Privacy.

Who is responsible.

The controller of the personal data described in this notice is Damian Duda, operating under the name Ground State Studio. Contact the controller about your data or recruitment using the email below.

Privacy contact

[email protected]

The details we collect.

When you apply, you provide your name, Discord username, disciplines, preferred collaboration type, portfolio link, availability and an experience statement. We also receive your acknowledgement of the working terms. If you contact us by email or Discord, we receive your contact details and the information you include in your message. Please avoid including identity documents, health information or other sensitive details.

The website forwards your application to Discord without saving an application or delivery register on the VPS. Connection information, including an IP-derived identifier, is used to limit abusive submissions. Submission fingerprints and delivery results are held only in server memory: attempt counters expire after 15 minutes and duplicate-protection entries expire after 24 hours; both reset when the process restarts. Hosting and proxy services may also process technical request information for operating and securing the website.

Why we use your details.

We use application details to assess your request to collaborate, contact you and take steps towards an agreement at your request under Article 6(1)(b) GDPR. Security and abuse prevention serve the legitimate interest of protecting the website and recruitment process under Article 6(1)(f). We also use contact correspondence to answer your questions and handle requests concerning your data; applicable GDPR obligations may require us to process those requests under Article 6(1)(c).

Submitting an application does not establish an employment contract or guarantee a paid position. We do not automatically add applicants to a pool for unrelated future recruitment or use their details for marketing.

Who receives an application.

Applications are delivered to a private recruitment channel on the studio's Discord server. The studio owner has confirmed that only studio owners have access to that channel. External collaborators do not join the team or its Discord server simply by applying.

Discord provides the messaging service. The website's hosting is a Hostinger VPS in Vilnius, Lithuania, managed with Coolify; its location was confirmed by the studio owner. Correspondence sent to our contact email is handled through Google's Gmail service. These providers process information needed to provide their services; their privacy information is linked below.

Website security and Cloudflare.

Cloudflare provides the website's reverse proxy, content delivery and protection against abusive traffic. Requests pass through its network, which processes connection and request information to deliver and secure the website. This includes traffic carrying form submissions. Cloudflare also makes technical request records available to the studio, including IP addresses, request times, requested hosts and paths, HTTP methods, response status codes and country information. We use this information to operate the website and investigate errors or abusive traffic.

The recruitment form also uses Cloudflare Turnstile. When you reach or interact with the form, it checks browser and connection signals to distinguish people from bots. The server validates the resulting security token with Cloudflare before sending a new application to Discord. We send the token and widget secret to this verification service, without including the application fields. Cloudflare describes its handling of these signals, including its own use to improve bot detection, in its Turnstile notice.

International processing.

The VPS location in Lithuania does not mean that all application data stays in the EU. Discord states that it processes and stores information in the United States and may use other countries. Google and Cloudflare also describe international processing in their privacy information.

Discord describes using adequacy decisions, the EU–US Data Privacy Framework and standard contractual clauses for applicable transfers. Discord transfer information

Google describes relying on adequacy decisions, including the EU–US Data Privacy Framework for Google LLC and standard contractual clauses where applicable. Google transfer safeguards

Cloudflare describes relying on the EU–US Data Privacy Framework for covered transfers to the United States and standard contractual clauses where applicable. Cloudflare transfer safeguards

These are the providers' published safeguards. Contact the controller to request more information about the safeguards relevant to your data or how to obtain a copy of them.

How long we keep it.

We delete rejected applications manually within 90 days after a rejection decision. This is the studio's selected retention period, not a statutory deadline. The studio owners remove the application message directly in Discord; the website does not schedule automatic deletion or keep a separate delivery register.

Active applications are kept to handle the recruitment process until a decision is made or the process ends and must be reviewed regularly. If collaboration begins, any information needed for that collaboration is handled according to its purpose, agreement and applicable retention requirements. A specific legal need may justify retaining a restricted record separately; we do not retain every application indefinitely just in case.

We keep contact correspondence until your inquiry and related follow-up have been resolved. Records needed to handle a request about your data or meet a legal obligation are retained only for that purpose and the period required by the applicable obligation.

Cloudflare retains technical request and security data according to the relevant service, dataset and plan. Its published dataset retention information distinguishes analytics records from other log products. The history available in a dashboard is not a promise that all copies held by the provider are deleted at the end of that period.

Discord may retain information under its own retention rules. Requests for earlier erasure are assessed individually, including any applicable exceptions.

Your rights.

Depending on the legal basis and circumstances, you may request access to your data, correction, erasure, restriction or portability. We may need proportionate information to confirm that a request concerns your application.

Your right to object. You may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests, including security and abuse prevention. Send your request to [email protected]. We will stop that processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms or the processing is needed for legal claims.

You may also complain to the Polish supervisory authority, the President of the Personal Data Protection Office (UODO).

Your choices.

Submitting an application is voluntary. Required form details allow us to assess it and contact you; without them we cannot process the application through this form. Optional additional information is not a condition of joining the studio.

People review applications. This website does not automatically rank applicants or make recruitment decisions. Choosing a collaboration type or acknowledging the working terms does not itself constitute consent for unrelated uses of your personal data.

Supporting the studio.

Support links open our Ko-fi page. Supporting the studio is optional and separate from recruitment. Payments take place through external services; this website does not collect payment-card details or embed a Ko-fi widget.

Ko-fi and the payment provider may make your name or username, email, message and transaction details available to the studio. We use these to administer your support and related correspondence based on our legitimate interest under Article 6(1)(f) GDPR. Where records are required by applicable accounting or other legal obligations, Article 6(1)(c) applies.

We keep this information until the contribution and related queries are resolved or for the period required by an applicable legal obligation. Ko-fi and payment providers have their own retention and international-processing practices. Ko-fi privacy

Browser storage.

The website can read a reduced-motion preference previously saved in your browser under gss-newland-reduced-motion. This preference is used for the site's presentation, alongside your system settings. Fonts and website artwork are served locally; the current application code does not include advertising pixels or client-side analytics trackers. Cloudflare provides the technical request analytics described above.

Cloudflare security services may use browser storage or security cookies as described in their notices. Turnstile pre-clearance is not needed for this form; verification does not grant a general bypass of website security rules. The website does not save your application in browser storage.

Links to Discord and other websites open services with their own privacy and browser-storage practices. Our contact email opens your email application; the recruitment form delivers its application to Discord.