on what lawful basis, and how it Fundamentals to include in will be used or shared. a privacy and cookies policy Empower a player to: Details of the organisation consent to or reject the in control of the data being download of the game; processed (usually but not always the publisher). distinguish between different data sets the app The type of data that’s collected will access; and and the source of the data. consent to different proposed The lawful basis for each uses of data rather than give processing operation. bundled consent. The use of collected data (be Highlight the use of device specific, not general). features and app-derived data. Information about withdrawing Make the privacy and cookies consent (where consent is the policy available to download basis on which data is processed). via the app store and within How long the data will be retained. the game. Details of any transfers of the data Set out how long player data to other countries. will be collected for. Description of cookies. Build in security features at the design stage. Whether the data will be shared with third parties and, where Replace device identifiers with possible, details of any third app-specific or temporary parties with whom the data will identifiers to avoid tracking players be shared. or wider distribution of data. Child safety provisions. Conduct ongoing privacy and security resilience testing. Reference to any external links included on the website. 106