Legal
Privacy Policy
How CMB Project handles personal data on cmbproject.com and in the pitches and enquiries sent to us. Written to be read, not to be survived.
Last updated: 23 August 2026. Version applies from that date.
1. Who is responsible for your data
The data controller is:
- Controller
- CMB Project
- CVR / Reg. no.
- 44892227
- EU VAT
- DK44892227
- Address
- Hovvej 73A, 3060 Espergærde, Denmark
- help@cmbproject.com
- Telephone
- +45 20 12 34 56
We have not appointed a Data Protection Officer. Article 37 GDPR does not require one for an organisation of this size and activity. Data protection questions go to help@cmbproject.com and are answered by the person responsible for them.
2. What this policy covers
This policy covers the website at cmbproject.com, the submission form on it, and the email correspondence that follows. It does not cover third-party websites we link to — storefronts, platform holders, press outlets — each of which has its own policy and its own controller.
3. What we collect, and why
| Data | Where it comes from | Why | Legal basis |
|---|---|---|---|
| Studio name, contact name, email address, country | The submission form | To assess your pitch and reply to it | Art. 6(1)(b) — steps at your request before a possible contract |
| Project details: title, genre, stage, platforms, target window, team size, description, links you provide | The submission form | To evaluate the project as a publishing opportunity | Art. 6(1)(b) and Art. 6(1)(f) — our legitimate interest in assessing submissions |
| Your confirmations about rights and content | The submission form | To record that the project can lawfully be published and falls within what we publish | Art. 6(1)(f) — legitimate interest in a documented assessment |
| Anything you write to us by email | You | To answer you and keep a record of the correspondence | Art. 6(1)(b) or Art. 6(1)(f) |
| Server log data: IP address, request line, user agent, timestamp, response code | Automatically, on every request | To operate the site and to detect abuse | Art. 6(1)(f) — legitimate interest in a secure, working service |
| A one-way keyed hash of your IP address | Generated when a form is submitted | Rate limiting — so one sender cannot flood the form | Art. 6(1)(f) — legitimate interest in preventing abuse |
We do not ask for, and have no use for, special categories of data under Article 9 — health, beliefs, political opinions, biometrics and so on. Please do not include any in a pitch.
3.1 What happens to a pitch specifically
A submitted pitch is written to storage on our server, outside the public website, and given a reference of the form CMB-YYYYMMDD-XXXXXX. It is read by the people at CMB Project who assess submissions. We also record a completeness score computed from what you sent — it measures the submission, not you and not your game.
Your pitch is not sold, rented, or disclosed to any third party for that party's own purposes. It is processed by the service providers listed in section 5, who act on our documented instructions and for no other purpose. Where a project moves into active discussion, we will normally sign a non-disclosure agreement at that point.
4. What we do not do
- No advertising, analytics, tracking or profiling cookies are set by this site.
- No advertising or analytics network receives data about your visit from this site.
- We do not build profiles of visitors and we do not use automated decision-making, including profiling, within the meaning of Article 22.
- We do not add you to a mailing list because you submitted a pitch. If we ever run one, it will be a separate, opt-in choice.
- We do not sell personal data. There is no arrangement under which any personal data from this site is exchanged for value.
5. Who processes data for us
We use two service providers. Both act as processors under Article 28: they process personal data on our documented instructions and not for their own purposes.
| Role | Provider | Country | How we know |
|---|---|---|---|
| Website hosting | Namecheap, Inc. | United States | cmbproject.com resolves to 104.207.88.186 — Namecheap, Inc. (AS22612), geolocated to Chicago, Illinois, United States on 2026-08-23. |
| Email (mailbox for help@cmbproject.com) | Namecheap Private Email (Namecheap, Inc.) | United States | MX records for cmbproject.com are mx1.privateemail.com and mx2.privateemail.com, operated by Namecheap, Inc. in the United States (read on 2026-08-23). |
Beyond these, personal data may be disclosed where we are legally required to disclose it — for example to a competent authority acting under a valid legal basis — and to our professional advisers where that is necessary and they are bound by confidentiality.
5.1 Transfers outside the EU/EEA
This site is not hosted inside the EU or the EEA. We measured it rather than assuming it: cmbproject.com resolves to an address operated by Namecheap, Inc. and geolocated to the United States, and the domain's mail exchangers are Namecheap Private Email, also in the United States. Both measurements were taken on 23 August 2026 and are restated in the table above.
That means personal data you send through this site is transferred to and processed in the United States, which is a transfer under Chapter V GDPR.
No adequacy decision is relied upon for this transfer. No adequacy decision is relied upon. The EU–US Data Privacy Framework covers only organisations that have self-certified under it, and no such certification is relied on here. The safeguard we rely on is: Standard Contractual Clauses, Module Two (controller to processor), Commission Implementing Decision (EU) 2021/914.
You can ask us for information about the safeguards in place by writing to help@cmbproject.com. If you would rather not send project details through infrastructure outside the EEA, email us and we will agree a different route.
6. Cookies and browser storage
This site sets one cookie, and only when you interact with a form. It is strictly necessary within the meaning of the ePrivacy rules, which is why there is no consent banner asking you to accept cookies — there is nothing here to consent to. There is no analytics, advertising, social or fingerprinting technology on this site.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
| cmb_session | First-party session cookie | Holds the anti-forgery (CSRF) token that proves a form submission came from this site. Set when a page carrying a form is loaded. | Deleted when you close the browser |
The cookie carries a random identifier and nothing else — no name, no email, no browsing history. This site does not use localStorage, sessionStorage, IndexedDB or any similar browser storage.
One third-party origin is contacted when a page loads: cdn.tailwindcss.com, which serves the CSS framework the site is styled with. It sets no cookie and receives no information about you beyond what any request to a server necessarily reveals — your IP address, the page you requested it from, and your browser's user agent.
7. How long we keep things
| What | How long | Then |
|---|---|---|
| Pitch submissions | 24 months from the date received | Deleted. Kept that long so that a resubmission can be recognised and the conversation picked up. |
| Email correspondence | 24 months from the last message | Deleted, unless it forms part of a contract, in which case Danish bookkeeping law applies. |
| Records relating to a signed agreement | Five years from the end of the financial year the record relates to | Retained to satisfy the Danish Bookkeeping Act (bogføringsloven), then deleted. |
| Server logs | Up to 90 days | Rotated and deleted. |
| Rate-limit counters (hashed) | One hour | Reset. They contain no directly identifying data at any point. |
8. Your rights
Under the GDPR you have the right to:
- Access (Art. 15) — a copy of the personal data we hold about you.
- Rectification (Art. 16) — correction of anything inaccurate.
- Erasure (Art. 17) — deletion, where no legal obligation requires us to keep it.
- Restriction (Art. 18) — processing paused while a dispute is resolved.
- Data portability (Art. 20) — your data in a structured, machine-readable form.
- Objection (Art. 21) — to processing based on legitimate interest, at any time.
- Withdraw consent (Art. 7(3)) — where we ever rely on consent, which today we do not.
Write to help@cmbproject.com. If you are asking about a pitch, quoting the reference we sent you makes it much faster. We answer within one month (Article 12(3) GDPR), and we will tell you if we need to extend that and why. Exercising any of these rights is free.
8.1 Complaints
If you are not satisfied with how we handled your request, you can complain to the Danish Data Protection Agency:
Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark · datatilsynet.dk
If you live in another EU or EEA country, you may also complain to your own national supervisory authority.
9. How we protect it
- The site is served over HTTPS, with HTTP Strict Transport Security once TLS is active.
- A Content Security Policy restricts what the page may load; one third-party origin is permitted, named in section 6.
- Submissions are written outside the public web root, so no misconfiguration can serve one as a file.
- Forms are protected against cross-site request forgery and rate limited against flooding.
- IP addresses used for rate limiting are hashed with a keyed function before being written anywhere.
- Application logs record events, not people: no names, emails or project details are written to them.
No system is beyond compromise. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify Datatilsynet within 72 hours as required by Article 33, and notify you directly where Article 34 requires it.
10. Children
This is a business-to-business site addressed to game developers and industry partners. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has sent us personal data, write to us and we will delete it.
11. Changes to this policy
When this policy changes we update the date at the top. Where a change materially affects how we handle data you have already sent us, we will contact you directly rather than rely on you noticing a new date.
12. Contact
CMB Project
Hovvej 73A, 3060 Espergærde, Denmark
help@cmbproject.com ·
+45 20 12 34 56
CVR 44892227 · EU VAT DK44892227