Effective Date: Oct 12, 2026

This Privacy Policy may be updated from time to time. We will post the updated policy on this page with a new effective date.

1. Introduction: Who We Are

This Privacy Policy describes how Castillo Games Inc. ("Castillo Games", "we", "us", or "our") collects, uses, and shares personal data. Castillo Games is a board game publisher and consultancy based in the United States.

For the purposes of the General Data Protection Regulation (GDPR) and other applicable data protection laws, Castillo Games Inc. is the data controller of your personal data.

Our Contact Details:

• Company Name:Castillo Games Inc.
• Address:4726 Ames St., Madison, WI 53711, USA
• EIN:85-0539120
• Email for data protection inquiries:privacy@castillogames.com

2. License to Use This Policy as a Template & Disclaimer

Castillo Games Inc. hereby grants its clients a non-exclusive, royalty-free right to copy, modify, and use this Privacy Policy as a template for their own business purposes.

Legal Disclaimer: This document is provided for informational purposes only and does not constitute legal advice. It is a template reflecting the data processing activities of Castillo Games Inc. and may not be suitable for your specific circumstances. Data protection laws are complex and vary by jurisdiction. Any person or entity using this Privacy Policy as a template acknowledges that they do so at their own risk. Castillo Games Inc. assumes no liability for any reliance on this template, and users are strongly advised to seek independent legal counsel to ensure their own privacy policy is compliant with all applicable laws and accurately reflects their data processing practices.

3. Scope and Applicability

This Cookie Policy applies to cookies and similar technologies that are set or accessed when you visit our official website (castillogames.com) and any associated subdomains, including our online store (powered by WooCommerce).

It does not cover third-party websites or platforms that you may reach from our site or interact with separately, such as crowdfunding platforms (e.g., Kickstarter, Gamefound) where we run campaigns, or our social media channels. Those services set their own cookies and are governed by their own policies.

4. What Are Cookies and Similar Technologies?

Cookies are small text files placed on your device (computer, tablet, or phone) when you visit a website. They are widely used to make websites work, to remember your choices, and to give site owners information about how the site is used. In this policy, "cookies" also refers to similar technologies that store or access information on your device, such as local storage, session storage, pixels, and tags.

Cookies can be described in the following ways:

• Session Cookies: Deleted automatically when you close your browser.
• Persistent Cookies: Remain on your device until they expire or you delete them.
• First-Party Cookies: Set directly by us.
• Third-Party Cookies: Set by other organizations whose services we use, such as Google, Stripe, and PayPal.

5. Cookies We Use

W

We use cookies for three purposes: to make our website and online store work, to process payments securely, and to analyze website traffic. We do not use advertising or retargeting cookies.

5.1 Strictly Necessary Cookies

These cookies are essential for our website and store to function and cannot be switched off. They are typically set when you take an action such as adding a game to your cart or saving your cookie choices.

5.2 Payment and Fraud-Prevention Cookies

When you check out, our third-party payment processors may set cookies to process your payment securely and to detect and prevent fraud. We do not store or have access to your full credit card number or financial account details.

5.3 Analytics Cookies

These cookies help us understand how visitors use our website, such as which pages are viewed most and where visitors come from, so that we can improve our design, content, and functionality. We use Google Analytics and have configured it to anonymize IP addresses where this feature is available. These cookies are only set if you consent to them.

Cookie names and durations are set by the providers and may change over time. We review the cookies on our website periodically and update this policy when needed.

6. Our Lawful Basis for Using Cookies

Under the GDPR and the ePrivacy Directive (as implemented in national law), our lawful bases are:

• Strictly Necessary Cookies (Article 6(1)(b) and 6(1)(f) GDPR): We use these cookies because they are necessary to provide the website and store services you request, including fulfilling your orders, and to keep our website secure. They do not require your consent under Article 5(3) of the ePrivacy Directive.
• Payment and Fraud-Prevention Cookies (Article 6(1)(b) and 6(1)(f) GDPR): We use these cookies when you check out, because they are necessary to process your payment and to protect against fraud.
• Analytics Cookies (Article 6(1)(a) GDPR): We only set analytics cookies after you give your freely given, specific, informed, and unambiguous consent through our cookie banner. You may withdraw your consent at any time.

7. Managing Your Cookie Preferences

• Our Cookie Banner: When you first visit our website, our cookie banner lets you accept all non-essential cookies, reject all non-essential cookies, or choose by category. Rejecting is as easy as accepting, and non-essential cookies are not set until you opt in.

  Changing or Withdrawing Your Consent: You can change your choices or withdraw your consent at any time using [cookie settings link, e.g. in the website footer]. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it. We keep a record of your consent choices so that we can demonstrate compliance.

  Browser Controls: Most browsers allow you to block or delete cookies in their settings. Please note that blocking strictly necessary cookies may prevent parts of our website, such as the shopping cart and checkout, from working properly. Instructions for common browsers:

  • Google Chrome: https://support.google.com/chrome/answer/95647
  • Mozilla Firefox: https://support.mozilla.org/kb/enhanced-tracking-protection-firefox-desktop
  • Apple Safari: https://support.apple.com/guide/safari/manage-cookies-sfri11471
  • Microsoft Edge: https://support.microsoft.com/microsoft-edge

  Google Analytics Opt-Out: You can also prevent Google Analytics from collecting data about your use of our website by installing the Google Analytics Opt-out Browser Add-on: https://tools.google.com/dlpage/gaoptout

8. Third-Party Providers and International Transfers

Some cookies on our website are set by third-party providers. For more information about how they handle your personal data, please refer to their own policies:

• Google (Google Analytics): https://policies.google.com/privacy
• Stripe: https://stripe.com/privacy
• PayPal: https://www.paypal.com/webapps/mpp/ua/privacy-full

Payment processors act as independent controllers governed by their own privacy and security policies.

Castillo Games Inc. is based in the United States. If you are located in the European Economic Area (EEA), the United Kingdom (UK), or Switzerland, personal data collected through cookies will be transferred to and processed in the USA. The USA is not considered by European authorities to provide an equivalent level of data protection. Therefore, where we or our service providers transfer such data outside the EEA, UK, or Switzerland, we ensure appropriate safeguards are in place as required by the GDPR, which may include the EU-U.S. Data Privacy Framework, Standard Contractual Clauses, or other lawful mechanisms required by applicable law.

9. Your Data Subject Rights

Under the GDPR, you have several rights concerning personal data collected through cookies. Subject to any legal exemptions, you have the right to:

• Right of Access (Article 15): Request a copy of the personal data we hold about you.
• Right to Rectification (Article 16): Request that we correct any inaccurate or incomplete data.
• Right to Erasure ('Right to be Forgotten') (Article 17): Request the deletion of your personal data where there is no compelling reason for its continued processing.
• Right to Restrict Processing (Article 18): Request that we suspend the processing of your data in certain circumstances.
• Right to Data Portability (Article 20): Request a copy of your data in a structured, machine-readable format to transfer to another controller.
• Right to Object (Article 21): Object to our processing of your data where we are relying on legitimate interests as our lawful basis.
• Right to Withdraw Consent (Article 7(3)): Withdraw your consent to non-essential cookies at any time, as described in Section 7.
• Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority in your country of residence if you believe our processing of your personal data infringes applicable law.

How to Exercise Your Rights: To exercise any of these rights, please contact us at privacy@castillogames.com

10. Data Retention

We retain personal data collected through cookies only for as long as necessary to fulfill the purposes for which it was collected. Our retention periods are:

• Cookies: Each cookie remains on your device for the duration listed in Section 5, unless you delete it sooner.
• Website Analytics Data: Retained according to Google Analytics' default policies (e.g., up to 26 months) or for a shorter period if we configure it. This data is typically aggregated and anonymized.
• Cookie Consent Records: Retained for as long as necessary to demonstrate that we have honored your choices.
• Order and Payment Data: Data you provide when placing an order is retained as described in our Privacy Policy.

11. Children's Privacy

Our products and services are not directed at children under the age of 16. We do not knowingly collect personal data from children, including through cookies. If we become aware that we have inadvertently collected personal data from a child without parental consent, we will take steps to delete that information as soon as possible.

12. Changes to This Cookie Policy

We may update this Cookie Policy from time to time to reflect changes in the cookies we use or for other operational, legal, or regulatory reasons. We will post the revised policy on our website and update the "Effective Date" at the top. Where required by law, for example if we introduce new categories of cookies, we will ask for your consent again.

13. Contact Information

If you have any questions, concerns, or requests regarding this Cookie Policy or our use of cookies, please contact our designated data protection contact:

• Name: Bryce Brown
• Title: President
• Email: privacy@castillogames.com
• Mailing Address: Castillo Games Inc., 4726 Ames St., Madison, WI 53711, USA

While our processing activities do not require us to appoint a formal Data Protection Officer (DPO) under Article 37 of the GDPR, we have designated the contact above to handle all data protection inquiries.

14. Addendum for US State Privacy Laws (CCPA/CPRA)

This section supplements the rest of this Cookie Policy and applies to residents of California under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and to residents of other US states with similar laws, to the extent those laws apply to us.

Notice at Collection

The table below describes the categories of personal information we collect through cookies and similar technologies on our website, why we collect them, and whether we sell or share them. Retention periods are described in Section 5 and Section 10.

We do not use cookies to collect sensitive personal information as defined by the CPRA.

Sale and Sharing of Personal Information

We do not sell or share (as those terms are defined in the CPRA, including sharing for cross-context behavioral advertising) personal information collected through cookies. We do not use advertising or retargeting cookies, and we do not knowingly sell or share the personal information of consumers under 16 years of age. Because we do not sell or share this information, we do not display a "Do Not Sell or Share My Personal Information" link. If this changes, we will update this policy and provide the required opt-out mechanism before any sale or sharing begins.

For information about how we may share professional contact information of business contacts for referral and networking purposes, and how to object, please see Section 17 of our Privacy Policy.

Your California Privacy Rights

Subject to certain exceptions, California residents have the right to:

• Know and Access: Request the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties we disclose it to.
• Delete: Request that we delete personal information we have collected from you.
• Correct: Request that we correct inaccurate personal information we hold about you.
• Opt Out of Sale or Sharing: Direct us not to sell or share your personal information. As described above, we do not do so.
• Limit Use of Sensitive Personal Information: Not applicable, because we do not use cookies to collect sensitive personal information.
• Non-Discrimination: Not be treated differently for exercising any of these rights. We will not deny you goods or services, charge you different prices, or provide a different level of service because you exercised your rights.

How to Submit a Request

To exercise any of these rights, please email us at privacy@castillogames.com. We will need to verify your identity before fulfilling a request, and we may ask you for information that matches what we already hold. You may also use an authorized agent to submit a request on your behalf; we may ask for proof of their authorization. We will respond within 45 days, and may extend this by a further 45 days where reasonably necessary, in which case we will let you know. Residents of some states also have the right to appeal our decision; to do so, reply to our response or email privacy@castillogames.com with "Appeal" in the subject line.

Opt-Out Preference Signals

Because we do not sell or share personal information collected through cookies, there is nothing to opt out of in that respect. You can still reject non-essential cookies, including analytics cookies, at any time through our cookie banner, as described in Section 7.

15. Email Communications and CAN-SPAM

This Cookie Policy mainly concerns our website. When we send you commercial emails, such as our marketing newsletter, updates about new games and crowdfunding campaigns, and business outreach for our consulting services, we comply with the US CAN-SPAM Act. This means that:

• Accurate Sender Information: The "From", "To", and "Reply-To" fields, and the routing information, accurately identify Castillo Games Inc. as the sender.
• Honest Subject Lines: Our subject lines reflect the content of the message and are not deceptive.
• Advertising Disclosure: Where a message is an advertisement or solicitation, we identify it as such.
• Physical Address: Every commercial email includes our valid postal address: Castillo Games Inc., 4726 Ames St., Madison, WI 53711, USA.
• Easy Opt-Out: Every commercial email includes a clear and conspicuous unsubscribe link. You can also opt out by emailing privacy@castillogames.com. We do not charge a fee, require you to log in, or require any information other than your email address to opt out.
• Prompt Processing: We honor opt-out requests within 10 business days. Once you opt out, we will not sell or transfer your email address to others, except to a service provider that helps us comply with the law.
• Vendors: Where a vendor sends email on our behalf, we remain responsible for making sure the message complies with the law.

Opting out of marketing emails does not stop us from sending transactional or relationship messages, such as order confirmations, shipping updates, and replies to your inquiries. As described in our Privacy Policy, we keep a minimal identifier, such as your email address, on a suppression list so that we can honor your opt-out.