PRIVACY POLICY FOR GAMES

We automatically collect certain information from your computing device, including:

• Outfit7's randomly generated unique user ID ("UID") which is unique per device;
• IP address;
• Coarse (approximate) location (as derived from an IP address);
• Advertising identifiers (IDFA, AAID);
• Third-party generated unique ID (eg. same app key for iOS, Firebase ID, Singular ID);
• Language; Locale (specific location where a given language is spoken);
• Timezone, session start/stop time;
• Network status (Wi-Fi, etc.), browser plug-in types and versions;
• User agent string (UA), platform, SDK version, timestamp;
• All Outfit7 apps installed;
• Technical device information (for example, device model and name, operating system name and version, CPU information, storage size, screen size, firmware, software, mobile phone carrier, Internet service provider, API key identifier for application, Android ID, Android Serial No., dark mode, low-power mode, volume, font size);
• Push notifications token (in order for us to be able to determine whether you are subscribed to push notifications);
• Player identifier string (we collect player identifier string only if you sign into Google Play Games Services or Apple's Game Center).

In addition to the above we also collect information, including log information, that lets us know:

• How you play our Games (how often you play the Games, for how long you play the Games, the events that occur within the Games, in-app progress, in-app purchases you make and their value, aggregated usage, performance data, life-time value of user etc.);
• How you interact with ads in our Games (which advertisements are shown to you, how long an ad is visible to you, the size of the ad and the angle of view, and your interaction with ads, including impressions, views and clicks);
• How you interact with our ads in other publisher's apps, including impressions, views, clicks, and installs of our Games.

• Cloud service providers: We store information we collect from you on servers provided by our third-party cloud service providers, such as Google Cloud Platform, Google's Android Backup Service, and Firebase Cloud Messaging - read more about their privacy practices at https://policies.google.com/privacy;
• Built-in customer support tool: In some of our Games we offer an in-app customer support tool. The tool provides answers to frequently asked questions, and also enables you to contact us within the Game. The in-app customer support tool is provided by Zendesk, for the data processing by them, please see Zendesk's privacy policy available at https://www.zendesk.com/company/agreements-and-terms/privacy-policy/. In some territories and some of our Games, some chat logs may be shared with our AI chatbot provider, OpenAI, to provide you with answers and to improve our internal database of frequently asked questions;
• Video hosting provider: In some of our Games we use a video hosting provider, JW Player, that assists us in delivering video content to you. You can read more about their data processing practices in their privacy policy available athttps://www.jwplayer.com/privacy/;
• Other service providers: We use Unity Software to develop some Games. For the data processing by Unity please see Unity's privacy policy available athttps://unity3d.com/legal/privacy-policy.

We use third-party analytics (Google's BigQuery and Google Analytics for Firebase) for the purposes of delivering our services, conducting analysis and research. To get more information about how your data is being collected and processed you can visit the site "How Google uses data when you use our partners' sites or apps" located atwww.google.com/policies/privacy/partners/.

Contextual ads

When you use our Games, we may display contextual advertisements to you. Contextual advertisements are ads that are relevant to the content of the app or website you are currently on. In order to enable advertising, we allow advertising providers to collect online identifiers that might be considered personal information under some legislations, but they should use it solely for the purposes of contextual advertising. For any other purposes they should use the information solely on an anonymized and aggregated basis.

Interest-based ads

Interest-based ads are ads that are relevant to an individual's habits, personal interest, app and device usage, and online behaviour across apps and websites. For some territories, we may share some information with advertising providers that we collect from you automatically (read more about the collection of information in the section Information Collected Automatically of this Privacy Policy) to enable them to deliver, target and optimize third-party advertising in our Games.

• Advertising providers: We have contracted with certain advertising providers that assist us in delivering advertising, which allows us to continue offering the Games for free or at a low cost. You can check our advertising providers athttps://talkingtomandfriends.com/third-party-ad-providers/. The information received by the advertising provider is controlled by that company and becomes subject to such company's privacy practices.
• Advertising providers' attribution provider: We allow our advertising providers to attribute impressions, clicks, views or other advertising campaign performance indicators through their attribution providers for the purposes of measuring their advertising campaign performance. Note that they may also use their own attribution providers.

• For some of our Games we use attribution and fraud prevention providers, such as Singular (check their privacy practices here: https://www.singular.net/privacy-policy/) and Google Analytics for Firebase (check their privacy practices here: https://policies.google.com/technologies/partner-sites), for the purposes of measuring performance and optimizing our advertising campaigns, displaying advertisements, conducting analysis to improve our services and for fraud prevention purposes.
• Advertising providers: We have contracted with certain advertising providers that assist us in delivering advertising of our Games. You can check our advertising providers at https://talkingtomandfriends.com/third-party-ad-providers/. The information received by the advertising provider is controlled by that company and becomes subject to such company’s privacy practices.

You will be asked to accept or refuse push notifications once a Game is played on all devices, except for the devices with Android version lower than 13, where you'll automatically receive push notifications after the download.

• For iOS: To manage notifications on your device: Open your Settings menu and tap "Notifications"; Find the App; Tap on the icon of App; Manage the "Notifications" option by sliding it OFF or ON.
• For Android: To manage push notification in the Game: enter the "info screen"/"level" button on the homepage of the Game and choose the "Settings" option. Here, notifications can be disabled by unchecking the "Notification" option within the Game.

When you decide to unsubscribe from push notifications, any push notification tokens will be deleted from our database.

If you connect to a game center, you will be able to use your account to log in on multiple devices and to synchronize progress across those devices. When you log in to your gaming center account, we will receive some of the information connected to your gaming center account - for example, your player identification which will help us restore your game progress in case you lose it.

If you use gaming centers to participate in game related activities, such as in leaderboards, you share your information with other players and gaming centers (for example, usernames, scores, rankings and achievements).

The features enabling potential collection and sharing of personally identifiable information, except for online identifiers, are disabled for Children. For example, usernames selected by Children are never shown in leaderboards to protect their privacy. Such features are safeguarded by either age gate or parental gate, depending on the Game.

The only personal information we collect from Children are online identifiers (such as device ID, advertising ID, IDFV, IP address). We will only do so when allowed by the legislation requirements. Such online identifiers are used and shared with other companies solely for providing support for the internal operations, which consists of us being able to provide you with Games and support, analyze the usage of our Games, to show you contextual advertisement (including frequency capping, fraud prevention, attribution and billing purposes), to analyze and optimise our marketing and advertising campaigns, to personalize the content of the Games (to send you local notifications - which are contextual and sent in app, not from a server or in conjunction with other user information), to protect the security or integrity of our players or the Game and to ensure legal or regulatory compliance.

Note that we do not, nor do we allow other companies we share your information with, to use information collected from Children for profiling, nor to track their behaviour over time and across different online services and websites nor to target them. Online identifiers also cannot be used to contact a specific individual and are not used for any other purpose other than as described herein.

In addition, we strive to ensure that all advertising providers adhere to the same standards for the collection, usage and disclosure of children's personal information as we do, but we cannot be responsible if they breach the commitments they gave to us regarding the collection of information. In case of such breaches, and as permitted by the applicable legislation, you agree that our liability is limited to the amounts we can receive as indemnification for the breaches from our advertising partner.

Kids Privacy Assured by PRIVO: COPPA Safe Harbor Certification

Outfit7 Limited is a member of the PRIVO Kids Privacy Assured COPPA Safe Harbor Certification Program ("the Program"). The Program certification applies to the digital properties listed on the validation page that is viewable by clicking on the PRIVO Seal. PRIVO is an independent, third-party organization committed to safeguarding children's personal information collected online. The PRIVO COPPA certification Seal posted on this page indicates Outfit7 Limited has established COPPA compliant privacy practices and has agreed to submit to PRIVO's oversight and consumer dispute resolution process. If you have questions or concerns about our privacy practices, please contact us on our toll-free telephone number +1 (256) 203-9712 or at [email protected]. If you have further concerns after you have contacted us, you can contact PRIVO directly at [email protected].

Kids Privacy Assured by PRIVO: GDPRkids™

The Program applies to the digital properties listed on the validation page that is viewable by clicking on the PRIVO GDPRkids™ Verified Shield. The PRIVO GDPRkids™ Privacy Assured Program supports services known as Information Society Services under the General Data Protection Regulation (GDPR), to comply with the requirements of this legislation as it relates to minors. It impacts any service in the UK or an EU Member State and any service globally that collects and or processes the personal data of children and minors. The Program also supports the service to help ensure they are not likely to attract children. There is no safe harbor for the GDPR to date, but to ensure this company's services meet the program requirements, we conduct regular monitoring and consulting.

All of our Games that offer a feature in which the virtual character repeats back what you said will always ask in advance for your permission to access the microphone on your device. If you decide to give the permission, the virtual character will be able to repeat what you say to it. Please note that our Games do not have a function to record audio, so what you say to the virtual character is not stored on our servers, it is only used by the Game to repeat to you in real time. If you decide not to give us the permission to access the microphone on your device, the virtual character will not be able to repeat after you, but you can continue playing the Game and use other features.

Please note that privacy practices of your Entertainment Device are not subject to this privacy policy. Please visit Huge Play's privacy policy available at http://gamebud.com/talkingtom/privacy to learn more about privacy practices of your Entertainment Device. All of our Games that offer such a connection feature will offer users an option to connect to the Entertainment Device in the Game Settings. To connect to your Entertainment Device, our Game will need to use the Bluetooth on your device to find your Entertainment Device. On iOS we will ask you for your permission to access the Bluetooth in advance. On Android, we will be automatically able to scan for the Entertainment Device if your Bluetooth is turned on, if not we will ask you to allow us to turn on the Bluetooth on your device. If you decide to give us permission, your Entertainment Device will be able to connect to our Game and react to your achievements and progress in the Game. If you decide not to give us permission, the game connection function of your Entertainment Device will not work.

• Right to object. You have the right to object to the processing of your personal information that is processed on the grounds of legitimate interests (see Legal Bases below). You are always free to opt out from the future collection of your personal information by us and other companies we have partnered with by uninstalling all the Games from each of your computing devices.
• Right of access. You have a right to know what information we hold about you and in some cases to have the information communicated to you. If you wish to exercise this right, please contact us by letting us know that you wish to exercise your right of access and what information in particular you would like to receive. We reserve the right to ask for reasonable evidence to verify your identity before we provide you with any information. Please note that we may not be able to provide all the information you ask for, for instance if the information includes personal information about another person. Where we are not able to provide you with information that you have asked for, we will explain why we are unable to provide it to you. We will try to respond to any request for a right of access as soon as possible, but we will always do so within one month (or as required by the applicable legislation) of receipt of your (verifiable) request.
• Right to correct personal information. We try to keep the information that we hold about you accurate and up to date. Should you realize that any of the information that we hold about you is incorrect, please contact us via [email protected] and we will correct it as soon as we can.
• Data deletion. You have a right to request deletion of the personal information that we hold about you. Should you wish to do that, please contact us via [email protected]. We reserve the right to ask to provide us additional information to verify your identity before we can start processing your request. Once we receive all information we need in order to be able to identify you, we will delete the personal information you have requested we delete as soon as possible, but we will always do so within one month (or as required by the applicable legislation) of receipt of your request and verification of your identity. Please note that we may still retain some or all of that information, for example for complying with our legal obligations and protecting or enforcing legal rights. We may also retain your information in an anonymized form. In some instances, personal information about you that is visible through gameplay and is cached on other players' devices,, such as your username or your high scores, may not be removed or updated from there if that device is not connected to a Wi-Fi network.
• Data portability. In some circumstances, you have the right to request that we provide you with the personal information which you have provided to us, so you can transfer this information to another data controller. Should you wish to do that, please contact us via [email protected].
• Restriction of processing. In some cases, you may have the right to request a restriction of the processing of your personal information.
• Right to file a complaint. You have the right to file a complaint against us. To do so, contact the supervisory authority in your country of residence.
• Right to non-discriminatory treatment for exercising any rights. You have a right to not receive discriminatory treatment for exercising your rights described under this section. This for example means we will not deny any services or provide a different level of service based on the fact you chose to exercise any right.
• Right to opt-out for the purposes of IBA. You have the right to opt-out of future processing of personal data for the purposes of interest-based advertising ("IBA"), which covers (i) targeted advertising, (ii) the sale of personal data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. You can read about more options on how to do so in our IBA Notices, currently accessible at talkingtomandfriends.com/privacy-general/iba-notices.
• For residents of California: Right to opt-out of the sale or sharing of your personal information. In some cases, you may have the right to request a restriction of the processing of your personal information. You are always free to opt out from the future collection of your personal information by us and other companies by choosing one of the options, described in our IBA Notices, accessible here: talkingtomandfriends.com/privacy-general/iba-notices

We may decline to process requests that are unreasonably repetitive, require disproportionate technical effort, jeopardize the privacy of others, are extremely impractical, or for which access is not otherwise required by local law.

General

This section explains our data processing and protection practices of personal data if you are from the European Economic Area, Switzerland, and the UK (collectively referred to as "Europe"). We always pay special attention to ensure that we process your information lawfully in accordance with one of the legal bases set out under Europe data protection laws. We have appointed a data protection officer and a UK representative to help us ensure compliance with Europe data protection laws. Find out how to reach out to them in the Contact us section below.

For information collected under this Privacy Policy, the data controller is Outfit7 Limited, a company registered at 1st Floor Sackville House, 143-149 Fenchurch Street, London EC3M 6BN, United Kingdom, with business address at Agiou Ioanni 2, 4045 Germasogeia, Limassol, Cyprus.

In limited cases, we determine the purposes for processing some personal information jointly with our partners and are therefore considered as joint controllers. For the purposes of collecting and transmitting certain data and for measurement and insight reporting, we and TikTok Technology Limited and TikTok Information Technologies UK Limited are joint controllers, and have also entered info a joint controller terms, available at https://ads.tiktok.com/i18n/official/policy/jurisdiction-specific-terms. You can also read more details about their privacy practices on the following link: https://www.tiktok.com/legal/page/eea/privacy-policy/en.

Legal bases

In each case where we process your personal data, we do so lawfully in accordance with one of the legal bases set out under Europe data protection law.

The legal bases that we rely upon are the following:

• Contractual Necessity. This covers information that is processed by us in order to provide you with our Games you have downloaded - and that we have agreed to provide to you, that is to deliver and improve the Games, to provide customer support, to deliver special features in our Games (such as in-app chat feature, leaderboards), or to deliver content of the in-app purchase you make.
• Legitimate Interests. This covers information that is processed by us for the purposes that can be reasonably expected within the context of your use of our Games to pursue our legitimate interests in order to ensure you have the best experience when playing our Games, to make sure your information is secure and to provide you our Games free of charge or at a low cost. We pay special attention to your data protection rights, making sure that your data protection rights are not overridden by our legitimate interests. We rely on our legitimate interests for data processing for analytics, attribution and fraud prevention, push-notifications, cross-promotion, and contextual advertising purposes.
• Consent. When we ask for your consent to use your data for a particular purpose, we will make this clear at the point of collection and we will also make clear how you can withdraw your consent. We will ask for your consent before sharing any information with the advertising partners for the purposes of interest-based advertising and before conducting any questionnaires.
• Legal Obligation. This covers information that is processed by us to comply with a legal obligation.

International transfer

We will transfer your personal information only when the transfer is based on one of the following safeguards:

• To a country with adequate data protection. We will transfer your personal information outside Europe to a country that ensures an adequate level of data protection in accordance with European data protection legislation.
• Based on standard contractual clauses. We will transfer your personal information only to such companies outside Europe if we have entered into standard contractual clauses with them. Standard contractual clauses are adopted by the European Commission or the UK Information Commissioner in accordance with European data protection legislation and are deemed to offer sufficient safeguards with respect to the protection of the privacy and fundamental rights and freedoms of individuals (you can obtain a copy of the clauses by contacting us via [email protected]).
• Based on an approved certification mechanism. We will transfer your personal information only to such companies outside Europe if they are certified by an approved certification mechanism pursuant to Europe data protection legislation.

Contact us

Please see the means of contacting us:

1. for privacy questions and exercising your rights via our privacy email: [email protected] or by sending us a letter to our mailing address: Outfit7 Limited, Agiou Ioanni 2, 4045 Germasogeia, Limassol, Cyprus,
2. our EEA data protection officer: ePrivacy GmbH, Burchardstraße 14, 20095 Hamburg, Germany;
3. our UK representative: PRIVO Verified Limited, Room 3, 168 South Street, Dorking, Surrey RH4 2ES, United Kingdom;

GENERAL

This section specifically sets out our data processing and protection practices regarding the personal data if you are from one of the countries listed below ("US States") and/or information received about users' computing devices through their use of the Games:

• California
• Virginia
• Colorado
• Connecticut
• Utah
• Oregon
• Texas
• Montana

To learn more about your rights (including under Californian legislation), see section Your Rights of this Privacy policy.

CONTACT US

Please see the means for contacting us:

1. for privacy questions and exercising your rights via our privacy email: [email protected],
2. call us on our toll-free US telephone number: +1 (256) 203-9712

GENERAL

This section specifically sets out our data processing and protection practices regarding the personal data if you are from Brazil and/or information received about Brazil users' computing devices through their use of the Games. You can always determine your country of residence in the Game settings by clicking a "Country" button and selecting your country.

In limited cases, we determine the purposes for processing some personal information jointly with our partners and are therefore considered as joint controllers. For the purposes of collecting and transmitting certain data, we and TikTok Pte. Ltd. (Singapore) are joint controllers, and have also entered info a joint controller terms, available at https://ads.tiktok.com/i18n/official/policy/jurisdiction-specific-terms. You can also read more details about their privacy practices on the following link: https://www.tiktok.com/legal/page/row/privacy-policy/en.

LEGAL BASES

In each case where we process your information, we do so lawfully in accordance with one of the legal bases set out under Brazil data protection law.

The legal bases that we rely upon are the following:

• Contractual Necessity. This covers information that is processed by us in order to provide you with Games that you have downloaded - and that we have agreed to provide to you, that is to deliver and improve our games, to provide customer support, to deliver special features in our Games (such as in-app chat feature, leaderboards), to deliver content of any in-app purchase you make.
• Legitimate Interests. This covers information that is processed by us for the purposes that can be reasonably expected within the context of your use of our services to pursue our legitimate interests in order to ensure you have the best experience when playing our Games, to make sure your information is secure and to provide to you our Games free of charge or at a low cost. We pay special attention to your data protection rights making sure that your data protection rights are not overridden by our legitimate interests. We rely on our legitimate interests for data processing for analytics, attribution and fraud prevention, push-notifications, cross-promotion, and contextual advertising purposes.
• Consent. When we ask for your consent to use your data for a particular purpose, we will make this clear at the point of collection and we will also make clear how you can withdraw your consent. We will ask for your consent before sharing any information with the advertising partners for the purposes of interest-based advertising and before conducting any surveys.
• Legal or Regulatory Obligation. This covers information that is processed by us to comply with a legal or regulatory obligation.

Contact us

Please see the means for contacting us:

1. for privacy questions and exercising your rights via our privacy email: [email protected],
2. our Brazil data protection officer: [email protected]