Puzzle Play Privacy Policy

This Privacy Policy is divided into two parts. Part 1 explains how we process your personal data in connection with the Puzzle Play loyalty program. Part 2 explains how we process your personal data in connection with the games we publish. Please use the links below to go to the relevant part:

Part 1: Privacy Policy for the Loyalty Program

Effective date: July 16, 2026

Because you use the Puzzle Play app ("App"), we process your personal data. PuzzlePlay Limited ("PuzzlePlay", "we", "our", or "us") respects your privacy and is committed to protecting your personal data. Below you will find information on why and how we do this. You will learn about your rights and how we ensure your data is protected.

If you are located in the United States, please refer to Section 9 and 13 for additional information specific to U.S. users.

1. WHO ARE WE AND HOW TO CONTACT US?

1.1. PuzzlePlay Limited is a company incorporated in England and Wales, with company number 16306437. If you have questions about this Privacy Policy or data processing, you may contact us at: dataprotect@puzzleplay.app.

1.2. PuzzlePlay is the controller, within the meaning of applicable laws, with regard to the collection, processing and use of personal data in the context of the App and as described in this Privacy Policy. This means PuzzlePlay is responsible for deciding the purpose and the means of how your personal information will be used and processed.

1.3. This Privacy Policy applies to your use of the App and any related services or features we provide. It does not cover other websites or services that may be linked to from within the App.

2. INFORMATION WE COLLECT

We collect different types of information to run the App, process rewards, prevent fraud, and improve the experience. Here's what we collect and why:

2.1. Information you provide:

2.1.1. Reward redemption details: when using Tremendous or third-party reward providers (e.g. PayPal, Amazon), we may collect your first and last name, email address, your unique user ID, and details about your reward history. This is so we can send you your rewards.

2.1.2. Support requests: if you contact us for help, we collect your name, email address, device ID, User ID and Install ID, and the message you send us. This helps us respond and solve the issue.

2.1.3. Biometric Data (Identity Verification): When you use our identity verification features, we collect biometric data, which includes personally identifiable physical trait or appearance information and images provided by you. This includes 3D facial scans, which are 3D representations of your face that contain biometric data and liveness data. We collect this data for the following purposes:

(a) verifying your identity and preventing fraud;

(b) ensuring account security and detecting unauthorized access;

(c) complying with age-verification requirements;

(d) preventing duplicate accounts and abuse of the rewards program.

For detailed information regarding the collection and use of biometric data, see Appendix 1.

2.2. Information we collect from game publishers (when you play other games via the App):

2.2.1. When you click through to a participating game via the App, we may receive:

a. in-game actions: installation of a particular game, in-game purchase information and in-game advertising information, transaction types, events, actions, clicks, impressions, and use of virtual items, game achievements, statistics and information on bugs and malfunctions ("Gameplay Data") so we can track your progress toward earning rewards;

b. identifiers: pseudonymous IDs like your user ID or advertising ID. These don't directly identify you but help us know it's the same person using different games;

c. engagement metrics: information used to help calculate your progress toward earning rewards, such as your engagement with games and ads);

2.2.2. This data is shared by the game publisher under a contract or technical setup. We use it only to track rewards properly, detect suspicious or fake activity, and improve our App.

2.3. Information we collect automatically (when you use the App):

2.3.1. device and usage info: we collect data such as your device type (e.g., iPhone, Samsung), operating system version, IP address, language, advertising ID (like GAID or IDFA), app version, screen views, button clicks, and timestamps of interactions;

2.3.2. reward tracking: data about your gameplay that helps us determine if you're eligible for a reward (e.g., how long you played, if you watched an ad);

2.3.3. attribution tools: we use tools like the Adjust SDK to understand which ads or campaigns led you to install or use the App, detect fraud, and ensure rewards are given fairly.

2.4. Cookies and similar technologies:

2.4.1. We use technologies similar to cookies, called SDKs (software development kits), provided by companies like Adjust and Google. These help us

a. understand how users engage with ads and the App;

b. ensure rewards are granted fairly;

c. protect against fraud and misuse.

These partners may process limited technical and usage data to:

a. support performance measurement and reward allocation,

b. help prevent fraudulent activity,

c. ensure accurate reward attribution.

2.4.2. We use Firebase, a service provided by Google, to help us improve the App's stability, performance, and user experience. Firebase may collect information such as your device type, operating system, app usage data (including crashes, screen views, and session durations), and other technical data. This information is used to monitor and fix technical issues, understand how users interact with the App, and optimize its functionality. Data collected via Firebase is processed in accordance with Google's Privacy Policy, and we use these services in a way that does not allow us to directly identify you.

3. FOR WHAT PURPOSES AND ON WHAT LEGAL BASIS DO WE PROCESS YOUR PERSONAL DATA?

3.1. In the table below, we explain the purposes and legal bases for our processing of your data:

3.2. Where required by law (e.g., in the EEA), we will obtain your explicit consent before processing your data for direct marketing purposes. You may opt out of receiving certain promotional communications (emails) any time by following the instructions provided in emails to click on the "unsubscribe" link, or if available, by changing your communications preferences in your account settings. Please note that your opt-out is limited to the email address used and will not affect subsequent subscriptions. If you opt-out of only certain communications, other subscription communications may continue. Even if you opt out of receiving promotional communications, we may, subject to applicable law, continue to send you non-promotional communications, such as communications about your coin balance, reward redemptions, or our ongoing business relationship with you.

4. AUTOMATED DECISION-MAKING AND PROFILING

4.1. We do not make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significant impacts on you (as defined under the GDPR and UK GDPR). However, we may use limited forms of profiling to analyse user behavior (e.g., in-game activity, ad engagement) for the following purposes:

4.1.1. improving gameplay experience,

4.1.2. optimizing reward distribution,

4.1.3. detecting fraud or abusive use,

4.1.4. attributing advertising performance,

4.1.5. performing biometric liveness detection to determine whether a user is a live human or a spoof attempt;

4.1.6. performing face matching and authentication to verify that user is not a bot.

This processing does not result in decisions that legally or significantly affect you. If we introduce fully automated decision-making with such effects in the future, we will notify you and provide you with your rights under applicable law, including the right to human intervention.

You have the right to object to profiling in certain circumstances. To exercise this right, please contact us at: dataprotect@puzzleplay.app.

5. HOW LONG DO WE PROCESS YOUR DATA (DATA RETENTION)?

5.1. The length of time we process your data depends on the purposes for which we use it and the legal basis for processing it. In order to determine appropriate retention and deletion periods for your personal data, we have also taken into account the extent, amount, nature and sensitivity of your data and the potential risk of harm.

5.2. We will process your data for as long as necessary to fulfil the purposes outlined above for which we collected it. In particular, we retain your data only as long as necessary to:

5.2.1. provide the App and services;

5.2.2. comply with legal obligations (e.g., tax regulations);

5.2.3. resolve disputes and enforce our agreements.

5.3. If you stop using the App or uninstall it, your data may be retained for a limited time, in accordance with our retention policy. If you do not use the App for at least 180 days, your account may be considered inactive and may be terminated. In such cases, any Coins earned may automatically expire, and your personal data may be deleted in line with applicable data protection laws and our internal policies. We will delete your data irretrievably only when it is no longer needed for any processing purpose. We may delete some of your data later than others. This may happen when we no longer need them for one purpose of processing, but they are still necessary for another purpose.

6. SHARING YOUR INFORMATION

6.1. We share your data with other entities in order to provide you with the best possible service or when we have a legal obligation to do so. In particular, these are entities that support us in providing our services, i.e. in particular technology and analytics service providers.

6.1.1. Game publishers – when you interact with games accessible via the App, we share your data with the respective game publishers. These publishers act as independent data controllers and process your data for the purpose of enabling in-game event tracking, ensuring correct reward allocation, and facilitating proper technical integration between the App and the games. Their use of your data is governed by their own privacy policies. Where a game is published by PuzzlePlay Limited on its own developer account, PuzzlePlay Limited is the controller for that game, as described in Part 2 of this Privacy Policy, and that game is not covered by a separate publisher's privacy policy.

6.1.2. Reward provider (Tremendous) - we share your data with the reward provider for the purpose of processing rewards and ensuring that you receive the rewards you are entitled to. In some cases, we may also share additional data if required to support fraud investigation or prevention efforts initiated by the reward provider. The reward provider may use your data for its own purposes, which are described on its website here.

6.1.3. Affiliates and subsidiaries – we share your data only with subsidiaries of Tripledot Studios, as our game publishers are limited to internal studios that Tripledot Studios own. Where a subsidiary acts as a game publisher, the data processing and sharing practices described in Section 6.1.1. will apply accordingly. Apart from that, we may share certain data - primarily gameplay data related to user acquisition and fraud detection - with other companies in the Tripledot Studios group, a list of which is available here. These companies help us to improve our services, support our customers, conduct business analysis, ensure security and detect frauds. The transfer of data may be necessary for you to use our services.

6.1.4. Service providers - we use third parties to help us maintain and provide certain solutions related to our services. These are, for example, providers responsible for operating IT systems, analytics, attribution, accounting service providers, legal service providers, marketing agencies. These entities process the data in accordance with our instructions, only to the extent indicated by us.

6.1.5. Disclosure in corporate transactions - we may disclose or transfer your personal data as part of any merger, acquisition, reorganization, sale of assets, or other corporate transaction involving PuzzlePlay Limited or its affiliates. In such an event, we will ensure that the receiving party is committed to protecting your personal data in a manner consistent with this Privacy Policy and applicable data protection laws. We will notify you of any such changes as required by law.

6.1.6. Supervisory authorities, public authorities and legal process - we may also be obliged to provide certain information to public authorities for the purposes of their investigations, in particular with regard to adverse reaction reports. Additionally, disclosures may be required pursuant to legal process, such as court orders or litigation. In all such cases, information shall only be provided if there is an appropriate legal basis for doing so.

7. CHILDREN'S PRIVACY

7.1. The App, including the rewards program, is intended solely for users aged 18 or over. We apply an age gate at account creation and, before rewards are redeemed, the identity and age verification described in Appendix 1. We do not knowingly collect personal data from anyone under the age of 18 in connection with the App. If we discover such data has been collected, we will promptly delete it. If you believe that we might have collected personal data from or about a child, please contact us at dataprotect@puzzleplay.app.

7.2. The games accessible via the App are distributed and operated separately from the App and may be subject to different (lower) age thresholds under Part 2 of this Privacy Policy. Gameplay data received from game publishers (Section 2.2) is processed only in connection with a registered App account. If we become aware that an App account is held by a person under the age of 18, we will close the account, cancel any pending rewards and delete the associated personal data.

8. YOUR RIGHTS (EU/ UK RESIDENTS)

8.1. You have the following rights: to access your data and to receive a copy of your data, to rectify your data, to request erasure of your data, to request restriction of data processing, the right to data portability.

8.2. You also have the right to object to the processing of your data for marketing purposes if the processing is carried out on the basis of our legitimate interest and, for reasons related to your particular situation, in other cases where the legal basis for the processing is our legitimate interest.

8.3. If we process your personal data on the basis of your consent, you have the right to withdraw it at any time, which does not, however, affect the lawfulness of the processing carried out before the withdrawal. Please note that certain data processing operations may be necessary to provide you with the core functionality of the App (such as the rewards program). If you opt out of data sharing through your device settings or use tools like ad blockers, this may interfere with these functionalities — see our Terms of Service - Loyalty Program for more details.

8.4. In order to exercise the above-mentioned rights, please contact us by email at: dataprotect@puzzleplay.app.

8.5. If you have doubts about the lawfulness of our processing of your personal data, you have the right to lodge a complaint with a supervisory authority. In the United Kingdom, that supervisory authority is the Information Commissioner's Office, which you can contact using the details provided on its website at https://ico.org.uk/make-a-complaint/.

9. U.S. STATE PRIVACY NOTICE

9.1. Residents of certain U.S. states may have specific privacy rights under applicable state laws, including the right to access, delete, correct, or opt out of certain processing of their personal information. These rights may vary depending on the state in which you reside and the applicable legislation in force at the time of your use of the App. We are committed to complying with all applicable state privacy laws. To see a current list of U.S. state privacy laws and their effective dates, please refer to par. 13. As used herein, "State Privacy Law" means one of the applicable laws identified below. If you are a resident of a state that has enacted such a law, you may exercise your rights by following the instructions in Section 9.4 of this Privacy Policy.

9.2. This Privacy Policy is designed to provide you with notice of our personal data processing practices over the 12 months prior to its Effective Date. However, this U.S. State Privacy Notice also applies to our current data practices such that it is also meant to comply with other requirements to provide current practices which under California's law is referred to as "notice at collection".

9.2.1. During the twelve (12) months prior to the Effective Date, we have collected and processed Personal Data as follows:

9.3. The Privacy Rights we will consider are as follows:

9.3.1. Right to Confirm Processing – You have the right to confirm we are processing your personal data, which you can request pursuant to the methods above, and to access your personal data as stated below.

9.3.2. Right to Know (categories) – If you are a California resident, you have the right to request that we share with you certain information about our collection, use, and disclosure of your personal data over the 12-month period prior to the request date, by category of personal data. You can request that we disclose to you: (1) the categories of personal data we collected about you; (2) the categories of sources for the personal data; (3) our business or commercial purpose for collecting or selling that personal data; (4) a list of the categories of personal data disclosed for a business purpose in the prior 12 months and, for each category of personal data, the categories of recipients; and (5) a list of the categories of personal data sold or shared about you in the prior 12 months and, for each, the categories of recipients. Oregon residents have the right to obtain a list of third-parties to which PuzzlePlay Limited has disclosed consumers' personal data.

9.3.3. Right to Delete – Some U.S. Privacy Laws (e.g., California) grant you the right to request that we delete any of your personal data that we have collected directly from you and retained, subject to certain exceptions which we will explain (if they apply), while other U.S. Privacy Laws (e.g., Texas) grant you the right to request that we delete any of your personal data that we have collected directly from you or personal data that we have obtained about you, such as from a source other than you. We will honor your deletion request as required by the laws of the State in which you reside. After we verify your identity, subject to permitted retention exceptions, we will carry out one or more of the following: (i) permanently erase your personal data on our existing systems with the exception of archived or back-up systems, (ii) deidentify your personal data, or (iii) aggregate your personal data with other consumers' information. Where legal exceptions will apply to your request for deletion, we will tell you which one(s) and will limit retention to the permitted purpose(s).

9.3.4. Right to Correct – You have the right to request that we correct inaccuracies that you find in your personal data maintained by us. Your request to correct is subject to our verification (as discussed below) and the response standards under the applicable U.S. Privacy Laws. Right to Data Portability – You have the right to request a transportable copy of the specific pieces of personal data we collected about you. As legally permitted, based on your state of residence, we may apply a limit on the number of "right to know" requests you make over a particular time period.

9.3.5. Right to Opt Out of Sharing or Targeted Advertising – Under the State Privacy Laws, consumers have the right to opt-out of certain processing activities. California and certain other states have opt-outs specific to Targeted Advertising activities, which involve the use of personal data from different businesses or services to target advertisements to you. California's law refers to these activities as "cross-context behavioral advertising" while other state laws refer to these activities simply as Targeted Advertising. California provides consumers the right to opt-out of Sharing, which includes providing or making available personal data to third parties for such Targeted Advertising activities, while other states provide consumers the right to opt-out of processing personal data for Targeted Advertising more broadly. There are broad and differing concepts of the Sale of personal data under the U.S. Privacy Laws, all of which at a minimum require providing or otherwise making available personal data to a third party.

We do not knowingly Sell or Share the personal data of consumers under 16.

9.3.6. Right to Limit Use of Sensitive Personal Data - With regard to personal data that qualifies as Sensitive Personal Data under U.S. Privacy Laws, if you elect to provide us with that Sensitive Personal Data you will have consented to such Processing. However, you can limit certain Sensitive Personal Data processing, and if you do so, we will explain in a response what processing purposes State Privacy Laws do not allow you to limit.

9.3.7. Right to Opt Out of Automated Decisionmaking – We do not engage in automated decision making or profiling, as these terms are defined under State Privacy Laws.

You can exercise these rights by contacting us at: dataprotect@puzzleplay.app. You can also opt out of Sharing or Targeted Advertising from within your phone settings. However if you exercise this opt out, it might result in losing the ability to get rewards.

We may verify your identity before responding to your request by confirming information related to your use of the App, such as your email address, device ID, user ID, or other interaction-related details. You can also designate an authorized agent to make a request on your behalf, subject to appropriate verification procedures. If we cannot verify your identity based on the provided information, we may request additional information necessary for verification.

9.3.8. If we deny your request, you may have the right to appeal our decision. To submit an appeal, please contact us at the same address with the subject line: "Privacy Appeal".

9.3.9. We will not discriminate against you for exercising your privacy rights. Exercising your rights will not result in denial of services, charging different prices, providing different quality of service, or suggesting you will receive a different price or quality of service.

9.3.10. We do not use or disclose sensitive personal data for any other purpose without your explicit consent, unless permitted or required by law.

9.4. Retention. Because there are so many different types of personal data in certain categories, and so many purposes and use cases for different data, we are unable to provide retention ranges based on categories of personal data in a way that would be meaningful and transparent to you. Actual retention periods for all personal data will depend upon how long we have a legitimate purpose for the retention, consistent with the collection purposes and applicable law. For instance, we may maintain business records for as long as relevant to our business and may have a legal obligation to hold personal data for as long as potentially relevant to prospective or actual litigation or government investigation. We apply the same criteria for determining if we have a legitimate purpose for retaining your personal data that you ask us to delete. If you make a deletion request, we will conduct a review of your personal data to confirm if legitimate ongoing retention purposes exist, will limit the retention to such purposes for so long as the purpose continues, and will respond to you with information on any retention purposes on which we rely for not deleting your personal data. By deleting your account, however, any Coins that you have earned and not redeemed will be permanently deleted. Please note that account deletion may occur not only through a formal request but also if you uninstall the App without submitting such a request. In either case, your earned Coins will not be retained. Additionally, if a User does not use the App for at least one hundred eighty days, the User's inactive account may be terminated automatically, Coins earned may expire, and personal data may be deleted in accordance with our retention policy.

9.5. Notice of Financial Incentive. We offer financial incentives to U.S. residents based upon the collection, retention, or sale of their personal data. The incentive is calculated based on a good faith estimate of the value of the personal data, which forms the basis for offering such financial incentives. We offer financial incentive payouts in the form of gift cards. The categories of personal data that are implicated by the financial incentive include: Identifiers, Service Usage Data, and Inferences. Factors we consider when calculating the value of a U.S. resident's include: playtime within a game and revenue generated by us from the consumer's Personal Data. You may enroll in or withdraw from our financial incentive program at any time by following the instructions here. However, if you withdraw from the financial incentive program, you will no longer be eligible to receive reward payouts.

9.6. Do-Not-Track. Your browser settings may allow you to automatically transmit a "Do Not Track" signal to online services you visit. Note, however, there is no consensus among industry participants as to what "Do Not Track" means in this context. PuzzlePlay Limited currently does not alter its practices when PuzzlePlay Limited receives a "Do Not Track" signal from a visitor's browser. To learn more about "Do Not Track," you can visit http://www.allaboutdnt.com, but PuzzlePlay Limited is not responsible for the completeness or accuracy of this third-party information.

9.7. Shine the Light. California's "Shine the Light" law (Civil Code section 1798.83) permits users of our Website who are California residents to request certain information regarding our disclosure of Personal Data to third parties for those third parties' own direct marketing purposes. To make such a request, please send an email to dataprotect@puzzleplay.app. You must put the statement "Shine the Light Request" in the body of your correspondence. In your request, please attest to the fact that you are a California resident and provide a current California address for your response. This right is different than, and in addition to, CCPA rights, and must be requested separately. However, a Do Not Sell/Share opt-out is broader than a Shine the Light request and will limit our disclosure to third parties for their own direct marketing purposes without the need for making a separate Shine the Light request. We will not accept Shine the Light requests by telephone or by fax and are not responsible for requests not labelled or submitted properly, or that are incomplete.

10. INTERNATIONAL TRANSFERS

10.1. Your data may be transferred to countries outside the UK or EU (e.g., the U.S.). Where this occurs, we implement necessary safeguards to protect your personal data in accordance with applicable law. To this end:

10.1.1. we cooperate with data importers in countries for which the European Commission has issued a decision finding an adequate level of data protection;

10.1.2. we use standard contractual clauses issued by the European Commission, together with the UK ICO's published addendum in respect of transfers from the United Kingdom.

10.2. You can request further information about data transfers outside the EEA or United Kingdom and obtain a copy of the protection measures adopted by writing to us at dataprotect@puzzleplay.app.

11. SECURITY OF YOUR INFORMATION

11.1. We employ commercially reasonable security measures designed to protect your personal data and to ensure that access is limited to authorized personnel only, to the extent necessary for performing their duties.

11.2. While we strive to maintain the security of your information, no system can guarantee absolute security. Therefore, PuzzlePlay Limited does not represent or warrant that the services are completely secure.

11.3. We require our subcontractors and partners who process personal data on our behalf to implement appropriate security measures consistent with commercially reasonable standards.

12. CHANGES TO THIS PRIVACY POLICY

12.1. We may update this Privacy Policy from time to time. The latest version will always be posted in the App and/or on our website. We encourage you to periodically review this Privacy Policy for the latest information on our privacy practices. Please note that if we need to adapt the Privacy Policy to legal requirements, the new Privacy Policy will become effective immediately or as required.

13. U.S. STATE COMPREHENSIVE PRIVACY LAW

APPENDIX 1. BIOMETRIC DATA AND FACE VERIFICATION NOTICE

1. Overview

1.1. This Appendix provides detailed information about how PuzzlePlay Limited ("PuzzlePlay", "we", "our", or "us") collects, uses, stores, and protects biometric data—including facial mapping data and 3D facial scans—when you use our identity verification features within the PuzzlePlay App ("App"). This Appendix forms an integral part of the Privacy Policy and prevails over it where it specifically concerns biometric data.

1.2. Depending on applicable law, facial mapping data and 3D facial scans may qualify as biometric identifiers or biometric information, including under the GDPR / UK GDPR (special categories of personal data), the Illinois Biometric Information Privacy Act (BIPA), and other U.S. state biometric privacy laws.

We collect and process biometric data only where permitted by applicable law and, where required, based on your explicit consent.

1.3. Provision of biometric data is voluntary, however, failure to provide such data may prevent you from using features requiring identity verification (such as rewards withdrawal).

2. What Biometric Data We Collect

2.1. When you complete identity verification, we collect the following data through FaceTec software integrated into the App:

2.1.1. 3D facial scans: three-dimensional mathematical representations of your facial geometry.

2.1.2. Facial mapping data ("FaceMaps"): encrypted numerical templates representing unique facial features.

2.1.3. Liveness data: indicators confirming that the scan is performed by a real, live person.

2.1.4. Facial images: still images captured during the verification attempt.

2.1.5. Verification metadata: timestamps, session identifiers, and anti-spoofing parameters.

We do not collect or store raw video recordings unless required for security or legal reasons.

3. Purposes of Processing Biometric Data

3.1. We process biometric data for the following purposes:

3.1.1. Identity verification – confirming that you are the legitimate account holder.

3.1.2. Fraud prevention – detecting bot activity, spoofing attempts, or false identities.

3.1.3. Account security – preventing unauthorized access.

3.1.4. Age-verification compliance – ensuring that users meet minimum age requirements.

3.1.5. Duplicate account prevention – ensuring that the same individual does not create multiple accounts to abuse the rewards program.

3.1.6. Establishing, exercising or defending legal claims, where applicable.

3.2. As part of fraud-prevention measures, the biometric template you provide may be compared with biometric templates from other users collected within a limited retention window. This comparison is automated but does not result in decisions that produce legal or similarly significant effects.

4. Legal Basis (GDPR / UK GDPR)

4.1. If you are located in the EU, EEA or the UK, the legal bases for processing biometric data are:

4.1.1. Explicit consent – Articles 6(1)(a) and 9(2)(a) GDPR / UK GDPR.

4.1.2. Legitimate interests – Article 6(1)(f), limited to fraud prevention, platform integrity and security.

4.1.3. Legal obligations, where required (e.g., age-verification rules).

4.2. You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing already conducted.

5. Storage and Retention

5.1. Biometric data and facial images are stored on secure infrastructure provided by our cloud service providers. We implement encryption in transit and at rest, strict access controls, and robust monitoring and audit mechanisms.

5.2. Retention periods:

Data is deleted when no longer required for verification, security, fraud-prevention, or legal compliance purposes.

Retention periods are based on fraud-prevention needs, security considerations, and minimum-necessary principles required under laws.

6. Sharing and Disclosure

6.1. We do not sell or share biometric data for advertising or marketing purposes.

6.2. We may share biometric data only with:

6.2.1. FaceTec, Inc., strictly as a service provider processing biometric templates within our controlled environment;

6.2.2. IT and security vendors assisting with fraud detection and identity verification;

6.2.3. Corporate affiliates for internal fraud detection, security, or legal compliance;

6.2.4. Authorities or courts, where legally required.

6.3. All processing by third parties is conducted under contractual safeguards and in compliance with applicable law.

7. Your Rights

7.1. Depending on where you live, you may have the following rights in relation to your biometric data:

7.1.1. Access to your biometric data;

7.1.2. Correction of inaccurate information;

7.1.3. Deletion of biometric data, subject to legal exceptions;

7.1.4. Withdrawal of consent (where processing is based on consent);

7.1.5. Restriction of processing or objection (EU/UK residents);

7.1.6. Rights under U.S. state biometric and privacy laws, including rights under BIPA, CCPA/CPRA and comparable state statutes.

7.2. To exercise any of these rights, contact us at dataprotect@puzzleplay.app.

8. Changes to This Notice

8.1. We may update this Notice to reflect legal requirements, changes in technology, or improvements to our verification processes. The updated version will be published within the App or on our website.

Part 2: Privacy Policy for Games

Effective Date: July 16, 2026

PuzzlePlay Limited develops and publishes mobile games for the web and mobile devices. This Privacy Notice (this "Notice") describes the ways PuzzlePlay Limited ("PuzzlePlay," "us", "our" or "we") collects, stores, uses, discloses or otherwise processes personal information of our users ("users" or "you") in connection with their use of our products or services. This Notice covers our product offerings such as our website available at https://www.puzzleplay.app, PuzzlePlay game(s) and PuzzlePlay services, in each case that directly posts or links to this Notice (each a "Service," collectively, the "Services"). Additionally, this Notice describes the rights and choices concerning your information that may apply to you. This Notice covers the following topics:

PuzzlePlay Limited having its registered address at 75 Hampstead Road, First Floor, The Lantern, London, England, NW1 2PL, is the "data controller" responsible for the processing of personal information in connection with our Services. This means that we determine and are responsible for how your personal information is used. If you have questions regarding this Notice or our collection and use of personal information, please contact us as described in the "Contact Us" Section.

1. PERSONAL INFORMATION WE COLLECT AND HOW WE COLLECT IT

When you interact with or use our Services, we may collect personal information about you. Sometimes we collect personal information automatically when you interact with our Services (e.g., information about how you interact with our Services) and sometimes we collect the personal information directly from you when you use our Services (e.g., information you give us when setting up your account or user profile). At times, we may collect personal information about you from other sources and third parties, including other players.

a. Information We Collect From You Directly

Registration Information

We may offer you the option to complete a user profile that is visible to other PuzzlePlay users ("Account"). If you create an Account, you provide us your name, a username, e-mail address, and other information that helps us confirm that it is you accessing your Account. You may also create an Account using third-party identity providers (such as Facebook or Apple Sign-in), in which case we receive a user identifier from that provider but do not collect or store your password. We may do this through in-game dialog boxes, which you may choose to skip. Your Account will be used to publicly identify you as part of social features of the Services, which may include user-to-user interaction, chat or messaging functionality, public leaderboards, head-to-head competition, and other similar features. Your username associated with your Account will be public and will be shown to other users. In addition, your username will allow others to access information on your user profile that is considered public or that you have designated as public in your user profile settings.

Address Book Information

We may also offer you the ability to choose to import your contacts or manually enter e-mail addresses so that you can locate your contacts and invite your contacts to join you in the Services. This information is typically collected through the use of third-party mobile device software development kits. If you choose to import your contacts or manually enter e-mail addresses, we will store those contacts for purposes of helping you and your contacts make connections through our Services. You are responsible for ensuring your sharing of this information with us is compliant with applicable laws. In some jurisdictions, this may require you to get permission from the people you invite before you share their information.

Payment Information

When you order any good or service through the Services, including any virtual currency or virtual good, we collect certain non-financial transaction information related to these purchases, including what you purchased, the price, and the date. Your in-app purchase transactions are processed by third-party payment processors, such as Apple (for purchases on iOS devices), Google (for purchases on Android devices), or Amazon (for purchases on Kindle devices). The third-party payment processors will collect your name, phone number, e-mail address, mailing address, billing address, and complete credit card information to enable them to process your payment. The third-party payment processors may also retain this information to enable you to purchase additional items through our Services without having to re-enter your payment information each time. Please note third-party payment processors do not share your financial information, like credit card numbers, with us. In addition, please note that the third-party payment processors' collection and use of your personal information is governed by their terms of service and privacy policy, and purchases through these third parties may also be subject to additional policies. We encourage you to review the terms of service and privacy policies of those third parties to learn more about how they handle your personal information.

Information Collected by or Provided to Customer Support

When you ask for assistance from our Customer Support team, we will collect and store the contact information you provide (generally your name and e-mail address), information about your game-play or activity on the Services, and your username or ID number. We will also store the correspondence and information within the correspondence that you choose to share with us.

Communication Preferences

We collect information about your interests and communication preferences that you choose to provide, such as when subscribing to news or alerts.

Surveys, User Research Projects, Competitions and Promotional Events

If you choose to participate in, or fill out any forms relating to, PuzzlePlay surveys, user research projects, competitions (contests/sweepstakes), promotional events, or similar activities, we will collect your contact information (such as your name, email, and phone number, address, and postal code) to enable you to participate in the activity and to allow us to communicate with you, as well as any other information that we request that you provide for purposes of the activities, including audio or video recordings, photos, and/or screen captures. In connection with PuzzlePlay surveys and user research projects, we also collect your opinions, responses to certain research questions, prompts, or surveys, and other personal information, consistent with the purposes of the PuzzlePlay survey or user research project.

On occasion, we collect your shipping and billing information to send you certain rewards or incentives, such as if you are a participant in a PuzzlePlay survey or user research project, a competition winner, or if you purchase our products or services. In addition, if you are a part of our event or promotion partner, we also collect your personal information including your name, company email, and company address.

Please note that your participation in any PuzzlePlay surveys, user research projects, competitions (contests/sweepstakes), promotional events, or similar activities, is completely voluntary.

b. Information We Collect Automatically

Technical and Usage Information

When you access our Services, we use cookies and other similar technologies to collect (i) certain technical information about your mobile device or computer system, including IP Address, mobile device ID (IDFA, Google Advertising ID or other identifiers), and the version of your operating system; and (ii) usage statistics about your interactions with the Services, including the links, objects, products and benefits you view, click, or otherwise interact with (also known as "Clickstream Data"). Our emails also contain tracking pixels that identify if and when you have opened an email that we have sent you, how many times you have read it and whether you have clicked on any links in that email. In connection with your use of certain Services, we will create and assign to your device an identifier that is similar to an account number. In addition, in certain circumstances, we collect the name you have associated with your device, device type, telephone number, country, and any other information you choose to provide, such as username, character name, or e-mail address. We also infer your approximate geographic location based on your IP address. For more information, see the "Online Advertising" section below.

Social Media Information

If you sign into the Services with Facebook Connect, we will collect information that is visible via your Facebook account such as: (1) your first and last name, (2) Facebook ID, (3) Profile Picture/URL, and (4) list of Facebook friends.

c. Information We Collect From Other Sources

We collect or receive information from the following other sources (i) other Service users who choose to upload their email contacts; (ii) third party information providers, such as digital advertising companies; and (iii) social networking sites. We combine this information with the information we collect from an individual directly.

d. Sensitive or Special Categories of Information

We typically do not request or seek to elicit sensitive or special categories of information (other than account access credentials), but you may choose to provide this information to us in connection with certain of the interactions described above, including when you ask for assistance from our Customer Support team. The meaning of sensitive or special categories of information varies by jurisdiction and it could include, for example, health, genetic or biometric data, or account access credentials such as account log-in details in combination with any required security or access code, password, or credentials allowing access to your account.

e. Information You Choose to Share on the Services

A number of our Services provide features including chat rooms, messaging services, and community and event forums for collaboration, peer connection, games, and information exchange purposes. Any personal information that you voluntarily choose to display on any publicly available portion of our Services, such as when you publish content, comments, or profile information, becomes publicly available and may be collected and used by others.

2. HOW WE USE YOUR INFORMATION

We use information collected through our Services for purposes described in this Notice or disclosed to you in connection with our Services. For example, we use your information for:

Service Delivery, in order to perform a contract with you and in our legitimate interests to provide a high quality of Services to you

Create your Service accounts and allow access to our Services;

Identify and suggest connections with other PuzzlePlay users;

Operate our Services;

Improve our Services;

Understand you and your preferences to enhance your experience and enjoyment using our Services;

Respond to your comments and questions and provide customer service;

Provide and deliver products and services you request;

Send you related information, including confirmations, invoices, technical notices, updates, security alerts, and support and administrative messages;

Conduct and administer surveys, user research projects, competitions and promotional events that you participate in;

Prevent fraud or potentially illegal activities, and enforce our Terms of Use;

Enable you to communicate with other users; and

Fulfill any other purpose for which you provide personal information.

Marketing and Advertising, in our legitimate interests to operate a successful business

Deliver and target advertising and marketing and promotional information to you; and

Communicate with you (including via email and push notifications) about promotions, contests, rewards, upcoming events, and other news about products and services offered by us and our selected partners.

Research and Development, in our legitimate interests to operate a successful business

Create aggregate or anonymous information derived from the personal information we handle, which we may use and disclose for research, development and other lawful business purposes;

Link or combine personal information with other information we get from third parties to help understand your preferences and provide you better services; and

Analyze information to choose to provide to us in connection with PuzzlePlay surveys and user research projects to gain insights into how users engage with our Services, to improve our Services, to consider developing new products or services, and other lawful purposes.

Compliance and Protection, in our legitimate interests to operate a successful business and ensure the safety and integrity of the Services

Comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government authorities;

Protect our, your or others' rights, privacy, safety, or property (including by investigating, bringing, making, or defending legal claims);

Audit our internal processes for compliance with legal and contractual requirements or our internal policies;

Enforce the terms and conditions that govern the Services; and

Prevent, identify, investigate, and deter fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks and identity theft.

Email or Push Notifications, in our legitimate interests to operate a successful business and with your consent where required by applicable laws

We may occasionally send you email or push notifications through our Service to send you game updates, high scores and other service-related notifications that may be of importance to you, as well as to send marketing communications. You may at any time opt-out from receiving these types of communications by clicking on the "unsubscribe" link (or a similar link) at the bottom of our marketing emails or by turning them off at the device level through your settings.

Finally, we may deidentify or anonymize your information such that it cannot reasonably be used to infer information about you or otherwise be linked to you ("deidentified information") (or we may collect information that has already been deidentified/anonymized), and we may use such deidentified information for any purpose. To the extent we possess or process any deidentified information, we will maintain and use such information in deidentified/anonymized form and not attempt to re-identify the information, except solely for the purpose of determining whether our deidentification/anonymization process satisfies legal requirements.

3. DISCLOSURE OF YOUR INFORMATION

We disclose personal information (including information that may be considered "sensitive" under applicable law), as indicated below we collect to the following third parties for the specified purposes:

Service Providers

We disclose your information to service providers that perform services on our behalf or enhance our Services, including platform providers, hosting services, customer support services, analytics services, and marketing partners.

Identifiers, such as name, username, email address and other contact information, IP address, and online identifiers (like advertising IDs and cookies)

Commercial Information, such as purchase history, in-app purchases, or other purchasing or consuming histories or tendencies

Internet or Network Information, such as information regarding interactions with a website, application, or advertisement

Location Data, such as city or county-level location information

Account access credentials such as account log-in details in combination with any required security or access code, password, or credentials allowing access to your account (which may be considered "sensitive" under applicable law)

Inferences, such as the derivation of information, data, or assumptions from the categories of personal information included above

Affiliates

We disclose your information to our parent company(ies), affiliates, or subsidiaries.

Identifiers, such as name, username, email address and other contact information, IP address, and online identifiers (like advertising IDs and cookies)

Additional California Customer Records, such as address book information

Commercial Information, such as purchase history, in-app purchases, or other purchasing or consuming histories or tendencies

Internet or Network Information, such as information regarding interactions with a website, application, or advertisement

Geolocation Data, such as city or county-level geolocation information

Inferences, such as the derivation of information, data, or assumptions from the categories of personal information included above

Payment Processors

We disclose your information to third-party payment processors that process payments you make in our Services.

Identifiers, such as name, username, email address and other contact information, IP address, and online identifiers (like advertising IDs and cookies)

Commercial Information, such as purchase history, in-app purchases, or other purchasing or consuming histories or tendencies

Your Specified Recipients

We disclose your information to individuals or other third parties or publicly with your consent or at your direction.

Identifiers, such as name, username, email address and other contact information, IP address, and online identifiers (like advertising IDs and cookies)

Additional California Customer Records, such as address book information

Commercial Information, such as purchase history, in-app purchases, or other purchasing or consuming histories or tendencies

Internet or Network Information, such as information regarding interactions with a website, application, or advertisement

Geolocation Data, such as city or county-level geolocation information

Advertising Partners

We disclose your information to advertisers, ad exchanges and other ad technology companies that require the data to select and serve relevant advertisements to you and others, and assist us in our marketing efforts, including as described in the Online Advertising section below.

Identifiers, such as name, username, email address and other contact information, IP address, and online identifiers (like advertising IDs and cookies)

Commercial Information, such as purchase history, in-app purchases, or other purchasing or consuming histories or tendencies

Internet or Network Information, such as information regarding interactions with a website, application, or advertisement

Geolocation Data, such as city or county-level geolocation information

Inferences, such as the derivation of information, data, or assumptions from the categories of personal information included above

Government Entities/Law Enforcement

We disclose your information to law enforcement and public authorities, as we believe in good faith to be necessary or appropriate for the compliance and protection purposes described above.

Identifiers, such as name, username, email address and other contact information, IP address, and online identifiers (like advertising IDs and cookies)

Internet or Network Information, such as information regarding interactions with a website, application, or advertisement

Geolocation Data, such as city or county-level geolocation information

We also disclose your information to professional advisors, such as lawyers, auditors, bankers, and insurers, where necessary in the course of the professional services that they render to us. In addition, in the event of a merger, acquisition, reorganization, bankruptcy, or other similar event, we may disclose your information (or it may be transferred) to our business transferees, successors, or assigns.

Because the specific information that we disclose and our reasons for doing so vary depending on the circumstances, how long the information may be retained can also vary. As explained below, we and our affiliates, subsidiaries, agents, contractors, and service providers generally retain information for as long as we reasonably need it for the purposes described in this policy (like complying with our legal obligations, managing internal records, enforcing our terms, and resolving disputes), unless applicable law requires or permits a longer retention period.

4. ONLINE ADVERTISING

Interest-Based Advertising

To the extent we display advertising in our Services, with your consent as may be required by applicable law, we disclose or we allow online advertising networks, social media companies, and other third-party services to collect information about your use of our Services over time to enable them to play or display ads on our Services, on other devices you may use, and on other websites, apps, or services. Typically, though not always, the information we disclose is provided through cookies, software integrations, or similar tracking technologies, which recognize the device you are using. We and our third-party partners use this information to try to make the advertisements you see online more relevant and tailored to your interests, as well as to provide advertising-related services such as reporting, attribution, analytics, and market research. Such information includes the following:

Device make, model and operating system;

Device properties related to screen size & orientation, audio volume and battery;

Carrier;

Operating system;

Name and properties of mobile application through which the user interacts with the Services;

Country, time zone and locale settings (country and preferred language);

Network connection type and speed;

IP Address;

Keywords;

City- and/or country-level location data;

Internet browser user-agent used to access the Services; and

Advertising ID (IDFA on iOS devices and GAID on Android devices).

The privacy policies of our partners may include additional terms and disclosures regarding their data collection and use practices. We encourage you to review those privacy policies to learn more about their data collection and use practices.

Social Media Widgets/Plugins

Our Service includes social media features, such as the Facebook button, Google, Instagram, Twitter, or other widgets or plugins. These social media companies may recognize you and will collect information about your visit to our Services, and they will set a cookie or employ other tracking technologies. These companies have interest-based advertising programs that allow us to direct advertisements to users who have shown interest in our Services while those users are on the social media platform or to groups of other users who share similar traits, such as likely commercial interests and demographics. Your interactions with those features are governed by the privacy notices of those companies.

Cross-Device Linking

We, or our third-party partners, will link your various devices so that content you see on one device can result in relevant advertising on another device. We do this by collecting information about each device you use when you are logged in to our Service. We also work with third parties who employ tracking technologies or the application of statistical modeling tools to determine if two or more devices are linked to a single user or household. We disclose a common account identifier (such as an email address or user ID) to third-party advertising partners to help recognize you across devices. We, and our partners, can use this cross-device linkage to serve interest-based advertising and other personalized content to you across your devices, to perform analytics, and to measure the performance of our advertising campaigns.

Opting Out of Interest-Based Advertising

As described below, under certain conditions, you have the right to object and/or restrict the processing or handling of your personal information under applicable law.

Opt Out through Device-Level Choices. You may limit data collection by third parties by visiting your mobile device settings and adjusting the device's ad tracking settings (such as turning off the feature to "Allow Apps to Request to Track") or by exercising other privacy options in your device's settings.

Opt Out through Industry Consumer-Choice Platforms. You may also visit www.aboutads.info/choices or www.youronlinechoices.eu (for individuals in the EU) to learn more about interest-based advertising and how to opt out of this form of advertising on your web browser by companies participating in the Digital Advertising Alliance ("DAA") self-regulatory program. If you wish to opt out of interest-based advertising in mobile apps on your device by companies that participate in the DAA's AppChoices app, you may download that app onto your device and exercise your choice. AppChoices is available at the links below:

• DAA AppChoices iOS

• DAA AppChoices Android

• DAA AppChoices Amazon

Please note that electing to opt out will not stop advertising from appearing in your browser or applications or reduce the number of ads that you receive. You will still receive ads, but those ads may be less relevant to your interests. In addition, if you use a different browser or erase cookies from your browser, or use a different mobile device, you will need to apply your opt-out choices to that particular browser or device.

Please note that the third-party opt-out tools described in this section are provided by third parties, not by us. We do not control and are not responsible for the effectiveness of, or compliance with, any third-parties' opt-out options or programs or the accuracy of their statements regarding their programs. In addition, third parties will still use cookies to collect information about your use of our online services, including for analytics and fraud prevention as well as any other purpose permitted under the DAA's Principles.

Opt Out through Ads. You may also be given the option to opt out of interest-based advertising through an icon available on the face of an ad served to you.

If you have any questions about these opt outs or rights you may have under applicable law, you can contact us at dataprotect@puzzleplay.app or by writing to us at the physical address in the "Contact Us" section.

Do Not Track

Some Internet browsers may be configured to send "Do Not Track" signals to the online services that you visit. We currently do not respond to "Do Not Track" signals. To find out more about "Do Not Track," please visit http://www.allaboutdnt.com.

Managing Cookies

As described in this Notice, we use cookies to inform, optimize, and display ads based on your past visits to the Service and to tailor our advertisements and content to you.

Google Analytics and Advertising. We utilize certain forms of display advertising and other advanced features through Google Analytics, including, but not limited to, Remarketing with Google Analytics, the DoubleClick Campaign Manager Integration, Google Ads, and Google Analytics Demographics and Interest Reporting. These features enable us to use first-party cookies (such as the Google Analytics cookie) and third-party cookies (such as the DoubleClick advertising cookie) or other third-party cookies together to inform, optimize, and display ads based on your past visits to the Service and to tailor our advertisements and content to you. You may control your advertising preferences or opt-out of certain Google advertising products by visiting the Google Ads Preferences Manager, currently available at https://google.com/ads/preferences. To learn how you can opt-out of data collection by Google Analytics, visit https://tools.google.com/dlpage/gaoptout.

You can also review other options to manage cookies by:

Opening the "Help" menu on the browser menu bar. Most browsers will tell you how you can disable or delete cookies.

Visiting your mobile device developer's website or reviewing your device manual. Most mobile device developers will tell you how you can manage the settings on your mobile device to opt out of and/or delete cookies from your mobile device, or to limit the use of your advertising ID, reset your advertising ID, and/or opt out of targeted advertising.

Visiting https://optout.networkadvertising.org and/or http://youronlinechoices.com, or if you are in the EU http://www.youronlinechoices.eu/, for choices to opt out of advertising. You can also click on the AdChoices logo within an advertisement (where available).

If you reject all cookies, you may not be able to use certain features of our websites and other products and services.

5. SECURITY OF YOUR INFORMATION

We implement reasonable technical and organizational measures designed to protect the security of your personal information against accidental or unlawful destruction, loss, change or damage.

However, no security system is impenetrable, and we cannot guarantee the security of your personal information. Any transmission is at your own risk.

6. DATA RETENTION

We store data on servers in the U.S. or any other country in which the PuzzlePlay or its affiliates, subsidiaries, agents or contractors or service providers maintain facilities. We retain your personal information for as long as needed to provide you Services, unless we are required by law to delete or if we accept your request to delete the information pursuant to applicable law. We will also retain and use your personal information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. When determining the length of time to retain your information, we consider various criteria, including whether we need the information to continue to provide you the Services, resolve a dispute, enforce our contractual agreements, prevent harm, promote safety, security and integrity, or protect ourselves, including our rights, property or products.

When we no longer require your personal information, we will look to delete, destroy, or anonymize it pursuant to our typical procedures. If this is not possible (for example, because your personal information has been stored in backup archives), then we will apply security measures to your personal information and isolate it from any further processing until deletion or destruction can occur pursuant to our typical procedures. If we anonymize your personal information (so that it can no longer be associated with you), we can use this information indefinitely without further notice to you.

Part 2 — 7. CHILDREN'S PRIVACY

The Services are not intended for use by children under the age of 16. We do not knowingly collect personal information from children through the Services or knowingly allow them to use our Services. If you believe that we might have collected personal information from or about a child, please contact us at dataprotect@puzzleplay.app.

8. THIRD-PARTY WEBSITES AND SERVICES

The Services may contain integrations or links to third-party websites or services, including those of our business partners. By interacting with these third parties, you are providing information directly to the third party. Please note that the PuzzlePlay is not responsible for the privacy practices of these third parties or any entity that it does not own or control. We encourage you to review the privacy policies and online terms of those third parties to learn more about how they handle your personal information.

9. TRANSFER OF PERSONAL INFORMATION OUTSIDE YOUR COUNTRY

We transfer information that we collect about you (detailed in Section 1) to other countries or jurisdictions where we or our service providers and vendors operate for our legitimate business purpose, including our cloud storage provider located in the United States, our advertising partners and other recipients of your personal data as listed above in "Disclosure of Your Information". The data protection laws and rules in these countries may be different from those in the country where you live. In these cases, we will provide appropriate safeguards to protect your personal data. This may include applying the standard contractual clauses approved by the European Commission for transfers of personal data or other safeguards recognized by applicable laws and regulations. If you are a resident in the European Economic Area, United Kingdom or Switzerland, please refer to "Privacy Rights for Certain Non-U.S. Users" below for more information.

If you have any questions regarding potential transfers of personal information outside of the country where you live or would like to exercise your data rights in relation to such transfers, please contact us at dataprotect@puzzleplay.app or write to us at the address set forth in the "Contact Us" section.

10. MANAGING YOUR INFORMATION

Subject to certain exemptions, you can manage information we receive about you as described below. If you are a resident of a country outside of the U.S. that has enacted a comprehensive consumer privacy law, you may have additional rights as explained in the "Privacy Rights for Certain Non-U.S. Users." If you are a resident of a U.S. state that has enacted a comprehensive consumer privacy law, you may have additional rights as explained in the "Privacy Rights for Certain U.S. Users."

Information-Related Requests — If you wish to review, change, or correct the information we have about you, or to withdraw your consent to the processing of your personal information, you may send an e-mail to dataprotect@puzzleplay.app making this request. If you have an account with us, you may be able to withdraw your consent to certain processing activities by adjusting your preferences in your account settings.

Deleting Your Account — If you have an account with us and would like us to delete your information, you may send an e-mail to dataprotect@puzzleplay.app. Please note that, if you proceed with the deletion of your account, you will no longer have access to the game account or services associated with your account. Other steps you should take should you wish to delete your account include disassociating your Facebook account from our mobile games, if applicable, and deleting the game from your mobile device. Please note that if you ask us to delete your account, all your progress in the game and any unused virtual items will be lost and we may not be able to restore them in the future. Please note that your information, for example records pertaining to payments or customer service matters, may be retained for legal and accounting purposes. If you have sent or posted content on the Service, we may not be able to delete it.

We will need to verify your identity before processing your request. In order to verify your identity, we will generally require the matching of sufficient information you provide us to the information we maintain about you in our systems. In certain circumstances, we may decline a request to exercise the rights described above, particularly where we are unable to verify your identity or locate your information in our systems. If we are unable to comply with all or a portion of your request, we will explain the reasons for declining to comply with the request.

Acting through an Authorized Agent or Representative — In certain circumstances, subject to applicable law, you may be permitted to use an authorized agent to submit requests on your behalf where (i) you provide sufficient evidence to show that the requestor is an authorized agent with written permission to act on your behalf and (ii) you successfully verify your own identity with us.

Response Time — In accordance with applicable law, we aim to respond to a consumer request as soon as possible after receiving that request and any necessary verification and in any event within statutory time limits. If we require more time, we will inform you of the reason and extension period in writing.

11. PRIVACY RIGHTS FOR CERTAIN NON-U.S. USERS

These additional provisions apply to individual residents of those countries outside of the United States that have enacted comprehensive consumer privacy laws, including the European Union General Data Protection Regulation, the United Kingdom Data Protection Act, and each of their associated regulations, as well as amendments to those laws or additional consumer privacy laws that have been enacted or may be enacted in the future.

This section addresses the specific disclosure requirements under those laws and provides additional information about how we collect, use, share, and otherwise process personal information, the rights of covered consumers in relation to that personal information, and the ways to exercise those rights.

Your Privacy Rights

Depending upon applicable law, you, your legal representative, and/or your next of kin have certain legal rights in connection with your personal information that we hold. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law. Subject to certain exemptions, you have the right to:

Access and Correct Your Personal Information. At any time, you may request to access the personal data that we hold about you. We may need to ask you to provide certain information to make sure you are who you claim to be. If you find the information on your account is not accurate, complete, or updated, then please provide us with the necessary information to correct it.

Erase or Restrict Access to Your Information. You may request to delete or restrict access to your personal data under certain conditions. To the extent permitted by applicable law, we may postpone or deny your request if your personal data is in current use for providing Services or for other legitimate purposes, in which case we will let you know if we are unable to do so and why.

Transfer Your Personal Data (Otherwise Known as Your Right to Data Portability). You have the right to receive your personal data that you have provided us in a structured, commonly used and machine-readable format and the right to transmit that data to another party of your choice, where technically feasible. However, this right shall not apply where it would adversely affect the rights and freedoms of others.

Right to Object and/or Restrict Processing of Your Personal Data. Under certain conditions, you have the right to object to our processing of your personal data as outlined in Sections 2, 3, and 4, above.

Right Not to be Subject to Automated Decision-Making. You have the right not to be subject to automated decision-making, except under certain conditions.

Withdrawing Your Consent. Contact us if you would like to withdraw your consent to the processing of your personal data based on that consent. Exercising this right will not affect the lawfulness of processing based on consent before withdrawal.

Right to Make a Complaint. In accordance with applicable law, you have the right to lodge a complaint with us or with an appropriate data protection regulator in the country where you live or work. The Global Privacy Assembly provides a publicly-available list of privacy authorities, which you can access here. If you have a complaint about how we process your personal data, we encourage you to contact us at dataprotect@puzzleplay.app and we will endeavor to address your request.

How to Exercise Your Privacy Rights

If you wish to exercise any of these rights or any other rights that you may have under applicable law, please contact us at dataprotect@puzzleplay.app or write to us at the address set forth in the "Contact Us" section.

We will need to verify your identity before processing your request. In order to verify your identity, we will generally require the matching of sufficient information you provide us to the information we maintain about you in our systems. In certain circumstances, you may also appoint an authorized agent to exercise any rights that you may have on your behalf using the methods described in this Notice. If you choose to exercise any rights through an authorized agent, you will need to verify your identity directly with us before we can process any requests. In addition, we will need written documentation demonstrating the authorized agent's authority to act on your behalf.

If you make a request, we will typically look to respond within one month, although a longer period may be permitted. In certain circumstances, we may decline a request, particularly where we are unable to verify your identity. If we are unable to comply with all or a portion of your request, we will explain the reasons for declining to comply with the request.

Marketing and Advertising

From time to time, we may contact you with information about our services, including sending you marketing messages and asking for your feedback on our services. Most marketing messages we send will be by email or push notifications. For some marketing messages, we may use personal information we collect about you to help us determine the most relevant marketing information to share with you.

Where we rely on consent to send you marketing communications, we will only send you such messages if you have given us your consent to do so. You can withdraw your consent at a later date by clicking on the "unsubscribe" link at the bottom of our marketing emails or by updating your preferences in the settings page of the App or Service.

Data Transfers and Processing Outside Europe

If you are located in the EEA, the UK, or Switzerland, your personal information may be processed outside of those regions, including in the United States. In the event of such a transfer, we typically try to ensure a degree of protection similar to that applied in your home country is afforded to it by employing one of the following mechanisms:

Transfers to territories with an adequacy decision. We may transfer your personal information to countries or territories whose laws have been deemed to provide an adequate level of protection for personal information by the relevant authorities (e.g., by the European Commission, UK Government, and/or Swiss Federal Council).

Transfers to territories without an adequacy decision.

We may transfer your personal information to countries or territories whose laws have not been deemed to provide an adequate level of protection for personal information by those relevant authorities (e.g., the United States).

However, in these cases, we may look to use specific appropriate safeguards approved by the relevant authorities, for example, standard-form contracts approved by relevant authorities for this purpose (such as the European Commission's standard contractual clauses or the UK Information Commissioner's international data transfer addendum to the EU standard contractual clauses).

In limited circumstances, we may rely on an exception, or 'derogation', which permits us to transfer your personal information to recipients in such countries despite the absence of an 'adequacy decision' or 'appropriate safeguards' – for example, reliance on your explicit consent to that transfer.

If you want further information on or a copy of the specific mechanism(s) used by us when transferring your personal information, please contact us at dataprotect@puzzleplay.app or write to us at the address set forth in the "Contact Us" section.

12. PRIVACY RIGHTS FOR CERTAIN U.S. USERS

This section applies to individual residents of any U.S. states that have enacted comprehensive consumer privacy laws. It addresses the specific rights that covered consumers have under such laws (in addition to the rights described elsewhere in this Notice) and the ways to exercise those rights.

Your Privacy Rights. Depending on the state you live in, to the extent permitted under applicable law, you may be able to exercise one or more of the following rights in relation to the personal information that we have collected about you, subject to certain limitations and requirements, including the verification of your identity and our right to retain information to comply with our legal obligations, among other circumstances. You may also have the right to exercise these rights on behalf of your minor child.

Know and Access your Personal Information

You may request access to your personal information and to obtain details about how we use and disclose your information, including (if applicable, depending on your location): the categories and specific pieces of personal information that we have collected about you; the categories of sources from which your personal information has been collected; the business or commercial purpose for collecting your personal information, selling it, or sharing it for targeted advertising purposes; the categories of personal information that we disclosed for a business purpose; any categories of personal information about you that we sold or shared for targeted advertising purposes; and the categories of third-parties (or where required by law, a list of specific third-parties) to whom we have disclosed your personal information, among other information required by applicable laws.

Request Deletion of your Personal Information

You have the right to request that we delete certain personal information that we may have collected from you.

Opt-Out of the "Sale" of your Personal Information and Targeted Advertising*

We do not sell your personal information in exchange for money or any other form of payment. However, we may disclose personal information about you for purposes of serving you with personalized ads or content, otherwise known as "interest-based advertising," "targeted advertising," or "cross-context behavioral advertising," and such disclosure may be considered a "sale" under applicable laws. You have the right to direct us not to sell your personal information, or share or process your personal information for targeted advertising purposes.

Non-Discrimination

You have the right to exercise the rights conferred on you by applicable laws without discrimination.

Data Portability

You have the right to request that we transmit certain personal information that we may have collected from you (or about you) to other entities, unless transmitting the information would not be technically feasible.

Correct Inaccurate Information

You have the right to request that we correct errors or inaccurate information in the personal information that we may have collected from you.

Limit the Use or Disclosure of Sensitive Personal Information

In certain circumstances, you have the right to limit the use of any sensitive categories of personal information. As noted above, we do not collect or seek to elicit sensitive categories of personal information other than account access credentials, which we only use as permitted by applicable law.

Opt-Out of the Use of Automated Decision Making

In certain circumstances, you have the right to opt-out of the use of automated decision making and/or profiling in furtherance of decisions that produce legal or similarly significant effects in relation to your personal information. We do not currently use personal information for profiling that results in legal or similarly significant effects.

*Right to Opt Out of the "Sale" of Your Personal Information and Targeted Advertising

We do not "sell" information about our users as most people would commonly understand that term or in the way that certain laws primarily define the term "sale." We do not disclose your personal information in direct exchange for money or some other form of payment.

However, consistent with common practice among companies that operate online, we do allow certain third-party advertising networks and other third-party businesses to collect and disclose your personal information directly from your browser or device through cookies or tracking technologies when you visit or interact with our websites, use our apps, or otherwise engage with us, and such disclosure may be considered a "sale" under applicable laws. These third parties use your personal information for purposes of analyzing and optimizing our Service and advertisements on our websites, on other websites or mobile apps, or on other devices you may use, to personalize content or to serve ads that may be more relevant to your interests, and to perform other advertising-related services such as reporting, attribution, analytics, and market research.

To learn more about how third parties collect information automatically through our Services and the choices you may have in relation to those activities, please see our Online Advertising section, above.

How to Exercise Your Rights

If you wish to exercise any of these rights or any other rights that you may have under applicable law, please contact us at dataprotect@puzzleplay.app or write to us at the address set forth in the "Contact Us" section.

As described above, we will need to verify your identity before processing certain requests. In order to verify your identity, we will generally require the matching of sufficient information you provide us to the information we maintain about you in our systems, such as your email address. In certain circumstances, you may also appoint an authorized agent to exercise any rights that you may have on your behalf using the methods described in this Notice. If you choose to exercise any rights through an authorized agent, you may need to verify your identity directly with us before we can process any requests. In addition, we may require written documentation demonstrating the authorized agent's authority to act on your behalf.

We aim to respond to a consumer request within 45 days of receiving that request. If we require more time, we will inform you of the reason and extension period in writing. In certain circumstances, we may decline a request, particularly where we are unable to verify your identity or locate your information in our systems. If we are unable to comply with all or a portion of your request, we will explain the reasons for declining to comply with the request.

In addition, you may have the right to appeal our decision regarding a request related to these rights by contacting us at dataprotect@puzzleplay.app or writing to us at the address set forth in the "Contact Us" section. When you submit a request or launch an appeal, we will limit our collection of your information to only what is necessary to securely fulfil your request or process your appeal. We will not require you or your authorized agent to pay a fee for the verification of your request or appeal.

Additional Information for California Residents

This section only applies to California residents. Sections 1, 2, and 3 of this Notice summarize the categories of personal information we collect, the sources of personal information collection, the business purposes for our collection, and the categories of third parties with whom we "disclose for a business purpose," "sell," or "share" (as such terms are defined under California law) personal information. These sections describe our practices both current and during the last 12 months. The "Data Retention" section above describes the criteria we use to determine how long to retain your personal information.

Information you voluntarily provide to us, such as in free-form webforms, may contain other categories of personal information not described below.

We sell and/or share certain categories of personal information and, in the preceding 12 months, we have sold and/or shared the following categories of personal information about individuals with advertising partners for interest-based advertising:

Identifiers — Sold and Shared — Advertising partners shared for interest based advertising

Commercial Information — Sold and Shared — Advertising partners shared for interest-based advertising

Internet or Network Information — Sold and Shared — Advertising partners shared for interest-based advertising

Geolocation Data — Sold and Shared — Advertising partners shared for interest-based advertising

Inferences — Sold and Shared — Advertising partners shared for interest-based advertising

We do not have actual knowledge that we sell and/or share personal information of individuals under 16 years of age.

13. CHANGES TO THIS NOTICE

We may update this Notice to reflect changes to our data privacy practices. If we make any material changes, we will notify you by reasonable means (such as posting a notice on the Services) prior to the change becoming effective and will take additional steps as required by law, including obtaining your consent where required. We encourage you to periodically review this Notice for the latest information on our privacy practices.

14. CONTACT US

Our Data Protection Team

You may contact us or our Data Protection Team at dataprotect@puzzleplay.app or at the address below for further information.

75 Hampstead Road, First Floor, The Lantern, London, England, NW1 2PL

EU Privacy Representatives

We have appointed the following entity as our privacy representatives in the EU. You can contact us through our privacy representative at the following addresses:

EU privacy representative for PuzzlePlay Limited is:

TRIPLEDOT POLAND Warsaw, Ul. Towarowa, Towarowa 28, 00-839, email: privacy@tripledotstudios.com

If you are in the EU or the UK and want to exercise your privacy rights, you may submit your request either through dataprotect@puzzleplay.app.