Why Shutting Us Up Is a Bad Idea: The Power of Transparency

Hey Dreadnought

You bring up some interesting points, but I’d like to address a few aspects of what you said.

We are sort off derailing from the intent of this topic, so i'll provide my response in a spoiler and maybe we should consider continueing in PM.

Quote from Dreadnought

I would D.M. you but your profile is limited to your forum friends .

I can receive DM's just fine, from people that are not added as friends;

I am trying to push for a certain level of transparancy and access to data here that; we should honestly already have, as dictated by european law. (And, GF's own privacy policy)

For my own case, I am following the book on what my options are. This is however a process, that will take "many months". And a random player shouldnt have to go to such lengths to receive something he has rights to.

I've given the transparancy issues some more thoughts today and typed the following:

Clarifying Gameforge/OGame's Use of "Official Channels"

from my personal viewpoint

It’s important to understand how Gameforge/OGame uses the term "official channels," especially in a realistic context. The wording is deliberately vague, and there's a reason for that: it gives Gameforge flexibility in its interpretation. While many may think "official channels" refers exclusively to the ticket tool, the reality is more nuanced.

Gameforge intends for the ticket system to be the primary means of communication for game support. However, anything that goes beyond the scope of what can be handled via the ticket tool (for instance, data privacy concerns or legal issues) must be directed to the appropriate higher-level channels.

When investigating what "official channels" are actually available, the options that you can identify are quite limited:

• The ticket tool for basic game support and inquiries.
• The privacy officer for issues related to GDPR and personal data. (this process can be started through the ticket tool)
• A legal email address for matters requiring legal attention.
• An address for news/marketing inquiries.

This setup reinforces their strategy of keeping most player interaction within the confines of the ticket system, while reserving the higher channels for very specific cases.

In my experience, having gone through several of these so-called "official channels," it feels as though they are structured to delay the process rather than resolve issues efficiently.

Typically, players start by opening a ticket, and from there, things can drag on for months. Many players will give up long before they get a proper resolution. The primary reason for these delays lies in the way ticket support is structured: it’s a back-and-forth system where each response offers limited information or vague answers, prolonging the resolution process.

If we look at the average response time for a ticket, it’s usually somewhere between 24 to 72 hours. However, this includes repetitive, sometimes irrelevant, responses that don’t advance the issue, and there’s no automatic escalation to a higher level of support. Whether your issue gets moved up depends largely on the support representative handling your case or whether you use the complain function in the ticket tool.

To be fair, part of the reason these tickets take so long is that many players assume they are already in the right place and don’t consider the possibility of escalating or using other "official channels." They think that once they’re in the ticket system, they’re where they’re supposed to be.

However, this is not the case for all situations. For privacy-related issues, you need to submit an official DSAR (Data Subject Access Request), which can be done through the ticket tool. From there, you’re legally entitled to a response within 1 month, but realistically, this will take around 2-3 weeks.

Once you receive your data dump, you’ll likely find that much of it is irrelevant to the issues you’re facing. At that point, you can ask for clarification on why certain information is missing, and again, they are legally obligated to respond within 1 month.

This next step, for me, is largely uncharted territory, but based on past experience, we can assume the process continues in a similar fashion. Filing a DSAR is often seen as a “soft-legal” approach, and we all know that legal processes tend to drag out. So, let’s break it down:

1. You request clarification about missing information.
2. You’ll either receive the data you actually requested, or you’ll get another vague or empty response asking for further clarification, or citing "trade secrets" or security reasons as the basis for withholding information.
3. At this point, you have to specifically request the legal basis for these actions, which they were not required to provide earlier because you didn’t explicitly ask for it. This could take another month of waiting.

After this, you’re in a position where you might start questioning whether it’s worth continuing down this path. Chances are, they’ll respond with a legal explanation as to why the data isn’t being provided, often citing trade secrets or other protected information.

At this stage, your options become quite limited. Most players, being naturally inclined to keep engaging, will continue the conversation with the privacy officer—but in my experience, this often results in silence. The officer may simply stop responding after they’ve provided what they claim is their “legal basis,” and won’t tell you that this is the end of the road unless you ask very specific questions they are legally required to answer.

The only option you have left at this point is to file a complaint with your country’s Data Protection Authority (DPA) if you’re in the EU. If you’re outside the EU, you’ll need to contact Germany’s DPA since that’s where Gameforge is based. Filing with a DPA could take another month or more. You’ll have to argue your case, and if they agree with your viewpoint, they will engage with Gameforge on your behalf. This adds another potential month to the process.

tl;dr

Ticket tool is a means to delay issues in hope that they simply get forgotten. And my past experience with it, has proven this.

Quote from zhog

Out of curiosity, how old are you ? Roughly ?

Not sure what my age has to do with this, but I am between 30-40.

Quote from DonutZ

Hang in there, keep fighting and be patient. While this long process may not end the way you want it to, it could at the very least show you where the legal rabbit hole leads, which will provide greater clarity to players about what legal rights they have to their personal information.

And we will "never back down"

Quote from zhog

I asked this because often people who take very seriously things other people do not deem important are often very young. ^^

I would argue that I simply have the time to care about it

Quote from Jillian

This next step, for me, is largely uncharted territory, but based on past experience, we can assume the process continues in a similar fashion. Filing a DSAR is often seen as a “soft-legal” approach, and we all know that legal processes tend to drag out. So, let’s break it down:
1) You request clarification about missing information.
2) You’ll either receive the data you actually requested, or you’ll get another vague or empty response asking for further clarification, or citing "trade secrets" or security reasons as the basis for withholding information.
3) At this point, you have to specifically request the legal basis for these actions, which they were not required to provide earlier because you didn’t explicitly ask for it. This could take another month of waiting.

We can now verify above section;

1) While I requested clarification and was very specific about the exact information I was asking for, the dataset I received still excluded the key information I had clearly requested. Despite being explicit in my request, I have not received the data that I specifically asked for.

2) After receiving the incomplete dataset, no explanation was given for the missing data I had explicitly requested. As part of the ongoing process, I made it clear that the provided data was still incomplete. I reiterated the specific information I was asking for and highlighted the sections of the GDPR that entitle me to this data. I also formally requested the legal basis for withholding this information, as is required by law. At this point, the process involves waiting for their response, which should either provide the missing data or give a clear legal justification for withholding it.

Ongoing Assumptions and Verification:

Initially, my assumption was that the delays and lack of clarity in the responses were due to inefficiencies or a possible oversight. However, with the verification we now have, it’s becoming evident that there is a clear intent behind the way information is being presented—or rather, omitted. Despite explicitly requesting specific data multiple times, the information has been consistently excluded without any explanation or legal justification for its absence.

This pattern strongly aligns with the earlier issues I mentioned regarding the lack of transparency. Not only is critical data missing, but there’s also no attempt to provide a reason for withholding it, which under the GDPR, should have been addressed clearly. The absence of both the requested information and a valid legal basis further supports the idea that the messaging is carefully curated to delay or prevent the release of data altogether.

Loss of Trust:

This ongoing behavior makes it incredibly difficult to maintain trust in the system. When an organization fails to be transparent, particularly after repeated requests for clarification, it inevitably leads to doubt about their intentions. The refusal to provide specific, relevant information, combined with a lack of explanation, has caused me to lose confidence in their willingness to act fairly and within legal boundaries. Transparency is essential to building trust, and without it, it’s hard to believe that future interactions will be handled with honesty or respect for user rights.

I would like to reach out to anyone who has experienced similar issues, faced transparency challenges, or holds more information that they might be hesitant to share in a public forum. If you're comfortable discussing your experience privately, feel free to contact me on Discord: Jillian|Jollian.

Let’s work together to bring more clarity to these situations and help each other navigate this process. Your insights and stories could be invaluable in making progress on this.

Quote from Cicada

may I ask you what is the key information you are missing? what kind of data we are talking about?

Ill respond to this in PM.

Hey Mensa,

First off, I completely understand your frustration, and I’m really sorry you’ve had to go through all of this. The way you've been treated—being led in circles for weeks, with vague responses and no clear answers—is sadly too familiar. Your experience mirrors what many of us, myself included, have faced while trying to get transparency from Gameforge regarding sanctions and the data behind them.

What makes this especially maddening is that, as you rightly pointed out, we’re simply asking for what we’re entitled to under GDPR—access to the personal data they used to make decisions about our accounts. It’s not an unreasonable request by any means. The fact that it took them a full month to even mention the option of filing a DSAR is deeply concerning and shows a serious lack of transparency and proper guidance on their end. And like you, I share doubts about how much clarity a DSAR would actually bring, based on my own experience.

In fact, I received a response to my own request recently, and while they finally acknowledged withholding some data, they used reasons like trade secrets and third-party privacy concerns as justification. They implied the data could compromise their internal systems, which feels like a stretch given that basic activity logs and sanction-related notes shouldn't fall under these protections.

I can’t help but feel that time-wasting tactics are exactly what they’re employing to make people give up before they ever get real answers. It's disheartening to see a company prioritize dodging accountability over taking care of their community’s concerns.

As for escalating this, I think it’s absolutely something worth considering. You have every right to escalate to the Data Protection Authority (DPA) in your country if you feel that Gameforge is mishandling your GDPR rights. Filing a formal complaint could push them to take these issues more seriously.

You’re definitely not alone in feeling like this. I’m hopefull to hear if anyone else has had similar experiences, but just know that you’ve got support from others who are going through the same nonsense. Thanks for sharing, and don’t hesitate to reach out if you want to discuss potential next steps—this community can be stronger together.

//EDIT

I could go more in depth in regards to the Email I received, but I am unsure on how much I can share in regards to its contents without "sharing private conversation", I can however also mention that they used the privacy of other users as an excuse, which is a serious matter - but a laughable excuse considering that said data that involves a 3rd party could be redacted or made anomynous. And I am not about to start asking if I can share the full content of the email, as a reply will probably never come. (and give reason to ignore my ongoing conversation with said party)

To give some extra clarity to the "time-wasting tactics" I've mentioned, My situation is ongoing since 2024-06-13. So its an ongoing case for over 12 weeks, or 3 months.

Hey everyone,

Since we're pushing for full transparency, it's time to let the cat out of the bag. Some of you might have noticed a user named Mensa participating in this thread, sharing similar frustrations and experiences with Gameforge’s handling of account sanctions and data requests. Well, here’s the truth: Mensa was actually a pseudonym I created.

The reason? I wanted to run a test to see how Gameforge would treat "someone else" who wasn’t directly associated with my previous inquiries and experiences. The goal was simple: to gauge whether responses and support handling would differ from what I had personally encountered.

As expected, Mensa faced similar roadblocks, delays, and vague answers. It seems that regardless of the individual, the approach to transparency (or lack thereof) remains the same.

I did this to highlight that these issues aren’t unique to any one player, but rather reflect a systemic problem with how transparency and user data requests are being handled. It shouldn’t matter who is asking for their GDPR rights—we should all be entitled to the same level of clarity and responsiveness.

On that note, we’re contemplating writing a full review of this entire experience—covering the lack of transparency, the stonewalling tactics, and the way GDPR requests are handled. We believe this needs to be documented in full for the wider community to understand what’s going on behind the scenes and to push for real change.

I hope this experiment sheds even more light on the broader issue at hand. Let’s keep pushing for real answers and real change.