PRIVACY POLICY

Troy the ToyRat Tribute – International 3D Sculpting Contest 2025
Last updated: 11 November 2025
Contact (privacy): info@thetoyrat.com

1) Who we are (Data Controller)

For the purposes of data protection laws (including the EU GDPR), the Data Controller is The Toy Rat Enterprises (together with co-organizer Sculpting Magic acting as a support partner/processor where applicable). For certain joint decisions related to contest administration and communications, the parties may act as joint controllers. You can contact us at info@thetoyrat.com.

2) What data we collect

Identity & contact: name, surname, email, country/region, portfolio links.
Contest materials: renders, videos, FBX/STL files, artwork titles, software used, short bio.
Account & usage: registration details, submission timestamps, IP/device metadata for security/logging.
Communications: emails and messages exchanged with us.
Marketing preferences: opt-in/opt-out flags (if you choose to receive updates).

3) Why we process your data (Purposes & Legal Bases)

Contest administration (receive, review, judge entries; shortlist/winner selection; notifications; prize payment): performance of a contract and legitimate interests.
Publication & promotion of results (e.g., winner announcement, showcasing finalist imagery with credit): legitimate interests and, where required, consent.
Compliance & security (fraud prevention, enforcing rules, record-keeping): legal obligation and legitimate interests.
Marketing communications (future contests/products): consent (optional; you can withdraw anytime).

4) Who receives your data (Recipients)

Internal teams at The Toy Rat Enterprises and Sculpting Magic (contest ops, legal, finance).
Jury members (for evaluation purposes only).
Service providers / processors (secure hosting, email, storage, analytics, payment/reporting) under data-processing agreements.
Authorities where required by law.

5) International transfers

Your data may be transferred to countries outside the EEA (e.g., trusted cloud/email providers). Where this occurs, we rely on adequacy decisions or Standard Contractual Clauses (SCCs) and implement appropriate safeguards.

6) How long we keep data (Retention)

Contest administration records & submissions: for the duration of the contest and up to 24 months thereafter for audit, defense of claims, and statistical reporting.
Winner’s contractual/royalty records: retained for the duration of commercialization and as required by applicable tax/commercial laws.
Marketing contact data: until you withdraw consent or object.
We may retain minimal, non-sensitive metadata where strictly necessary to comply with legal obligations.

7) Your rights

Subject to applicable law, you may access, rectify, erase, restrict, object to processing, and port your data. You can also withdraw consent at any time (for marketing or other consent-based processing) without affecting prior lawful processing.
To exercise your rights, contact privacy@thetoyrat.com. You also have the right to lodge a complaint with your local authority (e.g., AEPD in Spain).

8) Security

We implement appropriate technical and organizational measures to protect personal data (access controls, encryption in transit, least-privilege, monitoring, and regular backups). No system can be 100% secure; we maintain incident response procedures.

9) Children

This contest is 18+. We do not knowingly collect data from minors.

10) Cookies & tracking

The contest portal may use cookies or similar technologies for essential functionality, analytics, and security. See the portal’s Cookie Notice for details and controls.

11) Marketing

We will only send marketing communications (e.g., future contests, products) if you opt-in. You can unsubscribe at any time via the link in our emails or by contacting privacy@thetoyrat.com.

12) Changes to this policy

We may update this Privacy Policy to reflect legal, technical, or business developments. Material changes will be announced on the portal, indicating the effective date.