Privacy policy

1. Who this covers

• Website visitors and business contacts who visit goama.com, request a document, request a proposal, book a meeting or write to us. For this data, Goama decides how it is used: we are the controller (GDPR) or the organisation (PDPA).
• Players who use Goama games, missions or tournaments inside a partner's app (a telco, wallet, loyalty programme or brand). The partner decides what data is shared with us and why. We process it only on the partner's instructions, under our agreement with them: we are the processor (GDPR) or data intermediary (PDPA). The partner's privacy policy also applies.

2. What we collect

Website visitors and business contacts

• Details you give us: name, job title, business email address and, from that address, your company name.
• What you tell us about your business: the type of business, user numbers, products and markets of interest, timing, campaign budget range (brands only), and any message you write.
• Your choices: whether you agreed to receive marketing emails, and when you agreed or withdrew.
• The page you sent a form from and the campaign tags in the web address you arrived on (such as utm_source), so we know which campaign brought you. These tags are held in your browser only while the tab is open, with no cookie, and are sent only with a form you submit.
• Website usage statistics collected without cookies (pages viewed, country, device type). These do not identify you.

Players

• A random session ID generated by the partner app. It holds no personal information and does not identify you to Goama. We do not receive your name, phone number, email or other personal details.
• Gameplay data: games played, scores, leaderboard positions, missions completed, entries and prizes.
• Technical data used to run the service and prevent cheating: device and browser type, IP address and timestamps.

We never handle card or bank credentials. Payments and prize credits run through the partner's own systems.

3. Why we use it

• To send you a document you request, such as the integration guide or a case study (to take steps at your request).
• To reply to your enquiry, prepare a proposal you request, or run a meeting you book (to take steps at your request).
• To follow up once, personally, about what you requested, and to decide which team member does so based on your job title and company (our legitimate interest in responding to business requests; you can object at any time).
• To send occasional insights and updates about Goama, only if you opt in (your consent, which you can withdraw at any time).
• To run games, leaderboards, missions and prizes for partners (on the partner's instructions, under our agreement with them).
• To report usage and results back to the partner (under our agreement with them). All usage data is shared back to the partner.
• To detect fraud and cheating and keep our systems secure (our legitimate interest in fair competitions and secure systems).
• To meet legal obligations.

Where the GDPR applies, these are our legal bases under Article 6 of the GDPR. Under the PDPA, we rely on your consent, given when you submit a form or opt in to emails, or on an exception the PDPA allows, such as legitimate interests.

We do not sell personal data, build advertising profiles, or make decisions about you based solely on automated processing that have legal or similarly significant effects.

4. Who we share it with

• The partner whose app you play in (players only). All usage data is shared back to that partner.
• Service providers who help us run our website, email, customer records and platform, under written contracts that limit their use of the data to that service. These include website hosting (Vercel), email delivery (Resend), cookieless website analytics (PostHog, hosted in the EU), our customer relationship management (CRM) system, and cloud hosting for the platform.
• Professional advisers such as lawyers and auditors, under a duty of confidentiality.
• Authorities, where the law requires it.
• A buyer or investor, if Goama is involved in a merger, acquisition or sale of assets, under confidentiality terms.

5. International transfers

Goama is based in Singapore, and our team and service providers work in several countries, so your data may be processed outside the country where you live. When we transfer personal data out of Singapore, we make sure the recipient protects it to a standard comparable to the PDPA. When we transfer data from the EU or EEA to a country without an EU adequacy decision, we use the European Commission's Standard Contractual Clauses or another lawful safeguard. You can ask us for details of these safeguards.

6. How long we keep it

• Document requests, proposal requests, enquiries and meeting records: 24 months after our last contact with you, unless we start working together, in which case the contract terms apply.
• Marketing consent records: as long as your consent is active, plus 24 months to show we had it.
• Player data: as long as our agreement with the partner requires, then deleted or returned to the partner.

7. How we protect it

We use reasonable technical and organisational security measures, including access controls, encryption in transit and contractual safeguards with our providers. If a data breach is likely to cause you significant harm, we will notify you and the relevant authorities as the law requires.

8. Cookies

goama.com does not set tracking or advertising cookies and uses cookieless analytics (PostHog, hosted in the EU), which stores nothing in your browser. Campaign tags are held only while the tab is open, as described in section 2. The live demo is provided by a separate service and loads only when you click it; that service may set its own cookies.

9. Your rights

Subject to the data protection laws that apply to you, you may request to:

• access the personal data we hold about you, and information about the ways in which it has been used or disclosed within the year before your request;
• correct any error or omission in your personal data;
• withdraw your consent to our collection, use or disclosure of your personal data, in which case we will inform you of the likely consequences of withdrawal;
• have your personal data erased;
• restrict our processing of your personal data;
• object to our processing of your personal data, including, at any time and without giving reasons, processing for direct marketing purposes; and
• receive your personal data in a structured, commonly used and machine-readable format.

Some of these rights apply only where the applicable law provides for them, and each is subject to the exceptions in that law.

To exercise any of these rights, please contact our Data Protection Officer at dpo@goama.com. We may need to verify your identity before we respond. We will respond within the period required by applicable law. Every marketing email we send includes a means to unsubscribe.

If you use Goama's services through a partner's app, you may also direct your request to that partner, and we will assist the partner in responding.

You have the right to lodge a complaint with a data protection authority, including the Personal Data Protection Commission of Singapore or the supervisory authority of the EU member state in which you live or work, or in which the alleged breach took place. We encourage you to contact us first so that we can try to resolve your concern.

10. Children

Goama's games are offered through partners to users who meet the partner's age requirements. We do not knowingly collect personal data from children below the age allowed by local law. If you believe we have, contact dpo@goama.com and we will delete it.

11. Changes

We may update this policy and will post the new version here with a new effective date.