BREACH NOTIFICATION POLICY

What counts as a breach

A personal data breach is any security incident that accidentally or unlawfully destroys, loses, alters, discloses or gives unauthorised access to personal data. This includes:

• Unauthorised access to user accounts, databases or backups.
• Accidental disclosure or sending of personal data to the wrong recipient.
• Loss of encrypted or unencrypted devices or media containing personal data.
• Ransomware, malware or other attacks that affect data confidentiality, integrity or availability.

Detection and reporting

• Anyone involved in running the site, any contractor or automated system that detects a suspected breach must report it immediately to the responsible publisher.
• Reports can be sent to contact@trysomegames.com or through the contact page.
• Users who suspect a breach are encouraged to report it without delay; we treat every report confidentially.

Assessment and containment

• We start an initial investigation as soon as we become aware of the incident.
• Within 24 hours we assess the type of data, number of people, likely consequences and severity.
• We take immediate steps to contain the breach, recover data and prevent further harm.
• All steps, decisions and evidence are recorded in our internal incident log.

Notification to the supervisory authority

Under GDPR Article 33 we must notify the supervisory authority within 72 hours of becoming aware of a breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.

• Our lead supervisory authority is the Swedish Integritetsskyddsmyndigheten (IMY), imy.se.
• We notify IMY electronically through the official breach notification channel, normally within 72 hours.
• If we cannot notify within 72 hours we explain the reasons for the delay.

Communication to affected users

Under GDPR Article 34 we inform affected users directly if the breach is likely to result in a high risk to their rights and freedoms. The communication is clear, concise and in plain language, and includes:

• What happened and the nature of the breach.
• Which data categories and which users are likely affected.
• The likely consequences and risks for users.
• What we have already done to contain, fix and prevent recurrence.
• What users can do to protect themselves (for example changing passwords or enabling two-factor authentication).
• How to contact us for questions or to exercise data rights.

We communicate directly by email to affected users. If direct contact is not possible, we use a clear and equally effective alternative, such as a prominent notice on the site.

Roles and responsibilities

Documentation and review

• Every incident is recorded, even if we decide not to notify the authority or users.
• Records include the facts, effects, remedial action, reasoning and outcome.
• We review every breach afterwards to improve technical and organisational security measures.
• This policy is reviewed at least once a year or after every significant breach.

Contact and questions

If you have questions about this policy or want to report a suspected breach, please contact us at contact@trysomegames.com or use the contact page. You can also exercise your rights under the GDPR on the data rights page.

Related policies

• Privacy Policy
• Cookie Policy
• Data Subject Rights