Account Security and Player Responsibilities

01Scope

This document brings together the rules on the security of your Destan Game account: the tools that protect your account, the Service Provider's obligations and your responsibilities. It applies together with the Terms of Use and the User Agreement; explanations of how your personal data is protected are in the Privacy Policy.

At present your account is a web account only and is not linked to a game account. These rules apply to your web account; once the game services open, they apply to those services too.

02Tools that protect your account

The Services offer the following tools to protect your account. You can manage them in the Security Center.

Authenticator app

When you turn this method on, you are asked at sign-in for the one-time code generated by the authenticator app on your phone. When you turn the method on, you are given recovery codes, shown only once, for situations in which you cannot use the app.

E-mail code

When you turn this method on, you are asked at sign-in for a one-time verification code sent to your registered e-mail address. If the authenticator app is also turned on, you are asked for the app's code at sign-in.

New-device confirmation

When you turn this feature on, a sign-in from a device other than your trusted devices is completed with a confirmation sent to your e-mail address; you can deny a sign-in request you do not recognize from the same e-mail. If two-step verification is turned on, that step is asked for instead of the confirmation.

Sessions and devices

You can see the sessions in which your account is open on the Active Sessions page and the devices that have signed in to your account on the Devices page, and you can end or remove the ones you do not recognize.

Sign-in history and security alerts

Sign-ins, failed sign-in attempts and important security actions on your account are recorded; important events are sent to you as notifications and e-mails. You can see the records on the Account Activity page.

Limits on sign-in attempts

After repeated failed sign-in attempts, signing in is temporarily locked. This is not a sanction but a measure that protects your account.

Re-verification for sensitive actions

Before sensitive actions such as changing your password or e-mail address, you are asked to enter your password or a verification code again.

Details of how these tools work, such as how long a code or a confirmation remains valid, are shown on the relevant page during the action.

03The player's responsibilities

To keep your account secure, the following care is expected of you:

• Choose a strong password that you use only for this account; do not use the same password on other sites.
• Do not share your password, your e-mail codes, your authenticator app codes or your recovery codes with anyone.
• Protect the e-mail account registered to your account too: verification, security notifications and account recovery all go through that address.
• Keep your recovery codes in a safe place.
• Do not select “Keep me signed in” on a shared computer, and sign out when you are done.
• Do not sell or rent out your account, or let anyone else use it.
• Do not install software offered as cheats or speed boosters; such software can steal your account details.
• Update the address on your account when your e-mail address changes.
• Report suspicious access without delay.

04The Service Provider's obligations

The Service Provider is obliged to take the technical and administrative measures needed to keep accounts and personal data secure. These measures include the following:

• Passwords are stored only as an irreversible hash; authenticator app keys are stored encrypted.
• Session cookies are set so that page scripts cannot read them, and protection is in place against requests sent from other websites.
• Sign-in attempts, verification codes and sensitive actions are protected by request limits.
• Staff access to player data is limited by roles and logged; staff cannot see your password, your codes or your authenticator app key.
• Important security events on your account are notified to you.

The data controller's obligations relating to the lawful processing and protection of personal data are fulfilled by Destan Game. Users, for their part, must take the necessary care for the security of their own accounts and devices. A user's responsibility for the security of their account does not remove the data controller's statutory obligations.

05Sharing sign-in details

If you share your sign-in details with someone else, incidents arising from actions taken on your account are assessed on the concrete facts, not on a presumption: the review looks at when the action was taken, from which device and with which records.

A player's carelessness does not remove the Service Provider's own security and data protection obligations. In an incident in which the Service Provider did not fulfill their own obligation, the Service Provider cannot place the responsibility on the player alone.

Selling or transferring an account is prohibited; in disputes arising from such a transaction, the account is treated as belonging to the person who created it. The details are in the User Agreement.

06Suspicious access

If you suspect that someone else has accessed your account:

1. Change your password right away; a password change ends your other sessions.
2. On the Active Sessions and Devices pages, end the sessions you do not recognize and remove the devices you do not recognize.
3. Turn on two-step verification; if you use an authenticator app, generate new recovery codes.
4. Change the password of the e-mail account registered to your account too.
5. Report it to the contact e-mail address given in the Privacy Policy.

If you cannot sign in to your account, use the password reset step on the sign-in page; the reset link is sent only to the e-mail address registered to your account.

07Security lock and compromised accounts

An account suspected of being compromised may be closed to sign-ins for security reasons until the account owner's identity has been verified. A security lock is not a sanction: it is applied to protect your account and your data, and it deletes no data.

To have the lock lifted, you can reset your password or write to the contact e-mail address given in the Privacy Policy; your access is restored once it has been confirmed that the account is yours.

Suspensions and closures imposed as sanctions, and the way to appeal them, are explained in the Account Closure, Sanctions and Appeals Policy.

08Information the team will not ask you for

Employees of the Service Provider will never ask you for your password, your verification codes or your recovery codes. If you receive a message asking for them, do not reply, and report it to the contact e-mail address given in the Privacy Policy.

Your password does not appear in the e-mails sent to you. If you are not sure that a link in an e-mail takes you to this site, do not open it; go to the site by typing its address yourself.

09Information in the event of security incidents

When a security incident affecting your account or your personal data is detected, the Service Provider takes the necessary measures and informs you. What is done in such an incident is explained in the Privacy Policy.

10Changes to this document

This document is updated when the security tools the Services offer change; the current text is published on this page with its version number and date.

11Contact

You can send questions about account security to the contact e-mail address given in the Privacy Policy.