Privacy Policy & Cookie Policy

Nintendo of Europe SE

My Nintendo Store: Privacy Policy

This My Nintendo Store Privacy Policy (“Privacy Policy”) applies when you visit and use the My Nintendo Store. The My Nintendo Store is operated by Nintendo of Europe SE ("Nintendo", “we” or “us”), Goldsteinstrasse 235, 60528 Frankfurt am Main, Germany, and is accessible at https://store.nintendo.co.uk (“My Nintendo Store Website” or “Website”).

Nintendo is the controller for the processing of your personal data in connection with the Website.

For the purposes of this privacy policy on store.nintendo.co.uk, references to “GDPR” are references to the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016) and, if you are a UK resident, to the UK General Data Protection Regulation (“UK GDPR”).

Nintendo respects your privacy rights and recognises the importance of protecting your personal data.

This Privacy Policy applies to every visit to the My Nintendo Store Website and to every order placed in the My Nintendo Store via a Nintendo Account or via the guest feature without a registered Nintendo Account. If you log in to the My Nintendo Store with your Nintendo Account and place an order in the My Nintendo Store via your Nintendo Account, the Nintendo Account Privacy Policy applies in addition to this Privacy Policy.

The Nintendo Account Privacy Policy can be found here. The Nintendo Account Privacy Policy covers the general processing in connection with the creation and use of a Nintendo Account by us and our parent company Nintendo Co., Ltd. In the event of any conflict or inconsistency between the information set out in this Privacy Policy and the Nintendo Account Privacy Policy, this My Nintendo Store Privacy Policy prevails in so far as the information relates to the My Nintendo Store, the My Nintendo Store Website and any transactions or other activities carried out through the My Nintendo Store.

If you have any questions about our data processing practices or the various privacy policies, please contact us as described in section 8 below.

1 What Information we Collect and Process

1.1 Automated Collection of Data

Certain information is transmitted to Nintendo’s servers by the internet browser of each online visitor when they access the My Nintendo Store Website, including the date and time of access, the name of the requested file, the referral webpage, the status (e.g. transaction completed), the web browser and operating system used, the IP address of the device and the size of transmitted data.

We use this information to set up the connection of your device with Nintendo servers and to enable you to use the My Nintendo Store Website. The legal basis for this processing is the provision of the service you have requested (Art. 6 para. 1 (b) GDPR).

The information is further stored in connection logs for a limited period of time to ensure the security and proper functioning of the My Nintendo Store Website, including preventing hacking attacks on our systems. The legal basis for this processing is our legitimate interest (Art. 6 para. 1 (f) GDPR). The legitimate interest that Nintendo pursues is the protection of Nintendo’s systems.

You have the right to object to such processing at any time for reasons arising from your particular situation. To exercise this right, you can contact Nintendo at any time, as described in Section 8 of this Privacy Policy.

We may also use the information in anonymised form for statistical purposes.

1.2 Data concerning the Usage of the My Nintendo Store

1.2.1 Placing an Order

To place an order on the My Nintendo Store, you can either log in with your Nintendo Account or you can place the order as a guest user.

If you use your Nintendo Account, please read the Nintendo Account Privacy Policy to learn what personal data is collected and processed by us or our parent company Nintendo Co., Ltd. when you use your Nintendo Account. In addition to the data processing described in the Nintendo Account Privacy Policy, we need to collect your first and last name, delivery address, and billing address to fulfil your order from the My Nintendo Store. You can also provide your telephone number if you would like to be notified of the delivery.

If you want to place an order from My Nintendo Store as a guest user, you need to provide your email address, first and last name, delivery address, and billing address. We need this information to process and fulfil your order. You can also provide your phone number if you would like to receive delivery notifications. When ordering products with an age rating of 18+, you must also provide your date of birth. We need this information to ensure that you are eligible to order such products.

1.2.2 Payment

Depending on the payment method selected, you need to provide further personal data so that we or the payment service provider responsible for the respective payment method or the merchant bank (acquirer) can process your payment.

You can pay via debit or credit card, PayPal, Apple Pay, or Google Pay.

If you choose to pay by a debit or credit card, you need to provide your debit or credit card details (debit or credit card number, expiration date, and security code) to facilitate the transaction. To complete the payment process, we are required to share your delivery address, IP address and information about the browser you use when ordering, with the relevant payment service provider or acquirer.

If you use a credit or debit card to place an order via your Nintendo Account, you will have the option during the payment process to save your credit card details for your next transactions in the My Nintendo Store by ticking a box provided for this purpose. If you select this option, we store your credit card number separately in accordance with the credit card provider's regulations. You can delete credit card details saved in this way at any time via your account settings in the My Nintendo Store.

If you use PayPal as the payment method, we will share your delivery address and IP address with PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg, Luxembourg to process your payment.

If you use Google Pay as the payment method, we will share your delivery address, IP address and information about the browser you use when you place your order with Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.

When you pay with Apple Pay, we share your name, billing and shipping address, and IP address with Apple Inc., One Apple Park Way, Cupertino, California 95014, USA.

1.2.3 Further Data collected / Wishlist Function

When you log in to the My Nintendo Store with a Nintendo Account, you have the option to create a wish list. We will store your wish list and you can access it anytime you visit the My Nintendo Store and log in with your Nintendo Account.

We also collect information about the orders and purchases you have made on the My Nintendo Store.

If you subscribe to newsletters and allow customised offers and recommendations in your Nintendo Account settings, we may send you email notifications about products on your wish list, e.g. if there is a special offer for a product on your wish list.

1.3 Marketing and Promotional Communications

1.3.1 Subscription to Marketing and Promotional Communications

Subject to your consent, Nintendo may send you marketing and promotional communications about the My Nintendo Store and related products and services.

If you have purchased a product from the My Nintendo Store, we may also use your email address to send you invitations to submit customer reviews through a third party who acts as our data processor, provided that you have agreed to receive invitations to surveys in your Nintendo Account settings, or you have subscribed to marketing and promotional communications on the My Nintendo Store.

a) Nintendo Account Settings

If you log in to the My Nintendo Store via your Nintendo Account, have agreed to receive invitations to surveys or marketing and promotional communications and have allowed offers and recommendations to be customised, the messages will be sent to the email address registered in your Nintendo Account and the processing is subject to the Nintendo Account Privacy Policy.

b) Back in Stock Notifications for Nintendo Account Users

When you log in to the My Nintendo Store via your Nintendo Account, you have the option to register for notifications about specific products that are currently out of stock. If you activate such notifications on the relevant product display page by clicking on “Notify Me”, you will be notified by email when the product is back in stock or when the product is published and available for purchase. The email is sent to the email address registered with your Nintendo Account.

c) Newsletter Subscription in the My Nintendo Store

You have the option to sign up for marketing and promotional messages on the My Nintendo Store in the course of the checkout process. These messages include notifications about products that are still in your shopping basket, latest pre-orders, exclusive products, news, events, invitations to surveys, and promotions on the My Nintendo Store. If you sign up for marketing and promotional messages as part of an order process, your consent is not subject to completing the checkout.

If you sign up for marketing or promotional communications on My Nintendo Store and you do not have a Nintendo Account, we will send you an email asking you to confirm your consent. The messages will be sent to the email address you provided during the course of the checkout process.

d) “Register Your Interest” Forms

All users can sign up for news about specific products or services they would like to be informed about on the product display pages of the respective products on the My Nintendo Store Website (“Register Your Interest”). If you register for the marketing and promotional communication in the course of the ordering process, your consent is not subject to you finally placing the order.

If you sign up for the “Register Your Interest” notifications, we will send you an email asking you to confirm your consent. The communications will be sent to the email address you provided in the “Register Your Interest” form.

1.3.2 Reconciliation of Email Addresses

To avoid receiving the same marketing and promotional messages multiple times, we may check your email address for additional newsletter subscriptions if you signed up for marketing and promotional communications on My Nintendo Store and were not logged in via a Nintendo Account.

1.3.3 Tracking Your Interactions with our Marketing and Advertising Messages

If you have agreed to receive marketing and promotional messages on the My Nintendo Store (during the ordering process, in a “Register Your Interest” form or when you have activated a “Back in Stock” notification), we collect information about whether you have opened such messages and which links in their text you have followed.

2 How Information is Used – Purposes of Processing

2.1 Processing your Order

We collect and process your information to process, accept and dispatch your orders. We need your email address to send you receipts and order confirmations as well as the invoice and to arrange delivery and delivery notifications. If you have ordered digital products, we will also use your email address to send you the purchased products. When ordering products with an age rating of 18+, we need your date of birth to verify that you are eligible to purchase the age-restricted products.

We process information related to the payment method you have chosen (such as your credit card or debit card information) and share this data with the relevant payment service provider to process the payment.

The legal basis for the processing referred to in this Section 2.1 is the processing of your order, the performance of the purchase agreement and the provision of any additional services you have requested (Art. 6 para. 1 (b) GDPR).

If you have agreed to provide your telephone number, it may be used to arrange delivery and delivery notifications. The legal basis for processing your telephone number is your consent (Article 6 (1) (a) GDPR). You can withdraw your consent at any time.

We also use your email address to send you, through a third party which acts as our data processor, customer review invitations when you have purchased a product in the My Nintendo Store.

The legal basis for sending you customer review invitations is our legitimate interest (Art. 6 para. 1 (f) GDPR). The legitimate interest we pursue is the regular improvement of our online store by receiving feedback from our customers.

You have the right to object to such processing at any time for reasons arising from your particular situation. To exercise this right you may unsubscribe from receiving such emails at any time by clicking on the opt-out link provided in the email sent to you or contact us as described in Section 8 of this Privacy Policy.

If you use the additional service to store your credit card information and if your saved credit card has expired or the details on this credit card have changed, the following applies: If the bank that issued your credit card offers a service to update credit card information, and if you have authorised your issuing bank to do so, we may receive updated information about your credit card. This service helps prevent card payments from being rejected if the saved credit card expires or credit card information is changed. We receive the updated credit card information based on the consent you have given your issuing bank (Art. 6 para. 1 (a) GDPR) and use such updated credit card information for the provision of the service you have requested (Art. 6 para. 1 (b) GDPR).

2.2 Prevention of Fraud and Other Illegal Activities

We may process the information we collect to the extent necessary to prevent fraud, potentially illegal or offensive activities or to enforce our rights or the rights of our users. The legal basis for this processing is Art. 6 para. 1 (f) GDPR. The legitimate interest we pursue is the prevention of fraudulent and illegal activities, the protection of our systems, networks and our users, and the enforcement of our legitimate rights and the rights of our users.

You have the right to object to such processing at any time for reasons arising from your particular situation. To exercise this right, you can contact us at any time as described in Section 8 of this Privacy Policy.

2.3 Compliance with a Legal Obligation

During and after the completion of a purchase order, we may be required to collect and store certain data due to legal obligations, in particular resulting from tax and commercial law.

Insofar as we process personal data to comply with our legal obligations, the legal basis for the processing is Art. 6 para. 1 (c) GDPR.

2.4 Sending Marketing and Promotional Communication

If you agreed to receive marketing and promotional communications from us, the legal basis for processing your personal data in connection with such messages described in Section 1.3.1 above is your consent (Art. 6 para. 1 (a) GDPR).

You can withdraw your consent to receive marketing and promotional communications at any time.

If you have a Nintendo Account and opted in to receive such communications in your Nintendo Account, you can withdraw your consent by changing your promotional email preferences under “Privacy and Other Settings” in your Nintendo Account settings.

You can unsubscribe from the “Back in stock” notifications described in Section 1.3.1 b) above for Nintendo Account users, at any time by clicking the “unsubscribe” link provided in every email and following the instructions provided there or by contacting us as described in Section 8 below.

If you have signed up for marketing and promotional communications on My Nintendo Store, as described in Section 1.3.1 c) above, and if you do not have a Nintendo Account, or if you have a Nintendo Account but have not subscribed to promotional emails in your Nintendo Account settings, you can withdraw your consent by clicking on the “unsubscribe” link included in every email and following the instructions provided there, or by contacting us as described in Section 8.

You can unsubscribe from the “Register Your Interest” notifications described in Section 1.3.1 d) above at any time by clicking on the “unsubscribe” link included in every email and following the instructions provided there, or by contacting us as described in Section 8 below.

2.5 Avoiding Sending Marketing and Promotional Communications Multiple Times

As described in Section 1.3.2 above, if you have signed up for marketing and promotional communications on My Nintendo Store and have not signed in with a Nintendo Account, we will check whether your email address is registered for a Nintendo Account that also receives marketing and promotional communications.

This data reconciliation is necessary to prevent you from receiving the same emails multiple times and to make our newsletter system more user-friendly. The legal basis for this processing is Art. 6 para. 1 (f) GDPR. The legitimate interest we pursue is the avoidance of a negative experience for users.

2.6 Increasing the Relevance of Marketing and Promotional Communications

If you receive marketing and promotional communications from us, the legal basis for using your data as described in Sections 1.2.3 and 1.3.3 above, i.e. to tailor marketing communications to your personal preferences (your wish list), and / or to process information about whether you have opened such messages, which links in their text you have followed, or which options you have selected, is Art. 6 para. 1 (f) GDPR. Nintendo has a legitimate interest in processing your information to tailor marketing and promotional communications that you have agreed to receive as this prevents you from receiving marketing and promotional messages that are not relevant to you. Collecting information about whether you have opened such messages, which links you followed, and which options you have selected helps us understand which messages and links are more relevant to you, and we can therefore optimise future marketing and promotional messages to your advantage.

You have the right to object to the processing of your data for such tailored marketing purposes at any time. To exercise this right, you can contact us at any time as described in Section 8 of this Privacy Policy, or you can opt out of the processing of your information for such personalised marketing purposes at any time in your Nintendo Account settings, if applicable, or by clicking on the “unsubscribe” link included in every email and following the instructions.

3 Cookies and Similar Technologies

3.1 Strictly Necessary Cookies

Nintendo uses security and session cookies, which are strictly necessary to provide you with the services you have requested. Cookies are small files that are downloaded to your device. For example, we use cookies that enable us to maintain your session on the My Nintendo Store Website and to store your selections whilst you navigate through different pages. We also use cookies that enable us to save the language preferences you have chosen so that we can display the My Nintendo Store Website in your preferred language. We also use cookies, which are necessary to provide you with the shopping basket feature in the My Nintendo Store.

The legal basis for using such strictly necessary security and session cookies is the provision of the service you have requested (Art. 6 para. 1 (b) GDPR).

3.2 Non-essential Cookies

Apart from cookies that are strictly necessary to provide our services, the My Nintendo Store Website may also use non-essential cookies. Non-essential cookies will only be activated if you expressly allow it. In this case, the legal basis for using non-essential cookies is your consent (Art. 6 para. 1 (a) GDPR).

The legal basis for the subsequent processing of the data collected via non-essential cookies, such as usage, analysis and storage, is Art. 6 para. 1 (f) GDPR. The legitimate interest Nintendo pursues is the improvement and optimisation of the My Nintendo Store Website as well as the advertisement strategy for the benefit of visitors to the My Nintendo Store Website.

You have the right to object to such processing at any time for reasons arising from your particular situation. To exercise this right, you may at any time deactivate the use of non-essential cookies in the cookie settings below.

3.2.1 Nintendo's Tracking Cookies

With your express consent, we use our own tracking cookies on the My Nintendo Store Website to help us learn how we can serve our customers as best as we can. These tracking cookies enable us to monitor how long you stay on a page, for example, or which pages you visit exactly. The legal basis for using our own tracking cookies and for collecting personal data through tracking cookies is your consent (Art 6 para. 1 (a) GDPR). We only activate these tracking cookies if you expressly allow them to be used. If you permitted the use of non-essential cookies, you can deactivate these cookies at any time by updating your cookie settings.

The legal basis for the subsequent processing of the data collected with tracking cookies, such as usage, analysis and storage, is Art. 6 para. 1 (f) GDPR. The legitimate interest Nintendo pursues is the improvement and optimisation of the My Nintendo Store Website for the benefit of the Website visitors.

3.2.2 Google Analytics and Signals

With your consent, the My Nintendo Store Website uses Google Analytics, a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google Ireland”). Google Analytics uses cookies to help Nintendo analyse how visitors use the My Nintendo Store Website. The information generated by the cookie about visitors' use of the My Nintendo Store Website will generally be transmitted to and stored by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; "Google") on servers in the United States.

On the My Nintendo Store Website, IP anonymisation has been activated for the purposes of Google Analytics. The IP addresses of users from European Union member states, or from other states party to the Agreement on the European Economic Area, will be shortened. Only in exceptional cases will a complete IP address be transmitted to a Google server in the United States and shortened there. On behalf of Nintendo, Google Ireland will use this information to evaluate the My Nintendo Store Website for Nintendo, to compile reports on website activity, and to provide Nintendo with other services related to website activity and Internet usage.

Google Ireland / Google will not associate the IP address transmitted as part of Google Analytics with other data held by Google Ireland or Google. For further information, please visit https://support.google.com/analytics/answer/6004245?hl=en.

The legal basis for enabling Google Analytics is your consent (Art. 6 para. 1 (a) GDPR). Google Analytics is only activated if you expressly allow it. If you permitted the use of Google Analytics, you can disable Google Analytics at any time by updating your cookie settings. Alternatively, you can deactivate Google Analytics by downloading and installing a browser plug-in via the following link: http://tools.google.com/dlpage/gaoptout?hl=en.

The legal basis for the subsequent processing of the data collected via Google Analytics, such as usage, analysis and storage, is Art. 6 para. 1 (f) GDPR. The legitimate interest Nintendo pursues is the improvement and optimisation of the My Nintendo Store Website and the advertisement strategy for the benefit of the Website visitors.

You have the right to object to such processing at any time. To exercise this right, you may at any time download and install the aforementioned browser plug-in or you may at any time deactivate the use of non-essential cookies in the cookie settings.

The My Nintendo Store Website also uses “Google Signals”. Google Signals is an update provided by Google Ireland as part of Google Analytics and enables a cross device tracking of only those users who are logged into their Google account and have activated “Ads Personalization” in their Google account settings. When using Google Signals, aggregated data from Website users who are logged into their Google account and have activated “Ads Personalization” in their Google account is included in Google Analytics reports. As the data that Google Signals generates for Nintendo is aggregated, Nintendo is unable to identify an individual user from such data. On an aggregated basis, Google Signals provides Nintendo with information about how a visitor interacts with the My Nintendo Store Website from various browsers and devices.

Google account users can control their advertisement experience and deactivate “Ads Personalization” in their Google account settings at any time.

3.2.3 Google Ads Remarketing

With your consent, this Website uses Google Ads Remarketing technology which is a service provided by Google Ireland. Advertisements can be presented within the advertising network of Google / Google Ireland based on content which has previously been accessed on websites within the advertising network by visitors who also use the Google Ads Remarketing feature. In particular, based on your previous use of the My Nintendo Store Website we use Google Ads Remarketing to target our ads to you when you visit other websites, e.g. sites in Google’s / Google Ireland’s content network.

The legal basis for enabling Google Ads Remarketing is your consent (Art. 6 para. 1 (a) GDPR). We only use Google Ads Remarketing if you expressly allow it. If you permitted the use of Google Ads Remarketing, you can disable Google Ads Remarketing at any time by updating your cookie settings. Alternatively, Google Ads Remarketing can be deactivated by updating the settings under http://www.google.com/settings/ads.

The legal basis for the subsequent processing of the personal data collected via Google Ads Remarketing technology is Art. 6 para. 1 (f) GDPR. Nintendo has a legitimate interest in marketing purposes as it helps placing advertisements that are more relevant. You have the right to object to such processing at any time for reasons arising from your particular situation. To exercise this right, you may at any time deactivate the use of non-essential cookies in the cookie settings.

If you access the My Nintendo Store Website while logged into your Google account, and if you have chosen to enable Google / Google Ireland to link your browsing history to your Google account and use this information to personalise advertising, Google/ Google Ireland links the information collected via Google Analytics with your Google account data. Google/Google Ireland will use the information collected for cross-device marketing purposes. In particular, based on your use of the My Nintendo Store Website on one device, our advertisements can be targeted to you when you browse on another device. As the data that Google / Google Ireland collects on the My Nintendo Store Website about Google account users is aggregated, Nintendo is unable to identify any individual user from such data. For more information about the collection and use of data by Google / Google Ireland, please visit http://www.google.com/policies/privacy/.

Google account users can control their advertisement experience and change their settings with respect to personalised advertisements at any time in their Google account settings.

3.2.4 Google Marketing Platform/Double Click

With your consent, the My Nintendo Store Website also uses services offered by Google Ireland as part of the “Google Marketing Platform” (including the former “DoubleClick” service). These services from Google Ireland use cookies to provide Website visitors with relevant advertisements. A cookie ID is assigned to your browser to keep a log of which advertisements have already been delivered to that particular browser. The Google Marketing Platform cookie enables Google Ireland and its partner websites to show advertisements based on previous visits to this or other websites. In the same way, the cookie ID allows the Google Marketing Platform cookie to log conversions related to advertisement requests — for example, when a user views an advertisement placed via Google Marketing Platform and later visits the advertiser's website using the same browser.

The legal basis for enabling the Google Marketing Platform cookie is your consent (Art. 6 para. 1 (a) GDPR). We only use Google Marketing Platform if you expressly allow it. If you permitted the use of Google Marketing Platform, you can disable Google Marketing Platform at any time by updating your cookie settings. Alternatively, the Google Marketing Platform cookie can be disabled by installing the Google Marketing Platform browser plug-in via the following link: https://www.google.com/settings/ads/plugin or by updating the settings on the following website: https://www.google.com/settings/ads.

The legal basis for the subsequent processing of the personal data collected via the Google Marketing Platform cookie is Art. 6 para. 1 (f) GDPR. Nintendo has a legitimate interest in marketing purposes as it helps placing advertisements that are more relevant.

You have the right to object to such processing at any time for reasons arising from your particular situation. To exercise this right, you can deactivate the use of non-essential cookies at any time in the cookie settings.

3.2.5 Meta Pixel

With your consent, we use Meta pixel on this website. The Meta pixel is operated by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Meta”).

Meta pixel is a JavaScript code snippet that allows us and Meta to understand and track our website visitors’ activities. When you take certain actions on our website, Meta pixel loads a small library of functions with which Meta can track your actions on our website and link them to other information that they have about you.

The Meta pixel collects and processes the following information (called “Event Data”):

Information about actions and activities of the visitors of our website, such as searching and viewing a product or purchasing a product;
Specific pixel information such as the pixel ID and the Facebook cookie;
Information about buttons clicked by visitors to our website;
Information present in HTTP headers, such as IP addresses, web browser information, page location, and referrer; and
Information about the status of disabling/restricting ad tracking.

The Event Data collected via the Meta pixel is used for targeting our ads and improving ad delivery on Meta products such as the social media platforms Facebook and Instagram, for personalising features and content, or the measurement of the success of our ads (called "conversion tracking"), and for improving and securing Meta products.

We have no influence on the scope and subsequent processing of the submitted Event Data by Meta. Meta may process the information to create or enrich user profiles. If you are registered with a Meta service such as Facebook or Instagram, Meta may associate the Event Data (including the visit on our website) with your account. Even if you are not registered with a Meta service or have not logged in, it is possible that Meta may learn your IP address and other identifying information and use it to create a profile. For more information about how Meta processes user profiles and your personal data, including the purposes, legal basis on which Meta relies and how you can exercise your rights against Meta, please see Meta Privacy Policy at https://www.facebook.com/about/privacy.

We have also engaged Meta to prepare reports on the impact of our advertising campaigns and other online content based on the Event Data collected through the Meta pixel (“campaign reports”) and to provide analysis and insights about the visitors and their use of our website, products and services (“analytics”). We transfer personal data contained in the Event Data to Meta for these purposes. The transferred personal data is processed by Meta as our processor to provide us with campaign reports and analytics.

Please note that Meta may transfer processed data also to servers outside the EU, in particular to Meta Platforms, Inc. in the USA. Such data transfer is based on Art. 45 para. 1 GDPR, as Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework and is also registered in the list maintained by the U.S. Department of Commerce (Data Privacy Framework List). The EU-U.S. Data Privacy Framework is an adequacy decision by the EU Commission which certifies that participating companies provide for an adequate level of data protection within the meaning of the GDPR. The EU-U.S. Data Privacy Framework is available here: https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.

The Meta pixel with the remarketing function is used by Nintendo to target, based on visitors’ prior use of this website, advertisements to visitors of this website once they visit the social network Facebook ("Facebook Ads").

The legal basis for collection and transmission of personal data by us to Meta and the commissioned processing of personal data by Meta for the creation of analyses and campaign reports is your consent (Art. 6 para. 1 (a) GDPR). We will only use the Meta pixel if you explicitly allow it. If you permitted the use of the Meta pixel, you can withdraw your consent and disable the Meta pixel at any time with effect for the future by updating your cookie settings or by updating your Facebook account settings.

3.2.6 X Pixel

With your consent, the My Nintendo Store Website also uses the X Pixel with a remarketing function. The X Pixel is operated by Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland (“Twitter”).

The X Pixel with the remarketing function is used by Nintendo to target, based on visitors’ prior use of this Website, advertisements to visitors of this Website once they visit the social network Twitter.

Through the X Pixel a direct connection to the Twitter servers is made when visitors visit the My Nintendo Store Website. This sends the information to the Twitter server that a visitor has visited this Website, and Twitter processes this information and can assign this information to a visitor’s personal Twitter user account. For more information about how Twitter collects, processes and protects data, please see Twitter's privacy policy at https://twitter.com/privacy.

The legal basis for using the X Pixel is your consent (Art. 6 para. 1 (a) GDPR). We only use the X Pixel if you expressly allow it. If you permitted the use of the X Pixel, you can disable the X Pixel at any time by updating your cookie settings or in your Twitter account settings.

The legal basis for the subsequent processing of the personal data collected via the X Pixel such as usage, analysis and storage is Art. 6 para. 1 (f) GDPR. Nintendo has a legitimate interest in marketing purposes as it helps placing advertisements that are more relevant.

3.2.7 Awin

We cooperate with Awin affiliate marketing network for digital advertising services provided by Awin AG, Eichhornstr. 3, 10785 Berlin, Germany (“Awin”). As part of this program, subject to your consent, certain transactions are documented and identified. With your consent, we may set cookies to help us understand your navigation before a transaction on the My Nintendo Store and the effectiveness of our advertising measures. The data collected by these cookies is not necessarily personal data.

Awin places cookies on your device and uses information about transactions, such as purchases from the My Nintendo Store. Awin collects information about your browser, device, and the time you clicked on one of our ads. Awin cooperates with various publishers who display our ads on their websites. Publishers may also place cookies on your browser.

The cookies placed by Awin, the publishers or us serve the purpose to identify whether you purchased one of our products after having been shown an ad for this product before. These cookies may collect an identification number, a serial number and information about the specific advertising method. The cookies do not necessarily collect personal data.

Depending on your browser settings, in addition or alternatively to the cookies, your behaviour might be tracked via personalised URLs. This only serves the purpose to see whether you purchased one of our products after having been shown an ad for this product before.

For more information please see Awin's privacy policy: https://www.awin.com/gb/privacy

The legal basis for placing cookies to analyse your transactions within the Awin affiliate marketing network is your consent (Art. 6 para. 1 (a) GDPR). We will only use the respective cookies if you explicitly allow it. If you permitted the use of these cookies, you can disable the cookies at any time by updating your cookies settings.

The legal basis for any further processing of personal data in connection with the Awin affiliate marketing network is Art. 6 para. 1 (f) GDPR. Nintendo has a legitimate interest in marketing purposes as it helps placing advertisements that have an increased relevance. In addition, identifying your transactions and the effectiveness of our ads facilitates the processing of commission payments in the Awin affiliate marketing network.

3.2.8 Impact’s Universal Tracking Tag

We cooperate with Impact affiliate marketing network for digital advertising services provided by Impact Radius Limited, The Scalpel, 18th Floor 52 Lime Street, London EC3M 7AF, United Kingdom (“Impact”). With your consent, we place cookies that help us count visitors from websites participating in Impact’s affiliate marketing network and the effectiveness of our advertising measures. The data collected by these cookies is not necessarily personal data.

Impact may place cookies on your device to collect information about your browser, device and the time you clicked on one of our ads. Impact cooperates with different publishers who display our ads on their websites. Publishers may also place cookies on your browser.

3.2.8 Impact’s Universal Tracking Tag

The cookies placed by Impact, the publishers or us are used to identify whether you have purchased one of our products after you have previously been shown an ad for that product. These cookies may collect an identification number, a serial number and information about the specific advertising method. These cookies do not necessarily collect personal data.

Depending on your browser settings, your behaviour can also be tracked via personalised URLs in addition to or as an alternative to cookies. This only serves the purpose of seeing whether you have purchased one of our products after having been shown an ad for that product.

For more information please see Impact’s privacy policy: https://impact.com/privacy-policy.

The legal basis for placing cookies to analyse your transactions within the Impact affiliate marketing network is your consent (Art. 6 para. 1 (a) GDPR). We only use the respective cookies if you expressly allow it. If you permitted the use of these cookies, you can disable the cookies at any time by updating your cookie settings.

The legal basis for any further processing of personal data in connection with the Impact affiliate marketing network is Art. 6 para. 1 (f) GDPR. Nintendo has a legitimate interest in marketing purposes as it helps placing advertisements that are more relevant. In addition, identifying your transactions and the effectiveness of our ads facilitates the processing of commission payments within the Impact affiliate marketing network.

3.2.9 Bing Ads

With your consent, the My Nintendo Store Website uses the Bing Ads tracking service, which is provided and operated by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA (“Microsoft”). Subject to your consent, Microsoft places a cookie on your device if you have accessed our Website via a Microsoft Bing advertisement. This allows both us and Microsoft to recognise that you clicked on an advertisement, were redirected to our Website, and accessed a specific page on our Website.

Based on the information collected by the cookie, Microsoft can create pseudonymised user profiles. These user profiles are used to analyse the visitor behaviour on our Website and to display suitable advertisements. Among other things, the amount of time you spent on the Website, which areas of the Website you accessed and which advertisement brought you to the Website.

Microsoft can track your usage behaviour across multiple electronic devices through cross-device tracking. The information collected is transmitted to a Microsoft server in the United States.

For more information about Bing Ads and Microsoft's use of personal data for advertising purposes, please visit https://secure.bingads.microsoft.com/ and https://privacy.microsoft.com/en-US/privacystatement.

The legal basis for placing cookies to analyse your interactions with our Website and placing suitable advertisements is your consent (Art. 6 para. 1 (a) GDPR). We only use the Bing Ads cookies if you expressly allow it. If you permitted the use of Bing Ads cookies, you can disable the cookies at any time by updating your cookie settings. Alternatively, you can disable Bing Ads cookies here: http://choice.microsoft.com/de-DE/opt-out).

The legal basis for any further processing of personal data collected via the Bing Ads cookie is Art. 6 para. 1 (f) GDPR. Nintendo has a legitimate interest in marketing purposes as it helps placing advertisements that are more relevant.

We will occasionally update this Section 3 to reflect changes. If we make material changes to how we use tracking cookies, you will be notified by a message at the top of the Website. You can access the cookie settings by following the relevant link at the bottom of the Website.

Additionally, the European Interactive Digital Advertising Alliance (EDAA) has developed the website Your Online Choices (www.youronlinechoices.eu). On this website, you can find more information about your cookies, and manage them.

4 User Communications

When you send an email or other communication to Nintendo, we use these communications and any personal data you have provided to us to process your inquiries and respond to your requests. You can contact us via email, chat, or telephone. The legal basis for this processing is the provision of the service you have requested (Art. 6 para. 1 (b) GDPR).

If you contact our My Nintendo Store customer service in the UK by phone, we may record and use the conversation for quality and training purposes and to provide customer service, provided you do not object to the recording. The legal basis for processing your personal data in connection with the recording, the storage of the recording and the subsequent use for provision of customer support services and quality and training purposes, is our legitimate interest (Art. 6 para. 1 (f) GDPR). The legitimate interest Nintendo pursues is to provide the necessary customer services and to ensure the overall improvement of customer services provided to My Nintendo Store customers.

5 Who Has Access to Your Information

5.1 Nintendo may share your information with other entities in the Nintendo group to be used in accordance with this My Nintendo Store Privacy Policy, in particular, with:

its parent company Nintendo Co., Ltd. located in Japan; and
its European branches in France, the Netherlands, Belgium, Italy, Germany, Austria, Switzerland, Portugal, Spain and the United Kingdom.

We have a legitimate interest in sharing your information for internal administrative purposes, in particular to offer the My Nintendo Store and to process all inquiries in an efficient and high-quality manner.

Nintendo group companies that are located outside the European Union or the European Economic Area, are either located in a third country where the European Commission has decided that this country ensures an adequate level of data protection, or appropriate safeguards for an adequate level of data protection are provided through the standard data protection clauses that have been adopted by the European Commission and incorporated into the agreement between Nintendo and the other entity of the Nintendo group.

5.2 Some of our products are age-restricted and, to comply with our legal obligations, we are required to verify your age before we accept your purchase of these products. We use a data-driven service provided by GB Group Plc, The Foundation, Herons Way, Chester Business Park, Chester, CH4 9GB, UK (“GBG”) to verify the age of our customers.

As part of the age verification, we provide GBG with your name, address and date of birth, which you have provided to us. The age verification process is based on automated decision-making. During the age verification process, GBG's data-driven service automatically determines whether you are eligible to purchase the age-restricted item by matching your name, address, and date of birth with various databases. Depending on the result, you can continue the purchase process or the purchase process is cancelled. GBG's privacy policy can be found here.

The legal basis for processing your data in accordance with Section 5.2 and for the transfer of personal data to GBG is the provision of the services you have requested (Art. 6 para. 1 (b) GDPR).

You have the right to have someone review the automated decision, the right to express your point of view, and the right to challenge the automated decision. To exercise this right, you can contact us at any time as described in Section 8 of this Privacy Policy.

5.2.1 For orders delivered to the UK, the following also applies:

GBG relies on data sourced from the credit reference agency Equifax Limited, 1 Angel Court, London, EC2R 7HJ, UK (“Equifax”). Your name, address, and the date of birth you provide to us will be shared with Equifax. Equifax may keep a record of that information. This information is known as a search footprint. Equifax may disclose your information, and the fact that a search was made, to its other customers for the purposes of assessing the risk of giving credit and occasionally to prevent fraud, money laundering and to trace debtors.

The legal basis for disclosing personal data to Equifax are steps taken at your request prior to entering into a contract (Art. 6 para. 1 (b) GDPR).

As Equifax is a credit reference agency, we are obliged to share a copy of their information notice with you: https://www.equifax.co.uk/crain.html.

GBG also relies on data sourced from the credit reference agency Experian, PO BOX 9000, Nottingham, NG80 7WP United Kingdom (“Experian”). Your name, address and the date of birth you provide us is shared with Experian. A search will be carried out with Experian for the purposes of verifying your identity. A soft footprint shall be left on your credit file. Experian may check the supplied details against any particulars on any database (public or otherwise) to which Experian has access in order to verify your identity.

The legal basis for disclosing personal data to Experian are steps taken at your request prior to entering into a contract (Art. 6 para. 1 (b) GDPR).

As Experian is a credit reporting agency, we are obliged to share a copy of their information notice with you: https://www.experian.co.uk/legal/crain/

5.2.2 For orders delivered to Austria or Switzerland, the following also applies:

Nintendo obtains credit information based on mathematical-statistical procedures using your address data from Crif Burgel GmbH, Leopoldstraße 244, 80807 Munich, Germany, which, as a credit agency, stores data to provide information.

The legal basis for the transfer of personal data to Crif Burgel GmbH is measures that are taken at your request before concluding a contract (Art. 6 (1) (b) GDPR).

5.3 To enable your payment in the My Nintendo Store, as further explained in Section 1.2.2 above, we also need to share some of your personal data with payment service providers and acquirers who offer the payment method you have chosen. The legal basis for sharing this information is the performance of the purchase agreement (Art. 6 para. 1 (b) GDPR). More information about the payment service providers that offer the payment methods available in the My Nintendo Store and their data processing activities here.

5.4 If you have ordered physical products, we will also share your name, postal address, and email address with our parcel delivery provider to deliver your order. The legal basis for sharing this information is the delivery of your order and the performance of the purchase agreement (Art. 6 para. 1 (b) GDPR). If you choose to be notified of the delivery by our parcel service provider, we will share your telephone number and email address with the parcel service provider. The legal basis for sharing your telephone number and email address with the parcel deliverer is your consent (Art. 6 para. 1. (a) GDPR).

5.5 In accordance with applicable data protection requirements, Nintendo may also use third party data processors and may share your information with such third party data processors who act on Nintendo’s behalf to provide services in connection with the My Nintendo Store. If such third party processors are located outside the European Union or the European Economic Area, they are either located in a third country where the European Commission has decided that this country ensures an adequate level of data protection, or appropriate safeguards for an adequate level of data protection are provided for by standard data protection clauses that have been adopted by the European Commission and agreed between Nintendo and the third party data processor.

6 Storage Period

We only store your information as long as is necessary to fulfil the purposes for which the information is collected and processed, or – where the applicable law provides for longer storage and retention periods – for the storage and retention period required by law. Your personal data will then be deleted. Please note that we are required to retain certain transaction data about your purchase for a period of up to ten (10) years in accordance with legal commercial requirements and tax regulations.

In particular, the following applies:

If you have previously logged in to the My Nintendo Store using your Nintendo Account, your personal data will be deleted when you terminate your Nintendo Account by deleting your Nintendo Account in the account settings or by contacting us as provided for in the Nintendo Account Privacy Policy.
If you withdraw your consent on which a processing of your personal data is based, we will delete your personal data without undue delay to the extent that the collection and processing of the personal data was based on the withdrawn consent.
If you exercise your right to object to the processing of your personal data, we will delete your personal data that we have processed for the purpose to which you have objected without undue delay, unless there is another legal basis for processing and storing this data or applicable law obliges us to retain the data.

7 Your Rights under GDPR

In particular, but without limitation, you may have the following rights under GDPR:

Right of access: You have the right to obtain confirmation from us as to whether or not we process your personal data, and you also have the right to obtain access to your personal data stored by us at any time. To exercise this right, you can contact us at any time as described in Section 8 of this Privacy Policy.
Right to rectification of your personal data: If we process your personal data, we strive to take appropriate measures to ensure that your personal data is accurate and up to date for the purposes for which we collected it. If your personal data is incorrect or incomplete, you have the right to request that this data be corrected. To exercise this right, you can contact us at any time as described in Section 8 of this Privacy Policy.
Right to erasure of your personal data or right to restrict processing: You have the right to request the erasure of your personal data or the restriction of the processing of your personal data. To exercise this right, you can contact us at any time as described in Section 8 of this Privacy Policy.
Right to withdraw your consent: If you have consented to the processing of your personal data, you have the right to withdraw your consent at any time without affecting the lawfulness of processing based on consent prior to the withdrawal. To exercise this right, you can contact us at any time as described in Section 8 of this Privacy Policy or proceed as further described in this Privacy Policy.
Right to data portability: You have the right to receive the personal data concerning you and which you have provided to us, in a structured, commonly used and machine-readable format or to transmit those data to another controller. To exercise this right, you can contact us at any time as described in Section 8 of this Privacy Policy.
Right to object: You have the right to object to the processing of your personal data, as explained in more detail in this privacy policy.
Right to lodge a complaint with the supervisory authority: You have the right to lodge a complaint with a data protection supervisory authority located in the European Union. You can contact the Hessian Data Protection Supervisor.

8 Contact and Data Protection Officer

If you have any questions about this Privacy Policy and Nintendo’s data processing activities or would like to exercise any of your rights under GDPR, please contact:

Nintendo of Europe SE, Attn.: Legal Department, Goldsteinstrasse 235, 60528 Frankfurt am Main, Germany, or via the contact form available under https://nintendo-europe.com/contact.

You can also contact Nintendo’s data protection officer:

Nintendo of Europe SE, Attn.: Legal Department, Goldsteinstrasse 235, 60528 Frankfurt am Main, Germany, or via email to dataprotectionofficer@nintendo.de.

Please note that although our main office is based in Frankfurt am Main, Germany, we also maintain a registered branch in the United Kingdom at: Nintendo UK, The Quadrant, 55-57 High Street, Windsor, SL4 1LP.