> For the complete documentation index, see [llms.txt](https://docs.coda.co/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.coda.co/coda-portal/onboarding-compliance/security-overview/data-privacy.md). # Data Privacy
Data PrivacyContext
Personal Identifiable Information

Personal data points that Coda Payments collects from Codashop users in its capacity as an independent data controller

Personal and contact details of the players such as first name, last name, email address, and phone number (depending upon the product/service/use case);

Account details of the players such as in-app/in-game ID/publisher affiliation;

Device data such as IP address;

Correspondence data;

Order data such as transaction ID etc.

Cookies and/or statistical/analytical data;

Documentation that helps us verify the accuracy of the information provided by our users if it is required for fulfilling certain obligations or for providing certain services;

Social media links or public profiles of our users if they submit it; and User account passwords.

Personal data points that Coda Payments may share with the publishers (Depending upon the terms of the Data Processing Agreements and the relevant data privacy regulations as well as the purpose/requirement):

Personal and contact details of the players such as first name, last name, email address, and phone number;

Account details of the players such as in-app/in-game ID/publisher affiliation;

Device data such as IP address;

Correspondence data;

Order data such as transaction ID etc.

Personal data points that Coda Payments collects from publishers

1. Professional and contact details of the publisher’s authorized signatories and employees;

2. KYC and compliance information

Coda Payments's role as a Data Controller

1. Coda Payments's role in the data processing arrangement is that of an independent data controller, as such, our template reflects a controller-to-controller arrangement along with a provision for controller-to-processor transfers (Coda Payments as a processor) on the off chance that data is transferred to Coda Payments by the publisher in the capacity of a data controller and to safeguard the publisher interests therein.

2. This is owing to the hybrid nature of Coda Payments' business model, wherein Codapay is provided as a bundled service along with Codashop. In a normal payment service provider model, Coda Payments would have been a data processor.

3. Codashop is an independent e-commerce website/marketplace operated by Coda Payments through which Coda Payments provides content monetisation services to publishers. It has its own user base, these users visit Codashop to purchase content or top up their in-game accounts with in-game currencies (digital goods) which are posted for sale on the Codashop website.

4. While doing so, these end users accept Coda Payments' terms and conditions and privacy policies and become Codashop customers to avail the digital goods. In this user journey, user data is directly collected by Coda Payments for its own purposes mentioned in its privacy policy which is displayed on the Codashop website. The publishers of the game titles do not come into the picture from a data privacy/collection or transfer perspective in this user journey.

5. As such, both parties are independent controllers of the data they collect directly from the end users.

Data SecurityCoda Payments adopts an insight-driven framework for the implementation of our data security program. A data dictionary/glossary is consolidated to record all types of sensitive data, which will cross-reference the policies and procedures required in the data classification. This is used in conjunction with a data loss prevention platform to detect and block leakage of sensitive data, followed by continuous assessment and updates of the underlying controls to ensure the relevancy and effectiveness of changing threats, business practices, and landscape.
EncryptionCoda Payments implements encryption standards based on industry best practices and to meet regulatory/compliance requirements such as AES-256 database encryption algorithms to protect the sensitive data at rest and where applicable, TLS1.2 and above, with reputed certificate authority signed certificates with 2048-bit RSA keys to secure the sensitive data in transit.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.coda.co/coda-portal/onboarding-compliance/security-overview/data-privacy.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.