Updated: 11 October 2026
This policy explains how personal data is handled on the MAXKO website, game accounts and Power Up Store. Applicable data-protection rights are not limited to visitors located in the EU.
Data controller
MAXKO d.o.o., 44000 Sisak, Croatia, is responsible for this processing. Contact us at the email below about privacy or your data.
Data we process
Depending on your use of the service, we process account identifiers, email and registration details, characters and game activity, voting records, IP addresses and technical/security logs. Contact requests include the details and message you submit. Account and character names may appear in public rankings.
Purposes and legal grounds
Account operation, purchases and support are needed to provide the service and perform our contract. Security and fraud prevention serve our legitimate interest in protecting users and the service. Billing records meet legal obligations. Where processing requires consent, that consent is a separate legal basis and may be withdrawn.
Payments and other providers
Checkout may use PayPal, Skrill or BTCPay, subject to availability. We retain order, invoice/transaction identifiers, amounts and payment status; payment providers process payment details under their own notices. Hosting and other technical providers may also process necessary data. Transfers outside the EEA require applicable safeguards; contact us for details. We do not sell personal data.
Cookies and local storage
Login/session cookies keep the account working; preferences and navigation state may use cookies or browser storage. The website also includes Google Analytics for usage statistics. You can manage cookies in your browser, although blocking essential cookies may prevent login. Browser settings do not replace consent where it is required.
Retention and security
Retention depends on the purpose: account operation, support enquiries, security investigations, accounting duties and dispute limitation periods. Closing an account does not automatically erase records that must be retained by law. Access controls and secure connections help protect data, but no online system is risk-free.
Google reCAPTCHA
We use Google's reCAPTCHA to protect contact and registration forms from automated abuse. Verification is provided by Google and requires JavaScript and communication with Google's servers. reCAPTCHA sets a necessary _GRECAPTCHA cookie for risk analysis.
Your rights
Subject to applicable conditions, you may request access, correction, erasure, restriction or portability, object to processing and withdraw consent without affecting earlier lawful processing. Email us to exercise these rights; we may need proportionate identity verification, never your password. You may complain to AZOP in Croatia or another competent supervisory authority.