PRIVACY

Rynua Interactive is an independent game studio based in the Netherlands, and we're the data controller for this website — which just means we're the ones responsible for what happens to your information here, and the ones you should come to with questions about it. If you'd like to know what we hold about you, or you'd rather we didn't, write to contact@rynua.com. Someone on the team will actually read it and get back to you.

This policy covers www.rynua.com. It does not reach into any other platform we are present on — those are run by their own companies, under their own rules and their own privacy policies.

The careers page is one place on this site where we ask for personal information — and even there, only if you choose to provide it by submitting a job-alert or application form.

When you do, here's exactly what we keep:

Your email address

so we know where to send the alert when a role opens.

A random token

a one-off string tied to your confirmation and unsubscribe links. It isn't derived from your address, and on its own it means nothing to anyone.

The date you signed up

lets us clear out sign-ups nobody ever confirmed, and keeps the form safe from being used to send mail to other people.

We use what's called double opt-in: submitting the form doesn't put you on the list right away, it sends you one confirmation email first. If that link goes unclicked, your address is deleted within seven days and you won't hear from us again. It also means nobody can sign you up against your will just by typing your address in — you're always the one who confirms it.

We use your email address to send the job alerts you asked for, based on your consent under Article 6(1)(a) GDPR. Technical processing needed to operate and protect that service may also be carried out where necessary for our legitimate interests. When you unsubscribe, we delete your subscription record rather than marking it inactive. We do not maintain a suppression list for job alerts.

While you're on the list, the only thing you'll hear from us is that one email when a role opens. No newsletter riding along with it, no product updates, no general announcements — just the thing you actually signed up for.

If you contact us through the website, email us directly, or apply for a role, we keep that message — and whatever you've written in it — in our mailbox, simply so we can read it and reply. We won't use it for anything beyond that, and we won't quietly add you to a mailing list because you happened to write in.

Applying for a role also gets you a confirmation email with a "Withdraw your application" link built in, good for 30 days. If you ever change your mind, clicking it deletes your uploaded CV and any other attachments immediately — no email to write, no one to ask. It does send a short internal note to careers@rynua.com with your name, email, and the role, just so the team understands you withdrew on purpose rather than wondering why an attachment stopped working.

Attachments submitted through a job application are automatically deleted after 30 days unless we need to retain them longer for an ongoing recruitment process and have a lawful basis to do so.

The search box on this site sends whatever you type to our own server, which looks through our pages and hands back the results — nothing more elaborate than that. We don't store your queries, tie them to you, or send them anywhere else. Like any request to a website, they may pass briefly through technical logs, but that's the extent of it.

Like every website, ours is reached over a network, and the infrastructure serving it keeps a record of that traffic: an IP address, the page requested, a timestamp, the browser's user-agent string. It's fairly ordinary bookkeeping, and it's what keeps the site online and able to fend off attacks.

We only ever use these records to keep the site running and secure — never to build any kind of picture of who you are. Legally, this rests on our legitimate interest in operating a secure service (Article 6(1)(f) GDPR). Logs are retained only for as long as they are reasonably needed for security, abuse prevention and troubleshooting, after which they are deleted or allowed to expire.

This is worth spelling out plainly, because most websites do all of the following, and there's usually no way for you to tell which ones don't:

• No analytics or measurement of any kind — first-party or third-party.
• No advertising, remarketing, conversion tracking, or audience lists.
• No share widgets or embedded posts. The share buttons on an article are ordinary links: they load nothing, set nothing, and tell nobody you saw them unless you click one. Nothing third-party loads on this site, and where we link out, it is a plain link and nothing more.
• No embedded video players or iframes from other companies.
• No fingerprinting, and no profiling or automated decision-making about you.
• The typeface is served from our own domain rather than fetched from a font provider, so loading a page doesn't tell anyone else that you did.

This site doesn't set any cookies of its own. Nothing gets written to your browser to remember you, count your visits, or follow you from one to the next.

Our infrastructure provider might set a short-lived cookie of their own, purely to tell real visitors apart from automated traffic. It's strictly there for security, carries no advertising or analytics purpose, and can't be used to recognise you on other websites. Cookies like that don't need your consent under the ePrivacy rules — which is exactly why you won't find a cookie banner here.

We use a small number of service providers to operate this website and the services connected to it. They process personal data only where needed to provide those services to us.

Cloudflare

serves this website and keeps it protected from attack — the same requests described under Security and server logs pass through them.

Amazon Web Services

Website and backend infrastructure, database services, file processing and storage, and transactional email.

Microsoft 365

is our mailbox — anything you email us, and anything we write back, lives there.

None of them are allowed to use your data for their own purposes, and we wouldn't add anyone to this list without being able to explain exactly why they're on it.

The job-alerts list and our outgoing email both run in an Amazon Web Services region inside the European Union, so that particular data never actually leaves the EU.

Some of our service providers operate globally, which means limited personal data may be processed outside the European Economic Area. Where that happens, the provider must use an applicable transfer mechanism and safeguards required by data-protection law, such as an adequacy decision or Standard Contractual Clauses.

A confirmed job-alert address

until you unsubscribe. There is no expiry — we would rather you left because you chose to than because a timer ran out.

A sign-up you never confirmed

deleted within seven days.

An unsubscribed address

gone for good — the record is deleted, not just flagged.

Email you sent us

as long as we need it to sort things out with you, then deleted.

A job application (CV, etc.)

30 days, unless we need to retain it longer for an ongoing recruitment process and have a lawful basis to do so.

Technical logs

Retained only for as long as reasonably needed for security, abuse prevention and troubleshooting.

Under the GDPR, you have real rights over your own data: to see what we hold about you, correct it, have it deleted, restrict what we do with it, take it away in a portable form, or simply object to us processing it at all. Anywhere we rely on your consent, you're free to withdraw it whenever you like — and for job alerts specifically, you don't even need to ask us: the unsubscribe link handles it instantly.

Write to contact@rynua.com and we'll take it from there. You'll hear back within a month, and it won't cost you anything. We'll only ask you to prove who you are as far as we genuinely need to, so we're not accidentally handing your data to somebody else.

If you ever feel we've mishandled your data, we'd genuinely appreciate the chance to put it right first — but that's not a requirement. You're entirely free to go straight to the Dutch data protection authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl.

If this policy ever changes, we'll update the date at the top so it's easy to see. And if a change genuinely affects people on the job-alerts list, we won't just quietly edit this page — we'll email you directly.