CD PROJEKT RED Privacy Policy

Last updated: 28 September 2026

In effect from: 28 September 2026

(click here, to view the previous versions)

1. Hi! On this site you’ll learn how we process your personal data (“data”).

2. If you live in California, please read the Privacy Statement for California Residents section.

First things first

3. Those who play our games or use our services are our absolute priority. We want you to feel safe and comfortable when you give us your data. Below you’ll find everything you need to know. If you have more questions, write to us at dpo@cdprojektred.com.

What this policy is about

4. We apply the rules described in this policy when you use our services, that is when you:
   - play our games
   - visit our websites or social media profiles
   - use our tools (e.g. RED Launcher)
   - contact our customer service or technical support
   - use other services that we offer
   - take part in contests or events that we organize

5. This policy doesn’t apply to cases where we have separate regulations concerning privacy:
   - Gwent: The Witcher Card Game - Privacy Policy
   - Spokko - Privacy Policy
   - CD PROJEKT RED Press Center - Information on the processing of personal data [PL] [EN]
   - www.cdprojekt.com website - Privacy Policy [PL] [EN]
   - “Girls in the Game” program - Privacy Policy
   - Creators and Ambassadors Program - Privacy Policy

6. Our services can contain links to external websites or services. This policy doesn’t include these external websites or services, so please read their privacy policies.

Our role

7. If you use our services and give us your data, we become it’s controller or joint controller. This means that:
   - we decide (by ourselves or jointly with others) how and what we’ll use your data for and who we’ll share it with
   - we are responsible for processing it in a lawful way
   - we are responsible for its security
   - we will give you all the necessary information
   - we let you use your rights

Contact us

8. By “we”, we mean CD PROJEKT RED S.A. We are the company behind the CD PROJEKT RED development studio. Our main office is in Poland, at ul. Jagiellońska 74, 03-301 Warsaw.

9. The proper processing of your data is supervised by our Data Protection Officer. If you need to, you can contact them:
   - by email: dpo@cdprojektred.com
   - by post: Data Protection Officer CD PROJEKT RED S.A., ul. Jagiellońska 74, 03-301 Warsaw, Poland

How we use your data

10. We process your data in various ways depending on our purpose.

ℹ️ By “processing” we mean any action that we perform on your data, e.g. collecting, viewing, using for a selected purpose, sharing with certain people, deleting or just storing it. The full definition of processing can be found in Art. 4 (2) of GDPR.

11. Below you can find out why we process your data (Purpose), how long we store it for (Period), who we can share it with (Recipients) and what categories of data we use for this purpose (Data). You can also find the information about the legal basis we act on.

• Providing services / contract execution

12. When you accept the terms and conditions of a service you’re interested in or you enter into a different contract with us, we process your data in order to execute this contract. In such cases we act based on Art. 6 (1) b of GDPR.

Purpose	Period	Recipients	Data
provision of the CD PROJEKT RED Account service	for the time of the service provision	- external identity providers (if, when creating an account, you choose the option to authenticate using an account from one of these providers, e.g. using Google Sign-In) - cloud hosting service providers	email address, username, information about the external identity provider, data about services combined with the CDPR Account, data gained from game distribution platforms joined with the CDPR Account (such as CD PROJEKT RED game collection, achievements in particular games), records of games supporting inter-platform advancements
delivery of products and provision of services	for the time of service provision or product access	- companies from the CD PROJEKT Capital Group, which provide us with technological support or with which we cooperate when providing selected services - partners helping us analyze data by providing analytical tools - partners helping us manage email communication - partners providing us with tools for internal management and content sharing	email address, username, information about your account on the digital distribution platform (e.g. GOG Galaxy), technical information about the devices you’re using, information about the Internet or network connection, IP address, mobile device ID, operational system, browser type, data concerning computer equipment, as well as other technical information, information about when and how you use the CD PROJEKT RED services, data concerning the traffic and geographical location, information concerning your use of social portals (if you combine our services with your account on these portals),
managing forums	for the time of providing access to the forum	- companies from the CD PROJEKT Capital Group, which provide us with technological support or with which we cooperate when providing selected services - partners helping us manage email communication - partners providing us with tools for internal management and content sharing	username, email address, data of birth, website address, avatar, bio, interests, user’s preferred language, messenger address, location stated by the user
contests organization (including contacting the participants, evaluating the entries, distributing awards, paying taxes)	until the distribution of awards and payment of the tax due	- postal operators helping us send out the awards - entities supporting us in marketing activities - partners helping us manage email communication - partners providing us with tools for internal management and content sharing	email address, username, first name, last name, mailing address, telephone number, other data contained in the content of the contest entry
playtests	for 3 years from the date of your entry to the playtests, and in the case of recording the face at a playtest - 1 year from the date of the recording	- companies from the CD PROJEKT Capital Group, which provide us with technological support or with which we cooperate when providing selected services - partners helping us manage email communication - partners providing us with tools for internal management and content sharing - partners providing us with tools for post-test surveys and their subsequent evaluation - partners who work with us on creating and developing some of the CD PROJEKT RED products or services	first name, last name, date of birth, gender, education, profession, email address, phone number, user ID, recording of the face taken at the playtest, preferences concerning video games, preferences concerning playtests, information gained during the playtests

• Fulfillment of legal obligations

13. We need to process your data when it is required by the provisions of the law. In such cases we act based on Art. 6 (1) c of GDPR.

Purpose	Period	Recipients	Data
compliance with our tax, legal and accounting obligations	for the time required by the specific provisions of the law; for the time of statute of limitations on tax liabilities	- our professional legal, tax, audit and accountant advisors - partners providing us with tools for internal management and content sharing	first name, last name, contract ID, name of contractor, bank account number, amount of the remuneration, contract terms, scope of works, company’s number in the Polish register of economic entities (REGON), tax identification number (NIP), street address, postal address
recording the processing of personal data	for the time required to ensure accountability	- our professional legal, tax, audit and accountant advisors - partners providing us with tools for internal management and content sharing	email address, first name, last name, other data included in the entry

• Acting in a legitimate interest

14. We keep striving to provide you with the best possible entertainment. This means not only improving our games, but also supporting players, offering additional services, organizing community-engaging campaigns, etc. We also look after the interests of our investors, business partners and other persons. In such cases we act based on Art. 6 (1) f of GDPR and we always ensure that your interests are properly secured.

Purpose	Period	Recipients	Data
communication	for the time of the communication	- partners providing us with tools for internal management and data sharing - partners helping us manage our email communication	email address, username, first name, last name, mailing address
informing about changes concerning CD PROJEKT RED services	for the time when you use our services	- partners providing us with tools for internal management and data sharing - partners helping us manage our newsletters and email communication, providing us with tools dedicated for email marketing	email address
creation, maintenance, improvement or modification of CD PROJEKT RED services based on user reports	for the time when you use our services or the time of your participation in our research	- partners providing us with tools for internal management and data sharing - entities providing services or tools for data analytics	technical information about the devices you’re using, information concerning the Internet or network connection, IP address, mobile device ID, operational system, browser type, data concerning computer equipment, as well as other technical information, information about when and how you use CD PROJEKT RED services, diagnostical data provided by external platforms
asserting or defending claims, including managing court, administrative, arbitration or mediation proceedings	For the time when you use our services, and afterwards - for the claim limitation period	- partners providing us with tools for internal management and data sharing - auditors, actuaries, law firms, law and tax firms providing us with their services	name, surname, correspondence address, other information connected with products or services to which the claim relates

• Your consent

15. In some cases we ask if you want to consent to our processing of your data. In these cases we act on the basis of Art. 6 (1) a of GDPR.

Purpose	Period	Recipients	Data
sending our marketing information (newsletter)	until you opt out from newsletter subscription	- partners helping us manage our newsletters and email communication, providing us with tools dedicated for email marketing	email address
targeting and customization of marketing information	until you revoke your consent	- advertising partners supporting us in marketing customization and targeting (e.g. offering tools for adjusting the ads displayed to you to your interests).	email address, information about when and how you use the CD PROJEKT RED services, data concerning the traffic and geographical location
maintaining testers base and enabling participation in playtests	until you revoke your consent	- companies from the CD PROJEKT Capital Group, which provide us with technological support or with which we cooperate when providing selected services - partners helping us manage email communication - partners providing us with tools for internal management and content sharing	first name, last name, email address, phone number, user ID, preferences concerning video games, preferences concerning playtests
creation, maintenance, improvement or modification of CD PROJEKT RED products and services based on non-anonymous telemetry data	until you revoke your consent	- companies from the CD PROJEKT Capital Group, which provide us with technological support or with which we cooperate when providing selected services - partners providing us with tools for internal management and data sharing - entities providing services or tools for data analytics - partners who work with us on joint research and development projects - partners who work with us on creating and developing some of the CD PROJEKT RED products or services	non-anonymous telemetry data, technical information about the devices you’re using, information concerning the Internet or network connection, IP address, mobile device ID, operational system, browser type, data concerning computer equipment, as well as other technical information, information about when and how you use CD PROJEKT RED services, diagnostical data provided by external platforms

Data from third parties

16. In most cases we collect your data directly from you. In some situations we can also process your data which we get from third parties.

• External platforms

17. You can use our services available on external platforms (e.g. play our games available on game distribution platforms, such as Steam, PlayStation Network or Xbox Network) or connect with some of our other services with the use of external platforms. In such cases we can receive your data from these platform operators, according to the terms and conditions of service provision of the particular platforms.

18. Some of your data will be provided to us only if you turn on the collection of optional data on your device. For example, if you agree to collection of diagnostic data on the Xbox console you use to play our games, we will be able to receive and process additional details concerning your console, its settings, efficiency and ways of use, as well as extended reports on errors. We will process this type of data according to the terms and conditions determined by the platform operator (in the case of Xbox console data - for no longer than 28 days from the date of collecting the data).

19. External platform operators may process your data related to the use of our services also on their own behalf. To find out more about it, please read the terms and conditions of services and privacy policy of the external platform you’re using.

• External identity providers

20. When registering a CD PROJEKT RED Account you can choose to authenticate using an external identity provider you select (e.g. using Google Sign-In service). In such a case we will receive the following personal data from this provider: your account identifier, your email address, and your username or your full name. We will use this information to authenticate you, create and provide you access to a CD PROJEKT RED Account, and to provide you with services connected with CD PROJEKT RED Account.

Data sharing

• Partners

21. For our everyday business we use the tools and services provided by our trusted partners. When necessary, we provide them with your data and process it with these tools or within these services. We make sure to share with our partners only the data necessary for operating a certain tool or providing a given service. Before we start working with a partner, we check if they meet the necessary information security standards.

22. You’ll find details about the partners who support us in specific processing purposes in the How we use your data section.

23. We can provide aggregated data concerning user behavior (e.g. sales data for particular regions) to selected partners (e.g. payment operators, data analytics providers). In such cases the partner has no way of identifying you, so your personal data is not processed.

• Public authorities

24. If the applicable law requires us to do so, we will share your data with the courts or public administration bodies concerned. This can concern a potential violation of law. In such cases we make sure that the request provided is true and lawful.

Processing data abroad

25. Your data can be processed by our partners from outside the European Economic Area (i.e. EU member countries and Norway, Island and Liechtenstein). We ensure the security of your data, providing it to countries which guarantee the proper level of protection or using the European Union’s standard contractual clauses.

Profiling

>

ℹ️ By “profiling” we mean drawing conclusions on the basis of your data, e.g. concerning your current or future preferences or interests.

26. We don’t use algorithms to make automated decisions which could impact your legal situation. For example, we don’t make automatic offers based on your behavior while playing our games.

27. At the same time, we use profiling in the following cases:

• Newsletters and marketing communication

28. We can profile your data in the case of customization or targeting of our marketing communication, offers and advertisements. This means that we can use the information we have collected to adjust the messages we send to your interests.

• RED Playtesting Program

29. The persons who conduct tests with the participation of users of our services will filter our testers’ base on the basis of their preferences, gaming experience or other information from the entry form and choose the persons who will be invited to a particular test.

• CD PROJEKT RED Accounts

30. If you’re using a CD PROJEKT RED Account, we can profile the data concerning CD PROJEKT games which are in your library and your activity in the games, to adjust our marketing communication to your interests and improve our services.

What we don’t do with the data

• Processing children’s data

31. We don’t knowingly collect the data of persons below the age of 16. In the case of persons who are at least 16 years old but are not of legal age, we require the consent of the parent or carer.

32. If you are a parent or a carer and you have questions concerning the processing of data of the person in your care, write to us.

• Processing financial data

33. We don’t process any information concerning your payments. The data you provide when making purchases remains on the side of the payment operator. If you make a purchase as part of the CD PROJEKT RED services, we will be informed by your payment operator of the fact and we will make sure your order is delivered. We won’t get any of your financial data in the process. We only collect information concerning transaction dates, currencies, and the value of transactions and products concerned.

Cookies

34. We collect information about you through cookie files and other similar tools. When doing so, we use tools offered by other entities. If you want to know more or change your preferences, click the link “Declaration concerning cookie files” in the footnote of our websites.

Your rights

35. You have control over your data. Below we list your rights and situation in which you can exercise them. You can do it on your own, using the features available in some of our services or by contacting us directly.

Right	When you can exercise it
of access to data	in any situation
of rectification	if the data is incorrect or incomplete
of deletion	- if we no longer need the data to achieve the purpose for which we collected it - if you withdraw the consent on which the data processing is based - if you object to the processing of your data - if we processed your data unlawfully - if we should delete the data to meet our legal obligation
to restriction of processing	- if the data is incorrect - for the period enabling us to check if they are correct - if the data was processed unlawfully, but you don’t want them to be deleted - if we no longer need your data, but you may need it to pursue or defend against claims - if you object to the processing of your data - until it’s determined whether our interest outweighs the basis for your objection
to data portability	if the processing is based on consent or a contract we signed and takes place in an automated way
to object	if we process your data based on a legitimate interest and the objection is justified by your special circumstances
to complain	you can always lodge a complaint with the President of the Office for Personal Data Protection or with a local personal data protection office in your country of residence

36. If you live in California, the law of the state of California may grant you additional rights concerning the processing of your data. You can find out more information in the Privacy Statement for California Residents section.

Joint controllership

• Social media

37. If you visit our profiles on social media portals, we process the data concerning your activity on these profiles as part of the aggregate statistics. To this end we cooperate with the operator of a given social media portal as joint controllers. Detailed rules for this cooperation are determined in a relevant joint controllership agreement. Regardless of the content of these agreements, you can use your rights both with regards to us, and the operator of a given social media platform. You can find details concerning joint controllership of your data below.

Portal	Shared controlling terms and conditions
Facebook/ Instagram	Meta Platforms Ireland Ltd., with its registered office at Merrion Road, Dublin 4, Republic of Ireland. The content of the joint controllership agreement: https://www.facebook.com/legal/terms/page_controller_addendum
LinkedIn	LinkedIn Ireland Unlimited Company with its registered office in Wilton Place, Dublin 2, Republic of Ireland. The content of the joint controllership agreement: https://legal.linkedin.com/pages-joint-controller-addendum
TikTok	TikTok Technology Limited with its registered office at 10 Earlsfort Terrace, Dublin, D02 T380, Republic of Ireland. The content of the joint controllership agreement: https://www.tiktok.com/legal/page/global/tiktok-analytics-joint-controller-addendum/en/

Changes to this policy

38. We can change this policy when it’s necessary for legal or practical reasons (e.g. to include the changes to our services). If this happens, we will publish the new policy on this website. You can track the changes at this link.

Privacy Statement for California Residents

39. We are CD PROJEKT RED S.A., a company incorporated in Poland (we will further call ourselves “CDPR”, “we”, “us” or “our”). We have included this California-specific information below to inform you about additional rights regarding our use of your personal information under the California Consumer Privacy Act of 2018 (“CCPA”) and other California privacy laws. This Privacy Statement applies only to visitors, users, and others who reside in the State of California (“users,” “you,” or “your”). Below, we explain our privacy practices and your rights regarding the collection, use, and disclosure of your personal information.

• Information we collect and use of personal information

40. Personal information is information that directly or indirectly identifies a particular user, household, or device. We described the categories of personal information we collected from users within the last twelve (12) months and are the purposes for which we may use said personal information in the How we use your data section, which you will find in the Privacy Policy above.

• Collection of personal information

41. We obtain personal information from various sources, including, but not limited to:
    - Directly from you f.ex. information you give us when registering a CD PROJEKT RED Account;
    - Directly and indirectly from your activity on CDPR services;
    - From our vendors, affiliates and business partners that help deliver our services and functionalities to you f.ex. we use software and support ticket system to help us managing your customer support requests;
    - Social media, other platforms and other third-party accounts, if you choose to link them.

• Disclosure of personal information

42. You can find information on the reasons why we may disclose personal information in the Data sharing section of the Privacy Policy above.

    Over the preceding twelve (12) months, we have disclosed for business purposes the categories of personal data indicated in the How we use your data section of our Privacy Policy with the categories of third parties described therein.

• Your rights

43. As a California resident, you have the following rights under the CCPA regarding your personal information:
    - Access, update, and correct personal information
    You have the right to request access to and receive the following information about personal information we maintain about you in the preceding 12 months.
    (1) The categories of personal information we collected about you.
    (2) The categories of sources from which the personal information is collected.
    (3) The business or commercial purpose for collecting personal information.
    (4) The categories of third parties to whom we sell or with whom we share your personal information.
    (5) The specific pieces of personal information we collected about you (i.e. data portability rights).
    (6) If we sold or disclosed your personal information for a business purpose, two separate lists disclosing: (i) sales, identifying the personal information categories that each category of recipient purchased; and (ii) disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.
    - Right to opt-out of selling and sharing
    We do not sell your data to third parties for any purpose. This means we do not disclose any of your data to third parties in exchange for monetary or other valuable consideration. However, we may share some of your data with third parties (our marketing partners) for the purpose of cross-context behavioral advertising.
    You have the right, at any time, to opt-out of sale or sharing of your personal data. To do this, follow the dedicated "Do Not Sell or Share My Personal Information" link you will find in the footer of our websites to adjust your preferences.
    In any case, we do not sell or share any sensitive personal information, as defined by the CCPA.
    - Delete Personal Information
    You have the right to request that we delete any of your personal information we collected and retained, subject to certain exceptions. Once we receive and verify your user request, we will delete your personal information from our records. However, we may deny your deletion request if retaining the information is necessary for us or our service providers under certain circumstances, which we will explain to you at the time of the denial, if any.

• Contact us

44. Whether or not you are currently a CDPR user, if you would like to exercise your rights regarding your personal information, or have any questions or comments concerning this Privacy Statement, please follow the instructions you will find in the Contact us section of the Privacy Policy above.

• Non-Discrimination

45. We will not discriminate against you for exercising any of your CCPA rights by offering different pricing or products, or by providing you with a different level or quality of products, or in connection with promotions or other offerings.

• Non-Personal Information

46. This Privacy Statement does not restrict our collection, use or disclosure of any aggregated information or information that does not identify, or cannot be reasonably linked to, any individual, which is defined under the CCPA as not personal information.

• Updates

47. We may change this Privacy Statement if we think it's necessary for legal reasons or to reflect changes in CDPR services. If so, we will make the changed Privacy Statement available online and (if you have a CD PROJEKT RED Account or you signed up to another CDPR service using your email address) we'll email you to explain the changes. We will also update the revision date. Any changes to this Privacy Statement will become effective when posted on our website.

Last revised: as indicated above.