Sanctions and safety policy

1. Scope and meaning of sanctions

This policy applies to all players, regardless of language, country or purchases. A mute temporarily restricts chat posting; a ban restricts access to the game for the account, not just one character. Neither prevents Support or email contact, appeals, complaints or data protection requests. Administrators are also subject to these rules; a report about a moderator should be handled by another authorised account. These are draft rules requiring implementation and an effective date, not an automatic sanctioning system.

2. Evidence, proportionality and escalation

Decisions require review of content and context, evidence reliability, harm, intent, age, related confirmed violations and possible account compromise. A screenshot or accusation does not establish guilt. Reasoned criticism, complaints, exercising rights and reporting bugs are not sanction grounds. An IP, device or use of developer tools alone does not prove cheating. The levels are starting points; departures require recorded reasons. Recurrence normally means another related confirmed violation within 90 days after the previous sanction ends; older serious incidents may be considered only with reasons and a valid retention basis. Sanctions for the same incident are not mechanically added together. Serious risk can justify skipping a lower level, subject to human review.

3. Public sanctions schedule

These periods are contractual moderation rules, not criminal penalties imposed by a state. An urgent protective suspension does not establish that a crime occurred. A human should review it without undue delay, normally within 7 days; keeping it longer requires specific reasons and notice where legally permitted. A permanent ban does not automatically extinguish rights under paid contracts; settlements remain subject to law and the game terms.

4. Decision notice and appeals

The player receives the type, reason, scope and duration of the sanction and relevant facts, while protecting other people’s data and legally protected information. Appeal through Support or dimenshon@nekotec.pl with the case identifier, explanation and evidence. Human reconsideration may be requested, by a different reviewer where possible. We aim to reply within 14 days; this does not shorten applicable statutory deadlines or rights. Incorrect sanctions are reversed and their effects reviewed. Appeals do not depend on purchases or continued game access.

5. Insults and Polish law

Breaking game rules is not always a crime. Depending on the facts, relevant provisions may include Polish Civil Code Articles 23–24 on personal rights and Criminal Code Articles 212 (defamation), 216 (insult), 190 (threats) and 190a (persistent harassment). Not all criticism is defamation; a moderator’s decision does not replace legal classification or findings of guilt. Defamation and insult are generally subject to private prosecution; the appropriate procedure depends on the case. An affected person may approach the court, prosecutor or police under the relevant procedure. For immediate danger to life or health, contact local emergency services; Poland uses 112. Support is not an emergency service.

• Polish Criminal Code — ELI

6. Requests from affected persons and recipient verification

An affected person may ask Support or dimenshon@nekotec.pl to preserve evidence and consider disclosure necessary to protect their rights. Identify the incident, date, account, requested scope and purpose, such as pursuing a specific claim. For players, protected replies normally go to the verified email linked to their account after proportionate checks of entitlement and control of the address. Knowing an email address or sending a name does not prove identity. An account-linked address alone does not establish that the player was affected. We do not ask for passwords. A duly authorised representative, guardian or affected person without an account may also apply; legal rights cannot depend solely on game registration.

7. Information an affected person may receive

After verification, we may provide messages involving them or a relevant incident extract: necessary evidence content, the author’s public nickname and account identifier, message identifiers, dates and times with timezone, channel and information about handling the report. Unnecessary witness and third-party data is removed. The author’s email, IP addresses and non-public identifiers are not routinely given to the requester. Exceptional disclosure requires a separate legal basis, demonstrated necessity and a documented assessment; reliance on GDPR Article 6(1)(f) requires purpose, proportionality and balancing of rights, considering minors. A rules violation alone is insufficient. We may refuse, narrow the scope or refer the matter to a competent authority. We do not publish alleged offenders’ data or create a public accused-person register.

8. Police, prosecutors, courts and other competent authorities

In Poland, we cooperate with police, prosecutors, courts and other authorities only within their statutory powers. Before disclosure, we verify the authority, authenticity and legal basis of the request, scope, case reference and secure channel. A request relayed by a claimant is not automatically an authority request. A legal obligation may provide the basis under GDPR Article 6(1)(c) together with applicable national law; other cases need a separate assessment. Article 18(6) of the Polish Act on Providing Services by Electronic Means addresses information for authorities conducting proceedings, not automatic access by a claimant to the entire database.

• Polish Act on Providing Services by Electronic Means
• GDPR — EUR-Lex

9. Data that may be provided to an authority

Only data actually held, lawfully processed and necessary: account identifier, login, nicknames and linked email; account creation and relevant activity times; recorded IP addresses with dates, times and timezone; user-agent or device identifiers if available and relevant; related message/chat content, author/recipient/channel identifiers and event times; reports, documented moderation decisions and relevant security logs; and, for payment cases, necessary order/transaction identifiers, amounts, currencies and statuses. Names or addresses can be disclosed only if actually held lawfully and necessary; the game does not claim to verify every player’s real identity. Source ports are not guaranteed and are included only if recorded. An IP, email or device does not uniquely identify a natural person; identification is assessed by the competent authority. The ordinary scope excludes passwords, password hashes, active session tokens, API keys, full card details and banking passwords.

10. Other countries and transfers

Player safety rules apply globally, but offences, claims and authority powers depend on applicable law. We do not claim one clause complies with every law worldwide or requires responding to every foreign office. EU/EEA authority requests require an appropriate basis and cooperation procedure. A third-country authority request does not itself authorise transfer: we check GDPR Article 6 and Chapter V, including Articles 48–49, applicable international agreements or a lawful legal-assistance route. Private recipients outside the EEA are also subject to transfer rules. Without a lawful basis we do not release data and may indicate a route through competent authorities. Accepting the terms does not consent to unrestricted overseas disclosures.

• EDPB guidance on third-country authority requests

11. Preservation, confidentiality and limits

A request may justify preserving specific existing evidence against deletion when there is a valid basis; it does not mean indefinite retention of all data or guaranteed recovery of deleted records. Scope and duration depend on legal duties or claim necessity and are reviewed. Access is limited to authorised people. The basis, scope, recipient and transmission method should be documented; notification follows the law, including lawful restrictions protecting proceedings. Special-category data and offence-related data require additional assessment under GDPR Articles 9–10; Article 6 alone does not legitimise them. A human handles requests with DPO involvement; this page does not trigger automatic exports or identity recognition.