NOTE: This Privacy Policy may be translated into other languages. In the event of any discrepancy between the English version and a translated version, the English version shall prevail, unless otherwise required by applicable laws or regulations.

Effective Date: January 14, 2026

1. Introduction

FUNFLY PTE. LTD. (“Company”, “we”, “our”, or “us”) develops, publishes, markets and/or commercializes a variety of games for use on various platforms, including mobile devices (“Applications”) through which we offer relating game play and gaming services. We also operate networks and platforms related to our Applications (collectively “Networks”), web domains and subdomains (collectively “Sites”) and web forums or messaging boards related to our Applications and Sites (collectively “Forums”). Any and all of our Applications, Networks, Sites, Forums and any other related services provided by us are referred to herein as our “Services”.

To the extent permitted by applicable law, children under the age of 13 (or other age thresholds required by local laws) are not allowed to use the Services. If you are 13 or older but considered a minor in your country (e.g. under 18 years old in some jurisdictions), you must have your parent or guardian read through this Privacy Policy with you and you represent that you have obtained the permission of your parent or guardian to use the Services, including making purchases in exchange for certain parts of our Services.

This Privacy Policy is intended to provide notice of the Company’s information practices, including the types of personal data gathered, how personal data is used and safeguarded, and how you may control the maintenance and sharing of your personal data. This Privacy Policy applies to personal data we collect through our Services. If you have any questions, please reach out to us as described in “Contact Us” below.

By clicking or checking “I agree”, “Accept”, “Next”, “Play” or similar statements on our Applications and Sites, or by accessing or using any part of our Services, you acknowledge that you have read and understood this Privacy Policy, and hereby agree to and consent to our collection, use, disclosure and/or processing of your personal data as described in this Privacy Policy. If you do not agree with any terms of this Privacy Policy, please do not access or use our Services.

2. Contact Us

If you have questions about data protection or requests regarding your personal data, we encourage you to reach out to us primarily through the support features available in our games, as this allows us to respond to you more promptly. Alternatively, you can contact us at:

l privacy@firstfun.com

3. What Data We Collect and Process

Personal data means any information relating to an identified or identifiable natural person, such as full name, email address, contact address, postal code, location data, personal interests.

We may collect personal data about you in the following ways: (1) directly from you, (2) automatically through your use of our Services, or (3) from third parties. The personal data we receive depends on factors such as the Services you use, the third parties we partner with or you integrate with, and your privacy settings.

(1) Data that you provide directly: We may collect your personal data directly from you when you choose to provide us with such personal data online and through your other interactions with us (such as data collected via social media and any surveys, customer service communications, competitions or other promotional programs in which you may participate). Certain parts of our Services may ask you to provide personal data when you engage in activities such as linking an email address, contacting customer service and making purchases or arranging for delivery of goods/services.

(2) Data we collect automatically: We may automatically collect your personal data through technical means from your device when you use our Services. We may also use “cookies” and similar technologies to collect your personal data, as explained in the “Mobile IDs, Cookies and Tracking Technologies” section below.

(3) Data from third parties: We may also collect your personal data from third-party sources, including other users, service providers, advertising networks, analytics providers, business partners, and publicly available sources.

The table below describes the categories of personal data we collect from and about you through our Services.

Personal Data Description	Source
Name and contact information.When you choose to associate your email with the Services in order to prevent your game progress from being lost, we may collect your profile name, email address and a verification code. Depending on the policies of third-party partners or social media you choose to connect or interact with through our Services, we may also receive your social media handles, social media ID and social media information. We may also collect your address and/or other contact information for the promotional activities and events information to allow you and other players to participate in our activities and events. Depending on how our Services are configured, you may choose to include your gender information in your user profile.	Directly from you. Third parties.
Account information. We may collect account information related to our Services, such as your profile name, avatar, user ID (UID) and account level. We may also collect your account’s number of followers, “hearts” count, and other information depending on the setup of our Services.	Directly from you.
Date of birth. Where applicable, you may need to provide us with your age and/or date of birth for age verification purposes. Depending on the setup of our Services, you may choose to provide us your birthday in your user profile when you apply for birthday gifts or other benefits available in our Services. We may also collect your birthday information through H5 questionnaires or survey tools.	Directly from you.
Payment information. When you make a purchase through our Sites, Applications, or other Services, our authorized payment processors will collect your card number, financial account information, and other payment details necessary to process the transaction.	Directly from you.
Purchase information. When you make a purchase through our Sites, Applications, or other Services, we collect information related to the transaction—such as the order ID, order amount, and currency—in order to maintain your transaction history and to process your purchase and related activities. We may also ask you to provide your ZIP code, email address, or other information necessary to issue an invoice.	Automatic collection.
Content and files. We may collect the profile name, profile photos or other in-game content you upload to our Services or provide to us when you interact with us or our Services on social media; and if you send us email messages or other communications, we may also collect and retain the content of those communications.	Directly from you. Third parties.
Communications information. We collect the content of your communications when you use our Services to send messages to others. Additionally, we also collect and process all user-generated content, including all feedback you provide to us, information that you post, comment, or follow in any of our content or Services, and other interactions with our content or community features.	Directly from you. Third parties.
Identifiers and device information. When you use our Services, our servers automatically collect and log information about your device and network. This may include your Internet Protocol (IP) address; online identifiers such as Google Advertising ID, IDFA, IDFV; IMEI, device name, device type/model, operating system version and language; time zone; screen DPI and resolution; network provider; memory data; cookie identifiers and similar tracking technologies; and other device status, settings and configuration details. For more details about our use of cookies and similar technologies, please see the “Mobile IDs, Cookies, and Tracking Technologies” section below.	Automatic collection.
Usage data. We collect and process information related to in-game services and features, including your gameplay status, progression, usage statistics, security-related data (such as installed app names, system startup time, app installation and update timestamps, request and referral URLs, system activity details, game-related plugin and runtime data, network status and information, and data from external plugin programs), as well as your interactions within the Services. We may also collect data for debugging, error tracking, crash analysis, and diagnostics, which may include registration or login time, game version, UID, crash reports, and abnormal process data.	Automatic collection. Third parties.
Inferences. We may generate inferences about you from the data we collect, either using technical means to generate information about your likely preferences or other characteristics, or generating inferences based on survey responses or inferences received from other third parties.	Directly from you. Automatic collection. Third parties.
Customer support information. We collect the information you provide to us when you contact us (such as records of the issues you report, security-related information) and/or exercise any of your legal rights as the data subject.	Directly from you.
Activity participation information. If you agree to participate in any activities organized by us (such as sweepstakes), we may collect your participation information including your name, UID, email address, mobile phone number, profile name, and/or country/region. If you win any prizes, you may also be required to provide us with your mailing address or certain tax information for us to deliver the prize and comply with applicable laws.	Directly from you. Automatic collection. Third parties.
Survey information. We will collect your survey responses and any other information you voluntarily provide in the course of the survey if you choose to participate in our surveys.	Directly from you.

For some websites, apps, or services provided by us, we may collect additional personal data beyond the data listed above. In such cases, we will develop individual privacy notices to inform you how we process your personal data when you use the specific Services. Such individual privacy notices will prevail in terms of the personal data processed for such individual Services.

When you are asked to provide personal data, you may decline. You may use web browser or operating system controls to prevent certain types of automatic data collection. But if you choose not to provide or allow our collection, use, disclosure or processing of personal data that is necessary for certain Services or features, those Services or features may not be available or fully functional.

4. Mobile IDs, Cookies, and Tracking Technologies

We and certain partners may use a variety of technologies including mobile IDs, cookies and similar technologies. Our partners may operate under their own privacy policies as described in the “Third-Party Partners” section below.

(1) Mobile IDs

Mobile analytics and advertising IDs are generated by the operating systems of mobile devices (iOS and Android) and can be accessed and used by applications in much the same way that websites access data. These identifiers allow us (and/or our partners, as the case may be) to analyse app usage, attribute installs, prevent fraud and deliver other information. Our Applications contain software that enables our third-party analytics and advertising partners to access the mobile IDs.

(2) Cookies and Similar Technologies

Cookies are small files stored on your browser or device to enhance your experience on our Site. When you visit our Site, one or more cookies may be sent to your browser. Our partners may also place cookies and, in some cases, act as independent controllers of your data, as further described in the “Who May Access Your Personal Data” and “Third-Party Partners” section below.

Please note that the necessary cookies will always remain active on your device. Where required by law, we seek your consent before using non-essential cookies or sharing cookie data with third parties. You may reject or delete cookies in your browser settings, or use Global Privacy Control, as described in the “Your Rights and Choices” section below. You may also email your request to privacy@firstfun.com. However, please note that if you reject or delete certain cookies, some parts of the Services may not be available or may not function properly.

5. How We Use, Disclose or Process Your Personal Data

We may use, disclose or process the personal data we collect for purposes described in this Privacy Policy or for purposes that we explain to you at the time we collect your data. We are required to disclose the legal basis for processing your data under certain applicable laws, including the GDPR. To the extent that such laws apply to you, we rely on the following legal bases to collect and process your personal data:

Contract – we require certain personal data in order to provide and support the Services you purchase or request from us;

Consent – in certain circumstances, we may ask for your consent (separately from any contract between us) before we collect, use, or disclose your personal data, in which case you may freely choose to give or withhold your consent without any negative consequences to you;

Legitimate interests – we may use or disclose your personal data for the legitimate business interests of either us or a third party, provided that such legitimate interests are not overridden by your privacy rights. If we rely on our (or a third party's) legitimate interests, these interests will normally be to: operate, provide and improve our business, including our Services; communicate with you and respond to your questions; improve our Services or use the insights to improve or develop marketing activities and promote our products and services; detect or prevent illegal activities (for example, fraud); and/or to manage the security of our IT infrastructure, and the safety and security of our employees, customers and vendors. Any reliance on our legitimate interests or the legitimate interests of a third party will be consistent with your reasonable expectations to be part of the operation of our business and will not materially affect your rights and freedoms. We have identified below what our legitimate interests are; or

Legal obligation – there may be instances where we must process and retain your personal data to comply with laws or to fulfil certain legal obligations.

The following table provides more details on our purposes for processing your personal data and the related legal basis. The legal basis under which your personal data is processed will depend on the data concerned and the specific context in which we use it. If we process your data for other purposes, we will provide you with a specific notice at the time of collection.

Purposes of Use	Categories of Personal Data	EU/UK Lawful basis for processing including basis of legitimate interest
Product and service delivery. To provide and deliver our Services, including troubleshooting, improving and optimizing those Services (including through the use of analytics), and enforcing compliance with the Terms of Service.	Name and contact information, account information, date of birth, payment information, purchase information, content and files, communications information, identifiers and device information, usage data, inferences, customer support information, activity participation information, survey information.	Performance of a contract with you. Otherwise, as necessary for our legitimate interests (to operate, provide and improve our business; to communicate with you) where our communications are not necessary to perform or enter into a contract with you.
To facilitate the purchase of virtual items while using our Services.	Name and contact information, account information, date of birth, payment information, purchase information, content and files, communications information, identifiers and device information, usage data, customer support information, activity participation information.	Performance of a contract with you.
Protecting the safety and well-being of our players (including to prevent spam or fraud, stop cyber-attacks and prevent illegal activities, checking the authenticity of an account owner, for archival and/or backup purposes).	Name and contact information, account information, date of birth, payment information, purchase information, content and files, communications information, identifiers and device information, usage data, inferences, customer support information, activity participation information.	Necessary for our legitimate interests (to operate and provide our business safely and to protect our business interests). Legal obligation.
To protect our legal rights (including where necessary, to share information with law enforcement authorities and other governmental or regulatory authorities), for example to defend claims against us and to conduct litigation to defend our interests.	Name and contact information, account information, date of birth, payment information, purchase information, content and files, communications information, identifiers and device information, usage data, inferences, customer support information, activity participation information.	Necessary for our legitimate interests to protect our business interests.
Comply with legal and regulatory obligations to which we are subject, including our obligations to conduct age verification or respond to your requests under applicable data protection laws.	Name and contact information, account information, date of birth, payment information, purchase information, content and files, communications information, identifiers and device information, usage data, inferences, customer support information, activity participation information.	Legal obligation.
Business operations. To operate our business, such as billing, accounting, improving our internal operations，and to protect the integrity, data safety, and financial security of our Services.	Name and contact information, account information, date of birth, payment information, purchase information, content and files, communications information, identifiers and device information, usage data, inferences, customer support information, activity participation information, survey information.	Performance of a contract with you. Otherwise, as necessary for our legitimate interests (to operate and provide our business and to protect our business interests). Legal obligation.
Product improvement, development, and research. To develop new Services or features, and conduct research.	Name and contact information, account information, date of birth, payment information, purchase information, content and files, communications information, identifiers and device information, usage data, inferences, customer support information, activity participation information, survey information.	Necessary for our legitimate interests (to operate, provide and improve our business).
Personalization. To understand you and your preferences to enhance your experience and enjoyment using our Services.	Name and contact information, account information, date of birth, payment information, purchase information, content and files, communications information, identifiers and device information, usage data, inferences, customer support information, activity participation information, survey information.	Consent. Otherwise as necessary for our legitimate interests (to operate, provide and improve our business).
Customer support. To provide customer support and respond to your questions.	Name and contact information, account information, date of birth, payment information, purchase information, content and files, communications information, identifiers and device information, usage data, inferences, customer support information, activity participation information.	Necessary for our legitimate interests (to operate, provide and improve our business; to communicate with you) – where our communications are not necessary to perform or enter into a contract with you.
Communications. To send you information, including confirmations, technical notices, updates, security alerts, and support and administrative messages.	Name and contact information, account information, date of birth, payment information, purchase information, content and files, communications information, identifiers and device information, usage data, inferences, customer support information, activity participation information, survey information.	Necessary for our legitimate interests (to operate, provide and improve our business; to communicate with you) – where our communications are not necessary to perform or enter into a contract with you.
Marketing. To communicate with you about new Services, offers, promotions, rewards, contests, upcoming events, and other information about our Services and those of our selected partners (see the “Your Rights and Choices” section of this Privacy Policy for information about how to change your preferences for promotional communications).	Name and contact information, account information, date of birth, payment information, purchase information, content and files, communications information, identifiers and device information, usage data, inferences, customer support information, activity participation information, survey information.	Consent.

For the purposes set forth above, our affiliates may be authorized to process your data, provided that such affiliates comply with the terms in this Privacy Policy.

We may combine data we collect from different sources for these purposes and to give you a more seamless, consistent, and personalized experience.

6. Who May Access Your Personal Data

In addition to the Company and/or its affiliates, other parties may also access your personal data in the following situations. You acknowledge that you have foreseen the occurrence of such disclosure when you provide your personal data.

ü Public information: Some of your profile information can be seen by other players in the games such as your profile name (either the default name or the profile name of your choosing), your profile image (the default image, an image you select, the photo you take, or the profile photo associated with a linked account), your comments and the level of the game you are playing. You may select options available to edit your profile name, change your profile picture, and certain other information. Any data you post to any communication area is publicly viewable. We strongly recommend that all users avoid posting personal or sensitive data at any time on or through our Services.

ü Third-party social media platforms: Depending on the third-party account you choose to link, certain gameplay-related data (such as scores and rankings) may be shared with the relevant third-party platform services.

ü Service providers: We may provide personal data to third-party vendors, service providers, contractors or agents who perform functions on our behalf for the purposes described in this Privacy Policy. For example, this includes companies we hire to provide customer services support and game play analysis.

ü Financial services and payment processing: When you provide payment information, for example, to make a purchase, such payment and transactional data will be used by the banks and other entities as necessary for payment processing, fraud prevention, credit risk reduction, analytics, and/or other related financial services.

ü Affiliates: We enable access to personal data across our subsidiaries, affiliates, and related companies, for example, where we share common data systems or where access helps us to provide our Services and operate our business.

ü Corporate transactions: We may disclose personal data as part of a corporate transaction or proceeding such as a merger, financing, acquisition, bankruptcy, dissolution, or a transfer, divestiture, or sale of all or a portion of our business or assets.

ü Legal and law enforcement: We will access, disclose, and preserve personal data when we believe that doing so is necessary to comply with applicable law, a judicial proceeding, court order, or other valid legal process, including from law enforcement or other government agencies, whether within or outside Singapore.

ü Security, safety, and protecting rights: We will disclose personal data if we believe it is necessary to: to protect us, our users, and others, for example to prevent spam or attempts to commit fraud, or to help prevent the loss of life or serious injury of anyone; to operate and maintain the security of our Services, including to prevent or stop an attack on our computer systems or networks; or to protect the rights or property of ourselves or others, including to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person, enforce our agreements, terms, and policies, or as support or evidence in any dispute or litigation in which we are involved.

ü Business Partners: Our Services occasionally runs collaborations and special events with our business partners. These events may be run locally or globally, online or offline. If you participate in these special events, your personal data may be shared with these business partners in order to carry out the event, delivery of any prizes, to follow up on any events which you had opted in for, etc.

Third-party analytics and advertising companies may also collect personal data through our Services, including identifiers and device information (such as device IDs), IP address, usage data, and inferences based on and associated with that data. If some of the disclosures to these third parties are considered a “sale” or “sharing” of personal data as defined under the laws of California and other U.S. states, you may see the “Your Rights and Choices” section and relevant subsection in the “Supplemental Terms – Jurisdiction-Specific” section below for more details.

Please note that some of our Services also include integrations, references, or links to services provided by third parties whose privacy practices differ from ours. If you provide personal data to any of those third parties, link or bind your accounts, or allow us to share personal data with them, that data is governed by their privacy statements.

7. Your Rights and Choices

We provide a variety of ways for you to control the personal data we hold about you, including choices about how we use that data. In some jurisdictions, these controls and choices may be enforceable as legal rights under applicable law. If you are a resident of the UK, EEA, Switzerland, or California, please see the relevant subsections in the “Supplemental Terms – Jurisdiction-Specific” section below.

(1) Access, portability, correction, and deletion. In some jurisdictions, you have the right to access, receive a copy of, correct, and delete your personal data. If you reside in one of these jurisdictions, and you wish to access, receive a copy of, correct, or delete personal data about you that we hold, you may make your request by emailing privacy@firstfun.com. Subject to applicable laws, we may require you to provide some personal data so that we can verify your request and locate your personal data to fulfill your request.

You acknowledge and agree that as a result of deleting your account, you will lose access to game-related services, including the account data and game-related data linked to such account and lose the possibility to access other services through the account. Please note that certain records, for example those relating to payments or customer service matters, will be held for legal and accounting purposes.

If you have previously received push notifications through your device, you can stop receiving push notifications by visiting your mobile device's settings for the relevant Application or in some cases, through the Application itself.

(2) Withdrawal of consent. If we have collected and processed your personal data with your consent, you can withdraw your consent in accordance with applicable laws. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect the processing of your personal data based on lawful processing grounds other than consent. In many circumstances, we need to use your personal data to provide you with our Services you require. If you do not provide us with the required personal data, or if you withdraw your consent to our use and/or disclosure of your personal data for these purposes, it may not be possible for us to continue to serve you or provide you with the Services that you require.

(3) Communications preferences. If any promotional communication has been made to you, you may opt out of promotional communications by following the opt-out instructions contained in the promotional communications, or by contacting us as described in the “Contact Us” section above. Please note that it may take some time for us to process opt-out requests. If you opt out of receiving promotional emails, we may still send you emails about your account or any Services you have requested or received from us.

(4) Data sales. Some laws define “sale” broadly to include certain disclosures described in the “Who May Access Your Personal Data” section above. To opt out of such data “sales”, please refer to the “Do Not Sell or Share My Personal Data” section below and use the Global Privacy Control as described below, or email your request to privacy@firstfun.com.

(5) Browser or platform controls.

l Cookie controls. Most web browsers are set to accept cookies by default. If you prefer, you can adjust your browser settings to learn how to reject or delete certain cookies. Please note that rejecting or deleting certain cookies may affect the functionality of some features or services of our Sites. If you choose to delete certain cookies, settings and preferences stored in those cookies may also be deleted and may need to be reset.

l Global Privacy Control (GPC). Some browsers and browser extensions support the “Global Privacy Control” (GPC) or similar signals that help to indicate your choice to opt out of certain types of data processing, including data sales and/or targeted advertising, as specified by applicable law. When we detect such a signal, we will make reasonable efforts to honor your choices indicated by a GPC setting or other similar control which is recognized by relevant regulations or otherwise widely acknowledged as a valid opt-out preference signal.

l Mobile advertising ID controls. iOS and Android operating systems provide options to limit tracking using advertising IDs and/or reset the advertising IDs.

l Do Not Track (DNT). Some browsers have incorporated “Do Not Track” (DNT) features that can send a signal to the websites you visit indicating you do not wish to be tracked. Because there is no common understanding of how to interpret the DNT signal, our Sites do not currently respond to DNT signals. Instead, you may use other tools described above to control data collection and use, including the cookies controls and advertising controls described above.

(6) Email web beacons. Most email clients have settings which allow you to block the automatic downloading of images, including web beacons, which prevents the automatic connection to the web servers that host those images.

Except for the automated controls described above, if you send us a request to exercise your rights or choices, we may decline requests in certain cases to the extent permitted by applicable law. For example, we may decline a request if granting it would be prohibited by law, would adversely affect the privacy or rights of another person, would reveal a trade secret or other confidential information, or would interfere with a legal or business obligation that requires us to retain or use the data. Furthermore, subject to applicable laws, we may also decline a request if we are unable to authenticate you as the person to whom the data relates, if the request is unreasonable or excessive, or if otherwise permitted by applicable law. If we decline your requests in whole or in part, we will notify you that we have declined your request, and you may appeal that decision by submitting your appeal using the contact methods described at the beginning of this Privacy Policy.

8. Third-Party Partners

Our partners use technologies to enhance and customize your experience, analyze usage, and prevent fraud. Please be aware that our partners may have their own privacy policies governing their use of these technologies (as illustrated in the examples below). When specific third parties are involved in collecting data and information, please refer directly to their privacy policies on their official websites and learn more about their data processing practices.

ALICLOUD	https://www.alibabacloud.com/help/en/legal/latest/ alibaba-cloud-international-website-privacy-policy
FIREBASE	https://firebase.google.com/support/privacy
APPSFLYER	https://www.appsflyer.com/legal/processing-customer-data/
FACEBOOK	https://www.facebook.com/privacy/policy/
SURVEYMONKEY	https://www.surveymonkey.com/mp/legal/privacy/
NEXT DATA	https://intl.ishumei.com/account/serviceItems/ ?titleName=Privacy-Policy
THINKING DATA	https://docs.thinkingdata.cn/ta-manual/v4.2/ en/te_privacy_compliance/ te_privacy_compliance.html#data-collection
ZENDESK	https://www.zendesk.us/company/agreements-and-terms/privacy-notice/#
AKAMAI	https://www.akamai.com/legal/compliance/privacy-trust-center
ACE	https://www.tencentcloud.com/document/product/ 1018/59514
Airwallex	https://www.airwallex.com/terms/privacy-policy#scope-of-policy
Payermax	https://www.payermax.com/about/ terms/PrivacyPolicy
Adyen	https://www.adyen.com/privacy-policy
Kids Web Services	https://www.kidswebservices.com/en-US/privacy-policy
k-ID	https://www.k-id.com/privacy-policy

9. Retention of Personal Data

We retain personal data (including cookies) for as long as necessary to provide the Services and fulfill the transactions you have requested, comply with our legal obligations, resolve disputes, enforce our agreements, and other legitimate and lawful business purposes. Because these needs vary for different data types in the context of different services, actual retention periods can vary significantly based on criteria such as user expectations or consent, the sensitivity of the data, the availability of automated controls that enable users to delete data, and our legal or contractual obligations.

With respect to cookies, we use persistent cookies that remain on your device for a limited period or until you delete them. These cookies help us track download attribution and improve user experience. You can manage or delete cookies at any time through your browser settings, and in some jurisdictions you may exercise additional rights as described in the “Your Rights and Choices” section above.

Details of retention periods for different aspects of your personal data are available from us on request by contacting us using the contact details provided under the “Contact Us” section above.

In the case you request to remove or delete your personal data, we will retain your data as long as necessary for applicable laws and regulations, such as to comply with our legal obligations, resolve disputes, and/or enforce the agreements between you and us. Please note that the removal or deletion of any of your data may result in the termination of some of our applicable Services.

10. Location and International Transfer of Personal Data

The personal data we collect may be stored and processed in your country or region, or in any other country where we or our affiliates, subsidiaries, partners, or service providers process data. The storage locations are chosen to operate efficiently and improve performance. We take steps with the intent of processing and protecting personal data as described in this Privacy Policy, wherever the personal data is located.

To the maximum extent permitted by the applicable laws and regulations, we may transfer data that we collect about you to our affiliates, partners, service providers, or to other third parties across borders and from your country or jurisdiction to other countries or jurisdictions around the world. Please note that these countries and jurisdictions may not have the same data protection laws as your own jurisdiction, and we take appropriate steps to ensure adequate safeguards are in place to enable the transfer, use and disclosure of data about you, including your personal data, as described in this Privacy Policy.

11. Security of Your Personal Data

We have implemented commercially reasonable precautions designed to protect the data we collect from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. However, please note that the transmission of data via the Internet is not completely secure. While we strive to protect your personal data, we also remind you to be aware of hacking, cyberattacks, and other risks on the Internet.

Therefore, we strongly urge you to take every possible precaution to protect your personal data when using our Services, including but not limited to using a secure browser and/or taking other possible security measures.

Please be aware that advertisers or websites with links to and/or from our websites may collect personal data about you. This Privacy Policy does not apply to such third-party services, and we cannot control the activities of those third parties. We highly recommend that you read the privacy policies of such third-party websites which you may be directed to before providing any personal data.

12. Age Limits and Children Protection

The information below is provided for parents and guardians to understand our privacy practices with respect to children (under 13 or the age of consent under local laws, whichever is higher).

(1) Countries where we operate an Age-Gate

In certain countries, such as the United States, we are required by law to operate an age-gate, where, when a user indicates that they are a child, we do not collect or process their personal data until they are no longer a child as defined above or until a parent or guardian provides consent and/or enables access to particular features. In these circumstances, the personal data we collect may include:

n Age or date of birth, country and/or inferences about country to determine age and apply appropriate settings;

n Parent or guardian email address to provide notice and seek consent (which will be deleted if the parent does not respond within a reasonable period of time)

n Persistent identifiers like IP address, UIDs and device identifiers in order to provide and maintain our Services (including analytics to improve them), protect the security and integrity of users and ensure legal and regulatory compliance.

For clarity, the data indicated above (including persistent identifiers) may be collected and processed prior to obtaining parent or guardian consent, for the purposes stated and to support internal operations, for example, to trigger the age-gate and other internal operational purposes.

Notice, Consent, and Parental Controls

We collect a parent or guardian's email address from a child player to send the parent or guardian an email notice informing them that the child has started to play our games for the first time, and to explain them about how verifiable parental consent works. This notice also allows them to review our privacy practices and provide consent for their child to continue playing our games. Please note that parents/guardians must complete our parent verification process to provide consent for a child to continue to play our games.

We use Kids Web Services (KWS) and/or k-ID, for user age verification and parental consent purposes. You can learn more about KWS in the KWS Privacy Policy, and k-ID at k-id.com/privacy. To initiate that registration and consent process, users who self-identify or are identified as children will be automatically directed to either KWS or k-ID. We may share with, or receive from KWS or k-ID their date of birth and email address, including the parent or legal guardian’s email address. KWS and k-ID may collect additional personal information from users or their parent or legal guardian such as payment, identification card, or biometric information, but we do not have access to that personal information. When a parent or guardian gives permission for a child to continue to play, parental controls are enabled automatically. Once authorized, the privacy practices described elsewhere in this Privacy Policy generally apply, but child users may not have access to all content or features. The child player may be restricted in terms of community access such as social features and content sharing, among others.

A parent or guardian may revoke consent to the collection of their child’s data at any time by contacting us using the contact details under the “Contact Us” section above. If a parent or guardian does not consent or revokes the consent later, we will delete the child’s account and its associated data within a reasonable period after the response or revocation of consent. If a parent or guardian does not respond to this request for consent within the prescribed period, we will delete the parent/guardian's and the child’s data within a reasonable time of the initial request.

For the avoidance of doubt, in certain countries such as the United States, we are required to delete accounts of children under the age of 13 unless a parent or guardian provides verifiable consent. Any deletion carried out as a result of the foregoing is permanent, irrecoverable, and cannot be restored notwithstanding that the child subsequently reaches the age of 13. For other countries where the legally applicable age is higher, that higher age will apply.

Child and Parent Privacy Rights

Child users and their parents/guardians can exercise their privacy rights available to them as described in this Privacy Policy. Where applicable, parental controls enable parents and guardians to change the choices made about their child’s use of particular features like community access. Parents/guardians can also review the child’s personal data held by us and request us to delete their child’s account (which deletes the personal data and stops further collection). To exercise these rights, please see the “Contact Us” section above.

If we use k-ID for age verification and parental consent in your jurisdiction, parents or guardians can use k-ID’s family tools to manage their child’s account at family.k-id.com. The available account setting configurations in the family tools may vary across the jurisdictions depending on jurisdiction-specific laws and regulations. Parents or guardians can also submit data subject requests for their child’s data at family.k-id.com.

(2) Countries where we do not operate an Age-Gate

In countries where we do not operate an age-gate, certain laws may prohibit users under the age of 13 (or other age thresholds as stipulated under local laws) from using our Services or may require parental or guardian consent. If you are 13 and above but are considered a minor in your country, under certain laws, you must have your parent or guardian read through this Privacy Policy with you and you represent that you have obtained the permission or consent of your parent or guardian to use our Services.

Information to Parents and Guardians

If you are a parent or guardian of a minor in a country where we do not operate an age-gate, please make sure that you have read this Privacy Policy before allowing your child to create their own accounts or to use our Services. By permitting your child to use our Services, you agree that you are subject to this Privacy Policy and that you are responsible for your child’s activities while using our Services. You agree to supervise your child’s use of our Services and make sure that your child only views the contents that are age-appropriate for them.

Notwithstanding the foregoing, we recognize that we have a special obligation to protect children in regard to the collection and processing of personal data. We strongly urge parents and guardians to instruct their children never to disclose or give out their personal data when using our Services without the prior permission of their parents or guardians. If you are a parent or guardian and have any concerns about your child’s use of our Services, please contact us using the contact details under the “Contact Us” section above.

13. Supplemental Terms – Jurisdiction-Specific

(1) Additional Information for UK, EEA or Swiss Residents

If the processing of personal data about you is subject to UK or European Economic Area (EEA) or Swiss data protection law, you have certain rights with respect to your personal data:

l You can request access to, and rectification or erasure of, your personal data;

l If any automated processing of personal data is based on your consent or a contract with you, you have a right to transfer or receive a copy of the personal data in a usable and portable format;

l If the processing of personal data is based on your consent, you can withdraw consent at any time for future processing using the contact details provided under the “Contact Us” section above. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal data based on lawful processing grounds other than consent;

l You can object to, or obtain restriction of, the processing of personal data under certain circumstances as permitted by the applicable laws or regulations;

l You have the right to opt out of marketing communications we send to you at any time. You can usually exercise this right by following the opt-out instructions contained in our marketing communications sent to you. You can also contact us using the contact details provided under the “Contact Us” section above. If you choose to opt out of marketing communications, we will still send you non-promotional emails, such as emails about your account or our ongoing business relations;

l You have the right to complain to a supervisory authority about our collection and use of your personal data. For more information, please contact your local supervisory authority. Please note that certain supervisory authorities require you to exhaust our internal complaints process before looking into your complaint;

l For residents of France, you can send us specific instructions regarding the use of your personal data after your death; and

l We set non-essential cookies only with your consent. You can give or withdraw consent at any time as described in the Privacy Policy. Access to our Services is not conditioned on consenting to non-essential cookies, although rejecting or deleting them may result in us being unable to make certain Services available to you.

To make such requests to exercise your rights, contact us at privacy@firstfun.com. We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.

Our Data Protection Officer. We have appointed a Data Protection Officer (DPO), who is responsible for overseeing our compliance with applicable data protection laws. You can contact our DPO at dpo@firstfun.com.

General Data Protection Regulation (GDPR) – European Representative

Pursuant to Article 27 of the General Data Protection Regulation (GDPR), FUNFLY PTE. LTD has appointed European Data Protection Office (EDPO) as its GDPR Representative in the EU. You can contact EDPO regarding matters pertaining to the GDPR:

-by using EDPO’s online request form: https://edpo.com/gdpr-data-request/

-by writing to EDPO at Avenue Huart Hamoir 71, 1030 Brussels, Belgium

UK General Data Protection Regulation (GDPR) - UK Representative

Pursuant to Article 27 of the UK GDPR, FUNFLY PTE. LTD has appointed EDPO UK Ltd as its UK GDPR representative in the UK. You can contact EDPO UK regarding matters pertaining to the UK GDPR:

- by using EDPO’s online request form: https://edpo.com/uk-gdpr-data-request/

- by writing to EDPO UK at 8 Northumberland Avenue, London WC2N 5BY, United Kingdom

(2) Additional Information for California Residents

If you are a California resident and the processing of personal data about you is subject to the California Consumer Privacy Act (“CCPA”), you have certain rights with respect to your personal data.

l Notice at Collection. You have a right to be notified at or before the time we collect your personal data including the categories of personal data and sensitive personal data to be collected, the purposes for which such data is collected or used, whether such data is sold or shared, and how long such data is retained.

l Right to Know. You have a right to request that we disclose to you the personal data we have collected about you. You also have a right to request additional information about (1) the categories and/or specific pieces of personal data we have collected about you, (2) the categories of sources for that personal data, (3) the purposes for which we use that personal data, (4) the categories of third parties with whom we disclose the personal data, and (5) the categories of personal data that we sell or disclose to third parties under CCPA. Note that we have provided much of this information in this Privacy Policy. You may make such a “request to know” by contacting us at privacy@firstfun.com.

l Right to Request Deletion. You also have a right to request that we delete personal data under certain circumstances, subject to a number of exceptions. To make a request to delete, you may email us at privacy@firstfun.com. However, if certain personal data is necessary for us to provide you with our Services, and you refuse to provide such personal data to us or ask us to delete or stop processing such personal data, we may not be able to provide some parts of our Services.

l Right to Opt-Out/Do Not Sell or Share My Personal Data. You have a right to opt out of future “sales” or “sharing” of personal data (if any) as those terms are defined by the CCPA. We will not sell or share your personal data after we receive your opt-out request unless you later authorize us to do so again.

Note that the CCPA defines “sell” and “personal data” very broadly, and some of our data sharing described in this Privacy Policy may be considered a “sale” under those definitions. To opt-out from “sales” or “sharing” of personal data, please use the Global Privacy Control as described herein, or email your request to privacy@firstfun.com. We do not knowingly sell the personal data of minors under 16 years of age.

l Right to Correct: You may ask us to correct inaccurate information that we have about you. To make a request to correct, you may email us at privacy@firstfun.com.

l Right to Limit Use and Disclosure of Sensitive Personal Data. You have a right to limit our use of sensitive personal data for any purposes other than to provide the services or goods you request or as otherwise permitted by law. We collect and process the contents of your communications on our Services for the purpose of facilitating those communications, to provide customer service and respond to user complaints regarding violations of our Terms of Service. If you have any questions regarding our use of such sensitive personal data, please contact us using the contact information provided at the beginning of this Privacy Policy.

You may designate, in writing or through a power of attorney, an authorized agent to make requests on your behalf to exercise your rights under the CCPA. Before accepting such a request from an agent, we will require the agent to provide proof you have authorized it to act on your behalf, and we may need you to verify your identity directly with us.

Further, to provide, correct, or delete specific pieces of your personal data, we may need to verify your identity to the degree of certainty required or permitted by applicable law. We may do this by asking you to submit your request or confirm your request from the email address associated with your account or requiring you to provide additional information necessary to verify your account, depending on the rights you request to exercise.

Finally, you have a right not to be discriminated against for exercising these rights set out in the CCPA.

Additionally, under California Civil Code section 1798.83, also known as the “Shine the Light” law, California residents who have provided personal data to a business with which the individual has established a business relationship for personal, family, or household purposes (“California Customers”) may request information about whether the business has disclosed personal data to any third parties for the third parties’ direct marketing purposes. In general, if the business has made such a disclosure of personal data, upon receipt of a request by a California Customer, the business is required to provide a list of all third parties to whom personal data was disclosed in the preceding calendar year, as well as a list of the categories of personal data that were disclosed. California Customers may request further information about our compliance with this law by emailing privacy@firstfun.com. Please note that businesses are required to respond to one request per California Customer each year and may not be required to respond to requests made by means other than through the designated email address.

California residents under the age of 18 who are registered users of online sites, services, or applications have a right under California Business and Professions Code Section 22581 to remove, or request and obtain removal of, content or information they have publicly posted. To request that we remove content or information you have publicly posted, email us at privacy@firstfun.com. Please be aware that your request does not guarantee complete or comprehensive removal of content or information posted online and that the law may not permit or require removal in certain circumstances.

14. Effective Date; Policy Changes

Each time you use our Services, the current version of the Privacy Policy will apply. Accordingly, when you use our Services, you should check the date of this Privacy Policy (which appears at the top of the Privacy Policy) and review any changes since the last version.

This Privacy Policy is subject to changes from time to time. Unless stated otherwise, our current Privacy Policy applies to all personal data that we have about you. If we make material changes to the Privacy Policy, we will provide notice or obtain consent regarding such changes as may be required by law. Your continued access to or use of our Services after such notice had been given and such revised Privacy Policy had come into effect shall constitute your acceptance of the revised Privacy Policy.