Privacy notice: P-Man scoreboard and PVDIS updates
In short
- You can play without giving us your name or contact details.
- If you save a score, your nickname and score are public for up to 12 months. Please don't use your real name.
- If you sign up for updates, we email, WhatsApp or call you only on the channels you ticked, and only after you confirm by email. You can stop each channel at any time.
- We never sell your data and never show your contact details publicly.
Who is responsible
The controller is "Aurowe", UAB (a private limited company, trading as PVDIS), company code 307574919, Beržų al. 1, Laumėnų k., Samylų sen., Kauno r. sav., LT-53118, Lithuania. VAT number LT100019678617.
Privacy contact: sales@pvdis.com (please write "Privacy" in the subject line). We have not appointed a data protection officer because the law does not require one for our activities. The privacy contact handles all data protection questions.
Playing the game
You can play P-Man without giving us your name or contact details. For players, the game sets no cookies, uses no browser storage (localStorage or sessionStorage), and loads no analytics, tracking pixels, advertising or third-party scripts. The font and images are served from our own server.
Like any website, our hosting server receives your IP address, browser type, the page requested and the time. The hosting provider records these in standard server logs, kept for 7 days in the log view available to us. Hostinger may keep its own security logs under its data processing terms. When you press Play, our server issues a one-time round code so that scores can be checked for cheating. For anti-cheat checks and rate limits, our game database stores a keyed one-way code (hash) of your IP address, not the address in readable form. This hash is still personal data. It is removed from rate-limit records after 2 days and from round and score records after 30 days.
The "Share on LinkedIn" and "Follow PVDIS on LinkedIn" buttons are plain links. LinkedIn receives data only if you click them, and then LinkedIn's privacy policy applies.
What we collect, why, on what legal basis, and for how long
| Data | Purpose | Legal basis | Kept |
|---|---|---|---|
| Server logs: IP address, browser, page, time | Deliver the website, keep it secure, investigate errors and attacks | Legitimate interest in a secure, working website (Art. 6(1)(f) GDPR) | 7 days (log view available to us; Hostinger's internal security logs per its own retention rules) |
| Anti-cheat and rate limits: round code, start time, IP hash | Make sure scores come from real rounds; block bots and abuse | Legitimate interest in fair play and security (Art. 6(1)(f)) | IP hash: 2 days (rate limits) and 30 days (rounds, scores). Unused round codes: 1 day. |
| Scoreboard: nickname, company (only if you add one when saving your score), score, round statistics (game time, modules, containers, quiz answers), date and time | Show your nickname, company if you add one, rank and score on the public scoreboard at your request; check that the score is plausible | Legitimate interest in running the optional scoreboard you chose to join and keeping it fair (Art. 6(1)(f)) | Shown publicly for 12 months from the round, then deleted automatically. Earlier if you remove it (link after saving, or in our confirmation email) or ask us. |
| Sign-up for updates: work email (required); WhatsApp number (only if you tick WhatsApp); phone number (only if you tick "Call me about PVDIS offers"); company and country (optional); your scoreboard nickname and score, if you saved one | Send PVDIS stock and offer updates by email and/or WhatsApp, and call you about offers, only on the channel(s) you ticked; manage your sign-up in our sales CRM; tailor offers by country and company | Your consent (Art. 6(1)(a) GDPR, and Art. 69(1) of the Lithuanian Law on Electronic Communications), confirmed by email (double opt-in) | Unconfirmed sign-ups: deleted after 30 days (confirmation links expire after 7 days). Confirmed: until you withdraw consent. Contact details are then deleted within 30 days. If you withdraw only one channel (for example calls), we stop using it at once and delete the number kept only for it within 30 days. If you don't engage with our messages for 24 months, we delete your details or ask whether you still want updates. |
| Consent record: the channel(s) you agreed to, the version of the consent text, time of sign-up, confirmation and withdrawal, IP hash, and a one-way code (hash) of your email | Prove that you consented or withdrew consent, and make sure we never contact you after you opted out (suppression list) | Legitimate interest in demonstrating compliance and defending legal claims (Art. 6(1)(f), Art. 7(1) GDPR) | 3 years after your consent ends. After that, only the email hash stays on our suppression list for as long as we send marketing, so that we never email you again by mistake. |
Only your nickname, rank and score are public, plus your company if you choose to add one in the optional company field when you save your score. The contact details you give when signing up for updates (email, phone, WhatsApp number, company and country) are never shown on the scoreboard and never sold. Signing up for updates is optional and is not needed to appear on the scoreboard. Saving a score is not needed to sign up.
Our hosting provider makes automatic weekly backups of the website and database. These are kept for 6 weeks and then deleted automatically. If you ask us to delete your data, it disappears from the backups within that time at the latest. We do not restore deleted data from backups.
The public scoreboard
Your nickname, company (if you add one) and score are shown publicly for 12 months. Choose a nickname that does not reveal who you are. If you are under 14, please ask a parent before saving a score. Please don't use your real name, an email address or a phone number. Nicknames are checked automatically for offensive words, links and reserved names, and we may remove or reject any entry that is offensive, identifies a person or looks like cheating. To remove your entry, use the "Remove my score" link shown right after you save it, or the "Remove my score" link in our confirmation email if you signed up, or email sales@pvdis.com with your nickname, score and the approximate date and time you played. We may ask for details to check that the entry is yours.
Email, WhatsApp and phone updates
We send marketing by email or WhatsApp, or call you, only if you ticked the matching box and confirmed by email. Each channel has its own unticked box, and you can choose any one of them without the others. This applies to business addresses too. We do not use the "existing customer" exception for game sign-ups. Every email identifies PVDIS / "Aurowe", UAB and contains a free unsubscribe link. Every WhatsApp message from us identifies PVDIS and contains your personal stop link and our email address sales@pvdis.com, so you can stop at any time. We do not receive replies to our WhatsApp messages automatically, so please use the stop link or email us rather than replying STOP. The confirmation email checks your email address, not your WhatsApp number. Our first WhatsApp message therefore contains no offer: it says that you signed up on pvdis.com/game and gives your personal stop link, so you can stop at once if you did not ask for it or the number is not yours.
Phone calls. The phone number field is optional. We keep your phone number only if you tick "Call me about PVDIS offers", and we use it only to call you about solar module stock and offers. Every call from us identifies PVDIS / "Aurowe", UAB. You can withdraw your call consent at any time, separately from email and WhatsApp: use "Stop phone calls only" on the unsubscribe page linked in every email, use the stop link in our WhatsApp messages, tell us during a call, or write to sales@pvdis.com. We then stop calling you and delete the phone number within 30 days. We record every stop request within 1 working day.
Emails are sent from sales@pvdis.com through Hostinger Mail (SMTP), our email hosting. We do not use a separate newsletter tool.
Who receives the data
Only authorised PVDIS staff can access sign-up data, using a password-protected admin area. We use these service providers (processors), who act only on our instructions under data processing agreements:
- Hosting, database and email: Hostinger International Ltd, 61 Lordou Vironos str., 6023 Larnaca, Cyprus. The website, the game database and the server logs are on its servers in Boston, Massachusetts, USA. Our sales mailbox is hosted by Hostinger in France and Germany (EU). The Hostinger CDN is switched on for pvdis.com, so it also processes IP addresses to deliver and protect the site.
- Sales CRM (PVDIS Desk): our own sales tool. It is not yet in use. Before it stores any sign-up we will name its hosting provider and location here.
- WhatsApp (only if you ticked WhatsApp): we send WhatsApp messages through the WhatsApp Business Platform (Cloud API), not from a personal phone or the WhatsApp Business app. Meta, through WhatsApp Ireland Limited, processes your WhatsApp number and our messages to you on our behalf as our processor, under the WhatsApp Business Data Processing Terms. For a few of its own purposes, such as keeping WhatsApp secure and running, WhatsApp acts as an independent controller under its own privacy policy. WhatsApp Ireland uses its US affiliates WhatsApp LLC and Meta Platforms, Inc. as sub-processors to host and run the service (list). We use the Cloud API directly and do not use any other WhatsApp service provider.
We may also disclose data where the law requires it, for example to authorities or courts. We never sell your data.
Transfers outside the EU/EEA
Our website and game database are hosted by Hostinger International Ltd (Cyprus) on servers in the USA (Boston), so the data this website collects (server logs, scoreboard entries and sign-up details) is stored in the USA. This transfer is covered by the European Commission's Standard Contractual Clauses (Decision 2021/914), which are part of Hostinger's data processing terms (its Data Processing Addendum, section 9). Hostinger also uses a small number of sub-processors, some of them in the USA, for example Cloudflare, Inc. (DNS and protection against attacks), which is certified under the EU–U.S. Data Privacy Framework, and Proofpoint, Inc. (email filtering). Hostinger's data processing terms require them to protect the data in the same way; they are listed in Appendix 3 of that addendum. Hostinger itself is not certified under the Data Privacy Framework, so we rely on the Standard Contractual Clauses for this transfer.
If you ticked WhatsApp, WhatsApp Ireland transfers your WhatsApp number and our messages to WhatsApp LLC and Meta Platforms, Inc. in the USA. Both are certified under the EU–U.S. Data Privacy Framework, which is the safeguard for this transfer; WhatsApp Ireland may instead use the European Commission's Standard Contractual Clauses (WhatsApp Business Data Transfer Addendum). You can ask us for a copy of the safeguards for any of these transfers at sales@pvdis.com.
Children
PVDIS updates are business offers for installers and buyers. You must be at least 18 to sign up for updates. In Lithuania, children under 14 need consent from a parent or guardian for online services, so if you are under 14, please ask a parent or guardian before saving a score. If we learn that a sign-up comes from someone under 18, we delete it and do not send marketing.
Cookies and similar technologies
For players, the game uses no cookies or browser storage. The only cookie on pvdis.com/game is a strictly necessary session cookie for our staff's admin login. Players never receive it, so no cookie banner is needed. If we ever add analytics or other non-essential technologies, we will ask for your consent first.
Your rights
You have the right to:
- Withdraw consent at any time, as easily as you gave it, for each channel separately or for all of them: use the unsubscribe link in every email (it lets you stop emails, WhatsApp or phone calls only, or everything), use the personal stop link in every WhatsApp message, tell us during a call, or write to sales@pvdis.com. Withdrawal does not affect messages sent before it.
- Object at any time to processing based on our legitimate interest, including the scoreboard. You can always object to direct marketing, and we will then stop.
- Access your data and get a copy, have it corrected, deleted or restricted, and receive data you gave us with your consent in a portable format.
Every email also has a link to unsubscribe and delete your data, including your scoreboard entry. For anything else, write to sales@pvdis.com. We answer within one month (extendable by two months for complex requests, in which case we will tell you), and we may ask you to confirm your identity.
You can complain to the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, L. Sapiegos g. 17, LT-10312 Vilnius, ada@ada.lt, vdai.lrv.lt) or to the data protection authority in the EU country where you live or work. We would appreciate the chance to resolve your concern first.
Automated decisions and profiling
We make no decisions about you based solely on automated processing that have legal or similarly significant effects. The anti-cheat and nickname checks automatically decide only whether a score or nickname can appear on the scoreboard. If you think an entry was wrongly rejected, contact us and a person will look at it. In our CRM we may sort sign-ups by country and company to send relevant offers. This is simple segmentation, not profiling with significant effects.
Security
We use encrypted connections (HTTPS) and store passwords and links in hashed form. We keep sign-up data in a database and the settings in a folder that cannot be reached from the web, and limit access to authorised staff. Admin sessions time out after 30 minutes. Exports contain only confirmed opt-ins. When you unsubscribe or ask for deletion, we apply it to our sales CRM, our WhatsApp list, our call list and any exported list as well. No system is completely secure. If a personal data breach occurs, we will notify the authority and, where required, you.
Changes
We may update this notice. The version and effective date are shown at the top, and earlier versions are available on request. If we want to use your data for a new purpose that needs consent, we will ask you again first. A changed consent text applies only to sign-ups made after the change.
Changes in v3 (30 Oct 2026): added the separate, optional "Call me about PVDIS offers" consent and how to withdraw it; WhatsApp messages are sent through the WhatsApp Business Platform (Cloud API) with Meta as our processor; privacy contact set to sales@pvdis.com.
Changes in v4: added our VAT number; said that our website and game database are hosted by Hostinger on servers in Boston, USA, and our mailbox in France and Germany, and that the transfer to the USA is covered by the Standard Contractual Clauses in Hostinger's data processing terms (with its sub-processor list); stated that Hostinger is not certified under the Data Privacy Framework and that Cloudflare is; said that our first WhatsApp message contains no offer and gives your personal stop link; named WhatsApp Ireland's sub-processors (WhatsApp LLC and Meta Platforms, Inc.) and that the EU–U.S. Data Privacy Framework is the safeguard for WhatsApp data, with the Standard Contractual Clauses as the alternative; said we use no other WhatsApp service provider; added how long server logs and backups are kept; replaced "reply STOP" with a personal stop link in every WhatsApp message and our email address, because replies are not received automatically. The WhatsApp box on the sign-up form now says "stop any time with the link in every message", and the email box writes the company name as "Aurowe", UAB, so the consent text version changed to pman-consent-2026-10-30-v4.