How we handle personal data

1. Who is responsible

The data controller is Checkpoint Nomad, c/o Kubra Gurkan Kose, Bornholms Alle 17, 3. 1, 2630 Taastrup, Denmark, registered in Denmark under CVR 45843653. Contact for any privacy matter: info@checkpointnomad.com, or by post to the address above. We have not appointed a Data Protection Officer, because we are not required to under Article 37 GDPR; privacy questions go to the address above and are handled by the company.

2. What we collect, field by field

We collect nothing about you until you send it. There is no account system, no profiling, no advertising pixel and no third-party script on this site as it stands. Two forms exist, and this is the whole inventory:

2.1 Pitch submission (/pitch-your-demo)

• Studio or developer name — identifies who is submitting.
• Contact email — the only way we can send you an answer.
• Game title, genre, target platforms — the assessment itself.
• Your pitch text — what you choose to tell us about the game.
• Playable build link and design document link — what we assess.
• Funding band — tells us whether the project is in a range we can work with.

Every one of those fields is required, and there are no optional fields on that form. That is deliberate: the legal basis below covers what is necessary for the step you asked us to take, and a field you did not have to fill in could not be necessary by definition.

2.2 Contact form (/contact)

• Your name, your email address, the subject you selected, and your message.

2.3 Anti-abuse and server logs

• A one-way hash of your IP address plus a timestamp, so a single sender cannot flood the forms. The raw IP address is not stored in the application database.
• Standard web-server logs: request path, status code, timestamp, user agent, and IP address held for 30 days for security and error diagnosis.
• A hidden field on each form that only automated submitters fill in. If it is filled, the submission is discarded and nothing is stored.

3. Legal basis, and why we do not ask for consent

• Pitch submissions — Article 6(1)(b). Processing is necessary for steps taken at your request before entering into a contract. You asked us to assess a pitch; reading it and replying is that step.
• Contact messages — Article 6(1)(f), or 6(1)(b) where your message is a step towards a contract. Our legitimate interest is answering business correspondence addressed to us. You can object at any time under Article 21.
• Anti-abuse and logs — Article 6(1)(f). Our legitimate interest in keeping the site available and the forms usable.
• Non-essential cookies — Article 6(1)(a) consent, and only where you actually give it. See the Cookie Policy.

You will not find an “I agree to the privacy policy” tick-box on our forms. Consent is a separate legal basis from the ones above, and consent you have to give in order to submit a form is not freely given under Article 7(4) — so demanding it would misstate our basis and be invalid at the same time. Instead you get a notice at the point of collection telling you exactly what happens, which is what Article 13 requires.

4. What we never do

• We do not sell or rent personal data, and we never will.
• We do not disclose your data to third parties for those parties’ own purposes.
• We do not add you to a mailing list because you contacted us.
• We do not build profiles or take automated decisions with legal or similarly significant effects.
• We do not ask for a phone number, postal address, date of birth or any special-category data.

5. Who processes the data for us

We use processors that act only on our documented instructions under Article 28 contracts. Naming a processor is not the same as disclosing your data to a third party for its own purposes — a processor may only do what we tell it to.

• Hosting — Hostinger International Limited. This website, its API and its database run on a single virtual server operated by Hostinger International Limited in Düsseldorf, Germany. That is the only place your submission is stored. The processing terms are their published data processing addendum under Article 28.
• Transfers outside the EEA. Germany is in the European Economic Area, so storing your data there is not a Chapter V transfer and no adequacy decision or safeguard is needed for it. We do not rely on standard contractual clauses for hosting, because there is nothing to transfer.
• Email. Outbound mail from the server is switched off, so no email provider receives anything you submit through a form. Messages you send directly to info@checkpointnomad.com are handled by the mailbox provider for the checkpointnomad.com domain.
• How we know where the server is. The location was established from inside the machine on 2026-08-17 — the first upstream router, round-trip times to cities with known locations, and the RIPE registry entry — not from an IP-geolocation lookup, which is frequently wrong.

That list is exhaustive. There is no analytics provider, no CRM, no chat widget, no content delivery network, no backup provider and no third-party font host. If that changes, this section is updated before the change goes live, because adding a processor is a change to who holds your data.

We use no analytics provider, no CRM, no chat widget, no content delivery network and no third-party fonts. Every asset on this site is served from our own domain, which is why no request leaves your browser to anyone else while you read it.

6. How long we keep it

• Pitch submissions: 24 months from your last message about them, then deleted.
• Contact messages: 12 months from your last message, then deleted.
• Anti-abuse records and server logs: 30 days.
• Where a submission leads to a signed agreement, the contract file is kept for as long as Danish bookkeeping law requires (five years from the end of the financial year it relates to).

Deletion is not a promise made only in this policy: the retention periods above are enforced by scheduled jobs in the database itself.

7. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). Where processing rests on consent, you may withdraw it at any time without affecting processing already carried out.

Write to info@checkpointnomad.com. We answer within one month, and we will tell you if we need longer as Article 12(3) allows. There is no charge.

If you believe we have handled your data unlawfully you may complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark — datatilsynet.dk — or to the supervisory authority where you live.

8. Security

The site is served over HTTPS. Form input is validated and escaped on the server, database access uses prepared statements, credentials are held outside the web root, and the database is not exposed to the public internet. No system is perfect; if you find a weakness, please tell us at info@checkpointnomad.com and we will respond.

9. Children

This is a business-to-business site for game developers and is not directed at children. We do not knowingly collect data from anyone under 13, the age set for information society services in Denmark under Article 8(1) GDPR as implemented in Danish law. If you believe a child has sent us data, write to us and we will delete it.

10. Changes to this policy

When this policy changes we update the date at the top of the page. Material changes — a new processor, a new purpose, a different retention period — are described in the section they affect rather than summarised away.