Data referenced in partnerships (audit log, messages) may be retained in anonymized form.
Right to Data Portability (Art. 20)
You may request your data in a machine-readable format (JSON). This covers: account data, organization data, partnership history, and social platform data we store.
Right to Object (Art. 21)
You may object to processing based on legitimate interest. We will stop unless we have compelling legitimate grounds.
Right to Restrict Processing (Art. 18)
You may request restriction of processing in specific circumstances (e.g., while we verify a rectification request).
Right to Withdraw Consent (Art. 7(3))
Where processing is based on consent (email digests), you may withdraw consent at any time in your notification settings.
4. Data Retention Schedule
| Data Category | Retention Period | Basis |
|---|---|---|
| Active user account data | While account is active | Contract |
| Deleted account — personal identifiers | Anonymized within 30 days | Erasure right |
| Partnership messages | 3 years after partnership ends | Legitimate interest (dispute resolution) |
| Partnership audit log | 3 years | Legitimate interest |
| Payment records (Stripe) | 7 years | Legal obligation (accounting law) |
| Steam key assignment records | 3 years | Legitimate interest |
| Server/access logs | 30 days | Legitimate interest (security) |
| Social platform OAuth tokens | Retained (encrypted) while the platform is connected; deleted on disconnect or account closure | Performance of contract |
5. International Data Transfers
We transfer data to the following countries outside the EEA:
| Recipient | Country | Transfer Mechanism | Purpose |
|---|---|---|---|
| Stripe, Inc. | USA | EU-US Data Privacy Framework / SCCs | Payment processing |
| Google LLC (YouTube) | USA | EU-US Data Privacy Framework / SCCs | YouTube API data fetch |
| Twitch Interactive / Amazon | USA | EU-US Data Privacy Framework / SCCs | Twitch API data fetch |
| TikTok (varies) | USA / Singapore | SCCs | TikTok API data fetch |
Standard Contractual Clauses (Commission Implementing Decision 2021/914) are used where the EU-US Data Privacy Framework does not apply.
6. Data Minimization
We only collect data that is necessary for the platform to function:
- We request read-only social platform scopes only, and store the resulting OAuth tokens encrypted, solely to refresh channel statistics; they are deleted the moment the platform is disconnected
- We do not collect demographic data beyond what users voluntarily provide
- We do not track user behaviour for advertising purposes
- Server logs are retained for 30 days only
7. Security Measures
- All traffic is served over TLS 1.2+, with HTTP redirected to HTTPS and HSTS enforced
- Passwords are hashed using ASP.NET Core Identity (PBKDF2 with HMAC-SHA256); optional two-factor authentication is available
- Database connections use TLS encryption
- Data at rest (including Steam keys and messages) is encrypted with AES-256 via Azure transparent data encryption
- Social platform OAuth tokens are additionally encrypted at the application layer before storage
- Authorization is re-checked server-side against the database on every mutating request, not only in the UI
- Access to production systems is restricted to authorized personnel on a least-privilege basis, with two-factor authentication
- We conduct periodic security reviews
The full set of measures is documented in §7 of the Privacy Policy.
8. Data Breach Notification
In the event of a personal data breach that risks harm to affected individuals, we will:
- Notify the relevant supervisory authority within 72 hours (Art. 33)
- Notify affected users without undue delay if the breach poses high risk (Art. 34)
9. No Automated Decision-Making
Wishgate does not make solely automated decisions that produce legal or similarly significant effects on individuals. The match score algorithm is informational only and does not affect partnership approval decisions (which require manual studio/creator action).
10. Supervisory Authority
If you believe your data protection rights have been violated, you may lodge a complaint with:
- Your local EU/EEA data protection authority, or
- Our lead supervisory authority in Bulgaria, the Commission for Personal Data Protection (Комисия за защита на личните данни, CPDP), Sofia, Bulgaria — www.cpdp.bg
A directory of EU supervisory authorities is available at: https://edpb.europa.eu/about-edpb/about-edpb/members_en
11. Children
Wishgate does not target users under 16. If we become aware of data collected from a child under 16, we will delete it immediately and notify the relevant authority if required.